diff --git a/browser_tests/tests/dialogs/pricingTableDeepLink.spec.ts b/browser_tests/tests/dialogs/pricingTableDeepLink.spec.ts
index bb5cfb4afab..ae183a90de8 100644
--- a/browser_tests/tests/dialogs/pricingTableDeepLink.spec.ts
+++ b/browser_tests/tests/dialogs/pricingTableDeepLink.spec.ts
@@ -273,6 +273,23 @@ const UNEXPECTED_OPERATION_RESPONSE = {
   completed_at: '2026-07-20T00:00:01Z'
 } satisfies BillingOpStatusResponse
 
+const RECOVERED_3DS_OPERATION_ID = 'recovered-3ds-subscription'
+const RECOVERED_3DS_ACTION_URL = 'https://verify.example/3ds-session'
+
+const RECOVERED_3DS_STATUS = {
+  ...ACTIVE_TEAM_STATUS,
+  billing_status: 'pending_payment',
+  pending_billing_op_id: RECOVERED_3DS_OPERATION_ID,
+  action_url: RECOVERED_3DS_ACTION_URL
+} satisfies BillingStatusResponse
+
+const RECOVERED_3DS_OPERATION = {
+  id: RECOVERED_3DS_OPERATION_ID,
+  status: 'pending',
+  started_at: '2026-07-20T00:00:00Z',
+  action_url: RECOVERED_3DS_ACTION_URL
+} satisfies BillingOpStatusResponse
+
 const TRANSIENT_STATUS_ERROR = {
   code: 'billing_status_unavailable',
   message: 'Billing status is temporarily unavailable'
@@ -444,6 +461,36 @@ async function mockPopupBlockedCreatorDowngrade(page: Page) {
   }
 }
 
+async function mockRecovered3dsSubscription(page: Page) {
+  const statusRequests: Request[] = []
+  const operationPollRequests: Request[] = []
+  const subscribeRequests: Request[] = []
+
+  await page.route('**/api/billing/status', (route) => {
+    statusRequests.push(route.request())
+    return route.fulfill(jsonRoute(RECOVERED_3DS_STATUS))
+  })
+  await page.route(
+    `**/api/billing/ops/${RECOVERED_3DS_OPERATION_ID}`,
+    (route) => {
+      operationPollRequests.push(route.request())
+      return route.fulfill(jsonRoute(RECOVERED_3DS_OPERATION))
+    }
+  )
+  await page.route('**/api/billing/subscribe', (route) => {
+    subscribeRequests.push(route.request())
+    return route.fulfill({
+      ...jsonRoute({
+        code: 'unexpected_subscribe',
+        message: 'Recovered operations must not resubscribe'
+      } satisfies ErrorResponse),
+      status: 500
+    })
+  })
+
+  return { statusRequests, operationPollRequests, subscribeRequests }
+}
+
 const pricingHeading = (page: Page) =>
   page.getByRole('heading', { name: 'Choose a Plan' })
 
@@ -668,7 +715,7 @@ test.describe('Scheduled Team downgrade', { tag: '@cloud' }, () => {
     releasePostSubscribeRefresh = downgradeMock.releasePostSubscribeRefresh
   })
 
-  test('shows the existing success view when subscribe replays 200', async ({
+  test('completes the non-3DS flow when subscribe replays 200', async ({
     page
   }) => {
     await page.goto(`${APP_URL}/?pricing=personal`)
@@ -696,6 +743,9 @@ test.describe('Scheduled Team downgrade', { tag: '@cloud' }, () => {
         name: "You're all set"
       })
       await expect(successHeading).toBeVisible()
+      await expect(
+        page.getByRole('button', { name: 'Complete verification' })
+      ).toBeHidden()
       await expect.poll(() => statusRefreshRequests.length).toBe(1)
       await expect.poll(() => balanceRefreshRequests.length).toBe(1)
       const successView = successHeading.locator('..').locator('..')
@@ -721,6 +771,64 @@ test.describe('Scheduled Team downgrade', { tag: '@cloud' }, () => {
   })
 })
 
