diff --git a/provision-agent.py b/provision-agent.py
index 35075ac..7f7e799 100644
--- a/provision-agent.py
+++ b/provision-agent.py
@@ -326,24 +326,24 @@ def cloudron_panel_login(page: Page, agent: dict, bw: BitwardenHelper) -> bool:
     # If redirected to OIDC login page, fill that too
     # (Cloudron login.html and OIDC login look similar, both use #inputUsername/#inputPassword)
 
-    # Fill Cloudron login form (same selectors as invite page)
+    # Fill Cloudron login form (Pankow/Vue needs keyboard events, not fill())
     page.wait_for_selector("#inputPassword", timeout=15000)
-    page.fill("#inputUsername", cloudron_email)
-    page.fill("#inputPassword", password)
+    page.click("#inputUsername")
+    page.keyboard.type(cloudron_email)
+    page.click("#inputPassword")
+    page.keyboard.type(password)
 
-    # Submit: Cloudron uses different button types on panel vs OIDC pages
-    page.evaluate("""() => {
-        const selectors = [
-            "button.btn-primary",
-            'button[type="submit"]',
-            'input[type="submit"]',
-            "#loginSubmitButton",
-        ];
-        for (const sel of selectors) {
-            const el = document.querySelector(sel);
-            if (el) { el.click(); return; }
-        }
-    }""")
+    # Submit: Cloudron Pankow UI uses <div role="button"> instead of <button>.
+    submitted = False
+    for text in ["Log in", "Sign in", "Submit", "Continue"]:
+        btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
+        if btn.count() > 0 and btn.first.is_visible():
+            btn.first.click()
+            submitted = True
+            break
+    if not submitted:
+        page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
+        submitted = True
     page.wait_for_timeout(5000)
 
     # Handle TOTP if prompted
@@ -351,15 +351,34 @@ def cloudron_panel_login(page: Page, agent: dict, bw: BitwardenHelper) -> bool:
     if totp_input and totp_input.is_visible():
         totp_code = bw.get_totp(cloudron_item)
         totp_input.fill(totp_code)
-        page.evaluate('''() => {
-            for (const sel of ["button.btn-primary", 'button[type="submit"]', 'input[type="submit"]']) {
-                const el = document.querySelector(sel);
-                if (el) { el.click(); return; }
-            }
-        }''')
+        for text in ["Log in", "Sign in", "Submit", "Continue"]:
+            btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
+            if btn.count() > 0 and btn.first.is_visible():
+                btn.first.click()
+                break
+        else:
+            page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
         page.wait_for_timeout(5000)
 
-    if "login" not in page.url.lower() and "openid" not in page.url.lower():
+    # After submit, check if we're past the login form.
+    # The OIDC flow stays on /openid/interaction/... but changes from
+    # login form to consent page. Check for absence of password field.
+    page.wait_for_timeout(3000)
+    has_password = page.query_selector('#inputPassword')
+    if not has_password or not has_password.is_visible():
+        log.info(f"[{name}] Cloudron panel login successful")
+        return True
+
+    # Handle consent/authorize page if present
+    for consent_text in ["Continue", "Authorize", "Allow", "Accept"]:
+        consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}")')
+        if consent_btn.count() > 0 and consent_btn.first.is_visible():
+            consent_btn.first.click()
+            page.wait_for_timeout(5000)
+            break
+
+    has_password = page.query_selector('#inputPassword')
+    if not has_password or not has_password.is_visible():
         log.info(f"[{name}] Cloudron panel login successful")
         return True
 
@@ -428,7 +447,7 @@ def sso_login(page: Page, system_url: str, agent: dict, bw: BitwardenHelper,
 
     # Handle Cloudron OIDC login page if redirected
     if "openid" in page.url or "interaction" in page.url:
-        if not page.query_selector('input[type="password"]'):
+        if not page.query_selector("#inputPassword"):
             log.info(f"[{name}] OIDC auto-consent (already authenticated)")
         else:
             log.info(f"[{name}] Handling Cloudron OIDC login")
@@ -437,26 +456,41 @@ def sso_login(page: Page, system_url: str, agent: dict, bw: BitwardenHelper,
             password = bw.get_item_password(cloudron_item)
 
             page.wait_for_selector("#inputPassword", timeout=15000)
-            page.fill("#inputUsername", cloudron_email)
-            page.fill("#inputPassword", password)
+            page.click("#inputUsername")
+            page.keyboard.type(cloudron_email)
+            page.click("#inputPassword")
+            page.keyboard.type(password)
 
-            # Submit: Cloudron OIDC uses different button patterns than the panel
-            page.evaluate('''() => {
-                const selectors = [
-                    "button.btn-primary",
-                    'button[type="submit"]',
-                    'input[type="submit"]',
-                    'button:has-text("Log in")',
-                ];
-                for (const sel of selectors) {
-                    const el = document.querySelector(sel);
-                    if (el) { el.click(); return; }
-                }
-            }''')
+            # Submit using Pankow UI pattern: div[role="button"]
+            for text in ["Log in", "Sign in", "Submit", "Continue"]:
+                btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
+                if btn.count() > 0 and btn.first.is_visible():
+                    btn.first.click()
+                    break
+            else:
+                page.evaluate("() => { const f = document.querySelector('form'); if (f) f.requestSubmit(); }")
             page.wait_for_timeout(5000)
 
