diff --git a/backend/services/local_jwt.py b/backend/services/local_jwt.py
index aff8b9b..0f3d759 100644
--- a/backend/services/local_jwt.py
+++ b/backend/services/local_jwt.py
@@ -32,14 +32,17 @@ def decode_token(token: str) -> dict[str, Any] | None:
     secret = settings.auth_jwt_secret
     if not secret:
         return None
-    try:
-        return jwt.decode(
-            token,
-            secret,
-            algorithms=[ALGORITHM],
-            issuer="periscope-local",
-            options={"verify_aud": False},
-            leeway=10,
-        )
-    except jwt.PyJWTError:
-        return None
+    # Accept pre-rebrand issuer so existing sessions keep working.
+    for issuer in ("periscope-local", "pinscope-local"):
+        try:
+            return jwt.decode(
+                token,
+                secret,
+                algorithms=[ALGORITHM],
+                issuer=issuer,
+                options={"verify_aud": False},
+                leeway=10,
+            )
+        except jwt.PyJWTError:
+            continue
+    return None
diff --git a/frontend/content/changelog.md b/frontend/content/changelog.md
index 1a4b1ca..332ca04 100644
--- a/frontend/content/changelog.md
+++ b/frontend/content/changelog.md
@@ -2,6 +2,14 @@
 
 What's new in Periscope.
 
+## 2.29.1 — 2026-09-13 — Fix sign-in /login 404 after rebrand
+
+Landing CTAs pointed at `/login`, which did not exist (page is `/sign-in`). Added redirects, accepted legacy JWT issuer `pinscope-local`, and CORS for both Periscope and Pinscope hosts.
+
+- [Fixed] `/login` → `/sign-in`, `/register` → `/sign-up`; marketing links updated.
+- [Fixed] JWT decode accepts `pinscope-local` issuer from pre-rebrand sessions.
+- [Fixed] Deploy script CORS includes both public hostnames.
+
 ## 2.29.0 — 2026-09-13 — Rebrand to Periscope
 
 Product name, package (`periscopex`), Docker containers, deploy script, and default site URL are now **Periscope** (`https://periscope.michelebigi.it`). Deterministic finding IDs use the `PE-*` prefix. Existing project.json `pinscope_version` and browser storage keys are still read.
diff --git a/frontend/next.config.ts b/frontend/next.config.ts
index 5e872b2..80eaadd 100644
--- a/frontend/next.config.ts
+++ b/frontend/next.config.ts
@@ -27,6 +27,12 @@ const nextConfig: NextConfig = {
       canvas: { browser: "" },
     },
   },
+  async redirects() {
+    return [
+      { source: "/login", destination: "/sign-in", permanent: false },
+      { source: "/register", destination: "/sign-up", permanent: false },
+    ];
+  },
   async headers() {
     return [
       {
diff --git a/frontend/src/app/(marketing)/contact/nav.tsx b/frontend/src/app/(marketing)/contact/nav.tsx
index 3be5a69..a293e85 100644
--- a/frontend/src/app/(marketing)/contact/nav.tsx
+++ b/frontend/src/app/(marketing)/contact/nav.tsx
@@ -44,12 +44,12 @@ export function Nav() {
             </Link>
           ) : (
             <>
-              <Link href="/login">
+              <Link href="/sign-in">
                 <Button variant="ghost" size="sm">
                   Sign in
                 </Button>
               </Link>
-              <Link href="/login">
+              <Link href="/sign-up">
                 <Button
                   size="sm"
                   className="bg-blue-600 hover:bg-blue-500 text-white border-0"
diff --git a/frontend/src/app/(marketing)/landing-cta.tsx b/frontend/src/app/(marketing)/landing-cta.tsx
index 2f1bf83..7e4112d 100644
--- a/frontend/src/app/(marketing)/landing-cta.tsx
+++ b/frontend/src/app/(marketing)/landing-cta.tsx
@@ -22,12 +22,12 @@ export function NavAuthCluster() {
   }
   return (
     <>
-      <Link href="/login">
+      <Link href="/sign-in">
         <Button variant="ghost" size="sm">
           Sign in
         </Button>
       </Link>
-      <Link href="/login">
+      <Link href="/sign-up">
         <Button
           size="sm"
           className="bg-blue-600 hover:bg-blue-500 text-white border-0"
@@ -41,7 +41,7 @@ export function NavAuthCluster() {
 
