diff --git a/addons/base/models/core_company.go b/addons/base/models/core_company.go
index 8b382b0e..e81eaa40 100644
--- a/addons/base/models/core_company.go
+++ b/addons/base/models/core_company.go
@@ -24,4 +24,6 @@ type CoreCompany struct {
 	MailChatterEnabled       sdk.Boolean               `sumeru:"string=Chatter,default=true"`
 	MailActivityPanelEnabled sdk.Boolean               `sumeru:"string=Activity panel,default=true"`
 	Color                    sdk.Integer               `sumeru:"string=Color Index"`
+	LoginLogo                sdk.Text                  `sumeru:"string=Login logo"`
+	LoginTagline             sdk.String                `sumeru:"string=Login tagline"`
 }
diff --git a/addons/base/views/core_company_form_views.xml b/addons/base/views/core_company_form_views.xml
index b9842f11..756f36a5 100644
--- a/addons/base/views/core_company_form_views.xml
+++ b/addons/base/views/core_company_form_views.xml
@@ -28,6 +28,15 @@
                     </group>
                 </group>
 
+                <group string="Login branding">
+                    <group>
+                        <field name="login_logo" string="Login logo" widget="image"/>
+                    </group>
+                    <group>
+                        <field name="login_tagline" string="Login tagline" placeholder="Shown on the sign-in page…"/>
+                    </group>
+                </group>
+
                 <group string="Address">
                     <group>
                         <field name="street" string="Street"/>
diff --git a/core/engine/assets/css/sumeru-login.css b/core/engine/assets/css/sumeru-login.css
index f03fffc9..eb425c9c 100644
--- a/core/engine/assets/css/sumeru-login.css
+++ b/core/engine/assets/css/sumeru-login.css
@@ -15,8 +15,16 @@
 }
 
 .sum-login-brand {
+  --sum-login-accent: var(--sum-header);
+  position: relative;
   flex: 1 1 42%;
-  background: linear-gradient(145deg, var(--sum-header) 0%, var(--sum-header-dark) 55%, #1a2332 100%);
+  overflow: hidden;
+  background: linear-gradient(
+    155deg,
+    var(--sum-header-dark) 0%,
+    var(--sum-header) 42%,
+    color-mix(in srgb, var(--sum-login-accent) 35%, #1a2332) 100%
+  );
   color: var(--sum-surface);
   display: flex;
   align-items: center;
@@ -24,65 +32,126 @@
   padding: 3rem 2.5rem;
 }
 
+.sum-login-brand--accent-0 { --sum-login-accent: #875a7b; }
+.sum-login-brand--accent-1 { --sum-login-accent: #9c9c9c; }
+.sum-login-brand--accent-2 { --sum-login-accent: #67917a; }
+.sum-login-brand--accent-3 { --sum-login-accent: #a06666; }
+.sum-login-brand--accent-4 { --sum-login-accent: #8899aa; }
+.sum-login-brand--accent-5 { --sum-login-accent: #d4a017; }
+.sum-login-brand--accent-6 { --sum-login-accent: #6a5acd; }
+.sum-login-brand--accent-7 { --sum-login-accent: #4682b4; }
+.sum-login-brand--accent-8 { --sum-login-accent: #c0392b; }
+.sum-login-brand--accent-9 { --sum-login-accent: #e67e22; }
+.sum-login-brand--accent-10 { --sum-login-accent: #27ae60; }
+.sum-login-brand--accent-11 { --sum-login-accent: #3498db; }
+
+.sum-login-brand-bg {
+  position: absolute;
+  inset: 0;
+  pointer-events: none;
+  background-image:
+    linear-gradient(rgba(255, 255, 255, 0.04) 1px, transparent 1px),
+    linear-gradient(90deg, rgba(255, 255, 255, 0.04) 1px, transparent 1px);
+  background-size: 32px 32px;
+  mask-image: radial-gradient(ellipse 85% 70% at 30% 40%, #000 20%, transparent 75%);
+}
+
+.sum-login-brand-bg::after {
+  content: "";
+  position: absolute;
+  width: 420px;
+  height: 420px;
+  right: -120px;
+  top: -80px;
+  border-radius: 50%;
+  background: radial-gradient(circle, color-mix(in srgb, var(--sum-login-accent) 45%, transparent) 0%, transparent 70%);
+  opacity: 0.55;
+}
+
 .sum-login-brand-inner {
-  max-width: 420px;
+  position: relative;
+  z-index: 1;
+  max-width: 440px;
 }
 
-.sum-login-brand-logo {
+.sum-login-brand-lockup {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0.65rem;
   margin: 0 0 1.75rem;
-  width: 72px;
-  height: 72px;
+  border-radius: 20px;
+  background: rgba(255, 255, 255, 0.08);
+  border: 1px solid rgba(255, 255, 255, 0.14);
+  box-shadow: 0 12px 40px rgba(0, 0, 0, 0.22);
+}
+
+.sum-login-brand-logo {
+  display: block;
+  width: 96px;
+  height: 96px;
+  object-fit: contain;
+  border-radius: 14px;
 }
 
 .sum-login-brand-kicker {
   margin: 0 0 0.5rem;
   font-size: var(--sum-font-size-sm);
   font-weight: var(--sum-font-weight-semibold);
-  letter-spacing: 0.08em;
+  letter-spacing: 0.12em;
   text-transform: uppercase;
-  opacity: 0.85;
+  opacity: 0.88;
+  color: color-mix(in srgb, var(--sum-login-accent) 55%, #fff);
 }
 
 .sum-login-brand-title {
   margin: 0 0 1rem;
-  font-size: 1.75rem;
+  font-size: clamp(1.5rem, 2.5vw, 2rem);
   font-weight: var(--sum-font-weight-bold);
-  line-height: 1.2;
-  letter-spacing: -0.02em;
+  line-height: 1.15;
+  letter-spacing: -0.025em;
 }
 
 .sum-login-brand-copy {
   margin: 0 0 1.5rem;
   font-size: var(--sum-font-size-md);
   line-height: 1.55;
-  opacity: 0.92;
+  opacity: 0.9;
+  max-width: 36ch;
 }
 
-.sum-login-trust-list {
+.sum-login-trust-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
   margin: 0;
   padding: 0;
   list-style: none;
+}
+
+.sum-login-trust-chip {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  padding: 0.35rem 0.65rem;
   font-size: var(--sum-font-size-sm);
-  line-height: 1.6;
-  opacity: 0.9;
+  line-height: 1.35;
+  border-radius: 999px;
+  background: rgba(255, 255, 255, 0.1);
+  border: 1px solid rgba(255, 255, 255, 0.12);
 }
 
-.sum-login-trust-list li {
-  position: relative;
-  padding-left: 1.25rem;
-  margin-bottom: 0.35rem;
+.sum-login-trust-chip svg {
+  flex-shrink: 0;
+  opacity: 0.9;
 }
 
-.sum-login-trust-list li::before {
-  content: "";
-  position: absolute;
-  left: 0;
-  top: 0.55em;
-  width: 6px;
-  height: 6px;
-  border-radius: 50%;
-  background: var(--sum-surface);
-  opacity: 0.75;
+.sum-login-powered {
+  margin: 2rem 0 0;
+  font-size: var(--sum-font-size-sm);
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  opacity: 0.65;
 }
 
