diff --git a/backend/__tests__/service/signupSourceHttp.test.js b/backend/__tests__/service/signupSourceHttp.test.js
new file mode 100644
index 0000000000..7d8e4eae22
--- /dev/null
+++ b/backend/__tests__/service/signupSourceHttp.test.js
@@ -0,0 +1,83 @@
+const express = require('express');
+const request = require('supertest');
+const axios = require('axios');
+const User = require('../../models/User');
+const OAuthLoginState = require('../../models/OAuthLoginState');
+const { setupMongoDb, closeMongoDb, clearMongoDb } = require('../utils/testUtils');
+
+jest.mock('axios', () => ({ post: jest.fn(), get: jest.fn() }));
+jest.mock('../../services/emailService', () => ({ sendEmail: jest.fn().mockResolvedValue(undefined) }));
+jest.mock('../../services/communityPodService', () => ({ ensureUserInCommunityPod: jest.fn().mockResolvedValue(undefined) }));
+
+const app = express();
+app.use(express.json());
+app.use('/api/auth', require('../../routes/auth'));
+
+describe('signup source over the public HTTP auth surface', () => {
+  beforeAll(setupMongoDb);
+  afterAll(closeMongoDb);
+  beforeEach(() => {
+    process.env.GITHUB_OAUTH_CLIENT_ID = 'source-test-client';
+    process.env.GITHUB_OAUTH_CLIENT_SECRET = 'source-test-secret';
+    process.env.REGISTRATION_INVITE_ONLY = 'false';
+    delete process.env.AUTH_ALLOWED_EMAILS;
+    delete process.env.AUTH_ALLOWED_DOMAINS;
+    delete process.env.SMTP2GO_API_KEY;
+  });
+  afterEach(async () => {
+    await clearMongoDb();
+    jest.clearAllMocks();
+    delete process.env.GITHUB_OAUTH_CLIENT_ID;
+    delete process.env.GITHUB_OAUTH_CLIENT_SECRET;
+    delete process.env.REGISTRATION_INVITE_ONLY;
+  });
+
+  it('refuses dollar-prefixed OAuth form keys before creating server state', async () => {
+    const refused = await request(app).post('/api/auth/oauth/github/start').type('form')
+      .send('$gt=1').expect(400);
+    expect(refused.body).toMatchObject({ code: 'dollar_key_refused', field: 'body.$gt' });
+    expect(await OAuthLoginState.countDocuments({})).toBe(0);
+  });
+
+  it('carries bounded form attribution in server state through callback and ignores replay', async () => {
+    const source = { ref: 'HN', landingPath: `/${'%2F'.repeat(480)}?email=private`,
+      referrer: `https://news.example/${'%2F'.repeat(480)}?token=private`, firstSeenAt: '2026-01-01T00:00:00.000Z' };
+    expect(new URLSearchParams({ signupSource: JSON.stringify(source) }).toString().length).toBeGreaterThan(4096);
+    const response = await request(app).post('/api/auth/oauth/github/start').type('form')
+      .send({ signupSource: JSON.stringify(source) }).expect(302);
+    expect(response.headers.location).not.toMatch(/signupSource|landingPath|private/);
+    const state = new URL(response.headers.location).searchParams.get('state');
+    const stored = await OAuthLoginState.findOne({ state });
+    expect(stored.signupSource.landingPath).toBe(source.landingPath.split('?')[0]);
+    expect(JSON.stringify(stored.signupSource)).not.toContain('private');
+    expect(stored.signupSource.referrer).toBe('https://news.example');
+    axios.post.mockResolvedValue({ data: { access_token: 'source-test-access' } });
+    axios.get.mockImplementation((url) => Promise.resolve({ data: url.endsWith('/emails')
+      ? [{ email: 'source-http@example.com', verified: true, primary: true }]
+      : { id: 4245, login: 'source-http' } }));
+    const callback = `/api/auth/oauth/github/callback?state=${state}&code=source-code`;
+    await request(app).get(`${callback}&signupSource=forged`).expect(302);
+    const user = await User.findOne({ email: 'source-http@example.com' }).select('+signupSource');
+    expect(user.signupSource.authMethod).toBe('github');
+    expect(user.signupSource.ref).toBe('hn');
+    const replay = await request(app).get(callback).expect(302);
+    expect(replay.headers.location).toContain('oauthError=state_invalid');
+    expect(await User.countDocuments({ email: 'source-http@example.com' })).toBe(1);
+  });
+
+  it('writes the password source only at registration, and never returns it in an ordinary profile read', async () => {
+    await request(app).post('/api/auth/register').send({ email: 'password-source@example.com',
+      password: 'Password123!', signupSource: { landingPath: '/v2/invite/SECRETinviteTOKEN123',
+        referrer: 'https://news.example/v2/invite/SECRETinviteTOKEN123', ref: 'HN' } }).expect(201);
+    const before = await User.findOne({ email: 'password-source@example.com' }).select('+signupSource');
+    expect(before.signupSource.authMethod).toBe('password');
+    expect(before.signupSource.landingPath).toBeUndefined();
+    expect(before.signupSource.referrer).toBe('https://news.example');
+    expect(JSON.stringify(before.signupSource)).not.toContain('SECRETinviteTOKEN123');
+    const login = await request(app).post('/api/auth/login').send({ email: 'password-source@example.com',
+      password: 'Password123!', signupSource: { ref: 'replacement' } }).expect(200);
+    expect(JSON.stringify(login.body)).not.toContain('signupSource');
+    const after = await User.findById(before._id).select('+signupSource');
+    expect(after.signupSource.toObject()).toEqual(before.signupSource.toObject());
+  });
+});
diff --git a/backend/__tests__/unit/controllers/oauthController.test.js b/backend/__tests__/unit/controllers/oauthController.test.js
index 59f4c22f07..9b46d42928 100644
--- a/backend/__tests__/unit/controllers/oauthController.test.js
+++ b/backend/__tests__/unit/controllers/oauthController.test.js
@@ -7,6 +7,7 @@ const InvitationCode = require('../../../models/InvitationCode');
 jest.mock('../../../services/communityPodService', () => ({
   ensureUserInCommunityPod: jest.fn().mockResolvedValue(undefined),
 }));
+jest.mock('../../../services/emailService', () => ({ sendEmail: jest.fn().mockResolvedValue(undefined) }));
 const { ensureUserInCommunityPod } = require('../../../services/communityPodService');
 const oauthController = require('../../../controllers/oauthController');
 const authController = require('../../../controllers/authController');
@@ -81,6 +82,70 @@ describe('OAuth Controller', () => {
     delete process.env.AUTH_ALLOWED_DOMAINS;
   });
 