+test.describe('Recovered 3DS subscription', { tag: '@cloud' }, () => {
+  let statusRequests: Request[]
+  let operationPollRequests: Request[]
+  let subscribeRequests: Request[]
+
+  test.beforeEach(async ({ page }) => {
+    await page.addInitScript(() => {
+      window.open = (url, target, features) => {
+        document.documentElement.dataset.openedUrl = String(url)
+        document.documentElement.dataset.openedTarget = target ?? ''
+        document.documentElement.dataset.openedFeatures = features ?? ''
+        return window
+      }
+    })
+    await setupCloudApp(page, workspace('team', 'owner'), [
+      member({ email: SELF_EMAIL, role: 'owner', is_original_owner: true })
+    ])
+    const recoveryMock = await mockRecovered3dsSubscription(page)
+    statusRequests = recoveryMock.statusRequests
+    operationPollRequests = recoveryMock.operationPollRequests
+    subscribeRequests = recoveryMock.subscribeRequests
+  })
+
+  test('recovers on a fresh page without resubscribing and opens verification on click', async ({
+    page
+  }) => {
+    await page.goto(APP_URL)
+    await waitForCloudApp(page)
+    await page.getByRole('button', { name: 'Current user' }).click()
+    await page.getByTestId('manage-plan-menu-item').click()
+    await expect.poll(() => statusRequests.length).toBeGreaterThan(0)
+    await expect.poll(() => operationPollRequests.length).toBeGreaterThan(0)
+
+    const verificationButton = page.getByRole('button', {
+      name: 'Complete verification'
+    })
+    await expect(verificationButton).toBeVisible()
+    await expect(page.locator('html')).not.toContainText(
+      RECOVERED_3DS_ACTION_URL
+    )
+    expect(subscribeRequests).toHaveLength(0)
+
+    await verificationButton.click()
+
+    await expect
+      .poll(() => page.locator('html').getAttribute('data-opened-url'))
+      .toBe(RECOVERED_3DS_ACTION_URL)
+    await expect(page.locator('html')).toHaveAttribute(
+      'data-opened-target',
+      '_blank'
+    )
+    await expect(page.locator('html')).toHaveAttribute(
+      'data-opened-features',
+      'noopener,noreferrer'
+    )
+  })
+})
+
 test.describe(
   'Billing reconciliation after plan changes',
   { tag: '@cloud' },
diff --git a/packages/ingest-types/src/types.gen.ts b/packages/ingest-types/src/types.gen.ts
index f31edac5ef9..31a53f9af48 100644
--- a/packages/ingest-types/src/types.gen.ts
+++ b/packages/ingest-types/src/types.gen.ts
@@ -879,6 +879,10 @@ export type BillingOpStatusResponse = {
    * When the operation completed (success or failure)
    */
   completed_at?: string
+  /**
+   * HTTPS URL for completing required customer authentication
+   */
+  action_url?: string
 }
 
 /**
@@ -1506,6 +1510,14 @@ export type BillingStatusResponse = {
    */
   plan_slug?: string
   billing_status?: BillingStatus
+  /**
+   * The workspace's in-flight billing operation, when one exists.
+   */
+  pending_billing_op_id?: string
+  /**
+   * The customer action URL for the pending operation, when action is required.
+   */
+  action_url?: string
   /**
    * Whether the workspace has available credits
    */
diff --git a/packages/ingest-types/src/zod.gen.ts b/packages/ingest-types/src/zod.gen.ts
index c0d6f53b249..7ff7ba458cb 100644
--- a/packages/ingest-types/src/zod.gen.ts
+++ b/packages/ingest-types/src/zod.gen.ts
@@ -506,7 +506,8 @@ export const zBillingOpStatusResponse = z.object({
   status: z.enum(['pending', 'succeeded', 'failed']),
   error_message: z.string().optional(),
   started_at: z.string().datetime(),
-  completed_at: z.string().datetime().optional()
+  completed_at: z.string().datetime().optional(),
+  action_url: z.string().optional()
 })
 