 .sum-login-panel {
@@ -229,7 +298,7 @@
     font-size: 1.35rem;
   }
 
-  .sum-login-trust-list {
+  .sum-login-trust-chips {
     display: none;
   }
 }
diff --git a/core/engine/assets/img/sumeru-logo.svg b/core/engine/assets/img/sumeru-logo.svg
new file mode 100644
index 00000000..bcf2cbe2
--- /dev/null
+++ b/core/engine/assets/img/sumeru-logo.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 96 96" role="img" aria-label="Sumeru">
+  <defs>
+    <linearGradient id="sum-mark" x1="12" y1="8" x2="84" y2="88" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#5b8def"/>
+      <stop offset="1" stop-color="#2d4a7a"/>
+    </linearGradient>
+  </defs>
+  <rect width="96" height="96" rx="22" fill="url(#sum-mark)"/>
+  <path fill="#fff" d="M28 32c0-4.4 3.6-8 8-8h24c4.4 0 8 3.6 8 8v4H28v-4zm0 12h40v4c0 4.4-3.6 8-8 8H36c-4.4 0-8-3.6-8-8v-4zm8 16h24c4.4 0 8 3.6 8 8v4H28v-4c0-4.4 3.6-8 8-8z"/>
+</svg>
diff --git a/core/engine/render/page.go b/core/engine/render/page.go
index 04713600..3becbe01 100644
--- a/core/engine/render/page.go
+++ b/core/engine/render/page.go
@@ -13,16 +13,14 @@ func RenderPage(ctx context.Context, templatesDir string, data PageData, bootstr
 	if len(data.SWCBootstrapJSON) == 0 {
 		data.SWCBootstrapJSON = BuildSWCBootstrapJSON(ctx, data, bootstrapWorkspace)
 	}
-	tmpl, err := template.ParseFiles(
-		filepath.Join(templatesDir, "base.html"),
-		filepath.Join(templatesDir, "shell_partials.html"),
-	)
+	paths := ShellLayoutTemplateFiles(templatesDir)
+	tmpl, err := template.ParseFiles(paths...)
 	if err != nil {
 		return "", err
 	}
 	var buf bytes.Buffer
 	// Must execute the layout by name: the partials file only defines {{template "sumMenuIcon"}}.
-	if err := tmpl.ExecuteTemplate(&buf, "base.html", data); err != nil {
+	if err := tmpl.ExecuteTemplate(&buf, filepath.Base(TemplateShellBase), data); err != nil {
 		return "", err
 	}
 	return buf.String(), nil
diff --git a/core/engine/render/templates_paths.go b/core/engine/render/templates_paths.go
new file mode 100644
index 00000000..f23ad96b
--- /dev/null
+++ b/core/engine/render/templates_paths.go
@@ -0,0 +1,61 @@
+package render
+
+import "path/filepath"
+
+// Relative paths under TemplatesPath (core/engine/templates).
+const (
+	TemplateShellBase = "shell/base.html"
+
+	TemplatePartialMenuIcons     = "partials/menu_icons.html"
+	TemplatePartialHomeHub       = "partials/home_hub.html"
+	TemplatePartialAppsModule    = "partials/apps_module.html"
+	TemplatePartialLoginBrand    = "partials/login_brand_aside.html"
+	TemplatePartialAuthHead      = "partials/auth_head.html"
+
+	TemplateAuthLogin = "auth/login.html"
+	TemplateAuthTOTP  = "auth/totp_login.html"
+	TemplateAuthSetup = "auth/setup.html"
+
+	TemplatePortalHome  = "portal/portal_home.html"
+	TemplatePortalShare = "portal/portal_share.html"
+
+	TemplatePagesHome           = "pages/home_dashboard.html"
+	TemplatePagesApps           = "pages/apps.html"
+	TemplatePagesAppLogs        = "pages/app_logs.html"
+	TemplatePagesSettingsHub    = "pages/settings_hub.html"
+	TemplatePagesSettingsAccount = "pages/settings_account.html"
+	TemplatePagesSettingsFieldACL = "pages/settings_field_acl.html"
+	TemplatePagesSettingsModelACL = "pages/settings_model_acl.html"
+)
+
+// TemplatePath joins templatesDir with a relative template path.
+func TemplatePath(templatesDir, rel string) string {
+	return filepath.Join(templatesDir, rel)
+}
+
+// ShellLayoutTemplateFiles returns files parsed for base.html layout rendering.
+func ShellLayoutTemplateFiles(templatesDir string) []string {
+	return []string{
+		TemplatePath(templatesDir, TemplateShellBase),
+		TemplatePath(templatesDir, TemplatePartialMenuIcons),
+	}
+}
+
+// ShellInnerTemplateFiles returns files parsed for a shell inner page (pages/*.html).
+func ShellInnerTemplateFiles(templatesDir, pageRel string) []string {
+	return []string{
+		TemplatePath(templatesDir, pageRel),
+		TemplatePath(templatesDir, TemplatePartialMenuIcons),
+		TemplatePath(templatesDir, TemplatePartialHomeHub),
+		TemplatePath(templatesDir, TemplatePartialAppsModule),
+	}
+}
+
+// AuthTemplateFiles returns files parsed for standalone auth pages (login, TOTP, setup).
+func AuthTemplateFiles(templatesDir, pageRel string) []string {
+	return []string{
+		TemplatePath(templatesDir, pageRel),
+		TemplatePath(templatesDir, TemplatePartialLoginBrand),
+		TemplatePath(templatesDir, TemplatePartialAuthHead),
+	}
+}
diff --git a/core/engine/templates/README.md b/core/engine/templates/README.md
new file mode 100644
index 00000000..c20ed134
--- /dev/null
+++ b/core/engine/templates/README.md
@@ -0,0 +1,17 @@
+# Engine HTML templates
+
+Root path: `core/engine/templates` (`templates_path` in config). Relative paths are defined in [`render/templates_paths.go`](../render/templates_paths.go).
+
+| Folder | Role | Loaded by |
+|--------|------|-----------|
+| `shell/` | Authenticated app chrome (`base.html`) | `render.RenderPage` |
+| `partials/` | Shared `{{define}}` fragments (menu icons, home hub, apps forms, login brand, auth assets) | Parsed with shell layout, shell inner pages, or auth pages |
+| `pages/` | Main column HTML injected into `base.html` | `web.renderShellPage` / `executeInnerTemplate` |
+| `auth/` | Standalone login, TOTP, setup wizards | `web.getAuthTemplate`, setup handler |
+| `portal/` | Portal home and share pages | `web.loadPortalTemplates` |
+
+## Parse sets
+
+- **Shell layout:** `shell/base.html` + `partials/menu_icons.html`
+- **Shell inner page:** `pages/<page>.html` + menu, home hub, and apps partials
+- **Auth page:** `auth/<page>.html` + `partials/login_brand_aside.html` + `partials/auth_head.html`
diff --git a/core/engine/templates/login.html b/core/engine/templates/auth/login.html
similarity index 67%
rename from core/engine/templates/login.html
rename to core/engine/templates/auth/login.html
index fb49d7be..e6a36832 100644
--- a/core/engine/templates/login.html
+++ b/core/engine/templates/auth/login.html
@@ -4,32 +4,11 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Sign in — {{.AppName}}</title>
-    {{range .Stylesheets}}
-    <link rel="stylesheet" href="{{.}}">
-    {{end}}
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+    {{template "auth_head_assets" .}}
 </head>
 <body class="sum-login-page">
 <div class="sum-login-shell">
-    <aside class="sum-login-brand" aria-hidden="false">
-        <div class="sum-login-brand-inner">
-            {{if .LogoURL}}
-            <img src="{{.LogoURL}}" alt="" class="sum-login-brand-logo"/>
-            {{else}}
-            <div class="sum-login-logo sum-login-logo--placeholder sum-login-brand-logo" aria-hidden="true">S</div>
-            {{end}}
-            <p class="sum-login-brand-kicker">{{.AppName}} ERP</p>
-            <h2 class="sum-login-brand-title">{{if .CompanyName}}{{.CompanyName}}{{else}}Secure workspace access{{end}}</h2>
-            <p class="sum-login-brand-copy">Enterprise resource planning with role-based access, audit trails, and optional single sign-on.</p>
-            <ul class="sum-login-trust-list">
-                <li>Encrypted sessions</li>
-                <li>Multi-factor authentication</li>
-                <li>Administrator-controlled identity providers</li>
-            </ul>
-        </div>
-    </aside>
+    {{template "login_brand_aside" .}}
     <main class="sum-login-panel">
         <div class="sum-login-card sum-login-card--panel">
             <h1>Sign in</h1>
diff --git a/core/engine/templates/setup.html b/core/engine/templates/auth/setup.html
similarity index 93%
rename from core/engine/templates/setup.html
rename to core/engine/templates/auth/setup.html
index 4f170f08..b8e51558 100644
--- a/core/engine/templates/setup.html
+++ b/core/engine/templates/auth/setup.html
@@ -4,23 +4,11 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Database setup — Sumeru</title>
-    {{range .Stylesheets}}
-    <link rel="stylesheet" href="{{.}}">
-    {{end}}
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+    {{template "auth_head_assets" .}}
 </head>
 <body class="sum-login-page">
 <div class="sum-login-shell">
-    <aside class="sum-login-brand" aria-hidden="false">
-        <div class="sum-login-brand-inner">
-            <div class="sum-login-logo sum-login-logo--placeholder sum-login-brand-logo" aria-hidden="true">S</div>
-            <p class="sum-login-brand-kicker">Sumeru ERP</p>
-            <h2 class="sum-login-brand-title">Database setup</h2>
-            <p class="sum-login-brand-copy">Connect your PostgreSQL database, create your company, and define the first administrator account.</p>
-        </div>
-    </aside>
+    {{template "login_brand_aside" .}}
     <main class="sum-login-panel">
 <div class="sum-login-card sum-setup-card sum-setup-card--wide sum-login-card--panel">
     <p class="sum-setup-progress" id="stepLabel" aria-live="polite">Step 1 of 4</p>
diff --git a/core/engine/templates/totp_login.html b/core/engine/templates/auth/totp_login.html
similarity index 65%
rename from core/engine/templates/totp_login.html
rename to core/engine/templates/auth/totp_login.html
index 86b23bdc..d98ce046 100644
--- a/core/engine/templates/totp_login.html
+++ b/core/engine/templates/auth/totp_login.html
@@ -4,23 +4,11 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Two-factor authentication — {{.AppName}}</title>
-    {{range .Stylesheets}}
-    <link rel="stylesheet" href="{{.}}">
-    {{end}}
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+    {{template "auth_head_assets" .}}
 </head>
 <body class="sum-login-page">
 <div class="sum-login-shell">
-    <aside class="sum-login-brand" aria-hidden="false">
-        <div class="sum-login-brand-inner">
-            <div class="sum-login-logo sum-login-logo--placeholder sum-login-brand-logo" aria-hidden="true">S</div>
-            <p class="sum-login-brand-kicker">{{.AppName}} ERP</p>
-            <h2 class="sum-login-brand-title">Verify your identity</h2>
-            <p class="sum-login-brand-copy">Enter the code from your authenticator app to finish signing in.</p>
-        </div>
-    </aside>
+    {{template "login_brand_aside" .}}
     <main class="sum-login-panel">
         <div class="sum-login-card sum-login-card--panel">
             <h1>Authentication code</h1>
diff --git a/core/engine/templates/app_logs_inner.html b/core/engine/templates/pages/app_logs.html
similarity index 100%
rename from core/engine/templates/app_logs_inner.html
rename to core/engine/templates/pages/app_logs.html
diff --git a/core/engine/templates/apps_inner.html b/core/engine/templates/pages/apps.html
similarity index 81%
rename from core/engine/templates/apps_inner.html
rename to core/engine/templates/pages/apps.html
index db24a513..5d8fdac9 100644
--- a/core/engine/templates/apps_inner.html
+++ b/core/engine/templates/pages/apps.html
@@ -371,71 +371,3 @@ <h2 id="sum-apps-sys-heading" class="sum-apps-section-label-prem">Technical modu
     </div>
     {{end}}
 </div>
-
-{{define "apps_control_bar"}}
-<form class="sum-apps-control-bar sum-control-bar-wrap" method="get" action="/web/apps" role="search">
-    <input type="hidden" name="layout" value="{{.Layout}}" />
-    {{if .Category}}<input type="hidden" name="category" value="{{.Category}}" />{{end}}
-    <div class="sum-control-bar-row">
-        <div class="sum-control-bar-search-area">
-            <div class="sum-control-bar-search-wrap">
-                <div class="sum-control-bar-search-body">
-                    <input id="sum-apps-q" class="sum-control-bar-search" type="search" name="q" value="{{.Search}}" placeholder="Search apps…" autocomplete="off" aria-label="Search apps" />
-                </div>
-                <button type="submit" class="sum-control-bar-search-submit" aria-label="Search apps">
-                    <svg class="sum-control-bar-search-icon-svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.35-4.35"/></svg>
-                </button>
-            </div>
-        </div>
-        <div class="sum-control-bar-tools">
-            <div class="sum-control-bar-segment" role="group" aria-label="Catalog options">
-                <label class="sum-apps-segment-select">
-                    <span class="sum-control-bar-segment-btn {{if ne .Filter "all"}}sum-control-bar-segment-btn--active{{end}}">
-                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3"/></svg>
-                        <span class="sum-control-bar-segment-label">Filters</span>
-                        {{if ne .Filter "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
-                    </span>
-                    <select name="filter" data-auto-submit aria-label="Filter apps by installation status" title="Filter apps">
-                        <option value="all" {{if eq .Filter "all"}}selected{{end}}>All apps</option>
-                        <option value="installed" {{if eq .Filter "installed"}}selected{{end}}>Installed</option>
-                        <option value="uninstalled" {{if eq .Filter "uninstalled"}}selected{{end}}>Not installed</option>
-                    </select>
-                </label>
-                <label class="sum-apps-segment-select">
-                    <span class="sum-control-bar-segment-btn {{if ne .Scope "all"}}sum-control-bar-segment-btn--active{{end}}">
-                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
-                        <span class="sum-control-bar-segment-label">Show</span>
-                        {{if ne .Scope "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
