diff --git a/PLAN-4.1.2.md b/PLAN-4.1.2.md
index 57c6f8f..e32848b 100644
--- a/PLAN-4.1.2.md
+++ b/PLAN-4.1.2.md
@@ -165,8 +165,22 @@ Polish and UX improvements after the 4.1.1 stability release.
 
 ---
 
+## 4. Forced First-Login Setup
+
+**Status:** Planned
+
+**Problem:** Users can navigate the app without creating an admin account first. Should force password setup before anything else.
+
+**Solution:** Middleware/decorator that redirects to setup page if no users exist.
+
+### Files to Modify
+- `frontends/web/app.py` (add before_request check)
+- `frontends/web/templates/setup.html` (ensure it blocks other nav)
+
+---
+
 ## Notes
 
-- Keep 4.1.2 focused - 3 features max
+- Keep 4.1.2 focused - 4 small features
 - Don't break DCT compatibility (4.1.1 RS format is stable)
 - Test on Pi before release
diff --git a/rpi/first-boot-wizard.sh b/rpi/first-boot-wizard.sh
index b6d0fca..76fa1a0 100755
--- a/rpi/first-boot-wizard.sh
+++ b/rpi/first-boot-wizard.sh
@@ -373,15 +373,15 @@ HOSTNAME=$(hostname)
 # Build the access URL
 if [ "$ENABLE_HTTPS" = "true" ]; then
   if [ "$USE_PORT_443" = "true" ]; then
-    ACCESS_URL="https://$PI_IP"
-    ACCESS_URL_LOCAL="https://$HOSTNAME.local"
+    ACCESS_URL="https://$PI_IP/setup"
+    ACCESS_URL_LOCAL="https://$HOSTNAME.local/setup"
   else
-    ACCESS_URL="https://$PI_IP:5000"
-    ACCESS_URL_LOCAL="https://$HOSTNAME.local:5000"
+    ACCESS_URL="https://$PI_IP:5000/setup"
+    ACCESS_URL_LOCAL="https://$HOSTNAME.local:5000/setup"
   fi
 else
-  ACCESS_URL="http://$PI_IP:5000"
-  ACCESS_URL_LOCAL="http://$HOSTNAME.local:5000"
+  ACCESS_URL="http://$PI_IP:5000/setup"
+  ACCESS_URL_LOCAL="http://$HOSTNAME.local:5000/setup"
 fi
 
 gum style \
@@ -401,7 +401,7 @@ gum style \
   "Setup Complete!"
 
 echo ""
-gum style --foreground 82 --bold "Access URL:"
+gum style --foreground 82 --bold "Create your admin account:"
 gum style --foreground 226 "  $ACCESS_URL"
 gum style --foreground 245 "  $ACCESS_URL_LOCAL (if mDNS works)"
 echo ""
diff --git a/rpi/setup.sh b/rpi/setup.sh
index fe70a5e..49c7d85 100755
--- a/rpi/setup.sh
+++ b/rpi/setup.sh
@@ -446,15 +446,15 @@ echo ""
 
 PI_IP=$(hostname -I | awk '{print $1}')
 
-echo -e "${GREEN}Your Stegasoo server:${NC}"
+echo -e "${GREEN}Create your admin account:${NC}"
 if [ "$ENABLE_HTTPS" = "true" ]; then
     if [ "$USE_PORT_443" = "true" ]; then
-        echo -e "  ${YELLOW}https://$PI_IP${NC}"
+        echo -e "  ${YELLOW}https://$PI_IP/setup${NC}"
     else
-        echo -e "  ${YELLOW}https://$PI_IP:5000${NC}"
+        echo -e "  ${YELLOW}https://$PI_IP:5000/setup${NC}"
     fi
 else
-    echo -e "  ${YELLOW}http://$PI_IP:5000${NC}"
+    echo -e "  ${YELLOW}http://$PI_IP:5000/setup${NC}"
 fi
 
 echo ""
@@ -470,8 +470,6 @@ echo "  Stop:    sudo systemctl stop stegasoo"
 echo "  Status:  sudo systemctl status stegasoo"
 echo "  Logs:    journalctl -u stegasoo -f"
 echo ""
-echo -e "${YELLOW}Note: On first access, you'll create an admin account.${NC}"
-echo ""
 
 # Offer to start now
 read -p "Start Stegasoo now? [Y/n] " -n 1 -r
@@ -483,12 +481,12 @@ if [[ ! $REPLY =~ ^[Nn]$ ]]; then
         echo -e "${GREEN}✓ Stegasoo is running!${NC}"
         if [ "$ENABLE_HTTPS" = "true" ]; then
             if [ "$USE_PORT_443" = "true" ]; then
-                echo -e "  Visit: ${YELLOW}https://$PI_IP${NC}"
+                echo -e "  Create admin: ${YELLOW}https://$PI_IP/setup${NC}"
             else
-                echo -e "  Visit: ${YELLOW}https://$PI_IP:5000${NC}"
+                echo -e "  Create admin: ${YELLOW}https://$PI_IP:5000/setup${NC}"
             fi
         else
-            echo -e "  Visit: ${YELLOW}http://$PI_IP:5000${NC}"
+            echo -e "  Create admin: ${YELLOW}http://$PI_IP:5000/setup${NC}"
         fi
     else
         echo -e "${RED}✗ Failed to start. Check logs:${NC} journalctl -u stegasoo -f"
diff --git a/test_data/carrier2.JPG b/test_data/carrier2.JPG
new file mode 100644
index 0000000..d10c5fd
Binary files /dev/null and b/test_data/carrier2.JPG differ