+  describe('signup source round trips', () => {
+    it.each(['password', 'github', 'google'].flatMap((method) => [[method, false], [method, true]]))(
+      'persists sanitized %s first touch once, never from callback parameters (invite path: %s)', async (method, invitePath) => {
+      const touch = {
+        ref: 'HN', referrer: invitePath ? 'https://search.example/v2/invite/SECRETinviteTOKEN123' : 'https://search.example/results?email=private#token',
+        landingPath: invitePath ? '/v2/invite/SECRETinviteTOKEN123' : '/guides/start?invite=private#token', firstSeenAt: '2026-01-01T00:00:00.000Z',
+        authMethod: 'forged', recordedAt: '1900-01-01',
+      };
+      if (method === 'password') {
+        const res = mockRes();
+        await authController.register({ body: {
+          username: 'source-user', email: 'source@example.com', password: 'Password123!', signupSource: touch,
+        } }, res);
+        expect(res.status).toHaveBeenCalledWith(201);
+      } else {
+        if (method === 'google') {
+          process.env.GOOGLE_OAUTH_CLIENT_ID = 'google-client';
+          process.env.GOOGLE_OAUTH_CLIENT_SECRET = 'google-secret';
+        }
+        const signIn = async (source) => {
+          const startRes = mockRes();
+          await oauthController.startOAuth({ ...startReq(method), method: 'POST',
+            body: { signupSource: JSON.stringify(source) } }, startRes);
+          const location = startRes.redirect.mock.calls[0][0];
+          expect(location).not.toMatch(/search\.example|landingPath|signupSource|private|firstSeenAt/);
+          const state = new URL(location).searchParams.get('state');
+          const storedState = await OAuthLoginState.findOne({ state });
+          expect(JSON.stringify(storedState.signupSource)).not.toContain('private');
+          expect(JSON.stringify(storedState.signupSource)).not.toContain('SECRETinviteTOKEN123');
+          if (method === 'github') mockGithubProfile({ email: 'source@example.com' });
+          else {
+            axios.post.mockResolvedValueOnce({ data: { access_token: 'google-access-token' } });
+            axios.get.mockResolvedValue({ data: { sub: 'google-source', email: 'source@example.com',
+              email_verified: true, name: 'source-user' } });
+          }
+          const callbackRes = mockRes();
+          await oauthController.oauthCallback({ ...startReq(method),
+            query: { code: 'provider-code', state, signupSource: JSON.stringify({ ref: 'forged' }), ref: 'forged' } }, callbackRes);
+          expect(callbackRes.redirect).toHaveBeenCalledWith(expect.stringContaining('/v2/oauth/complete?'));
+          expect(callbackRes.redirect.mock.calls[0][0]).not.toMatch(/signupSource|firstSeenAt|search\.example|private/);
+          return { state, callbackRes };
+        };
+        const first = await signIn(touch);
+        // A replay cannot create an account or overwrite its attribution.
+        const replay = mockRes();
+        await oauthController.oauthCallback({ ...startReq(method), query: { state: first.state, code: 'replay' } }, replay);
+        expect(replay.redirect).toHaveBeenCalledWith(expect.stringContaining('oauthError=state_invalid'));
+        await signIn({ ref: 'later', landingPath: '/later' });
+      }
+      const user = await User.findOne({ email: 'source@example.com' }).select('+signupSource');
+      expect(user.signupSource.toObject()).toEqual({
+        ref: 'hn', referrer: 'https://search.example', ...(invitePath ? {} : { landingPath: '/guides/start' }),
+        firstSeenAt: new Date('2026-01-01T00:00:00.000Z'), authMethod: method, recordedAt: expect.any(Date),
+      });
+      expect(user.onboarding.signupRef).toBe('hn');
+      expect((await User.findById(user._id).lean()).signupSource).toBeUndefined();
+      // Neither a later save nor a dotted update may rewrite a created source.
+      user.signupSource.ref = 'changed';
+      await user.save();
+      await User.updateOne({ _id: user._id }, { $set: { 'signupSource.ref': 'also-changed' } });
+      expect((await User.findById(user._id).select('+signupSource')).signupSource.ref).toBe('hn');
+    });
+  });
+
   describe('getOAuthProviders', () => {
     it('lists only configured providers', () => {
       const res = mockRes();
diff --git a/backend/__tests__/unit/middleware/refuseDollarKeys.test.js b/backend/__tests__/unit/middleware/refuseDollarKeys.test.js
index e077e5a445..4493213047 100644
--- a/backend/__tests__/unit/middleware/refuseDollarKeys.test.js
+++ b/backend/__tests__/unit/middleware/refuseDollarKeys.test.js
@@ -279,6 +279,6 @@ describe('where the guard is mounted', () => {
   });
 