-        # After OIDC login, may need consent — or may redirect back to app
+            # Handle TOTP if prompted
+            totp_input = page.query_selector("#inputTotp")
+            if totp_input and totp_input.is_visible():
+                totp_code = bw.get_totp(cloudron_item)
+                totp_input.fill(totp_code)
+                for text in ["Log in", "Sign in", "Submit", "Continue"]:
+                    btn = page.locator(f'[role="button"]:has-text("{text}"), button:has-text("{text}")')
+                    if btn.count() > 0 and btn.first.is_visible():
+                        btn.first.click()
+                        break
+                page.wait_for_timeout(5000)
+
+        # After OIDC login, may need consent
         page.wait_for_timeout(3000)
+        for consent_text in ["Continue", "Authorize", "Allow", "Accept"]:
+            consent_btn = page.locator(f'[role="button"]:has-text("{consent_text}"), button:has-text("{consent_text}")')
+            if consent_btn.count() > 0 and consent_btn.first.is_visible():
+                consent_btn.first.click()
+                page.wait_for_timeout(5000)
+                break
 
     page.wait_for_timeout(3000)
     log.info(f"[{name}] SSO result: {page.url}")
@@ -498,32 +532,63 @@ def provision_gitea(page: Page, agent: dict, bw: BitwardenHelper) -> str:
               sso_button_selector='a[href*="oauth2/cloudron"]')
 
     # Navigate to API token settings
-    page.goto(f"{url}/user/settings/applications", wait_until="networkidle")
-    page.wait_for_timeout(2000)
+    page.goto(f"{url}/user/settings/applications", wait_until="domcontentloaded")
+    page.wait_for_timeout(3000)
     _debug_dump(page, f"gitea-settings-{name}")
 
-    # Generate new token
-    name_input = page.query_selector('input[name="name"]')
-    if name_input:
-        name_input.fill(token_name)
+    # Generate new token — the input may not be visible to Playwright
+    # (behind flash message or in collapsed section). Use JS to fill.
+    page.evaluate(f"""() => {{
+        const input = document.querySelector('#name');
+        if (input) {{
+            input.value = '{token_name}';
+            input.dispatchEvent(new Event('input', {{bubbles: true}}));
+            input.dispatchEvent(new Event('change', {{bubbles: true}}));
+        }}
+    }}""")
 
-    # Select scopes if checkboxes exist
-    for scope in gitea_cfg.get("scopes", ["api", "repo", "read:org"]):
-        scope_cb = page.query_selector(f'input[value="{scope}"]')
-        if scope_cb and not scope_cb.is_checked():
-            scope_cb.check()
+    # Select scopes via JS (radio buttons may also be non-visible)
+    scope_map = {
+        "repository": "write:repository",
+        "user": "write:user",
+        "organization": "write:organization",
+        "issue": "write:issue",
+        "package": "write:package",
+        "notification": "read:notification",
+        "misc": "read:misc",
+    }
+    page.evaluate("""(scopes) => {
+        for (const [cat, val] of Object.entries(scopes)) {
+            const radio = document.querySelector('input[value="' + val + '"]');
+            if (radio) { radio.checked = true; radio.dispatchEvent(new Event('change', {bubbles: true})); }
+        }
+    }""", scope_map)
 
-    gen_btn = page.query_selector('button:has-text("Generate Token")')
-    if gen_btn:
-        gen_btn.click()
-        page.wait_for_timeout(2000)
+    # Click Generate Token via JS
+    page.evaluate("""() => {
+        const btns = document.querySelectorAll('button');
+        for (const b of btns) {
+            if (b.textContent.trim() === 'Generate Token') { b.click(); return; }
+        }
+    }""")
+    page.wait_for_timeout(3000)
 
-    # Extract the generated token
-    token_el = page.query_selector('.ui.info.message code, .ui.message code, input[readonly]')
+    # Extract the generated token.
+    # Gitea shows it in a flash-info message div as plain text (the token
+    # string itself, not wrapped in <code>).
+    token_el = page.query_selector('.ui.info.message.flash-info, .ui.info.message')
     if not token_el:
-        token_el = page.query_selector('.token-value, .access-token')
+        token_el = page.query_selector('.ui.message code, input[readonly]')
 
-    token = token_el.text_content().strip() if token_el else ""
+    token = ""
+    if token_el:
+        token = token_el.text_content().strip()
+        # The flash message may contain extra text; extract just the token
+        # (Gitea tokens are 40-char hex strings)
+        import re
+        match = re.search(r'[a-f0-9]{40}', token)
+        if match:
+            token = match.group(0)
     if not token:
         log.error(f"[{name}] Could not extract Gitea API token")
         _debug_dump(page, f"gitea-no-token-{name}")