 /**
@@ -980,6 +981,8 @@ export const zBillingStatusResponse = z.object({
   subscription_duration: zSubscriptionDuration.optional(),
   plan_slug: z.string().optional(),
   billing_status: zBillingStatus.optional(),
+  pending_billing_op_id: z.string().optional(),
+  action_url: z.string().optional(),
   has_funds: z.boolean(),
   cancel_at: z.string().datetime().optional(),
   renewal_date: z.string().datetime().optional(),
diff --git a/src/locales/en/main.json b/src/locales/en/main.json
index bc71e7fd800..8152f9c63b1 100644
--- a/src/locales/en/main.json
+++ b/src/locales/en/main.json
@@ -2850,6 +2850,7 @@
       "message": "Team billing is coming soon. You'll be able to subscribe to a plan for your workspace with per-seat pricing. Stay tuned for updates."
     },
     "preview": {
+      "completeVerification": "Complete verification",
       "confirmPayment": "Confirm your payment",
       "confirmPlanChange": "Confirm your plan change",
       "startingToday": "Starts today",
diff --git a/src/platform/workspace/api/workspaceApi.test.ts b/src/platform/workspace/api/workspaceApi.test.ts
index 58c1ed40aa2..c927615f0c6 100644
--- a/src/platform/workspace/api/workspaceApi.test.ts
+++ b/src/platform/workspace/api/workspaceApi.test.ts
@@ -566,7 +566,8 @@ describe('workspaceApi', () => {
       expect(mockAxiosInstance.get).toHaveBeenCalledWith(
         '/api/billing/ops/op-1',
         {
-          headers: AUTH_HEADER
+          headers: AUTH_HEADER,
+          timeout: 30_000
         }
       )
       expect(result).toEqual(data)
diff --git a/src/platform/workspace/api/workspaceApi.ts b/src/platform/workspace/api/workspaceApi.ts
index 3ba0576b77f..0aa075bed29 100644
--- a/src/platform/workspace/api/workspaceApi.ts
+++ b/src/platform/workspace/api/workspaceApi.ts
@@ -276,6 +276,8 @@ export interface BillingStatusResponse {
   subscription_duration?: SubscriptionDuration
   plan_slug?: string
   billing_status?: BillingStatus
+  pending_billing_op_id?: string
+  action_url?: string
   has_funds: boolean
   cancel_at?: string
   renewal_date?: string
@@ -313,6 +315,7 @@ export interface BillingOpStatusResponse {
   error_message?: string
   started_at: string
   completed_at?: string
+  action_url?: string
 }
 
 interface BillingEvent {
@@ -814,7 +817,7 @@ export const workspaceApi = {
     try {
       const response = await workspaceApiClient.get<BillingOpStatusResponse>(
         api.apiURL(`/billing/ops/${opId}`),
-        { headers }
+        { headers, timeout: 30_000 }
       )
       return response.data
     } catch (err) {
diff --git a/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.test.ts b/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.test.ts
index af1e0eb7dbf..ac88a3e8222 100644
--- a/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.test.ts
+++ b/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.test.ts
@@ -148,4 +148,39 @@ describe('SubscriptionAddPaymentPreviewWorkspace', () => {
     )
     expect(emitted().addCreditCard).toBeTruthy()
   })
+
+  it('opens verification only from its button without exposing the URL', async () => {
+    const actionUrl = 'https://verify.example/sensitive-token'
+    const open = vi.spyOn(window, 'open').mockReturnValue({} as Window)
+    const { container } = render(SubscriptionAddPaymentPreviewWorkspace, {
+      props: { tierKey: 'creator', actionUrl },
+      global: globalOptions
+    })
+
+    expect(open).not.toHaveBeenCalled()
+    expect(container.innerHTML).not.toContain(actionUrl)
+    await userEvent.click(
+      screen.getByRole('button', {
+        name: 'subscription.preview.completeVerification'
+      })
+    )
+    expect(open).toHaveBeenCalledWith(
+      actionUrl,
+      '_blank',
+      'noopener,noreferrer'
+    )
+  })
+
+  it('prevents leaving the preview while payment is pending', () => {
+    render(SubscriptionAddPaymentPreviewWorkspace, {
+      props: { tierKey: 'creator', isLoading: true },
+      global: globalOptions
+    })
+
+    expect(
+      screen.getByRole('button', {
+        name: 'subscription.preview.backToAllPlans'
+      })
+    ).toBeDisabled()
+  })
 })
diff --git a/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.vue b/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.vue
index 8e15af61c89..b2ea72667ff 100644
--- a/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.vue
+++ b/src/platform/workspace/components/SubscriptionAddPaymentPreviewWorkspace.vue
@@ -136,7 +136,16 @@
       <!-- Terms Agreement -->
       <SubscriptionTermsNote />
 