   test('the OAuth start form runs it after its urlencoded parser', () => {
-    expect(src('routes/auth.ts')).toMatch(/express\.urlencoded\(\{ extended: false, limit: '4kb' \}\), refuseDollarKeys, startOAuth\)/);
+    expect(src('routes/auth.ts')).toMatch(/express\.urlencoded\(\{ extended: false, limit: '16kb' \}\), refuseDollarKeys, startOAuth\)/);
   });
 });
diff --git a/backend/__tests__/unit/utils/signupSource.test.js b/backend/__tests__/unit/utils/signupSource.test.js
new file mode 100644
index 0000000000..b469e96f9b
--- /dev/null
+++ b/backend/__tests__/unit/utils/signupSource.test.js
@@ -0,0 +1,51 @@
+const { cleanSignupTouch, signupSourceFields } = require('../../../utils/signupSource');
+
+describe('signup source privacy boundary', () => {
+  it('strips query, fragment and URL credentials, and ignores unrecognized keys', () => {
+    const source = cleanSignupTouch({
+      ref: ' X ', referrer: 'https://name:password@news.example/article?email=secret#token',
+      landingPath: '/guides/a?invite=private#secret', firstSeenAt: '2026-01-01T00:00:00.000Z',
+      authMethod: 'admin', extra: 'secret',
+    });
+    expect(source).toEqual({
+      ref: 'x', referrer: 'https://news.example', landingPath: '/guides/a',
+      firstSeenAt: new Date('2026-01-01T00:00:00.000Z'),
+    });
+  });
+
+  it.each([null, [], '{bad', 'x'.repeat(4097), { referrer: 'javascript:secret', landingPath: '//foreign.example', firstSeenAt: 'nope' }])(
+    'drops malformed optional input without failing registration: %p', (input) => {
+      expect(cleanSignupTouch(input)).toEqual({});
+    },
+  );
+
+  it.each([
+    '/v2/invite/SECRETinviteTOKEN123',
+    '/v2/INVITE/short',
+    '/v2/%69nvite/short',
+    '/v2/%2569nvite%252Fshort',
+    '/share/0123456789abcdef0123456789abcdef',
+    '/share/550e8400-e29b-41d4-a716-446655440000',
+    '/share/AbCdEfGhIjKlMnOpQrStUvWxYz012345', '/v2/%25252569nvite/short', '/bad/%zz',
+  ])('drops path-embedded capabilities even from an old or forged client: %s', (path) => {
+    expect(cleanSignupTouch({ landingPath: path, referrer: `https://news.example${path}` }))
+      .toEqual({ referrer: 'https://news.example' });
+  });
+
+  it('retains a normal guide path while reducing even long referrer paths to an origin', () => {
+    expect(cleanSignupTouch({ landingPath: '/guides/multi-agent-collaboration-platform',
+      referrer: `https://news.example/${'a'.repeat(1500)}` })).toEqual({
+      landingPath: '/guides/multi-agent-collaboration-platform', referrer: 'https://news.example',
+    });
+  });
+
+  it('does not turn a later ref into the ref of an earlier direct visit', () => {
+    expect(cleanSignupTouch({ landingPath: '/' }, 'later')).toEqual({ landingPath: '/' });
+    expect(cleanSignupTouch(undefined, 'old-browser')).toEqual({ ref: 'old-browser' });
+  });
+
+  it('sets auth method and recording time on the server, even without browser storage', () => {
+    const source = signupSourceFields({ authMethod: 'github', recordedAt: '1900-01-01' }, 'password');
+    expect(source.signupSource).toEqual({ authMethod: 'password', recordedAt: expect.any(Date) });
+  });
+});
diff --git a/backend/controllers/authController.ts b/backend/controllers/authController.ts
index 8a38ed72e7..d16f81038d 100644
--- a/backend/controllers/authController.ts
+++ b/backend/controllers/authController.ts
@@ -8,7 +8,7 @@ const AgentIdentityService = require('../services/agentIdentityService');
 const { sendEmail } = require('../services/emailService');
 const { ensureUserInCommunityPod } = require('../services/communityPodService');
 const { normalizeAvatarUrl } = require('../services/avatarService');
-const { cleanSignupRef } = require('../utils/signupRef');
+const { signupSourceFields } = require('../utils/signupSource');
 const { deriveUsernameFromEmail, ACCOUNT_LABEL_COLLATION } = require('../services/derivedUsername');
 const { issueSessionToken } = require('../services/sessionTokenService');
 const {
@@ -19,13 +19,6 @@ const { disconnectUserSessionSockets } = require('../services/sessionSocketServi
 const { isInstanceAccessRestricted, isInstanceEmailAllowed,
   INSTANCE_ACCESS_ERROR } = require('../services/instanceAccessPolicy');
 
-// The first-touch ref a signup arrived with (?ref=x), stored once on the new
-// account. Anything that is not a short plain code is dropped, not refused.
-const signupRefField = (raw: unknown) => {
-  const ref = cleanSignupRef(raw);
-  return ref ? { onboarding: { signupRef: ref } } : {};
-};
-
 const joinCommunityPodBestEffort = (userId: any) => {
   void ensureUserInCommunityPod(userId).catch((err: Error) => {
     console.warn('[community-pod] background join failed after auth transition:', err.message);
@@ -412,6 +405,7 @@ exports.register = async (req: any, res: any) => {
       password,
       invitationCode,
       signupRef,
+      signupSource,
     } = req.body;
 
     const normalizedEmail = normalizeEmail(email);
@@ -534,7 +528,7 @@ exports.register = async (req: any, res: any) => {
       password: rawPassword,
       verified: shouldAutoVerify,
       entitlements: { cloudAgents: invitationRedeemed },
-      ...signupRefField(signupRef),
+      ...signupSourceFields(signupSource, 'password', signupRef),
     });
 
     // Save user to database
diff --git a/backend/controllers/oauthController.ts b/backend/controllers/oauthController.ts
index c2672469a3..fd400cdeef 100644
--- a/backend/controllers/oauthController.ts
+++ b/backend/controllers/oauthController.ts
@@ -4,6 +4,7 @@ const axios = require('axios');
 const User = require('../models/User');
 const OAuthLoginState = require('../models/OAuthLoginState');
 const { cleanSignupRef } = require('../utils/signupRef');
+const { cleanSignupTouch, signupSourceFields } = require('../utils/signupSource');
 const AgentIdentityService = require('../services/agentIdentityService');
 const {
   isInviteOnlyRegistrationEnabled,
@@ -237,6 +238,9 @@ exports.startOAuth = async (req: any, res: any) => {
       invitationCode: String(input.invite || '').trim(),
       next: safeNextPath(input.next),
       signupRef: cleanSignupRef(input.ref) || '',
+      // Attribution arrives in a form body, stays in this server-side state,
+      // and is never copied into a provider or completion URL.
+      ...(req.method === 'POST' ? { signupSource: cleanSignupTouch(input.signupSource, input.ref) } : {}),
       expiresAt: new Date(Date.now() + STATE_TTL_MS),
     });
 
@@ -336,14 +340,13 @@ exports.oauthCallback = async (req: any, res: any) => {
         return loginErrorRedirect(res, 'invitation_required');
       }
 
-      const signupRef = cleanSignupRef(stateRow.signupRef);
       user = new User({
         username: await generateUsername(profile.usernameHint, profile.email),
         email: profile.email,
         verified: true, // provider-asserted
         entitlements: { cloudAgents: invitationRedeemed },
         // Set at creation only: signing in to an existing account never changes it.
-        ...(signupRef ? { onboarding: { signupRef } } : {}),
+        ...signupSourceFields(stateRow.signupSource, provider, stateRow.signupRef),
         authProviders: [{
           provider,
           providerId: profile.providerId,
diff --git a/backend/models/OAuthLoginState.ts b/backend/models/OAuthLoginState.ts
index e4f41dde3d..7c6ae4f610 100644
--- a/backend/models/OAuthLoginState.ts
+++ b/backend/models/OAuthLoginState.ts
@@ -1,4 +1,5 @@
 import mongoose, { Document, Schema, Types } from 'mongoose';
+import type { SignupTouch } from '../utils/signupSource';
 
