diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index 6d27f21..d9fb877 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "ChatApp",
-  "version": "0.3.3",
+  "version": "0.3.4",
   "identifier": "com.meinname.chatapp",
   "build": {
     "beforeDevCommand": "pnpm vite:dev",
diff --git a/apps/desktop/src/context/AuthContext.tsx b/apps/desktop/src/context/AuthContext.tsx
index 077e9ab..29a7516 100644
--- a/apps/desktop/src/context/AuthContext.tsx
+++ b/apps/desktop/src/context/AuthContext.tsx
@@ -61,7 +61,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
           const status = (error as { status?: number }).status;
           if (status === 401 || status === 403) {
             // Token genuinely invalid — wipe.
-            await supabase.auth.signOut().catch(() => {
+            await supabase.auth.signOut({ scope: 'local' }).catch(() => {
               /* ignore */
             });
             setSession(null);
diff --git a/packages/shared/src/auth/magic-link.ts b/packages/shared/src/auth/magic-link.ts
index a37d482..427dd37 100644
--- a/packages/shared/src/auth/magic-link.ts
+++ b/packages/shared/src/auth/magic-link.ts
@@ -86,7 +86,11 @@ export async function completeSessionFromUrl(
 }
 
 export async function signOut(client: AppSupabaseClient): Promise<void> {
-  const { error } = await client.auth.signOut();
+  // `scope: 'local'` only ends the session in THIS client. Without it Supabase
+  // defaults to 'global', which invalidates the user's refresh tokens
+  // everywhere — meaning a logout in the browser would also kick the desktop
+  // app (and vice versa) the next time it tries to refresh its token.
+  const { error } = await client.auth.signOut({ scope: 'local' });
   if (error) throw error;
 }