diff --git a/e2e/helpers.ts b/e2e/helpers.ts
index 7a6a79b1..8682e81a 100644
--- a/e2e/helpers.ts
+++ b/e2e/helpers.ts
@@ -8,16 +8,10 @@
  *   E2E_USERNAME=admin E2E_PASSWORD=mypassword npx playwright test
  */
 import { Page, expect } from '@playwright/test';
-import { authenticator } from 'otplib';
-import { HashAlgorithms } from '@otplib/core';
+import { OTP } from 'otplib';
 
-// Match backend configuration so generated codes are accepted.
-authenticator.options = {
-  digits: 6,
-  step: 30,
-  algorithm: HashAlgorithms.SHA1,
-  window: 1,
-};
+const totp = new OTP({ strategy: 'totp' });
+const TOTP_PARAMS = { algorithm: 'sha1' as const, digits: 6, period: 30 };
 
 export const TEST_USERNAME = process.env.E2E_USERNAME ?? 'admin';
 export const TEST_PASSWORD = process.env.E2E_PASSWORD ?? 'password123';
@@ -27,7 +21,7 @@ export const TEST_PASSWORD = process.env.E2E_PASSWORD ?? 'password123';
  * E2E tests to drive the login challenge without a real authenticator app.
  */
 export function totpNow(secret: string): string {
-  return authenticator.generate(secret.replace(/\s+/g, ''));
+  return totp.generateSync({ secret: secret.replace(/\s+/g, ''), ...TOTP_PARAMS });
 }
 