 // One row per social-login attempt. Lives for the length of the OAuth
 // round-trip and is deliberately separate from OAuthState (the X/Twitter
@@ -22,6 +23,7 @@ export interface IOAuthLoginState extends Document {
   next?: string;
   // First-touch ref code (?ref=x) for a signup made through this login.
   signupRef?: string;
+  signupSource?: SignupTouch;
   userId?: Types.ObjectId | null;
   exchangeCode?: string | null;
   exchangeExpiresAt?: Date | null;
@@ -39,6 +41,9 @@ const OAuthLoginStateSchema = new Schema<IOAuthLoginState>(
     invitationCode: { type: String, default: '' },
     next: { type: String, default: '/v2' },
     signupRef: { type: String, default: '' },
+    signupSource: {
+      type: new Schema({ ref: String, referrer: String, landingPath: String, firstSeenAt: Date }, { _id: false }),
+    },
     userId: { type: Schema.Types.ObjectId, ref: 'User', default: null },
     // NO default here — a sparse unique index skips MISSING fields but still
     // indexes explicit nulls, so `default: null` made every pending state row
diff --git a/backend/models/User.ts b/backend/models/User.ts
index 3ed0e0c778..1f3d2b8c64 100644
--- a/backend/models/User.ts
+++ b/backend/models/User.ts
@@ -220,6 +220,15 @@ export interface IUser extends Document {
     signupRef?: string;
   };
   createdAt: Date;
+  /** Browser-reported first touch, persisted only for a new human account. */
+  signupSource?: {
+    ref?: string;
+    referrer?: string;
+    landingPath?: string;
+    firstSeenAt?: Date;
+    authMethod: 'password' | 'google' | 'github';
+    recordedAt: Date;
+  };
   // Instance methods
   comparePassword(password: string): Promise<boolean>;
   generateApiToken(): string;
@@ -230,6 +239,20 @@ export interface IUser extends Document {
 export interface IUserModel extends Model<IUser> {}
 