-                    </span>
-                    <select name="scope" data-auto-submit aria-label="Show applications or technical modules" title="Show module type">
-                        <option value="all" {{if eq .Scope "all"}}selected{{end}}>Apps &amp; technical</option>
-                        <option value="apps" {{if eq .Scope "apps"}}selected{{end}}>Apps only</option>
-                        <option value="technical" {{if eq .Scope "technical"}}selected{{end}}>Technical only</option>
-                    </select>
-                </label>
-                <label class="sum-apps-segment-select">
-                    <span class="sum-control-bar-segment-btn {{if .GroupBy}}sum-control-bar-segment-btn--active{{end}}">
-                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M23 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
-                        <span class="sum-control-bar-segment-label">Group By</span>
-                        {{if .GroupBy}}<span class="sum-control-bar-badge">1</span>{{end}}
-                    </span>
-                    <select name="group_by" data-auto-submit aria-label="Group apps in the catalog" title="Group apps">
-                        <option value="" {{if not .GroupBy}}selected{{end}}>None</option>
-                        <option value="category" {{if eq .GroupBy "category"}}selected{{end}}>Category</option>
-                    </select>
-                </label>
-            </div>
-        </div>
-    </div>
-</form>
-{{end}}
-
-{{define "apps_post_hiddens"}}
-<input type="hidden" name="apps_layout" value="{{.Layout}}" />
-<input type="hidden" name="apps_filter" value="{{.Filter}}" />
-<input type="hidden" name="apps_scope" value="{{.Scope}}" />
-<input type="hidden" name="apps_q" value="{{.Search}}" />
-<input type="hidden" name="apps_category" value="{{.Category}}" />
-<input type="hidden" name="apps_group_by" value="{{.GroupBy}}" />
-{{if .CSRFToken}}<input type="hidden" name="csrf_token" value="{{.CSRFToken}}" />{{end}}
-{{end}}
diff --git a/core/engine/templates/home_dashboard_inner.html b/core/engine/templates/pages/home_dashboard.html
similarity index 100%
rename from core/engine/templates/home_dashboard_inner.html
rename to core/engine/templates/pages/home_dashboard.html
diff --git a/core/engine/templates/settings_account_inner.html b/core/engine/templates/pages/settings_account.html
similarity index 100%
rename from core/engine/templates/settings_account_inner.html
rename to core/engine/templates/pages/settings_account.html
diff --git a/core/engine/templates/settings_field_acl_inner.html b/core/engine/templates/pages/settings_field_acl.html
similarity index 100%
rename from core/engine/templates/settings_field_acl_inner.html
rename to core/engine/templates/pages/settings_field_acl.html
diff --git a/core/engine/templates/settings_hub_inner.html b/core/engine/templates/pages/settings_hub.html
similarity index 100%
rename from core/engine/templates/settings_hub_inner.html
rename to core/engine/templates/pages/settings_hub.html
diff --git a/core/engine/templates/settings_model_acl_inner.html b/core/engine/templates/pages/settings_model_acl.html
similarity index 100%
rename from core/engine/templates/settings_model_acl_inner.html
rename to core/engine/templates/pages/settings_model_acl.html
diff --git a/core/engine/templates/partials/apps_module.html b/core/engine/templates/partials/apps_module.html
new file mode 100644
index 00000000..3e205d97
--- /dev/null
+++ b/core/engine/templates/partials/apps_module.html
@@ -0,0 +1,67 @@
+{{define "apps_control_bar"}}
+<form class="sum-apps-control-bar sum-control-bar-wrap" method="get" action="/web/apps" role="search">
+    <input type="hidden" name="layout" value="{{.Layout}}" />
+    {{if .Category}}<input type="hidden" name="category" value="{{.Category}}" />{{end}}
+    <div class="sum-control-bar-row">
+        <div class="sum-control-bar-search-area">
+            <div class="sum-control-bar-search-wrap">
+                <div class="sum-control-bar-search-body">
+                    <input id="sum-apps-q" class="sum-control-bar-search" type="search" name="q" value="{{.Search}}" placeholder="Search apps…" autocomplete="off" aria-label="Search apps" />
+                </div>
+                <button type="submit" class="sum-control-bar-search-submit" aria-label="Search apps">
+                    <svg class="sum-control-bar-search-icon-svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.35-4.35"/></svg>
+                </button>
+            </div>
+        </div>
+        <div class="sum-control-bar-tools">
+            <div class="sum-control-bar-segment" role="group" aria-label="Catalog options">
+                <label class="sum-apps-segment-select">
+                    <span class="sum-control-bar-segment-btn {{if ne .Filter "all"}}sum-control-bar-segment-btn--active{{end}}">
+                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polygon points="22 3 2 3 10 12.46 10 19 14 21 14 12.46 22 3"/></svg>
+                        <span class="sum-control-bar-segment-label">Filters</span>
+                        {{if ne .Filter "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
+                    </span>
+                    <select name="filter" data-auto-submit aria-label="Filter apps by installation status" title="Filter apps">
+                        <option value="all" {{if eq .Filter "all"}}selected{{end}}>All apps</option>
+                        <option value="installed" {{if eq .Filter "installed"}}selected{{end}}>Installed</option>
+                        <option value="uninstalled" {{if eq .Filter "uninstalled"}}selected{{end}}>Not installed</option>
+                    </select>
+                </label>
+                <label class="sum-apps-segment-select">
+                    <span class="sum-control-bar-segment-btn {{if ne .Scope "all"}}sum-control-bar-segment-btn--active{{end}}">
+                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 2L2 7l10 5 10-5-10-5z"/><path d="M2 17l10 5 10-5"/><path d="M2 12l10 5 10-5"/></svg>
+                        <span class="sum-control-bar-segment-label">Show</span>
+                        {{if ne .Scope "all"}}<span class="sum-control-bar-badge">1</span>{{end}}
+                    </span>
+                    <select name="scope" data-auto-submit aria-label="Show applications or technical modules" title="Show module type">
+                        <option value="all" {{if eq .Scope "all"}}selected{{end}}>Apps &amp; technical</option>
+                        <option value="apps" {{if eq .Scope "apps"}}selected{{end}}>Apps only</option>
+                        <option value="technical" {{if eq .Scope "technical"}}selected{{end}}>Technical only</option>
+                    </select>
+                </label>
+                <label class="sum-apps-segment-select">
+                    <span class="sum-control-bar-segment-btn {{if .GroupBy}}sum-control-bar-segment-btn--active{{end}}">
+                        <svg class="sum-control-bar-segment-icon" width="15" height="15" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M23 21v-2a4 4 0 0 0-3-3.87"/><path d="M16 3.13a4 4 0 0 1 0 7.75"/></svg>
+                        <span class="sum-control-bar-segment-label">Group By</span>
+                        {{if .GroupBy}}<span class="sum-control-bar-badge">1</span>{{end}}
+                    </span>
+                    <select name="group_by" data-auto-submit aria-label="Group apps in the catalog" title="Group apps">
+                        <option value="" {{if not .GroupBy}}selected{{end}}>None</option>
+                        <option value="category" {{if eq .GroupBy "category"}}selected{{end}}>Category</option>
+                    </select>
+                </label>
+            </div>
+        </div>
+    </div>
+</form>
+{{end}}
+
+{{define "apps_post_hiddens"}}
+<input type="hidden" name="apps_layout" value="{{.Layout}}" />
+<input type="hidden" name="apps_filter" value="{{.Filter}}" />
+<input type="hidden" name="apps_scope" value="{{.Scope}}" />
+<input type="hidden" name="apps_q" value="{{.Search}}" />
+<input type="hidden" name="apps_category" value="{{.Category}}" />
+<input type="hidden" name="apps_group_by" value="{{.GroupBy}}" />
+{{if .CSRFToken}}<input type="hidden" name="csrf_token" value="{{.CSRFToken}}" />{{end}}
+{{end}}
diff --git a/core/engine/templates/partials/auth_head.html b/core/engine/templates/partials/auth_head.html
new file mode 100644
index 00000000..9b7de421
--- /dev/null
+++ b/core/engine/templates/partials/auth_head.html
@@ -0,0 +1,8 @@
+{{define "auth_head_assets"}}
+    {{range .Stylesheets}}
+    <link rel="stylesheet" href="{{.}}">
+    {{end}}
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Roboto:ital,wght@0,400;0,500;0,700;1,400&display=swap" rel="stylesheet">
+{{end}}
diff --git a/core/engine/templates/shell_partials.html b/core/engine/templates/partials/home_hub.html
similarity index 75%
rename from core/engine/templates/shell_partials.html
rename to core/engine/templates/partials/home_hub.html
index 02b27aa5..b1f53b4d 100644
--- a/core/engine/templates/shell_partials.html
+++ b/core/engine/templates/partials/home_hub.html
@@ -1,11 +1,3 @@
-{{define "sumMenuIcon"}}
-{{- if . -}}
-<svg class="sum-menu-icon" aria-hidden="true" width="18" height="18" viewBox="0 0 24 24" focusable="false">
-  <use href="/static/img/menu-icons.svg#i-{{.}}"></use>
-</svg>
-{{- end -}}
-{{end}}
-
 {{define "sumHomePinIcon"}}
 <svg class="sum-home-pin-icon" width="16" height="16" viewBox="0 0 24 24" aria-hidden="true">
   <path class="sum-home-pin-icon-outline" d="M19 21l-7-5-7 5V5a2 2 0 0 1 2-2h10a2 2 0 0 1 2 2v16z" fill="none" stroke="currentColor" stroke-width="2" stroke-linejoin="round"/>
diff --git a/core/engine/templates/partials/login_brand_aside.html b/core/engine/templates/partials/login_brand_aside.html
new file mode 100644
index 00000000..2b0acb96
--- /dev/null
+++ b/core/engine/templates/partials/login_brand_aside.html
@@ -0,0 +1,34 @@
+{{define "login_brand_aside"}}
+<aside class="sum-login-brand{{if .Brand.AccentClass}} {{.Brand.AccentClass}}{{end}}" aria-label="Sign-in branding">
+    <div class="sum-login-brand-bg" aria-hidden="true"></div>
+    <div class="sum-login-brand-inner">
+        <div class="sum-login-brand-lockup">
+            <img src="{{.Brand.LogoURL}}" alt="{{.Brand.LogoAlt}}" class="sum-login-brand-logo" width="96" height="96"/>
+        </div>
+        {{if .Brand.Kicker}}
+        <p class="sum-login-brand-kicker">{{.Brand.Kicker}}</p>
+        {{end}}
+        <h2 class="sum-login-brand-title">{{.Brand.Headline}}</h2>
+        <p class="sum-login-brand-copy">{{.Brand.Tagline}}</p>
+        {{if .Brand.ShowTrustChips}}
+        <ul class="sum-login-trust-chips" role="list">
+            <li class="sum-login-trust-chip">
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M20 6L9 17l-5-5"/></svg>
+                Encrypted sessions
+            </li>
+            <li class="sum-login-trust-chip">
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M20 6L9 17l-5-5"/></svg>
+                Multi-factor authentication
+            </li>
+            <li class="sum-login-trust-chip">
+                <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" aria-hidden="true"><path d="M20 6L9 17l-5-5"/></svg>
+                Admin-controlled SSO
+            </li>
+        </ul>
+        {{end}}
+        {{if .Brand.ShowPoweredBy}}
+        <p class="sum-login-powered">Powered by {{$.AppName}}</p>
+        {{end}}
+    </div>
+</aside>
+{{end}}
diff --git a/core/engine/templates/partials/menu_icons.html b/core/engine/templates/partials/menu_icons.html
new file mode 100644
index 00000000..51cbd12e
--- /dev/null
+++ b/core/engine/templates/partials/menu_icons.html
@@ -0,0 +1,7 @@
+{{define "sumMenuIcon"}}
+{{- if . -}}
+<svg class="sum-menu-icon" aria-hidden="true" width="18" height="18" viewBox="0 0 24 24" focusable="false">
+  <use href="/static/img/menu-icons.svg#i-{{.}}"></use>
+</svg>
+{{- end -}}
+{{end}}
diff --git a/core/engine/templates/portal_home.html b/core/engine/templates/portal/portal_home.html
similarity index 100%
rename from core/engine/templates/portal_home.html
rename to core/engine/templates/portal/portal_home.html
diff --git a/core/engine/templates/portal_share.html b/core/engine/templates/portal/portal_share.html
similarity index 100%
rename from core/engine/templates/portal_share.html
rename to core/engine/templates/portal/portal_share.html
diff --git a/core/engine/templates/base.html b/core/engine/templates/shell/base.html
similarity index 100%
rename from core/engine/templates/base.html
rename to core/engine/templates/shell/base.html
diff --git a/core/server/web/login.go b/core/server/web/login.go
index d7d43d7d..4477bc88 100644
--- a/core/server/web/login.go
+++ b/core/server/web/login.go
@@ -8,7 +8,6 @@ import (
 	"html/template"
 	"net/http"
 	"net/url"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -33,10 +32,9 @@ type loginPageData struct {
 	Error             string
 	CSRFToken         string
 	Stylesheets       []string
-	LogoURL           string
+	Brand             loginBrand
 	AuthProviders     []loginAuthProvider
 	LocalLoginEnabled bool
-	CompanyName       string
 	AppName           string
 	InfoTitle         string
 	InfoBody          string
@@ -203,14 +201,22 @@ func parsePositiveInt(s string) int {
 	return n
 }
 