-      <!-- Add Credit Card Button -->
+      <Button
+        v-if="actionUrl"
+        variant="primary"
+        size="lg"
+        class="w-full rounded-lg"
+        @click="openVerification"
+      >
+        {{ $t('subscription.preview.completeVerification') }}
+      </Button>
+
       <Button
         variant="tertiary"
         size="lg"
@@ -151,6 +160,7 @@
       <Button
         variant="textonly"
         class="cursor-pointer text-center text-xs text-muted-foreground transition-colors hover:bg-none hover:text-base-foreground"
+        :disabled="isLoading"
         @click="$emit('back')"
       >
         {{ $t('subscription.preview.backToAllPlans') }}
@@ -186,6 +196,7 @@ interface Props {
   previewData?: PreviewSubscribeResponse | null
   /** Team-plan checkout (selected slider stop); overrides tier-derived display. */
   teamPlan?: TeamPlanSelection | null
+  actionUrl?: string | null
 }
 
 const {
@@ -193,7 +204,8 @@ const {
   billingCycle = 'monthly',
   isLoading = false,
   previewData = null,
-  teamPlan = null
+  teamPlan = null,
+  actionUrl = null
 } = defineProps<Props>()
 
 defineEmits<{
@@ -205,6 +217,11 @@ const { t, n } = useI18n()
 
 const isFeaturesCollapsed = ref(true)
 
+function openVerification() {
+  if (!actionUrl) return
+  window.open(actionUrl, '_blank', 'noopener,noreferrer')
+}
+
 const tierName = computed(() =>
   teamPlan
     ? t('subscription.teamPlan.name')
diff --git a/src/platform/workspace/components/SubscriptionPanelContentWorkspace.test.ts b/src/platform/workspace/components/SubscriptionPanelContentWorkspace.test.ts
index 3b28aebb824..a59a7e22892 100644
--- a/src/platform/workspace/components/SubscriptionPanelContentWorkspace.test.ts
+++ b/src/platform/workspace/components/SubscriptionPanelContentWorkspace.test.ts
@@ -15,6 +15,13 @@ import type {
 
 import SubscriptionPanelContentWorkspace from './SubscriptionPanelContentWorkspace.vue'
 
+const { mockIsSettingUp, mockSubscriptionActionOperation } = vi.hoisted(() => ({
+  mockIsSettingUp: { value: false },
+  mockSubscriptionActionOperation: {
+    value: undefined as { actionUrl: string } | undefined
+  }
+}))
+
 const RENEWAL_DATE_ISO = '2026-06-20T12:00:00Z'
 const END_DATE_ISO = '2026-01-20T12:00:00Z'
 
@@ -179,7 +186,14 @@ vi.mock('@/platform/workspace/composables/useWorkspaceUI', () => ({
 }))
 
 vi.mock('@/platform/workspace/stores/billingOperationStore', () => ({
-  useBillingOperationStore: () => ({ isSettingUp: false })
+  useBillingOperationStore: () => ({
+    get isSettingUp() {
+      return mockIsSettingUp.value
+    },
+    get subscriptionActionOperation() {
+      return mockSubscriptionActionOperation.value
+    }
+  })
 }))
 
 vi.mock('@/services/dialogService', () => ({
@@ -277,6 +291,41 @@ describe('SubscriptionPanelContentWorkspace', () => {
     }
     mockIsLoading.value = false
     mockError.value = null
+    mockIsSettingUp.value = false
+    mockSubscriptionActionOperation.value = undefined
+  })
+
+  it('keeps verification available in settings without exposing its URL', async () => {
+    const actionUrl = 'https://verify.example/sensitive-token'
+    const open = vi.spyOn(window, 'open').mockReturnValue({} as Window)
+    mockIsSettingUp.value = true
+    mockSubscriptionActionOperation.value = { actionUrl }
+    const { container } = renderComponent()
+
+    expect(open).not.toHaveBeenCalled()
+    expect(container.innerHTML).not.toContain(actionUrl)
+    await userEvent.click(
+      screen.getByRole('button', { name: 'Complete verification' })
+    )
+    expect(open).toHaveBeenCalledWith(
+      actionUrl,
+      '_blank',
+      'noopener,noreferrer'
+    )
+  })
+
+  it('hides verification from users without billing permission', () => {
+    mockIsSettingUp.value = true
+    mockCanManageSubscription.value = false
+    mockSubscriptionActionOperation.value = {
+      actionUrl: 'https://verify.example/sensitive-token'
+    }
+
+    renderComponent()
+
+    expect(
+      screen.queryByRole('button', { name: 'Complete verification' })
+    ).not.toBeInTheDocument()
   })
 