 const userSchema = new Schema<IUser>({
+  // Growth opts in with .select('+signupSource'); incidental profile/populate
+  // reads must not disclose referral paths. Every field is write-once too.
+  signupSource: {
+    type: new Schema({
+      ref: { type: String, immutable: true },
+      referrer: { type: String, immutable: true },
+      landingPath: { type: String, immutable: true },
+      firstSeenAt: { type: Date, immutable: true },
+      authMethod: { type: String, enum: ['password', 'google', 'github'], required: true, immutable: true },
+      recordedAt: { type: Date, required: true, immutable: true },
+    }, { _id: false }),
+    immutable: true,
+    select: false,
+  },
   username: { type: String, required: true, unique: true },
   previousUsernames: { type: [String], default: [] },
   displayName: { type: String, trim: true },
diff --git a/backend/routes/auth.ts b/backend/routes/auth.ts
index e82abe6a26..b737c0e713 100644
--- a/backend/routes/auth.ts
+++ b/backend/routes/auth.ts
@@ -230,7 +230,8 @@ router.get('/oauth/:provider/start', oauthLimiter, startOAuth);
 // The same start as a form POST, so an invite code rides in the body, not the URL
 // (the register page uses it whenever it holds a code; TASK-404).
 // This parser runs after the global $-key guard, so the guard runs again on its body.
-router.post('/oauth/:provider/start', oauthLimiter, express.urlencoded({ extended: false, limit: '4kb' }), refuseDollarKeys, startOAuth);
+// Two bounded 2 KiB paths in signupSource expand under form URL-encoding.
+router.post('/oauth/:provider/start', oauthLimiter, express.urlencoded({ extended: false, limit: '16kb' }), refuseDollarKeys, startOAuth);
 router.get('/oauth/:provider/callback', oauthLimiter, oauthCallback);
 router.post('/oauth/exchange', oauthLimiter, exchangeOAuthCode);
 router.get('/registration-policy', registrationPolicyLimit, getRegistrationPolicy);
diff --git a/backend/utils/signupSource.ts b/backend/utils/signupSource.ts
new file mode 100644
index 0000000000..d478cd8a1e
--- /dev/null
+++ b/backend/utils/signupSource.ts
@@ -0,0 +1,67 @@
+const { cleanSignupRef } = require('./signupRef');
+
+export interface SignupTouch {
+  ref?: string;
+  referrer?: string;
+  landingPath?: string;
+  firstSeenAt?: Date;
+}
+
+// Keep this rule aligned with frontend/public/signup-source.js. The backend is
+// the trust boundary, including for a browser with an older stored touch.
+function hasCapabilityPath(pathname: string): boolean {
+  let decoded = pathname;
+  for (let i = 0; i < 3 && decoded.includes('%'); i += 1) decoded = decodeURIComponent(decoded);
+  // Fail closed on malformed or deeper escaping; decodeURIComponent throws on
+  // malformed escapes and the caller drops the optional path.
+  if (decoded.includes('%')) return true;
+  const segments = decoded.split('/');
+  return segments.some((segment, i) => (
+    (segment.toLowerCase() === 'invite' && i < segments.length - 1)
+    || /^[a-f0-9]{24,}$/i.test(segment)
+    || /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(segment)
+    || (segment.length >= 32 && /^[a-z0-9_.~+=-]+$/i.test(segment) && /[A-Z0-9_.~+=]/.test(segment))
+  ));
+}
+
+// Attribution is browser-reported, not authorization. Drop unknown fields and
+// URL queries/fragments before either the temporary OAuth state or User sees it.
+export function cleanSignupTouch(raw: unknown, legacyRef?: unknown): SignupTouch {
+  let input: Record<string, unknown> = {};
+  try {
+    const value = typeof raw === 'string' && raw.length <= 4096 ? JSON.parse(raw) : raw;
+    if (value && typeof value === 'object' && !Array.isArray(value)) input = value;
+  } catch { /* malformed optional attribution does not prevent signup */ }
+  const result: SignupTouch = {};
+  const ref = cleanSignupRef(input.ref) || (!input.landingPath ? cleanSignupRef(legacyRef) : undefined);
+  if (ref) result.ref = ref;
+  if (typeof input.referrer === 'string' && input.referrer.length <= 2048) {
+    try {
+      const url = new URL(input.referrer);
+      if (['https:', 'http:'].includes(url.protocol) && url.origin.length <= 256) result.referrer = url.origin;
+    } catch { /* no valid referrer */ }
+  }
+  if (typeof input.landingPath === 'string' && input.landingPath.length <= 2048) {
+    try {
+      const url = new URL(input.landingPath, 'https://landing.invalid');
+      if (input.landingPath.startsWith('/') && url.origin === 'https://landing.invalid'
+        && !url.pathname.startsWith('//') && !hasCapabilityPath(url.pathname)) result.landingPath = url.pathname;
+    } catch { /* no valid path */ }
+  }
+  const seen = input.firstSeenAt instanceof Date ? input.firstSeenAt
+    : typeof input.firstSeenAt === 'string' && input.firstSeenAt.length <= 32
+      ? new Date(input.firstSeenAt) : undefined;
+  if (seen && Number.isFinite(seen.getTime()) && seen.getTime() <= Date.now()) {
+    result.firstSeenAt = seen;
+  }
+  return result;
+}
+
+/** Called only in new-account constructors, never in login/link/update paths. */
+export function signupSourceFields(raw: unknown, authMethod: 'password' | 'google' | 'github', legacyRef?: unknown) {
+  const touch = cleanSignupTouch(raw, legacyRef);
+  return {
+    signupSource: { ...touch, authMethod, recordedAt: new Date() },
+    ...(touch.ref ? { onboarding: { signupRef: touch.ref } } : {}),
+  };
+}
diff --git a/docs/design/evidence/signup-source-2026-10-25/browser.jsonl b/docs/design/evidence/signup-source-2026-10-25/browser.jsonl
new file mode 100644
index 0000000000..fe72f03c7a
--- /dev/null
+++ b/docs/design/evidence/signup-source-2026-10-25/browser.jsonl
@@ -0,0 +1,2 @@
+{"width":390,"overflow":false,"buttons":[{"width":322,"height":40},{"width":322,"height":40}],"method":"POST","query":"","source":{"landingPath":"/guides/start","firstSeenAt":"2026-10-25T15:25:30.086Z","ref":"hn"}}
+{"width":1440,"overflow":false,"buttons":[{"width":322,"height":40},{"width":322,"height":40}],"method":"POST","query":"","source":{"landingPath":"/guides/start","firstSeenAt":"2026-10-25T15:25:31.671Z","ref":"hn"}}
diff --git a/docs/design/evidence/signup-source-2026-10-25/invite-browser.jsonl b/docs/design/evidence/signup-source-2026-10-25/invite-browser.jsonl
new file mode 100644
index 0000000000..f1d6401f27
--- /dev/null
+++ b/docs/design/evidence/signup-source-2026-10-25/invite-browser.jsonl
@@ -0,0 +1,2 @@
+{"width":390,"overflow":false,"buttons":[{"width":322,"height":40},{"width":322,"height":40}],"method":"POST","query":"","source":{"firstSeenAt":"2026-10-25T16:58:35.087Z","ref":"hn","referrer":"http://127.0.0.1:14525"}}
+{"width":1440,"overflow":false,"buttons":[{"width":322,"height":40},{"width":322,"height":40}],"method":"POST","query":"","source":{"firstSeenAt":"2026-10-25T16:58:36.159Z","ref":"hn","referrer":"http://127.0.0.1:14525"}}
diff --git a/docs/design/evidence/signup-source-2026-10-25/register-1440.png b/docs/design/evidence/signup-source-2026-10-25/register-1440.png
new file mode 100644
index 0000000000..f7e987e606
Binary files /dev/null and b/docs/design/evidence/signup-source-2026-10-25/register-1440.png differ
diff --git a/docs/design/evidence/signup-source-2026-10-25/register-390.png b/docs/design/evidence/signup-source-2026-10-25/register-390.png
new file mode 100644
index 0000000000..bc0d2db910
Binary files /dev/null and b/docs/design/evidence/signup-source-2026-10-25/register-390.png differ
diff --git a/docs/development/signup-source.md b/docs/development/signup-source.md
new file mode 100644
index 0000000000..a9903e602b
--- /dev/null
+++ b/docs/development/signup-source.md
@@ -0,0 +1,48 @@
+# Signup source
+
+New human accounts retain an optional first browser touch in `User.signupSource`.
+The auth method (`password`, `github`, `google`) and `recordedAt` are supplied by
+the server at creation. `ref`, `referrer`, `landingPath` and `firstSeenAt` are
+browser-reported attribution, not verified identity or authorization facts.
+`firstSeenAt` is optional when storage was blocked or the browser clock was invalid.
+
+`frontend/public/signup-source.js` runs from the real `frontend/index.html`
+before React or redirects. Static public pages keep the script when the SEO
+generator removes the React bundle. The first stored touch wins even when it
+has no ref. Previously saved `commonly.firstTouchRef` codes remain usable for
+older browsers. The old `onboarding.signupRef` is retained for Growth's readers.
+
+Only a short ref code, an HTTP(S) referrer **origin**, an optional app-relative
+landing path, and a timestamp are retained. Referrer paths are always discarded,
+along with URL queries, fragments and userinfo; the stored origin is at most
+256 characters. Landing inputs are bounded at 2048 characters. Both the browser
+and server drop the entire landing path if a decoded segment is `invite` with
+a following segment, a hex token of at least 24 characters, a UUID, or a token-like
+segment of at least 32 characters containing uppercase letters, digits or token
+punctuation. Matching decodes up to three layers; malformed or deeper escaping
+also drops the path. Thus `/v2/invite/<bearer>` is absent from attribution, while
+normal guide paths remain. This is a conservative filter for known routes and
+token shapes, not a promise to identify every possible secret in arbitrary text.
+New token-bearing routes must extend this rule or use a static route template.
+
+The whole browser payload is bounded at 4096. The server independently sanitizes
+the input before temporary OAuth storage and again before creating the account,
+including input from an older browser that still has an unsanitized saved touch.
+
+Password registration sends the source in its JSON body. OAuth buttons with
+attribution use a form POST to `/api/auth/oauth/:provider/start`; the source
+stays in the expiring, one-use `OAuthLoginState` row. Only the random state token
+goes to the provider. Callbacks and completion URLs never carry the source.
+The historical GET start still works for old clients; it accepts no new source
+object. An existing-account login or provider link never sets or overwrites it.
+
+The User schema makes the source and its fields immutable and excludes it from
+ordinary queries. Growth's authorized server-side reads opt in with
+`.select('+signupSource')`; no public profile field or new read endpoint is added.
+Existing accounts remain without this field. No historical source is invented.
+
+Verification covers all three auth methods against persisted Mongo rows,
+real HTTP form parsing and login/replay paths, immutable dotted updates,
+query/fragment/userinfo removal, decoded invite/token paths in both attribution
+fields, referrer-origin reduction, static public pages, blocked browser storage,
+and the OAuth form request in isolated Chromium at 390 and 1440.
diff --git a/frontend/index.html b/frontend/index.html
index 1e598bb56d..4a288d1192 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -3,6 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <script src="/signup-source.js"></script>
     <meta name="theme-color" content="#1d3fd1" />
     <!-- Every page load 404ed on /favicon.ico until 2026-08-05 — no icon link
          existed at all. SVG serves Chrome/Firefox/Edge; Safari ignores SVG
diff --git a/frontend/nginx.conf b/frontend/nginx.conf
index c1b1e3ac4c..fe4b29e63e 100644
--- a/frontend/nginx.conf
+++ b/frontend/nginx.conf
@@ -65,6 +65,15 @@ server {
         expires -1;
     }
 
