diff --git a/dashboard/src/auth.rs b/dashboard/src/auth.rs
index 4fc322b632604ce76585a6a5a07d9b368f22272d..fecc2df0fb97e991f6039153259330fe412805f0 100644
--- a/dashboard/src/auth.rs
+++ b/dashboard/src/auth.rs
@@ -705,21 +705,40 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
         )
             .into_response());
     }
-    if path == "/auth/sign-out" || path == "/auth/file/sign-out" {
+    let shale_logout = path == "/auth/shale/sign-out";
+    if path == "/auth/sign-out" || path == "/auth/file/sign-out" || shale_logout {
         if method == Method::GET && path == "/auth/file/sign-out" {
             return Ok(axum::response::Html("<!doctype html><html><meta name=viewport content='width=device-width'><title>Sign out of Files</title><body><form method=post action='/auth/file/sign-out'><button>sign out of Files</button></form></body></html>").into_response());
         }
-        if method != Method::POST {
+        if method
+            != (if shale_logout {
+                Method::GET
+            } else {
+                Method::POST
+            })
+        {
             return Err(Error::new(405, "Use the sign-out button."));
         }
-        let expected = if path.contains("/file/") {
+        let expected = if shale_logout {
+            &app.shale.origin
+        } else if path.contains("/file/") {
             &auth.file
         } else {
             &auth.origin
         };
-        if headers.get("origin").and_then(|v| v.to_str().ok())
-            != Some(expected.origin().ascii_serialization().as_str())
-        {
+        let source = if shale_logout {
+            headers
+                .get("referer")
+                .and_then(|v| v.to_str().ok())
+                .and_then(|v| url::Url::parse(v).ok())
+                .map(|v| v.origin().ascii_serialization())
+        } else {
+            headers
+                .get("origin")
+                .and_then(|v| v.to_str().ok())
+                .map(str::to_owned)
+        };
+        if source.as_deref() != Some(expected.origin().ascii_serialization().as_str()) {
             return Err(Error::new(403, "Open your account to sign out."));
         }
         if let Some(token) = cookie(&headers, COOKIE) {
@@ -728,12 +747,19 @@ pub async fn route(State(app): State<Arc<App>>, request: Request) -> Result<Resp
                 .unwrap()
                 .execute("DELETE FROM sessions WHERE hash=?", [mcp::hash(&token)])?;
         }
-        if path.contains("/file/") {
+        if path.contains("/file/") || shale_logout {
             return Ok((
                 StatusCode::SEE_OTHER,
                 [
                     ("set-cookie", set_cookie(COOKIE, "", 0)),
-                    ("location", "/".into()),
+                    (
+                        "location",
+                        if shale_logout {
+                            app.shale.origin.to_string()
+                        } else {
+                            "/".into()
+                        },
+                    ),
                 ],
             )
                 .into_response());
diff --git a/tools/dashboard-auth-test.py b/tools/dashboard-auth-test.py
index 9b31301c26a97f3dbb5e01c4373497d5ea10c902..78ebf27bb7eb181ec291a1717ecf36e666c40b9d 100644
--- a/tools/dashboard-auth-test.py
+++ b/tools/dashboard-auth-test.py
@@ -197,10 +197,22 @@ def main():
             stop(); start()
             request('/api/me', cookies=cookies)
             request('/auth/file/check', cookies=file_cookies, status=204, host=file)
+            shale_session = {}; shale_csrf = request('/auth/status', cookies=shale_session)['csrf']
+            request('/auth/password', 'POST', {**login, 'csrf': shale_csrf}, shale_session)
+            captured = shale_session.copy()
+            request('/auth/shale/sign-out', cookies=shale_session, status=403)
+            request('/auth/shale/sign-out', cookies=shale_session, status=403, extra={'Referer': 'https://evil.example/'})
+            request('/auth/shale/sign-out', cookies=shale_session, status=403, extra={'Referer': 'https://shale.paperclover.net.evil.example/'})
+            request('/auth/shale/sign-out', 'POST', {}, shale_session, 405, {'Referer': 'https://shale.paperclover.net/'})
+            request('/api/me', cookies=shale_session)
+            ended = request('/auth/shale/sign-out', cookies=shale_session, status=303, extra={'Referer': 'https://shale.paperclover.net/'})
+            assert ended['location'] == 'https://shale.paperclover.net/' and shale_session['__Host-snow-session'] == ''
+            request('/api/me', cookies=captured, status=401)
+            request('/api/me', cookies=cookies)
             request('/api/users/' + actor + '/logout', 'POST', {}, cookies, 204)
             request('/api/me', cookies=cookies, status=401)
             request('/auth/file/check', cookies=file_cookies, status=401, host=file)
-            print(json.dumps({'import': 'passed', 'password': 'passed', 'signed_legacy_passkey': 'passed', 'username_free_passkey': 'passed', 'remember_me': 'passed', 'registration': 'passed', 'csrf_and_header_forgery': 'passed', 'file_handoff_replay_and_binding': 'passed', 'invitation_one_use_and_revocation': 'passed', 'restart_and_logout': 'passed'}))
+            print(json.dumps({'import': 'passed', 'password': 'passed', 'signed_legacy_passkey': 'passed', 'username_free_passkey': 'passed', 'remember_me': 'passed', 'registration': 'passed', 'csrf_and_header_forgery': 'passed', 'file_handoff_replay_and_binding': 'passed', 'invitation_one_use_and_revocation': 'passed', 'restart_and_logout': 'passed', 'shale_logout_and_cookie_replay': 'passed'}))
         finally:
             if server and server.poll() is None: stop()
             log.close()
diff --git a/tools/router.py b/tools/router.py
index 9ae855b0c80be1e5a7b117f5b441160d7104d369..5d90516318213ac028cd30cf958f5dab75a7984a 100644
--- a/tools/router.py
+++ b/tools/router.py
@@ -196,6 +196,10 @@ def render(token):
                 lines += shale_attachment_routes(" ".join(sorted(route["upstreams"])),
                                                  "/srv/staging/" + service)
             if service == "shale":
+                lines += ["  handle /-/logout {", f"    reverse_proxy {' '.join(sorted(route['upstreams']))} {{",
+                          f"      header_down Location https://snowglobe.{os.environ['STUDIO_DOMAIN']}/auth/shale/sign-out",
+                          "      @logged_out status 200 302 303 404", "      handle_response @logged_out {",
+                          "        copy_response 303", "      }", "    }", "  }"]
                 lines += shale_attachment_routes(" ".join(sorted(route["upstreams"])))
                 lines += ["  @userscript path_regexp userscript ^/userscripts/discord-pluralkit-predict(/.*)?$",
                           "  redir @userscript /discord-pluralkit-predict{re.userscript.1}?{query} 308"]