+func resetAuthTemplateCache() {
+	authTemplateMu.Lock()
+	defer authTemplateMu.Unlock()
+	authTemplateCache = map[string]*template.Template{}
+	authTemplateErrs = map[string]error{}
+}
+
 func getAuthTemplate(filename string) (*template.Template, error) {
 	authTemplateMu.Lock()
 	defer authTemplateMu.Unlock()
 	if _, loaded := authTemplateErrs[filename]; loaded {
 		return authTemplateCache[filename], authTemplateErrs[filename]
 	}
-	path := filepath.Join(config.AppConfig.TemplatesPath, filename)
-	tmpl, err := template.ParseFiles(path)
+	dir := config.AppConfig.TemplatesPath
+	paths := render.AuthTemplateFiles(dir, filename)
+	tmpl, err := template.ParseFiles(paths...)
 	authTemplateCache[filename] = tmpl
 	authTemplateErrs[filename] = err
 	return tmpl, err
@@ -223,11 +229,10 @@ func buildLoginPageData(r *http.Request, next, errorMessage, csrfToken string) l
 		Error:             errorMessage,
 		CSRFToken:         csrfToken,
 		Stylesheets:       assets.LoginStylesheetURLs(),
-		LogoURL:           render.ShellLogoURL(),
+		Brand:             resolveLoginBrand(ctx),
 		AuthProviders:     listEnabledAuthProviders(ctx),
 		LocalLoginEnabled: authLocalEnabled(ctx),
-		CompanyName:       loginPageCompanyName(ctx),
-		AppName:           "Sumeru",
+		AppName:           loginBrandPlatformName,
 		Year:              time.Now().Year(),
 	}
 	if flash, ok := FlashFromQueryMessage(r.URL.Query().Get(flashMessageParam)); ok {
@@ -244,7 +249,7 @@ func buildLoginPageData(r *http.Request, next, errorMessage, csrfToken string) l
 	return data
 }
 