+    # This public-page script has no content hash. Revalidate it so changes to
+    # capture/privacy rules reach returning browsers on the next page load.
+    location = /signup-source.js {
+        add_header Cache-Control "no-cache, must-revalidate" always;
+        add_header Content-Security-Policy "img-src 'self' $upload_image_origins data: blob:" always;
+        expires -1;
+        try_files $uri =404;
+    }
+
     # Hashed static assets are content-addressed and immutable — a given URL's
     # bytes never change, so cache hard and skip revalidation. A new build emits
     # new filenames, which index.html (above) points at.
diff --git a/frontend/package.json b/frontend/package.json
index 4e8ddb2deb..dd59d572b4 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -36,7 +36,7 @@
     "start": "vite",
     "build": "vite build && node scripts/generate-seo-pages.mjs",
     "preview": "vite preview",
-    "test": "jest --watchAll=false --forceExit && node --test scripts/generate-seo-pages.test.mjs scripts/nginx-routing.test.mjs",
+    "test": "jest --watchAll=false --forceExit && node --test scripts/generate-seo-pages.test.mjs scripts/nginx-routing.test.mjs scripts/signup-source.test.mjs",
     "test:coverage": "jest --coverage --watchAll=false --forceExit",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src --ext .js,.jsx,.ts,.tsx",
diff --git a/frontend/public/signup-source.js b/frontend/public/signup-source.js
new file mode 100644
index 0000000000..d24f8fab9b
--- /dev/null
+++ b/frontend/public/signup-source.js
@@ -0,0 +1,44 @@
+// Runs on static public pages as well as the app, before any redirect. This is
+// attribution only: no query, fragment, URL credentials or request is retained.
+(function () {
+  var key = 'commonly.signupSource.v1';
+  // Keep aligned with backend/utils/signupSource.ts; the server repeats this
+  // check for old or forged clients. Drop known invite routes and token shapes.
+  function hasCapabilityPath(pathname) {
+    var decoded = pathname;
+    for (var i = 0; i < 3 && decoded.includes('%'); i += 1) decoded = decodeURIComponent(decoded);
+    if (decoded.includes('%')) return true;
+    var segments = decoded.split('/');
+    return segments.some(function (segment, index) {
+      return (segment.toLowerCase() === 'invite' && index < segments.length - 1)
+        || /^[a-f0-9]{24,}$/i.test(segment)
+        || /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/i.test(segment)
+        || (segment.length >= 32 && /^[a-z0-9_.~+=-]+$/i.test(segment) && /[A-Z0-9_.~+=]/.test(segment));
+    });
+  }
+  try {
+    if (window.localStorage.getItem(key)) return;
+    var source = { firstSeenAt: new Date().toISOString() };
+    try {
+      if (window.location.pathname.length <= 2048 && !hasCapabilityPath(window.location.pathname)) {
+        source.landingPath = window.location.pathname;
+      }
+    } catch (_) { /* malformed encoded path is not attribution */ }
+    var ref = new URLSearchParams(window.location.search).get('ref');
+    ref = typeof ref === 'string' ? ref.trim().toLowerCase() : '';
+    if (/^[a-z0-9_-]{1,32}$/.test(ref) && !['__proto__', 'constructor', 'prototype'].includes(ref)) source.ref = ref;
+    // Preserve the established ref for browsers that arrived before this field.
+    if (!source.ref) {
+      try {
+        var old = JSON.parse(window.localStorage.getItem('commonly.firstTouchRef') || 'null');
+        var oldRef = old && typeof old.ref === 'string' ? old.ref.trim().toLowerCase() : '';
+        if (/^[a-z0-9_-]{1,32}$/.test(oldRef) && !['__proto__', 'constructor', 'prototype'].includes(oldRef)) source.ref = oldRef;
+      } catch (_) { /* optional legacy value */ }
+    }
+    if (document.referrer && document.referrer.length <= 2048) {
+      var url = new URL(document.referrer);
+      if ((url.protocol === 'https:' || url.protocol === 'http:') && url.origin.length <= 256) source.referrer = url.origin;
+    }
+    window.localStorage.setItem(key, JSON.stringify(source));
+  } catch (_) { /* blocked storage must never prevent navigation or signup */ }
+}());
diff --git a/frontend/scripts/nginx-routing.test.mjs b/frontend/scripts/nginx-routing.test.mjs
index 797a7d4949..48ece9c772 100644
--- a/frontend/scripts/nginx-routing.test.mjs
+++ b/frontend/scripts/nginx-routing.test.mjs
@@ -38,12 +38,12 @@ test('HTML and inherited NGINX locations enforce the same image source policy',
     'default "https://api.$host http://api.$host";',
   ]);
   const policy = /add_header Content-Security-Policy "img-src 'self' \$upload_image_origins data: blob:" always;/g;
-  // Server scope, index.html (which adds Cache-Control), and asset location
-  // (which also adds Cache-Control) each need their own copy.
-  assert.equal([...config.matchAll(policy)].length, 3);
+  // Server, index.html, signup-source.js and the hashed asset location need
+  // their own copy where Cache-Control overrides inherited headers.
+  assert.equal([...config.matchAll(policy)].length, 4);
   assert.doesNotMatch(config, /img-src[^"\n]*\*/);
   const imagePolicies = [...config.matchAll(/Content-Security-Policy "img-src ([^"\n]+)"/g)];
-  assert.equal(imagePolicies.length, 3);
+  assert.equal(imagePolicies.length, 4);
   for (const [, sources] of imagePolicies) {
     assert.deepEqual(sources.split(/\s+/), ["'self'", '$upload_image_origins', 'data:', 'blob:']);
   }
@@ -51,3 +51,12 @@ test('HTML and inherited NGINX locations enforce the same image source policy',
   assert.doesNotMatch(chatRoom, /logo:\s*['"]https?:\/\//);
   assert.doesNotMatch(chatRoom, /src\s*=\s*['"]https?:\/\//);
 });
+
+test('unhashed signup capture script revalidates instead of inheriting six-month immutable caching', async () => {
+  const config = await readFile(resolve(frontendDir, 'nginx.conf'), 'utf8');
+  const block = config.match(/location = \/signup-source\.js \{([^}]+)\}/)?.[1];
+  assert.ok(block);
+  assert.match(block, /Cache-Control "no-cache, must-revalidate"/);
+  assert.match(block, /expires -1;/);
+  assert.match(block, /try_files \$uri =404;/);
+});
diff --git a/frontend/scripts/signup-source.test.mjs b/frontend/scripts/signup-source.test.mjs
new file mode 100644
index 0000000000..bc19e4862d
--- /dev/null
+++ b/frontend/scripts/signup-source.test.mjs
@@ -0,0 +1,80 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import vm from 'node:vm';
+import { renderStaticPage, buildPageDefinitions } from './generate-seo-pages.mjs';
+
+const script = await readFile(new URL('../public/signup-source.js', import.meta.url), 'utf8');
+const key = 'commonly.signupSource.v1';
+
+function visit(storage, url, referrer = '') {
+  const location = new URL(url);
+  vm.runInNewContext(script, {
+    window: { location, localStorage: {
+      getItem: (k) => storage.get(k) || null, setItem: (k, v) => storage.set(k, v),
+    } }, document: { referrer }, URL, URLSearchParams, Date,
+  });
+  return JSON.parse(storage.get(key));
+}
+
+test('captures first public-page touch without query, fragment, or credentials', () => {
+  const storage = new Map();
+  const first = visit(storage, 'https://commonly.me/guides/a?ref=X&email=secret#invite=secret',
+    'https://name:password@search.example/result?q=secret#secret');
+  assert.equal(first.landingPath, '/guides/a');
+  assert.equal(first.referrer, 'https://search.example');
+  assert.equal(first.ref, 'x');
+  assert.ok(Number.isFinite(Date.parse(first.firstSeenAt)));
+  assert.deepEqual(visit(storage, 'https://commonly.me/v2/register?ref=later'), first);
+  assert.equal(JSON.stringify(first).includes('secret'), false);
+});
+
+test('never captures invite capabilities in landing or referrer paths', () => {
+  for (const path of ['/v2/invite/SECRETinviteTOKEN123', '/v2/INVITE/short',
+    '/v2/%69nvite/short', '/v2/%2569nvite%252Fshort',
+    '/share/0123456789abcdef0123456789abcdef', '/share/550e8400-e29b-41d4-a716-446655440000',
+    '/share/AbCdEfGhIjKlMnOpQrStUvWxYz012345', '/v2/%25252569nvite/short', '/bad/%zz']) {
+    const first = visit(new Map(), `https://commonly.me${path}`, `https://news.example${path}`);
+    assert.equal(first.landingPath, undefined, path);
+    assert.equal(first.referrer, 'https://news.example', path);
+    assert.ok(first.firstSeenAt);
+  }
+  const normal = visit(new Map(), 'https://commonly.me/guides/multi-agent-collaboration-platform',
+    `https://news.example/${'a'.repeat(1500)}`);
+  assert.equal(normal.landingPath, '/guides/multi-agent-collaboration-platform');
+  assert.equal(normal.referrer, 'https://news.example');
+});
+
+test('a direct first visit stays direct; old browsers retain their existing clean ref', () => {
+  const storage = new Map();
+  assert.equal(visit(storage, 'https://commonly.me/').ref, undefined);
+  assert.equal(visit(storage, 'https://commonly.me/v2?ref=later').ref, undefined);
+  const old = new Map([['commonly.firstTouchRef', JSON.stringify({ ref: 'HN' })]]);
+  assert.equal(visit(old, 'https://commonly.me/').ref, 'hn');
+});
+
+test('blocked storage cannot block a public page', () => {
+  assert.doesNotThrow(() => vm.runInNewContext(script, {
+    window: { localStorage: { getItem() { throw Error('blocked'); } } },
+  }));
+});
+
+test('static SEO pages preserve the capture script after removing the React entry', async () => {
+  const root = new URL('../', import.meta.url);
+  const [index, en, useCases, guides] = await Promise.all([
+    readFile(new URL('index.html', root), 'utf8'),
+    readFile(new URL('src/i18n/locales/en.json', root), 'utf8'),
+    readFile(new URL('src/content/use-cases.json', root), 'utf8'),
+    readFile(new URL('src/content/guides.json', root), 'utf8'),
+  ]);
+  const translations = JSON.parse(en);
+  const pages = buildPageDefinitions({ landing: translations.landing, compare: translations.compare,
+    useCases: JSON.parse(useCases), guides: JSON.parse(guides) });
+  // Use the same built-template entry shape as the generator's existing tests.
+  const template = index.replace('<script type="module" src="/src/index.tsx"></script>',
+    '<script type="module" crossorigin src="/assets/index-example.js"></script>');
+  for (const page of pages) {
+    const html = renderStaticPage(template, page);
+    assert.ok(html.includes('<script src="/signup-source.js"></script>'), page.path);
+  }
+});
diff --git a/frontend/src/v2/__tests__/V2OAuth.test.tsx b/frontend/src/v2/__tests__/V2OAuth.test.tsx
index 50568b36f3..e5b12a9035 100644
--- a/frontend/src/v2/__tests__/V2OAuth.test.tsx
+++ b/frontend/src/v2/__tests__/V2OAuth.test.tsx
@@ -99,8 +99,11 @@ describe('V2OAuthButtons', () => {
     submit.mockRestore();
   });
 
