diff --git a/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx b/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx
index d3df8764a..5e120fbe7 100644
--- a/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx
+++ b/frontend-modern/src/components/SetupWizard/steps/SecurityStep.tsx
@@ -1,6 +1,6 @@
 import { Component, createSignal, Show } from 'solid-js';
 import { showError, showSuccess } from '@/utils/toast';
-import { setApiToken as setApiClientToken } from '@/utils/apiClient';
+import { setApiToken as setApiClientToken, apiFetchJSON } from '@/utils/apiClient';
 import type { WizardState } from '../SetupWizard';
 
 interface SecurityStepProps {
@@ -52,13 +52,11 @@ export const SecurityStep: Component<SecurityStepProps> = (props) => {
         try {
             setApiClientToken(token);
 
-            const response = await fetch('/api/security/quick-setup', {
+            await apiFetchJSON('/api/security/quick-setup', {
                 method: 'POST',
                 headers: {
-                    'Content-Type': 'application/json',
                     'X-Setup-Token': props.bootstrapToken,
                 },
-                credentials: 'include',
                 body: JSON.stringify({
                     username: username(),
                     password: finalPassword,
@@ -68,10 +66,6 @@ export const SecurityStep: Component<SecurityStepProps> = (props) => {
                 }),
             });
 
-            if (!response.ok) {
-                throw new Error(await response.text());
-            }
-
             props.updateState({
                 username: username(),
                 password: finalPassword,
diff --git a/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx b/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx
index 203099bcf..9fafc07dc 100644
--- a/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx
+++ b/frontend-modern/src/components/SetupWizard/steps/WelcomeStep.tsx
@@ -1,5 +1,6 @@
 import { Component, createSignal, Show } from 'solid-js';
 import { showError, showSuccess } from '@/utils/toast';
+import { apiFetch, apiFetchJSON } from '@/utils/apiClient';
 import { logger } from '@/utils/logger';
 
 interface WelcomeStepProps {
@@ -20,7 +21,7 @@ export const WelcomeStep: Component<WelcomeStepProps> = (props) => {
     // Fetch bootstrap info on mount
     const fetchBootstrapInfo = async () => {
         try {
-            const response = await fetch('/api/security/status');
+            const response = await apiFetch('/api/security/status');
             if (response.ok) {
                 const data = await response.json();
                 if (data.bootstrapTokenPath) {
@@ -46,20 +47,18 @@ export const WelcomeStep: Component<WelcomeStepProps> = (props) => {
 
         setIsValidating(true);
         try {
-            const response = await fetch('/api/security/validate-bootstrap-token', {
+            await apiFetch('/api/security/validate-bootstrap-token', {
                 method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({ token: props.bootstrapToken.trim() }),
             });
 
-            if (!response.ok) {
-                throw new Error('Invalid bootstrap token');
-            }
-
             props.setIsUnlocked(true);
             showSuccess('Token verified!');
             props.onNext();
         } catch (_error) {
+            if (_error instanceof Error && _error.message !== 'Invalid bootstrap token') {
+                // In case apiFetch throws other errors
+            }
             showError('Invalid bootstrap token. Please check and try again.');
         } finally {
             setIsValidating(false);