-func writeAuthFormPage(w http.ResponseWriter, r *http.Request, templateFile, logRoute string, statusCode int, next, errorMessage, csrfToken string) {
+func writeAuthFormPage(w http.ResponseWriter, r *http.Request, templateFile, logRoute string, statusCode int, next, errorMessage, csrfToken string, adjust func(*loginPageData)) {
 	tmpl, err := getAuthTemplate(templateFile)
 	if err != nil {
 		if statusCode == http.StatusOK {
@@ -267,12 +272,16 @@ func writeAuthFormPage(w http.ResponseWriter, r *http.Request, templateFile, log
 	if statusCode != http.StatusOK {
 		w.WriteHeader(statusCode)
 	}
-	_ = tmpl.Execute(w, buildLoginPageData(r, next, errorMessage, csrfToken))
+	data := buildLoginPageData(r, next, errorMessage, csrfToken)
+	if adjust != nil {
+		adjust(&data)
+	}
+	_ = tmpl.Execute(w, data)
 }
 
 func showAuthFormError(w http.ResponseWriter, r *http.Request, templateFile, logRoute string, statusCode int, next, errorMessage string) {
 	csrfToken := setLoginCSRFCookie(w)
-	writeAuthFormPage(w, r, templateFile, logRoute, statusCode, next, errorMessage, csrfToken)
+	writeAuthFormPage(w, r, templateFile, logRoute, statusCode, next, errorMessage, csrfToken, nil)
 }
 
 func registerTOTPRoutes() {
@@ -286,7 +295,9 @@ func TOTPLoginGet(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	csrfToken := setLoginCSRFCookie(w)
-	writeAuthFormPage(w, r, totpLoginTemplateFile, totpLoginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken)
+	writeAuthFormPage(w, r, totpLoginTemplateFile, totpLoginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken, func(data *loginPageData) {
+		data.Brand = totpLoginBrand(data.Brand)
+	})
 }
 
 func TOTPLoginPost(w http.ResponseWriter, r *http.Request) {
@@ -421,7 +432,7 @@ func LoginGet(w http.ResponseWriter, r *http.Request) {
 	}
 
 	csrfToken := setLoginCSRFCookie(w)
-	writeAuthFormPage(w, r, loginTemplateFile, loginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken)
+	writeAuthFormPage(w, r, loginTemplateFile, loginRoute, http.StatusOK, resolveLoginNext(r), "", csrfToken, nil)
 }
 
