diff --git a/src-tauri/src/db.rs b/src-tauri/src/db.rs
index cb749b4..1195939 100644
--- a/src-tauri/src/db.rs
+++ b/src-tauri/src/db.rs
@@ -76,15 +76,14 @@ fn init_at_path_internal(app_data_dir: &Path, force_disable_keychain: bool) -> R
         backup_database(&connection, &database_path, &format!("schema-v{version}"))?;
     }
     migrate_schema(&mut connection, version)?;
-    let (current_token_pending, keychain_granted) =
-        sanitize_current_settings_and_restore_token(&connection, false)?;
-        
-    let allow_keychain = keychain_granted && !force_disable_keychain;
 
+    // We no longer touch the keychain on backend startup.
+    // Legacy imports will safely preserve any pairing token in the JSON payload.
+    // The frontend will manually trigger migration to the keychain via IPC if access is granted.
     import_legacy_data(
         &mut connection,
         app_data_dir,
-        allow_keychain && !current_token_pending,
+        false,
     )?;
 
     Ok(DbState {
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index 7226593..88ff710 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -3900,22 +3900,14 @@ pub fn run() {
             let database = crate::db::init(app.handle())
                 .map_err(|error| format!("failed to initialize persistence: {error}"))?;
             let initial_pairing_token = {
-                let mut connection = database.lock()?;
-                let skip_keychain = !crate::db::is_keychain_access_granted(&connection).unwrap_or(false);
-                match crate::db::hydrate_pairing_token(&mut connection, skip_keychain) {
-                    Ok((token, _)) => token,
-                    Err(error) => {
-                        log::warn!(
-                            "Secure credential storage unavailable; using session-only extension token: {}",
-                            error
-                        );
-                        format!(
-                            "{}{}",
-                            uuid::Uuid::new_v4().simple(),
-                            uuid::Uuid::new_v4().simple()
-                        )
-                    }
-                }
+                // Generate a temporary session token for the extension server on startup.
+                // The frontend will hydrate the real token via IPC once it mounts, 
+                // avoiding any macOS system prompts before the UI is fully visible.
+                format!(
+                    "{}{}",
+                    uuid::Uuid::new_v4().simple(),
+                    uuid::Uuid::new_v4().simple()
+                )
             };
             {
                 let mut pairing_token = extension_pairing_token