   it('renders the subscribed credit stop price and renewal subtitle', () => {
diff --git a/src/platform/workspace/components/SubscriptionPanelContentWorkspace.vue b/src/platform/workspace/components/SubscriptionPanelContentWorkspace.vue
index 3030489fe3e..7d026c93bd2 100644
--- a/src/platform/workspace/components/SubscriptionPanelContentWorkspace.vue
+++ b/src/platform/workspace/components/SubscriptionPanelContentWorkspace.vue
@@ -9,6 +9,15 @@
         <i class="pi pi-spin pi-spinner" />
         <span>{{ $t('billingOperation.subscriptionProcessing') }}</span>
       </div>
+      <Button
+        v-if="subscriptionActionUrl && permissions.canManageSubscription"
+        variant="primary"
+        size="lg"
+        class="rounded-lg px-4 text-sm font-normal"
+        @click="openSubscriptionVerification"
+      >
+        {{ $t('subscription.preview.completeVerification') }}
+      </Button>
     </div>
 
     <!-- Billing data still loading: avoid rendering a false Free/$0 plan -->
@@ -353,6 +362,14 @@ const { t, n, locale } = useI18n()
 
 const billingOperationStore = useBillingOperationStore()
 const isSettingUp = computed(() => billingOperationStore.isSettingUp)
+const subscriptionActionUrl = computed(
+  () => billingOperationStore.subscriptionActionOperation?.actionUrl ?? null
+)
+
+function openSubscriptionVerification() {
+  if (!subscriptionActionUrl.value) return
+  window.open(subscriptionActionUrl.value, '_blank', 'noopener,noreferrer')
+}
 