 func LoginPost(w http.ResponseWriter, r *http.Request) {
diff --git a/core/server/web/login_brand_logo.go b/core/server/web/login_brand_logo.go
new file mode 100644
index 00000000..d72c3413
--- /dev/null
+++ b/core/server/web/login_brand_logo.go
@@ -0,0 +1,67 @@
+package web
+
+import (
+	"encoding/base64"
+	"net/http"
+	"strings"
+)
+
+const maxLoginLogoDecodedBytes = 512 << 10 // 512 KiB
+
+// LoginBrandLogoHandler serves the first company's login_logo for unauthenticated sign-in pages.
+func LoginBrandLogoHandler(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+	payload := loadLoginCompanyLogoPayload(r.Context())
+	if payload == "" {
+		http.NotFound(w, r)
+		return
+	}
+	mime, data, ok := parseLoginLogoDataURL(payload)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	if len(data) > maxLoginLogoDecodedBytes {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", mime)
+	w.Header().Set("Cache-Control", "public, max-age=300")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+	_, _ = w.Write(data)
+}
+
+func parseLoginLogoDataURL(raw string) (mime string, data []byte, ok bool) {
+	raw = strings.TrimSpace(raw)
+	if !strings.HasPrefix(raw, "data:") {
+		return "", nil, false
+	}
+	rest := strings.TrimPrefix(raw, "data:")
+	semi := strings.Index(rest, ";")
+	if semi <= 0 {
+		return "", nil, false
+	}
+	mime = strings.TrimSpace(rest[:semi])
+	if !strings.HasPrefix(mime, "image/") {
+		return "", nil, false
+	}
+	if !strings.HasPrefix(rest[semi:], ";base64,") {
+		return "", nil, false
+	}
+	b64 := strings.TrimPrefix(rest[semi:], ";base64,")
+	decoded, err := base64.StdEncoding.DecodeString(b64)
+	if err != nil {
+		return "", nil, false
+	}
+	if len(decoded) == 0 {
+		return "", nil, false
+	}
+	return mime, decoded, true
+}
+
+func registerLoginBrandRoutes() {
+	registerPublic(http.MethodGet, loginBrandLogoRoute, LoginBrandLogoHandler)
+}
diff --git a/core/server/web/login_branding.go b/core/server/web/login_branding.go
new file mode 100644
index 00000000..348760f4
--- /dev/null
+++ b/core/server/web/login_branding.go
@@ -0,0 +1,149 @@
+package web
+
+import (
+	"context"
+	"strconv"
+	"strings"
+
+	"sumeru/core/engine/render"
+	"sumeru/core/orm"
+	"sumeru/core/server/config"
+)
+
+const (
+	defaultSumeruLogoURL     = "/static/img/sumeru-logo.svg"
+	loginBrandLogoRoute      = "/web/login/logo"
+	loginBrandPlatformName   = "Sumeru"
+	defaultLoginHeadline     = "Enterprise workspace"
+	defaultLoginTagline      = "Role-based access, audit trails, and optional single sign-on for your organization."
+	defaultLoginTenantTagline = "Sign in to continue to your workspace."
+)
+
+// loginBrand is the left-panel hero on auth pages (login, TOTP, setup).
+type loginBrand struct {
+	LogoURL        string
+	LogoAlt        string
+	Kicker         string
+	Headline       string
+	Tagline        string
+	ShowTrustChips bool
+	ShowPoweredBy  bool
+	AccentClass    string
+}
+
+type loginCompanyRow struct {
+	Name         string
+	LoginLogo    string
+	LoginTagline string
+	Color        int
+}
+
+var kanbanAccentHex = []string{
+	"#875a7b", "#9c9c9c", "#67917a", "#a06666", "#8899aa", "#d4a017",
+	"#6a5acd", "#4682b4", "#c0392b", "#e67e22", "#27ae60", "#3498db",
+}
+
+func resolveLoginBrand(ctx context.Context) loginBrand {
+	row := loadLoginCompanyRow(ctx)
+	return buildLoginBrand(row)
+}
+
+func defaultSumeruLoginBrand() loginBrand {
+	return loginBrand{
+		LogoURL:        defaultSumeruLogoURL,
+		LogoAlt:        loginBrandPlatformName,
+		Kicker:         loginBrandPlatformName,
+		Headline:       defaultLoginHeadline,
+		Tagline:        defaultLoginTagline,
+		ShowTrustChips: true,
+	}
+}
+
+func buildLoginBrand(row loginCompanyRow) loginBrand {
+	out := defaultSumeruLoginBrand()
+
+	cfgName := strings.TrimSpace(config.AppConfig.CompanyDisplayName)
+	companyName := strings.TrimSpace(row.Name)
+	if companyName == "" {
+		companyName = cfgName
+	}
+
+	tagline := strings.TrimSpace(row.LoginTagline)
+	hasCompanyLogo := strings.TrimSpace(row.LoginLogo) != ""
+	shellLogo := strings.TrimSpace(render.ShellLogoURL())
+
+	switch {
+	case hasCompanyLogo:
+		out.LogoURL = loginBrandLogoRoute
+		out.LogoAlt = companyName
+		if companyName == "" {
+			out.LogoAlt = loginBrandPlatformName
+		}
+	case shellLogo != "":
+		out.LogoURL = shellLogo
+		out.LogoAlt = loginBrandPlatformName
+	}
+
+	tenantBranded := hasCompanyLogo || companyName != "" || tagline != ""
+	if tenantBranded && companyName != "" {
+		out.Kicker = "Welcome"
+		out.Headline = companyName
+		if tagline != "" {
+			out.Tagline = tagline
+		} else {
+			out.Tagline = defaultLoginTenantTagline
+		}
+		out.ShowPoweredBy = true
+	} else if cfgName != "" {
+		out.Kicker = "Welcome"
+		out.Headline = cfgName
+		out.Tagline = defaultLoginTenantTagline
+		out.ShowPoweredBy = true
+	}
+
+	if class := kanbanAccentClass(row.Color); class != "" {
+		out.AccentClass = class
+	}
+	return out
+}
+
+func loadLoginCompanyRow(ctx context.Context) loginCompanyRow {
+	ctx = orm.AuditedBypass(ctx, "login.brand")
+	rows, err := orm.SearchLimit(ctx, "core.company", nil, 1)
+	if err != nil || len(rows) == 0 {
+		return loginCompanyRow{}
+	}
+	rec := rows[0]
+	return loginCompanyRow{
+		Name:         oauthRowString(rec, "name"),
+		LoginLogo:    oauthRowString(rec, "login_logo"),
+		LoginTagline: oauthRowString(rec, "login_tagline"),
+		Color:        int(oauthRowInt(rec, "color")),
+	}
+}
+
+func loadLoginCompanyLogoPayload(ctx context.Context) string {
+	return strings.TrimSpace(loadLoginCompanyRow(ctx).LoginLogo)
+}
+
+func kanbanAccentClass(colorIndex int) string {
+	if colorIndex < 0 || colorIndex >= len(kanbanAccentHex) {
+		return ""
+	}
+	return "sum-login-brand--accent-" + strconv.Itoa(colorIndex)
+}
+
+func totpLoginBrand(base loginBrand) loginBrand {
+	base.Headline = "Verify your identity"
+	base.Tagline = "Enter the code from your authenticator app to finish signing in."
+	base.ShowTrustChips = false
+	return base
+}
+
+func setupLoginBrand() loginBrand {
+	b := defaultSumeruLoginBrand()
+	b.Headline = "Database setup"
+	b.Tagline = "Connect your PostgreSQL database, create your company, and define the first administrator account."
+	b.ShowTrustChips = false
+	return b
+}
diff --git a/core/server/web/portal_handlers.go b/core/server/web/portal_handlers.go
index 3d7db816..c1ef1bad 100644
--- a/core/server/web/portal_handlers.go
+++ b/core/server/web/portal_handlers.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"html/template"
 	"net/http"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -152,13 +151,13 @@ func loadPortalTemplates() (*template.Template, *template.Template, error) {
 	portalTemplateOnce.Do(func() {
 		dir := config.AppConfig.TemplatesPath
 		portalHomeTmpl, portalTemplateErr = template.ParseFiles(
-			filepath.Join(dir, "portal_home.html"),
+			render.TemplatePath(dir, render.TemplatePortalHome),
 		)
 		if portalTemplateErr != nil {
 			return
 		}
 		portalShareTmpl, portalTemplateErr = template.ParseFiles(
-			filepath.Join(dir, "portal_share.html"),
+			render.TemplatePath(dir, render.TemplatePortalShare),
 		)
 	})
 	return portalHomeTmpl, portalShareTmpl, portalTemplateErr
diff --git a/core/server/web/routes_table.go b/core/server/web/routes_table.go
index 7ad6b138..15cd7546 100644
--- a/core/server/web/routes_table.go
+++ b/core/server/web/routes_table.go
@@ -60,6 +60,7 @@ func registerAuthRoutes() {
 	registerAPIKeyRevealRoute()
 	registerOAuthRoutes()
 	registerTOTPRoutes()
+	registerLoginBrandRoutes()
 }
 
 func registerWorkspaceRoutes() {
diff --git a/core/server/web/setup_handlers.go b/core/server/web/setup_handlers.go
index 59828c0d..ccb2c858 100644
--- a/core/server/web/setup_handlers.go
+++ b/core/server/web/setup_handlers.go
@@ -7,13 +7,13 @@ import (
 	"html/template"
 	"net/http"
 	"os"
-	"path/filepath"
 	"strings"
 	"syscall"
 	"time"
 
