diff --git a/apps/desktop/src/context/AuthContext.tsx b/apps/desktop/src/context/AuthContext.tsx
index 7724e97..20876d9 100644
--- a/apps/desktop/src/context/AuthContext.tsx
+++ b/apps/desktop/src/context/AuthContext.tsx
@@ -207,9 +207,14 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   // Pre-warm Supabase: fires the first round-trip in the background so the
   // first user-triggered query (e.g. loading conversations) doesn't pay
   // the cold-connection latency.
+  //
+  // Uses auth.getSession() instead of a `profiles` SELECT because the
+  // SELECT race-fired before the supabase client committed its JWT to
+  // request headers, causing a 400 from PostgREST on app boot. Auth
+  // endpoints don't depend on RLS and tolerate the race.
   useEffect(() => {
     if (!session) return;
-    void supabase.from('profiles').select('id').limit(1).then(() => undefined);
+    void supabase.auth.getSession();
   }, [session]);
 
   // Phase 3: ensure this install owns exactly one devices row. The row is
diff --git a/apps/desktop/src/lib/userIdentity.ts b/apps/desktop/src/lib/userIdentity.ts
index 55083e6..41b64a5 100644
--- a/apps/desktop/src/lib/userIdentity.ts
+++ b/apps/desktop/src/lib/userIdentity.ts
@@ -213,7 +213,7 @@ async function runLegacyMigration(
     }
   }
 
-  console.info(
+  console.debug(
     '[crypto-migration] vault scan:',
     'serverDevices=' + report.serverDevices,
     'keysFromServerList=' + report.strongholdKeysFromServerDevices,
diff --git a/packages/shared/src/chat/userKeyMigration.ts b/packages/shared/src/chat/userKeyMigration.ts
index 5e22e17..942bbf6 100644
--- a/packages/shared/src/chat/userKeyMigration.ts
+++ b/packages/shared/src/chat/userKeyMigration.ts
@@ -57,7 +57,7 @@ export async function migrateOwnLegacyBundles(params: MigrateParams): Promise<Mi
     attempted: 0, noStrongholdKey: 0, decryptFailed: 0, rpcFailed: 0,
   };
   if (params.ownLegacyDeviceIds.length === 0) {
-    console.info('[crypto-migration] no legacy device-ids to consider — skipping');
+    console.debug('[crypto-migration] no legacy device-ids to consider — skipping');
     return result;
   }
 
@@ -76,7 +76,7 @@ export async function migrateOwnLegacyBundles(params: MigrateParams): Promise<Mi
     .not('recipient_device_id', 'is', null);
   if (error) throw error;
   const rows = (rowsRaw ?? []) as LegacyRow[];
-  console.info('[crypto-migration] legacy rows visible to me: ' + rows.length);
+  console.debug('[crypto-migration] legacy rows visible to me: ' + rows.length);
   if (rows.length === 0) return result;
 
   const senderDeviceIds = Array.from(new Set(rows.map((r) => r.sender_device_id).filter(Boolean)));
@@ -136,13 +136,26 @@ export async function migrateOwnLegacyBundles(params: MigrateParams): Promise<Mi
     result.migratedConversations += 1;
   }
 
-  console.info(
-    '[crypto-migration] result:',
-    'attempted=' + result.attempted,
-    'migrated=' + result.migratedConversations,
-    'noKey=' + result.noStrongholdKey,
-    'decryptFail=' + result.decryptFailed,
-    'rpcFail=' + result.rpcFailed,
-  );
+  // If anything was actually migrated this run, leave it as console.info
+  // so it's visible in default consoles. If we only re-failed on already-
+  // unrecoverable rows (no local stronghold key), demote to debug — the
+  // migration is idempotent but the noisy "noKey=N" line scared the user
+  // who thought migration was already done.
+  if (result.migratedConversations > 0 || result.decryptFailed > 0 || result.rpcFailed > 0) {
+    console.info(
+      '[crypto-migration] result:',
+      'attempted=' + result.attempted,
+      'migrated=' + result.migratedConversations,
+      'noKey=' + result.noStrongholdKey,
+      'decryptFail=' + result.decryptFailed,
+      'rpcFail=' + result.rpcFailed,
+    );
+  } else {
+    console.debug(
+      '[crypto-migration] result (all unrecoverable, expected on stale clients):',
+      'attempted=' + result.attempted,
+      'noKey=' + result.noStrongholdKey,
+    );
+  }
   return result;
 }