 const {
   isActiveSubscription,
diff --git a/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.test.ts b/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.test.ts
index 05a0ea06e14..b746b4b8f91 100644
--- a/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.test.ts
+++ b/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.test.ts
@@ -21,6 +21,7 @@ vi.mock('@/platform/workspace/composables/useSubscriptionCheckout', () => ({
     selectedTierKey: ref(null),
     selectedTeamStop: ref(null),
     selectedBillingCycle: ref('yearly'),
+    activeCheckoutActionUrl: ref(null),
     isPolling: ref(false),
     isTeamCheckout: computed(() => false),
     previewVariant: computed(() => null),
diff --git a/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.vue b/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.vue
index 7371114b09d..c726ea26974 100644
--- a/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.vue
+++ b/src/platform/workspace/components/SubscriptionRequiredDialogContentUnified.vue
@@ -14,6 +14,7 @@
       variant="muted-textonly"
       class="absolute top-2.5 left-2.5 shrink-0 rounded-full text-text-secondary hover:bg-white/10"
       :aria-label="$t('g.back')"
+      :disabled="isPolling"
       @click="handleBackToPricing"
     >
       <i class="pi pi-arrow-left text-xl" />
@@ -64,6 +65,7 @@
         :preview-data="previewData!"
         :team-plan="selectedTeamStop!"
         :is-loading="isSubscribing || isPolling"
+        :action-url="activeCheckoutActionUrl"
         @confirm="handleTeamSubscribe"
         @back="handleBackToPricing"
       />
@@ -73,6 +75,7 @@
         :team-plan="selectedTeamStop!"
         :billing-cycle="selectedBillingCycle"
         :is-loading="isSubscribing || isPolling"
+        :action-url="activeCheckoutActionUrl"
         @add-credit-card="handleTeamSubscribe"
         @back="handleBackToPricing"
       />
@@ -83,6 +86,7 @@
         :tier-key="selectedTierKey!"
         :billing-cycle="selectedBillingCycle"
         :is-loading="isSubscribing || isPolling"
+        :action-url="activeCheckoutActionUrl"
         @add-credit-card="handleAddCreditCard"
         @back="handleBackToPricing"
       />
@@ -91,6 +95,7 @@
         v-else-if="previewVariant === 'personal-change'"
         :preview-data="previewData!"
         :is-loading="isSubscribing || isPolling"
+        :action-url="activeCheckoutActionUrl"
         @confirm="handleConfirmTransition"
         @back="handleBackToPricing"
       />
@@ -144,6 +149,7 @@ const {
   selectedTierKey,
   selectedTeamStop,
   selectedBillingCycle,
+  activeCheckoutActionUrl,
   isPolling,
   isTeamCheckout,
   previewVariant,
@@ -169,7 +175,12 @@ onMounted(() => {
 // Backspace mirrors the back arrow on the confirm step, but never while an
 // editable element is focused (let it delete text there).
 useEventListener(window, 'keydown', (event: KeyboardEvent) => {
-  if (event.key !== 'Backspace' || checkoutStep.value !== 'preview') return
+  if (
+    event.key !== 'Backspace' ||
+    checkoutStep.value !== 'preview' ||
+    isPolling.value
+  )
+    return
   const target = event.target
   if (
     target instanceof HTMLInputElement ||
diff --git a/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.test.ts b/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.test.ts
index 550eb5a5271..c3e1ace8fd9 100644
--- a/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.test.ts
+++ b/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.test.ts
@@ -120,6 +120,7 @@ describe('SubscriptionRequiredDialogContentWorkspace', () => {
       previewData: mockPreviewData,
       selectedTierKey: ref('standard'),
       selectedBillingCycle: ref('yearly'),
+      activeCheckoutActionUrl: ref(null),
       isPolling: ref(false),
       handleSubscribeClick: mockHandleSubscribeClick,
       handleBackToPricing: mockHandleBackToPricing,
diff --git a/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.vue b/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.vue
index ca84db35d35..7c16c920966 100644
--- a/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.vue
+++ b/src/platform/workspace/components/SubscriptionRequiredDialogContentWorkspace.vue
@@ -8,6 +8,7 @@
       variant="muted-textonly"
       class="absolute top-2.5 left-2.5 shrink-0 rounded-full text-text-secondary hover:bg-white/10"
       :aria-label="$t('g.back')"
+      :disabled="isPolling"
       @click="handleBackToPricing"
     >
       <i class="pi pi-arrow-left text-xl" />
@@ -85,6 +86,7 @@
       :tier-key="selectedTierKey!"
       :billing-cycle="selectedBillingCycle"
       :is-loading="isSubscribing || isPolling"
+      :action-url="activeCheckoutActionUrl"
       @add-credit-card="handleAddCreditCard"
       @back="handleBackToPricing"
     />
@@ -98,6 +100,7 @@
       "
       :preview-data="previewData"
       :is-loading="isSubscribing || isPolling"
+      :action-url="activeCheckoutActionUrl"
       @confirm="handleConfirmTransition"
       @back="handleBackToPricing"
     />
@@ -151,6 +154,7 @@ const {
   previewData,
   selectedTierKey,
   selectedBillingCycle,
+  activeCheckoutActionUrl,
   isPolling,
   handleSubscribeClick,
   handleBackToPricing,
diff --git a/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.test.ts b/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.test.ts
index 9abe51b9a42..6bf54c8fe10 100644
--- a/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.test.ts
+++ b/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.test.ts
@@ -1,4 +1,5 @@
 import { render, screen } from '@testing-library/vue'
+import userEvent from '@testing-library/user-event'
 import { describe, expect, it, vi } from 'vitest'
 
 import type {
@@ -130,6 +131,31 @@ describe('SubscriptionTransitionPreviewWorkspace', () => {
     expect(screen.getByText('$82.50')).toBeTruthy()
   })
 
