diff --git a/client/cmd/login.go b/client/cmd/login.go
index 1d886ed0c..428864375 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -326,16 +326,16 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
-	// CLI standalone login: profilemanager no longer auto-applies MDM,
-	// so layer in the OS-native policy here. Desktop builds construct
-	// a Loader with no fetcher — the build-tagged loadPlatform reads
-	// the registry/plist directly.
-	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
-
 	// Reading a config does not provision one: this login is about to dial
 	// management with the profile's identity, so mint the keys if the profile
 	// has none yet and put them on disk — a key that stayed in memory would
 	// come back different on the next run and register a second peer.
+	//
+	// Before the MDM overlay below, on purpose: the file must keep the
+	// profile's own values. The overlay is runtime-only and re-derived on
+	// every load, so persisting it would turn an enforced management URL or
+	// pre-shared key into one the user appears to own once the policy is
+	// withdrawn.
 	if generated, err := config.EnsureIdentity(); err != nil {
 		return fmt.Errorf("ensure profile identity: %v", err)
 	} else if generated {
@@ -344,6 +344,12 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 		}
 	}
 
+	// CLI standalone login: profilemanager no longer auto-applies MDM,
+	// so layer in the OS-native policy here. Desktop builds construct
+	// a Loader with no fetcher — the build-tagged loadPlatform reads
+	// the registry/plist directly.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
+
 	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
 	// ssh config, legacy routing) from a previous unclean shutdown and
 	// enable advanced routing before dialing management.