-  test('carries the first-touch ref into the provider start', async () => {
+  test('posts first-touch attribution into the provider start, never in its URL', async () => {
     localStorage.setItem('commonly.firstTouchRef', JSON.stringify({ ref: 'x' }));
+    localStorage.setItem('commonly.signupSource.v1', JSON.stringify({
+      ref: 'x', referrer: 'https://news.example/article', landingPath: '/guides/start', firstSeenAt: '2026-01-01T00:00:00.000Z',
+    }));
     axios.get.mockResolvedValueOnce({ data: { providers: [{ id: 'google', label: 'Google' }] } });
 
     render(
@@ -109,8 +112,20 @@ describe('V2OAuthButtons', () => {
       </MemoryRouter>,
     );
 
-    const google = await screen.findByRole('link', { name: /continue with google/i });
-    expect(new URL(google.getAttribute('href') as string, 'https://api.test').searchParams.get('ref')).toBe('x');
+    const submit = jest.spyOn(HTMLFormElement.prototype, 'submit').mockImplementation(() => {});
+    const google = await screen.findByRole('button', { name: /continue with google/i });
+    fireEvent.click(google);
+    const form = document.body.querySelector('form[action*="/api/auth/oauth/google/start"]');
+    expect(form.method).toBe('post');
+    expect(new URL(form.action).search).toBe('');
+    const fields = Object.fromEntries(Array.from(form.elements).filter((el) => el.name).map((el) => [el.name, el.value]));
+    expect(fields.ref).toBe('x');
+    expect(JSON.parse(fields.signupSource)).toEqual({
+      ref: 'x', referrer: 'https://news.example/article', landingPath: '/guides/start', firstSeenAt: '2026-01-01T00:00:00.000Z',
+    });
+    expect(sessionStorage.getItem('commonly.pendingInviteOAuth')).toBeNull();
+    form.remove();
+    submit.mockRestore();
   });
 