 	"sumeru/core/applog"
 	"sumeru/core/engine/assets"
+	"sumeru/core/engine/render"
 	"sumeru/core/errcode"
 	"sumeru/core/module"
 	"sumeru/core/orm"
@@ -35,6 +35,8 @@ type setupPageData struct {
 	DbName             string
 	Stylesheets        []string
 	SetupTokenRequired bool
+	AppName            string
+	Brand              loginBrand
 }
 
 // SetupInitHandler runs database sync, installs base, bootstraps security from the JSON wizard payload, then restarts.
@@ -144,14 +146,17 @@ func buildSetupPageData() setupPageData {
 		DbName:             config.AppConfig.DbName,
 		Stylesheets:        assets.LoginStylesheetURLs(),
 		SetupTokenRequired: strings.TrimSpace(config.AppConfig.SetupToken) != "",
+		AppName:            loginBrandPlatformName,
+		Brand:              setupLoginBrand(),
 	}
 }
 
 func writeSetupPage(w http.ResponseWriter, ctx context.Context, pageData setupPageData) {
-	templatePath := filepath.Join(config.AppConfig.TemplatesPath, setupTemplateFile)
-	templateFile, err := template.ParseFiles(templatePath)
+	dir := config.AppConfig.TemplatesPath
+	paths := render.AuthTemplateFiles(dir, setupTemplateFile)
+	templateFile, err := template.ParseFiles(paths...)
 	if err != nil {
-		logSetupFailure(ctx, "Failed to parse setup template", err, map[string]interface{}{"template": templatePath})
+		logSetupFailure(ctx, "Failed to parse setup template", err, map[string]interface{}{"template": setupTemplateFile})
 		http.Error(w, "Setup template missing", http.StatusInternalServerError)
 		return
 	}
diff --git a/core/server/web/shell_render.go b/core/server/web/shell_render.go
index badf6592..782567a4 100644
--- a/core/server/web/shell_render.go
+++ b/core/server/web/shell_render.go
@@ -5,8 +5,6 @@ import (
 	"context"
 	"html/template"
 	"net/http"
-	"path/filepath"
-
 	"sumeru/core/engine/render"
 	"sumeru/core/errcode"
 	"sumeru/core/server/config"
@@ -50,10 +48,7 @@ func resolveShellRoute(opts shellPageOpts, r *http.Request) string {
 }
 
 func executeInnerTemplate(ctx context.Context, w http.ResponseWriter, route string, opts shellPageOpts) (template.HTML, bool) {
-	templatePaths := []string{
-		filepath.Join(config.AppConfig.TemplatesPath, opts.InnerTemplate),
-		filepath.Join(config.AppConfig.TemplatesPath, shellPartialsTemplate),
-	}
+	templatePaths := render.ShellInnerTemplateFiles(config.AppConfig.TemplatesPath, opts.InnerTemplate)
 	templateFile, err := template.ParseFiles(templatePaths...)
 	if err != nil {
 		webLogFail(ctx, route, "render", "Failed to parse inner template", err, logStatusFailure, map[string]interface{}{"template": opts.InnerTemplate})
diff --git a/core/server/web/testexports.go b/core/server/web/testexports.go
index fe8253f3..1251c0c9 100644
--- a/core/server/web/testexports.go
+++ b/core/server/web/testexports.go
@@ -445,6 +445,50 @@ func ListEnabledAuthProvidersForTest(ctx context.Context) []LoginAuthProviderFor
 // LoginPageCompanyNameForTest returns branding text for the login page.
 func LoginPageCompanyNameForTest(ctx context.Context) string { return loginPageCompanyName(ctx) }
 
+// TestLoginBrandLogoRoute is the public company login logo URL.
+const TestLoginBrandLogoRoute = loginBrandLogoRoute
+
+// TestDefaultSumeruLogoURL is the bundled default sign-in logo path.
+const TestDefaultSumeruLogoURL = defaultSumeruLogoURL
+
+// LoginCompanyRowForTest configures synthetic login branding inputs.
+type LoginCompanyRowForTest struct {
+	Name         string
+	LoginLogo    string
+	LoginTagline string
+	Color        int
+}
+
+// LoginBrandSnapshotForTest is the resolved left-panel branding for assertions.
+type LoginBrandSnapshotForTest struct {
+	LogoURL        string
+	ShowPoweredBy  bool
+	ShowTrustChips bool
+}
+
+// BuildLoginBrandForTest resolves branding from a synthetic company row (no DB).
+func BuildLoginBrandForTest(row LoginCompanyRowForTest) LoginBrandSnapshotForTest {
+	b := buildLoginBrand(loginCompanyRow(row))
+	return LoginBrandSnapshotForTest{
+		LogoURL:        b.LogoURL,
+		ShowPoweredBy:  b.ShowPoweredBy,
+		ShowTrustChips: b.ShowTrustChips,
+	}
+}
+
+// ParseLoginLogoDataURLForTest decodes login logo data URLs for tests.
+func ParseLoginLogoDataURLForTest(raw string) (mime string, data []byte, ok bool) {
+	return parseLoginLogoDataURL(raw)
+}
+
+// LoginBrandLogoGetForTest exposes the public login logo handler.
+func LoginBrandLogoGetForTest(w http.ResponseWriter, r *http.Request) {
+	LoginBrandLogoHandler(w, r)
+}
+
+// ResetAuthTemplateCacheForTest clears parsed auth HTML templates (tests change TemplatesPath).
+func ResetAuthTemplateCacheForTest() { resetAuthTemplateCache() }
+
 // LogoutGetForTest exposes the logout GET handler for tests.
 func LogoutGetForTest(w http.ResponseWriter, r *http.Request) { LogoutGet(w, r) }
 
diff --git a/core/server/web/web_constants.go b/core/server/web/web_constants.go
index 5ebaae54..cbb2344e 100644
--- a/core/server/web/web_constants.go
+++ b/core/server/web/web_constants.go
@@ -31,7 +31,7 @@ const (
 // Setup wizard limits and templates.
 const (
 	maxSetupInitBodyBytes = 1 << 17 // 128 KiB
-	setupTemplateFile     = "setup.html"
+	setupTemplateFile     = render.TemplateAuthSetup
 	setupOperation        = "setup"
 	setupCompleteMessage  = "Setup complete — server is restarting…"
 	setupTokenHeader      = "X-Setup-Token"
@@ -41,8 +41,7 @@ const (
 
 // Shell layout templates and defaults.
 const (
-	shellPartialsTemplate = "shell_partials.html"
-	defaultPageTitle      = "Sumeru"
+	defaultPageTitle = "Sumeru"
 )
 
