diff --git a/js/main.js b/js/main.js
index 44f64cc..2418469 100644
--- a/js/main.js
+++ b/js/main.js
@@ -97,8 +97,16 @@ document.addEventListener('DOMContentLoaded', () => {
   // Login button — opens Telegram bot deep-link, then locks itself
   const loginBtn = document.getElementById('login-btn');
   if (loginBtn) {
-    loginBtn.addEventListener('click', () => {
-      // No modal: swap label, drop the link, make the button unclickable
+    loginBtn.addEventListener('click', (e) => {
+      e.preventDefault();
+      const url = loginBtn.href;
+      // Open the link programmatically (reliable than relying on href after DOM changes)
+      const w = window.open(url, '_blank');
+      if (!w || w.closed) {
+        // Popup blocked — fallback: navigate same window
+        window.location.href = url;
+      }
+      // Then swap label and lock
       loginBtn.innerHTML = 'Approve in Telegram';
       loginBtn.removeAttribute('href');
       loginBtn.classList.add('btn-locked');