+  it('opens verification only from its button without exposing the URL', async () => {
+    const actionUrl = 'https://verify.example/sensitive-token'
+    const open = vi.spyOn(window, 'open').mockReturnValue({} as Window)
+    const { container } = render(SubscriptionTransitionPreviewWorkspace, {
+      props: {
+        previewData: preview({}),
+        actionUrl
+      },
+      global: globalOptions
+    })
+
+    expect(open).not.toHaveBeenCalled()
+    expect(container.innerHTML).not.toContain(actionUrl)
+    await userEvent.click(
+      screen.getByRole('button', {
+        name: 'subscription.preview.completeVerification'
+      })
+    )
+    expect(open).toHaveBeenCalledWith(
+      actionUrl,
+      '_blank',
+      'noopener,noreferrer'
+    )
+  })
+
   it('renders a scheduled downgrade with the after-that block and no charge', () => {
     render(SubscriptionTransitionPreviewWorkspace, {
       props: {
diff --git a/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.vue b/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.vue
index d34bb3d7d45..efb0119641e 100644
--- a/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.vue
+++ b/src/platform/workspace/components/SubscriptionTransitionPreviewWorkspace.vue
@@ -172,6 +172,16 @@
     <div class="flex flex-col gap-2 pt-8">
       <SubscriptionTermsNote />
 
+      <Button
+        v-if="actionUrl"
+        variant="primary"
+        size="lg"
+        class="w-full rounded-lg"
+        @click="openVerification"
+      >
+        {{ $t('subscription.preview.completeVerification') }}
+      </Button>
+
       <Button
         variant="tertiary"
         size="lg"
@@ -186,6 +196,7 @@
       <Button
         variant="textonly"
         class="cursor-pointer text-center text-xs text-muted-foreground transition-colors hover:bg-none hover:text-base-foreground"
+        :disabled="isLoading"
         @click="$emit('back')"
       >
         {{ $t('subscription.preview.backToAllPlans') }}
@@ -214,13 +225,15 @@ type PersonalTierKey = 'standard' | 'creator' | 'pro'
 const {
   previewData,
   isLoading = false,
-  teamPlan = null
+  teamPlan = null,
+  actionUrl = null
 } = defineProps<{
   previewData: PreviewSubscribeResponse
   isLoading?: boolean
   /** Set for a team credit-commit change: plan name + refill credits come from
    *  the selected slider stop; all proration money stays driven by previewData. */
   teamPlan?: TeamPlanSelection | null
+  actionUrl?: string | null
 }>()
 
 defineEmits<{
@@ -233,6 +246,11 @@ defineEmits<{
 const { t, n } = useI18n()
 const { subscription } = useBillingContext()
 
+function openVerification() {
+  if (!actionUrl) return
+  window.open(actionUrl, '_blank', 'noopener,noreferrer')
+}
+
 function formatTierName(tier: string): string {
   return t(`subscription.tiers.${tier.toLowerCase()}.name`)
 }
diff --git a/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.test.ts b/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.test.ts
index fe45c52f6a7..71e525e3f75 100644
--- a/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.test.ts
+++ b/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.test.ts
@@ -29,7 +29,8 @@ vi.mock('@/composables/billing/useBillingContext', () => ({
 
 vi.mock('@/platform/workspace/stores/billingOperationStore', () => ({
   useBillingOperationStore: () => ({
-    hasPendingOperations: false,
+    hasPendingOperations: true,
+    isAddingCredits: false,
     startOperation: mockStartOperation
   })
 }))
@@ -159,6 +160,12 @@ describe('TopUpCreditsDialogContentWorkspace', () => {
     mockFetchStatus.mockResolvedValue(undefined)
   })
 
+  it('allows a top-up while an unrelated billing operation is pending', () => {
+    renderDialog()
+
+    expect(screen.getByRole('button', { name: 'Add credits' })).toBeEnabled()
+  })
+
   it('refreshes both balance and status after a completed top-up', async () => {
     mockTopup.mockResolvedValue(topupResponse('completed'))
 
diff --git a/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.vue b/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.vue
index 06b205cfe97..c11a30cdb47 100644
--- a/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.vue
+++ b/src/platform/workspace/components/TopUpCreditsDialogContentWorkspace.vue
@@ -183,7 +183,7 @@ const { shouldUseWorkspaceBilling } = useBillingRouting()
 const { permissions } = useWorkspaceUI()
 
 const billingOperationStore = useBillingOperationStore()
-const isPolling = computed(() => billingOperationStore.hasPendingOperations)
+const isPolling = computed(() => billingOperationStore.isAddingCredits)
 