 // Pinned apps API form fields and limits.
@@ -61,8 +60,8 @@ const (
 
 // Login page identifiers and form fields.
 const (
-	loginTemplateFile       = "login.html"
-	totpLoginTemplateFile   = "totp_login.html"
+	loginTemplateFile       = render.TemplateAuthLogin
+	totpLoginTemplateFile   = render.TemplateAuthTOTP
 	totpLoginRoute          = "/web/login/totp"
 	loginCSRFCookie         = "sumeru_login_csrf"
 	loginNextCookie         = "sumeru_login_next"
@@ -128,7 +127,7 @@ const (
 // Home dashboard page identifiers.
 const (
 	homeMenuRootXMLID = "base.menu_home_root"
-	homeInnerTemplate = "home_dashboard_inner.html"
+	homeInnerTemplate = render.TemplatePagesHome
 	homePageTitle     = "Home"
 	homeStylesheetURL = "/static/css/sumeru-home.css"
 	homeEmptyMessage  = "No installed applications. Install apps from Apps."
@@ -138,7 +137,7 @@ const (
 // App logs page identifiers.
 const (
 	appLogsMenuXMLID       = "base.menu_app_logs"
-	appLogsInnerTemplate   = "app_logs_inner.html"
+	appLogsInnerTemplate   = render.TemplatePagesAppLogs
 	appLogsPageTitle       = "App Logs"
 	appLogsBreadcrumb      = "Event Log"
 	appLogModel            = "app.log"
@@ -151,13 +150,13 @@ const (
 const (
 	settingsRootMenuXMLID      = "base.menu_settings_root"
 	settingsHubMenuXMLID       = render.MenuGeneralSettingsXMLID
-	settingsHubInnerTemplate   = "settings_hub_inner.html"
+	settingsHubInnerTemplate   = render.TemplatePagesSettingsHub
 	settingsHubPageTitle       = "Settings"
 	settingsHubStylesheetURL   = "/static/css/sumeru-settings-hub.css"
 	settingsHubBodyClass         = " sum-body--settings-hub"
-	settingsAccountInnerTemplate  = "settings_account_inner.html"
-	settingsFieldACLInnerTemplate = "settings_field_acl_inner.html"
-	settingsModelACLInnerTemplate = "settings_model_acl_inner.html"
+	settingsAccountInnerTemplate  = render.TemplatePagesSettingsAccount
+	settingsFieldACLInnerTemplate = render.TemplatePagesSettingsFieldACL
+	settingsModelACLInnerTemplate = render.TemplatePagesSettingsModelACL
 	groupUserXML                 = "base.group_user"
 )
 
@@ -298,7 +297,7 @@ const (
 const (
 	appsRoute         = "/web/apps"
 	appsPageTitle     = "Apps"
-	appsInnerTemplate = "apps_inner.html"
+	appsInnerTemplate = render.TemplatePagesApps
 	appsModuleModel   = "sys.module"
 )
 
diff --git a/sumeru.conf.example b/sumeru.conf.example
index e582d0e6..e8e6ec48 100644
--- a/sumeru.conf.example
+++ b/sumeru.conf.example
@@ -46,8 +46,8 @@ log_rolling = false
 # assets_path =
 # templates_path =
 # brand_css =
-# logo_path =
-# company_display_name =
+# logo_path =            # Host-level sign-in + shell logo when core.company login_logo is empty (served as /static/app-logo)
+# company_display_name = # Sign-in headline when no company name in the database yet
 # user_display_name =
 
 # Database pool (optional — tune for production load)
diff --git a/test/core/server/web/login_branding_test.go b/test/core/server/web/login_branding_test.go
new file mode 100644
index 00000000..c140a71f
--- /dev/null
+++ b/test/core/server/web/login_branding_test.go
@@ -0,0 +1,90 @@
+package web_test
+
+import (
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"sumeru/core/engine/render"
+	"sumeru/core/server/config"
+	"sumeru/core/server/web"
+)
+
+func TestBuildLoginBrand_logoPriority(t *testing.T) {
+	render.SetShellBranding(render.ShellBranding{})
+	t.Cleanup(func() { render.SetShellBranding(render.ShellBranding{}) })
+
+	defaultBrand := web.BuildLoginBrandForTest(web.LoginCompanyRowForTest{})
+	if defaultBrand.LogoURL != web.TestDefaultSumeruLogoURL {
+		t.Fatalf("default logo: got %q want %q", defaultBrand.LogoURL, web.TestDefaultSumeruLogoURL)
+	}
+	if defaultBrand.ShowPoweredBy {
+		t.Fatal("default brand should not show powered-by")
+	}
+	if !defaultBrand.ShowTrustChips {
+		t.Fatal("default brand should show trust chips")
+	}
+
+	withCompanyLogo := web.BuildLoginBrandForTest(web.LoginCompanyRowForTest{
+		Name:      "Acme",
+		LoginLogo: "data:image/png;base64,abcd",
+	})
+	if withCompanyLogo.LogoURL != web.TestLoginBrandLogoRoute {
+		t.Fatalf("company logo route: got %q", withCompanyLogo.LogoURL)
+	}
+	if !withCompanyLogo.ShowPoweredBy {
+		t.Fatal("tenant brand should show powered-by")
+	}
+
+	render.SetShellBranding(render.ShellBranding{LogoURL: "/static/app-logo"})
+	cfgBrand := web.BuildLoginBrandForTest(web.LoginCompanyRowForTest{})
+	if cfgBrand.LogoURL != "/static/app-logo" {
+		t.Fatalf("config logo: got %q", cfgBrand.LogoURL)
+	}
+}
+
+func TestParseLoginLogoDataURL(t *testing.T) {
+	png := []byte{0x89, 0x50, 0x4e, 0x47}
+	raw := "data:image/png;base64," + base64.StdEncoding.EncodeToString(png)
+	mime, data, ok := web.ParseLoginLogoDataURLForTest(raw)
+	if !ok || mime != "image/png" || len(data) != len(png) {
+		t.Fatalf("parse ok=%v mime=%q len=%d", ok, mime, len(data))
+	}
+	if _, _, bad := web.ParseLoginLogoDataURLForTest("data:text/plain;base64,YQ=="); bad {
+		t.Fatal("expected reject non-image mime")
+	}
+}
+
+func TestLoginBrandLogoGet_notFoundWithoutLogo(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, web.TestLoginBrandLogoRoute, nil)
+	rec := httptest.NewRecorder()
+	web.LoginBrandLogoGetForTest(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("status: got %d", rec.Code)
+	}
+}
+
+func TestLoginGet_rendersBrandLockup(t *testing.T) {
+	root := sumeruModuleRoot(t)
+	prevTemplates := config.AppConfig.TemplatesPath
+	config.AppConfig.TemplatesPath = filepath.Join(root, "core", "engine", "templates")
+	t.Cleanup(func() { config.AppConfig.TemplatesPath = prevTemplates })
+	web.ResetAuthTemplateCacheForTest()
+
+	req := httptest.NewRequest(http.MethodGet, web.TestLoginRoute, nil)
+	rec := httptest.NewRecorder()
+	web.LoginGetForTest(rec, req)
+	body := rec.Body.String()
+	for _, needle := range []string{
+		"sum-login-brand-lockup",
+		web.TestDefaultSumeruLogoURL,
+		"sum-login-trust-chip",
+	} {
+		if !strings.Contains(body, needle) {
+			t.Fatalf("missing %q in login HTML", needle)
+		}
+	}
+}
diff --git a/test/core/server/web/login_csrf_test.go b/test/core/server/web/login_csrf_test.go
index f551de1e..c264c121 100644
--- a/test/core/server/web/login_csrf_test.go
+++ b/test/core/server/web/login_csrf_test.go
@@ -184,12 +184,13 @@ func TestLoginGet_rendersEnterpriseShell(t *testing.T) {
 	t.Cleanup(func() {
 		config.AppConfig.TemplatesPath = prevTemplates
 	})
+	web.ResetAuthTemplateCacheForTest()
 
 	req := httptest.NewRequest(http.MethodGet, web.TestLoginRoute+"?msg="+web.TestOAuthDeniedMsg, nil)
 	rec := httptest.NewRecorder()
 	web.LoginGetForTest(rec, req)
 	body := rec.Body.String()
-	for _, needle := range []string{"sum-login-shell", "sum-login-brand", "Sign in", "Authorized users only"} {
+	for _, needle := range []string{"sum-login-shell", "sum-login-brand-lockup", web.TestDefaultSumeruLogoURL, "Sign in", "Authorized users only"} {
 		if !strings.Contains(body, needle) {
 			t.Fatalf("missing %q in login HTML", needle)
 		}