 /** Selector for the dashboard - only present in EditorLayout, not on login/setup pages */
diff --git a/package-lock.json b/package-lock.json
index 2d6f943d..410ab2d1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,62 +10,82 @@
       "license": "SEE LICENSE IN LICENSE",
       "devDependencies": {
         "@playwright/test": "^1.59.1",
-        "otplib": "^12.0.1"
+        "otplib": "^13.4.0"
+      }
+    },
+    "node_modules/@noble/hashes": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.2.0.tgz",
+      "integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/@otplib/core": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@otplib/core/-/core-12.0.1.tgz",
-      "integrity": "sha512-4sGntwbA/AC+SbPhbsziRiD+jNDdIzsZ3JUyfZwjtKyc/wufl1pnSIaG4Uqx8ymPagujub0o92kgBnB89cuAMA==",
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/@otplib/core/-/core-13.4.0.tgz",
+      "integrity": "sha512-JqOGcvZQi2wIkEQo8f3/iAjstavpXy6gouIDMHygjNuH6Q0FjbHOiXMdcE94RwfgDNMABhzwUmvaPsxvgm9NYw==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@otplib/plugin-crypto": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@otplib/plugin-crypto/-/plugin-crypto-12.0.1.tgz",
-      "integrity": "sha512-qPuhN3QrT7ZZLcLCyKOSNhuijUi9G5guMRVrxq63r9YNOxxQjPm59gVxLM+7xGnHnM6cimY57tuKsjK7y9LM1g==",
-      "deprecated": "Please upgrade to v13 of otplib. Refer to otplib docs for migration paths",
+    "node_modules/@otplib/hotp": {
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/@otplib/hotp/-/hotp-13.4.0.tgz",
+      "integrity": "sha512-MJjE0x06mn2ptymz5qZmQveb+vWFuaIftqE0b5/TZZqUOK7l97cV8lRTmid5BpAQMwJDNLW6RnYxGeCRiNdekw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@otplib/core": "^12.0.1"
+        "@otplib/core": "13.4.0",
+        "@otplib/uri": "13.4.0"
       }
     },
-    "node_modules/@otplib/plugin-thirty-two": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@otplib/plugin-thirty-two/-/plugin-thirty-two-12.0.1.tgz",
-      "integrity": "sha512-MtT+uqRso909UkbrrYpJ6XFjj9D+x2Py7KjTO9JDPhL0bJUYVu5kFP4TFZW4NFAywrAtFRxOVY261u0qwb93gA==",
-      "deprecated": "Please upgrade to v13 of otplib. Refer to otplib docs for migration paths",
+    "node_modules/@otplib/plugin-base32-scure": {
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/@otplib/plugin-base32-scure/-/plugin-base32-scure-13.4.0.tgz",
+      "integrity": "sha512-/t9YWJmMbB8bF5z8mXrBZc2FXBe8B/3hG5FhWr9K8cFwFhyxScbPysmZe8s1UTzSA6N+s8Uv8aIfCtVXPNjJWw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@otplib/core": "^12.0.1",
-        "thirty-two": "^1.0.2"
+        "@otplib/core": "13.4.0",
+        "@scure/base": "^2.0.0"
       }
     },
-    "node_modules/@otplib/preset-default": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@otplib/preset-default/-/preset-default-12.0.1.tgz",
-      "integrity": "sha512-xf1v9oOJRyXfluBhMdpOkr+bsE+Irt+0D5uHtvg6x1eosfmHCsCC6ej/m7FXiWqdo0+ZUI6xSKDhJwc8yfiOPQ==",
-      "deprecated": "Please upgrade to v13 of otplib. Refer to otplib docs for migration paths",
+    "node_modules/@otplib/plugin-crypto-noble": {
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/@otplib/plugin-crypto-noble/-/plugin-crypto-noble-13.4.0.tgz",
+      "integrity": "sha512-KrvE4m7Zv+TT1944HzgqFJWJpKb6AyoxDbvhPStmBqdMlv5Gekb80d66cuFRL08kkPgJ5gXUSb5SFpYeB+bACg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@otplib/core": "^12.0.1",
-        "@otplib/plugin-crypto": "^12.0.1",
-        "@otplib/plugin-thirty-two": "^12.0.1"
+        "@noble/hashes": "^2.0.1",
+        "@otplib/core": "13.4.0"
       }
     },
-    "node_modules/@otplib/preset-v11": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/@otplib/preset-v11/-/preset-v11-12.0.1.tgz",
-      "integrity": "sha512-9hSetMI7ECqbFiKICrNa4w70deTUfArtwXykPUvSHWOdzOlfa9ajglu7mNCntlvxycTiOAXkQGwjQCzzDEMRMg==",
+    "node_modules/@otplib/totp": {
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/@otplib/totp/-/totp-13.4.0.tgz",
+      "integrity": "sha512-dK+vl0f0ekzf6mCENRI9AKS2NJUC7OjI3+X8e7QSnhQ2WM7I+i4PGpb3QxKi5hxjTtwVuoZwXR2CFtXdcRtNdQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@otplib/core": "^12.0.1",
-        "@otplib/plugin-crypto": "^12.0.1",
-        "@otplib/plugin-thirty-two": "^12.0.1"
+        "@otplib/core": "13.4.0",
+        "@otplib/hotp": "13.4.0",
+        "@otplib/uri": "13.4.0"
+      }
+    },
+    "node_modules/@otplib/uri": {
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/@otplib/uri/-/uri-13.4.0.tgz",
+      "integrity": "sha512-x1ozBa5bPbdZCrrTL/HK21qchiK7jYElTu+0ft22abeEhiLYgH1+SIULvOcVk3CK8YwF4kdcidvkq4ciejucJA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@otplib/core": "13.4.0"
       }
     },
     "node_modules/@playwright/test": {
@@ -84,6 +104,16 @@
         "node": ">=18"
       }
     },
+    "node_modules/@scure/base": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@scure/base/-/base-2.2.0.tgz",
+      "integrity": "sha512-b8XEupJibegiXV+tDUseI8oLQc8ei3d/4Jkb2RpbHh3MfE054ov3uIz2dhFkB3FI8iwYkEh0gGCApkrYggkPNg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/fsevents": {
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
@@ -100,15 +130,18 @@
       }
     },
     "node_modules/otplib": {
-      "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/otplib/-/otplib-12.0.1.tgz",
-      "integrity": "sha512-xDGvUOQjop7RDgxTQ+o4pOol0/3xSZzawTiPKRrHnQWAy0WjhNs/5HdIDJCrqC4MBynmjXgULc6YfioaxZeFgg==",
+      "version": "13.4.0",
+      "resolved": "https://registry.npmjs.org/otplib/-/otplib-13.4.0.tgz",
+      "integrity": "sha512-RUcYcRMCgRWhUE/XabRppXpUwCwaWBNHe5iPXhdvP8wwDGpGpsIf/kxX/ec3zFsOaM1Oq8lEhUqDwk6W7DHkwg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@otplib/core": "^12.0.1",
-        "@otplib/preset-default": "^12.0.1",
-        "@otplib/preset-v11": "^12.0.1"
+        "@otplib/core": "13.4.0",
+        "@otplib/hotp": "13.4.0",
+        "@otplib/plugin-base32-scure": "13.4.0",
+        "@otplib/plugin-crypto-noble": "13.4.0",
+        "@otplib/totp": "13.4.0",
+        "@otplib/uri": "13.4.0"
       }
     },
     "node_modules/playwright": {
@@ -142,15 +175,6 @@
       "engines": {
         "node": ">=18"
       }
-    },
-    "node_modules/thirty-two": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/thirty-two/-/thirty-two-1.0.2.tgz",
-      "integrity": "sha512-OEI0IWCe+Dw46019YLl6V10Us5bi574EvlJEOcAkB29IzQ/mYD1A6RyNHLjZPiHCmuodxvgF6U+vZO1L15lxVA==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.2.6"
-      }
     }
   }
 }
diff --git a/package.json b/package.json
index bf1ce92c..20db8a3f 100644
--- a/package.json
+++ b/package.json
@@ -22,6 +22,6 @@
   "homepage": "https://github.com/AnsoCode/Sencho#readme",
   "devDependencies": {
     "@playwright/test": "^1.59.1",
-    "otplib": "^12.0.1"
+    "otplib": "^13.4.0"
   }
 }