diff --git a/client/src/pages/Login.css b/client/src/pages/Login.css
index 26ece7b..0e5bc75 100644
--- a/client/src/pages/Login.css
+++ b/client/src/pages/Login.css
@@ -20,8 +20,9 @@
 }
 
 .login-logo img {
-  width: 56px;
-  height: 56px;
+  width: 80px;
+  height: auto;
+  filter: brightness(0) invert(1);
 }
 
 .login-card h1 {
diff --git a/client/src/pages/Login.jsx b/client/src/pages/Login.jsx
index 5c1b03d..b444d35 100644
--- a/client/src/pages/Login.jsx
+++ b/client/src/pages/Login.jsx
@@ -27,7 +27,7 @@ export default function Login() {
     <div className="login-wrapper">
       <div className="login-card">
         <div className="login-logo">
-          <img src="/favicon.svg" alt="Logo" />
+          <img src="/hpl.png" alt="Logo" />
         </div>
         <h1>Playable Showcase</h1>
         <form onSubmit={handleSubmit} className="login-form">
diff --git a/server/index.js b/server/index.js
index b9aa401..71f32b0 100644
--- a/server/index.js
+++ b/server/index.js
@@ -13,7 +13,7 @@ app.use(express.json({ limit: '10mb' }));
 
 // Auth middleware for protected API routes
 function requireAuth(req, res, next) {
-  const password = process.env.SHOWCASE_PASSWORD;
+  const password = (process.env.SHOWCASE_PASSWORD || '').trim();
   if (!password) return next(); // not configured, skip
 
   const auth = req.headers['authorization'] || '';
diff --git a/server/routes/auth.js b/server/routes/auth.js
index 6672e79..09a2d94 100644
--- a/server/routes/auth.js
+++ b/server/routes/auth.js
@@ -9,7 +9,7 @@ function makeToken(password) {
 
 router.post('/login', (req, res) => {
   const { password } = req.body;
-  const expected = process.env.SHOWCASE_PASSWORD;
+  const expected = (process.env.SHOWCASE_PASSWORD || '').trim();
 
   if (!expected) {
     return res.status(500).json({ error: 'Server not configured' });