diff --git a/client/internal/profilemanager/profilemanager.go b/client/internal/profilemanager/profilemanager.go
index e25d493d5..680fa7395 100644
--- a/client/internal/profilemanager/profilemanager.go
+++ b/client/internal/profilemanager/profilemanager.go
@@ -165,6 +165,11 @@ func (pm *ProfileManager) setActiveProfileState(id ID) error {
 }
 
 // GetLoginHint retrieves the email from the active profile to use as login_hint.
+//
+// TODO: only works when called as the logged-in user; the root-owned daemon
+// resolves the state file under /root/.config/netbird and always gets "".
+// Every caller now fills the hint itself, so dropping this and the daemon-side
+// fallbacks in client/server/server.go is the suggested fix.
 func GetLoginHint() string {
 	pm := NewProfileManager()
 	activeProf, err := pm.GetActiveProfile()
diff --git a/client/ui/authsession/service.go b/client/ui/authsession/service.go
index d94cef696..b82940585 100644
--- a/client/ui/authsession/service.go
+++ b/client/ui/authsession/service.go
@@ -9,6 +9,7 @@ import (
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -60,6 +61,9 @@ func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (Exten
 
 	// a request from the UI implies a graphical session, which the daemon cannot detect itself
 	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: true}
+	if p.Hint == "" {
+		p.Hint = profilemanager.GetLoginHint()
+	}
 	if p.Hint != "" {
 		h := p.Hint
 		req.Hint = &h