diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 919919c4c6..7eec3ee9fe 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-19a76a09ffb43649ee19e62d07e8b8a42d78757b
+a3fefe85f5f2f52bb473fa47acc9efa8fd0b2206
diff --git a/frontend/src/lib/components/Login.svelte b/frontend/src/lib/components/Login.svelte
index 98afb8c5a2..dce840814e 100644
--- a/frontend/src/lib/components/Login.svelte
+++ b/frontend/src/lib/components/Login.svelte
@@ -415,7 +415,21 @@
 			return false
 		}
 		persistRd()
-		window.location.href = saml
+		let target = saml
+		// Carry the SP-initiated deep link through the IdP round-trip via SAML
+		// RelayState so the ACS redirects straight back to it (bypassing
+		// /user/login). Only same-origin relative paths are passed; the backend
+		// re-validates. Absolute `rd` still relies on the localStorage fallback.
+		if (rd && rd.startsWith('/') && !rd.startsWith('//')) {
+			try {
+				const url = new URL(saml)
+				url.searchParams.set('RelayState', rd)
+				target = url.toString()
+			} catch (e) {
+				console.error('Could not set SAML RelayState', e)
+			}
+		}
+		window.location.href = target
 		return true
 	}