diff --git a/VERSION b/VERSION
index 8f0916f..4b9fcbe 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.5.0
+0.5.1
diff --git a/larry.sh b/larry.sh
index c323ad6..e6ebd74 100755
--- a/larry.sh
+++ b/larry.sh
@@ -36,7 +36,7 @@ set -o pipefail
 # ─────────────────────────────────────────────────────────────────────────────
 # Config
 # ─────────────────────────────────────────────────────────────────────────────
-LARRY_VERSION="0.5.0"
+LARRY_VERSION="0.5.1"
 LARRY_HOME="${LARRY_HOME:-$HOME/.larry}"
 LARRY_BASE_URL="${LARRY_BASE_URL:-https://raw.githubusercontent.com/bojj27/cloverleaf-larry/main}"
 LARRY_UPDATE_URL="${LARRY_UPDATE_URL:-${LARRY_BASE_URL}/larry.sh}"
@@ -176,9 +176,10 @@ prompt_api_key() {
   log "API key saved."
 }
 
-if [ -z "$LARRY_AUTH_MODE" ]; then
-  prompt_first_run_auth
-fi
+# NOTE: the auth-prompt CALL (prompt_first_run_auth) is deliberately deferred
+# until AFTER self_update has run — otherwise a broken lib/oauth.sh traps the
+# user before the auto-update mechanism gets a chance to fix it. See call site
+# below the self_update block.
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Fetch agents if missing
@@ -352,6 +353,14 @@ self_update() {
 }
 self_update
 
+# ── Deferred auth prompt ────────────────────────────────────────────────────
+# Now that self_update has had a chance to refresh lib/oauth.sh, gate on
+# credentials. On a fresh box (no .oauth.json, no API key) this is the first
+# interactive prompt the user sees.
+if [ -z "$LARRY_AUTH_MODE" ]; then
+  prompt_first_run_auth
+fi
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Cloverleaf environment detection
 # Surfaces HCIROOT / HCISITE / HCISITEDIR and which tool layer is present