 export function PrimaryCta() {
   const { isSignedIn } = useOptionalAuth();
-  const href = isSignedIn ? "/dashboard" : "/login";
+  const href = isSignedIn ? "/dashboard" : "/sign-up";
   const label = isSignedIn ? "Go to Dashboard" : "Start for free";
   return (
     <Link href={href}>
@@ -59,7 +59,7 @@ export function PrimaryCta() {
 export function PricingCta() {
   const { isSignedIn } = useOptionalAuth();
   return (
-    <Link href={isSignedIn ? "/billing" : "/login"}>
+    <Link href={isSignedIn ? "/billing" : "/sign-up"}>
       <Button
         size="sm"
         className="bg-blue-600 hover:bg-blue-500 text-white border-0 gap-1.5"
diff --git a/frontend/src/app/(marketing)/sign-in/page.tsx b/frontend/src/app/(marketing)/sign-in/page.tsx
index 3fc7ec8..d679c77 100644
--- a/frontend/src/app/(marketing)/sign-in/page.tsx
+++ b/frontend/src/app/(marketing)/sign-in/page.tsx
@@ -29,7 +29,14 @@ export default function SignInPage() {
       });
       const data = await res.json().catch(() => ({}));
       if (!res.ok) {
-        throw new Error(data.detail || "Sign in failed");
+        const detail = data.detail;
+        const msg =
+          typeof detail === "string"
+            ? detail
+            : Array.isArray(detail)
+              ? detail.map((d: { msg?: string }) => d.msg || JSON.stringify(d)).join("; ")
+              : "Sign in failed";
+        throw new Error(msg);
       }
       storeAuthToken(data.token);
       router.replace("/");
diff --git a/frontend/src/app/(marketing)/sign-up/page.tsx b/frontend/src/app/(marketing)/sign-up/page.tsx
index e0a6c6a..b609cef 100644
--- a/frontend/src/app/(marketing)/sign-up/page.tsx
+++ b/frontend/src/app/(marketing)/sign-up/page.tsx
@@ -35,9 +35,13 @@ export default function SignUpPage() {
       const data = await res.json().catch(() => ({}));
       if (!res.ok) {
         const detail = data.detail;
-        throw new Error(
-          typeof detail === "string" ? detail : "Could not create account",
-        );
+        const msg =
+          typeof detail === "string"
+            ? detail
+            : Array.isArray(detail)
+              ? detail.map((d: { msg?: string }) => d.msg || JSON.stringify(d)).join("; ")
+              : "Could not create account";
+        throw new Error(msg);
       }
       storeAuthToken(data.token);
       router.replace("/");
diff --git a/scripts/update-periscope.sh b/scripts/update-periscope.sh
index c66aff6..9b2e3c4 100755
--- a/scripts/update-periscope.sh
+++ b/scripts/update-periscope.sh
@@ -115,8 +115,8 @@ fi
 
 log "Ensuring public URL in .env ($SITE)"
 upsert_env NEXT_PUBLIC_API_URL "$SITE" .env
-# JSON list — keep it a single line so docker compose / pydantic-settings parse it.
-upsert_env CORS_ORIGINS "[\"$SITE\"]" .env
+# Allow both Periscope and legacy Pinscope host during transition.
+upsert_env CORS_ORIGINS "[\"$SITE\",\"https://pinscope.michelebigi.it\"]" .env
 
 KEY="$(read_env DEEPSEEK_API_KEY .env || true)"
 if [[ -z "$KEY" || "$KEY" == "sk-..." ]]; then