   test('renders nothing when no provider is configured', async () => {
diff --git a/frontend/src/v2/__tests__/V2Register.test.tsx b/frontend/src/v2/__tests__/V2Register.test.tsx
index 81572f27b7..6c303f46d1 100644
--- a/frontend/src/v2/__tests__/V2Register.test.tsx
+++ b/frontend/src/v2/__tests__/V2Register.test.tsx
@@ -131,13 +131,14 @@ describe('V2Register', () => {
 
   it('sends the first-touch ref with the signup', async () => {
     localStorage.setItem('commonly.firstTouchRef', JSON.stringify({ ref: 'x' }));
+    localStorage.setItem('commonly.signupSource.v1', JSON.stringify({ landingPath: '/guides/start', ref: 'x' }));
     renderRegister();
 
     await createAccount();
 
     await waitFor(() => expect(axios.post).toHaveBeenCalledWith(
       '/api/auth/register',
-      expect.objectContaining({ signupRef: 'x' }),
+      expect.objectContaining({ signupRef: 'x', signupSource: expect.objectContaining({ landingPath: '/guides/start', ref: 'x' }) }),
     ));
     localStorage.clear();
   });
diff --git a/frontend/src/v2/components/V2OAuthButtons.tsx b/frontend/src/v2/components/V2OAuthButtons.tsx
index c84a4e8a26..85e130e836 100644
--- a/frontend/src/v2/components/V2OAuthButtons.tsx
+++ b/frontend/src/v2/components/V2OAuthButtons.tsx
@@ -2,7 +2,7 @@ import React, { useEffect, useState } from 'react';
 import axios from '../../utils/axiosConfig';
 import getApiBaseUrl from '../../utils/apiBaseUrl';
 import { useTranslation } from 'react-i18next';
-import { readFirstTouchRef } from '../utils/firstTouch';
+import { readFirstTouchRef, readFirstTouchSource } from '../utils/firstTouch';
 import { rememberInviteOAuthStart } from '../utils/pendingInvite';
 
 // Social sign-in buttons shared by V2Login and V2Register. Renders nothing
@@ -53,8 +53,8 @@ const readProviderCache = (): OAuthProvider[] => {
   } catch { return []; }
 };
 
-const submitInviteOAuth = (action: string, params: URLSearchParams): void => {
-  rememberInviteOAuthStart();
+const submitOAuth = (action: string, params: URLSearchParams, hasInvite: boolean): void => {
+  if (hasInvite) rememberInviteOAuthStart();
   const form = document.createElement('form');
   form.method = 'post';
   form.action = action;
@@ -103,13 +103,15 @@ const V2OAuthButtons: React.FC<V2OAuthButtonsProps> = ({ invite, next }) => {
   if (!providers.length) return null;
 
   const startPath = (id: string) => `${getApiBaseUrl()}/api/auth/oauth/${id}/start`;
+  const source = readFirstTouchSource();
+  const ref = readFirstTouchRef();
   const startParams = () => {
     const params = new URLSearchParams();
     if (next) params.set('next', next);
     // A new account made through the provider keeps the first-touch ref too;
     // signing in to an existing account ignores it (oauthController).
-    const ref = readFirstTouchRef();
     if (ref) params.set('ref', ref);
+    if (source) params.set('signupSource', JSON.stringify(source));
     return params;
   };
   const startUrl = (id: string) => {
@@ -118,7 +120,7 @@ const V2OAuthButtons: React.FC<V2OAuthButtonsProps> = ({ invite, next }) => {
   };
   const inviteParams = () => {
     const params = startParams();
-    params.set('invite', invite || '');
+    if (invite) params.set('invite', invite);
     return params;
   };
 
@@ -127,12 +129,12 @@ const V2OAuthButtons: React.FC<V2OAuthButtonsProps> = ({ invite, next }) => {
       <div className="v2-login__or"><span>{t('auth.oauth.or')}</span></div>
       <div className="v2-login__oauth">
         {providers.map((p) => (
-          invite ? (
+          invite || source || ref ? (
             <button
               key={p.id}
               type="button"
               className="v2-login__oauth-btn"
-              onClick={() => submitInviteOAuth(startPath(p.id), inviteParams())}
+              onClick={() => submitOAuth(startPath(p.id), inviteParams(), Boolean(invite))}
             >
               {PROVIDER_ICONS[p.id]}
               {t('auth.oauth.continueWith', { provider: p.label })}
diff --git a/frontend/src/v2/components/V2Register.tsx b/frontend/src/v2/components/V2Register.tsx
index fd9d8a95ad..ba14429a24 100644
--- a/frontend/src/v2/components/V2Register.tsx
+++ b/frontend/src/v2/components/V2Register.tsx
@@ -8,7 +8,7 @@ import V2AuthBrand from './V2AuthBrand';
 import { Trans, useTranslation } from 'react-i18next';
 import { useAuth } from '../../context/AuthContext';
 import { safeNextPath } from '../utils/safeNextPath';
-import { readFirstTouchRef } from '../utils/firstTouch';
+import { readFirstTouchRef, readFirstTouchSource } from '../utils/firstTouch';
 import {
   readInviteFromUrl, searchWithoutInvite, rememberInvite, recallInvite, forgetInvite,
   forgetInviteOAuthStart,
@@ -94,6 +94,7 @@ const V2Register: React.FC = () => {
         invitationCode: invitationCode.trim(),
         // Where this signup came from (?ref=x on the first visit), stored once.
         signupRef: readFirstTouchRef(),
+        signupSource: readFirstTouchSource(),
       });
       const data = res.data as { message?: string };
       const message = data?.message || t('auth.register.success.ready');
diff --git a/frontend/src/v2/utils/firstTouch.ts b/frontend/src/v2/utils/firstTouch.ts
index 9e3a44cb94..20d3359c06 100644
--- a/frontend/src/v2/utils/firstTouch.ts
+++ b/frontend/src/v2/utils/firstTouch.ts
@@ -10,6 +10,18 @@
  * just means "no ref".
  */
 const KEY = 'commonly.firstTouchRef';
+
+/** Captured by /signup-source.js on the first public page, including static guides. */
+export const readFirstTouchSource = (): Record<string, unknown> | undefined => {
+  try {
+    const raw = window.localStorage.getItem('commonly.signupSource.v1');
+    if (!raw || raw.length > 4096) return undefined;
+    const value = JSON.parse(raw);
+    if (!value || typeof value !== 'object' || Array.isArray(value)) return undefined;
+    // The server sanitizes these untrusted values. Never forward arbitrary keys.
+    return { ref: value.ref, referrer: value.referrer, landingPath: value.landingPath, firstSeenAt: value.firstSeenAt };
+  } catch { return undefined; }
+};
 // The same rule as backend/utils/signupRef.ts (SIGNUP_REF_PATTERN,
 // RESERVED_REFS); change both together. The backend is the gate.
 const REF_PATTERN = /^[a-z0-9_-]{1,32}$/;