 // Constants
 const PRESET_AMOUNTS = [10, 25, 50, 100]
diff --git a/src/platform/workspace/composables/useSubscriptionCheckout.test.ts b/src/platform/workspace/composables/useSubscriptionCheckout.test.ts
index a305f4d5fe6..47e770c3aaa 100644
--- a/src/platform/workspace/composables/useSubscriptionCheckout.test.ts
+++ b/src/platform/workspace/composables/useSubscriptionCheckout.test.ts
@@ -78,12 +78,15 @@ const {
   mockResubscribe,
   mockToastAdd,
   mockStartOperation,
+  mockGetOperation,
+  mockSubscriptionActionOperation,
   mockTrackBeginCheckout,
   mockTrackBillingEvent,
   mockShowDowngradeToPersonalDialog,
   mockUserId,
   mockIsTeamPlan,
   mockShouldUseWorkspaceBilling,
+  mockSetActiveWorkspaceId,
   mockPermissions,
   mockSubscription
 } = vi.hoisted(() => ({
@@ -96,12 +99,23 @@ const {
   mockResubscribe: vi.fn(),
   mockToastAdd: vi.fn(),
   mockStartOperation: vi.fn(),
+  mockGetOperation: vi.fn(),
+  mockSubscriptionActionOperation: {
+    value: undefined as
+      | {
+          status: 'pending'
+          workspaceId: string
+          actionUrl: string
+        }
+      | undefined
+  },
   mockTrackBeginCheckout: vi.fn(),
   mockTrackBillingEvent: vi.fn(),
   mockShowDowngradeToPersonalDialog: vi.fn(),
   mockUserId: { value: 'user-1' as string | null },
   mockIsTeamPlan: { value: false },
   mockShouldUseWorkspaceBilling: { value: true },
+  mockSetActiveWorkspaceId: vi.fn<(workspaceId: string) => void>(),
   mockPermissions: {
     value: {
       canManageSubscription: true,
@@ -158,10 +172,28 @@ vi.mock('@/platform/workspace/api/workspaceApi', () => ({
 vi.mock('@/platform/workspace/stores/billingOperationStore', () => ({
   useBillingOperationStore: () => ({
     startOperation: mockStartOperation,
-    hasPendingOperations: false
+    getOperation: mockGetOperation,
+    get subscriptionActionOperation() {
+      return mockSubscriptionActionOperation.value
+    }
   })
 }))
 
+vi.mock('@/platform/workspace/stores/teamWorkspaceStore', async () => {
+  const { ref } = await import('vue')
+  const activeWorkspaceId = ref('workspace-1')
+  mockSetActiveWorkspaceId.mockImplementation((workspaceId) => {
+    activeWorkspaceId.value = workspaceId
+  })
+  return {
+    useTeamWorkspaceStore: () => ({
+      get activeWorkspaceId() {
+        return activeWorkspaceId.value
+      }
+    })
+  }
+})
+
 vi.mock('@/config/comfyApi', () => ({
   getComfyPlatformBaseUrl: () => 'https://platform.comfy.org'
 }))
@@ -211,13 +243,19 @@ describe('useSubscriptionCheckout', () => {
   beforeEach(() => {
     setActivePinia(createTestingPinia({ stubActions: false }))
     vi.clearAllMocks()
+    mockSubscriptionActionOperation.value = undefined
     mockPlans.value = allPlans()
     mockFetchPlans.mockResolvedValue(undefined)
-    mockStartOperation.mockResolvedValue({ status: 'succeeded' })
+    mockStartOperation.mockResolvedValue({
+      status: 'succeeded',
+      workspaceId: 'workspace-1'
+    })
+    mockGetOperation.mockReturnValue(undefined)
     mockShowDowngradeToPersonalDialog.mockResolvedValue(null)
     mockUserId.value = 'user-1'
     mockIsTeamPlan.value = false
     mockShouldUseWorkspaceBilling.value = true
+    mockSetActiveWorkspaceId('workspace-1')
     mockPermissions.value = {
       canManageSubscription: true,
       canManageSubscriptionLifecycle: true,
@@ -1242,6 +1280,21 @@ describe('useSubscriptionCheckout', () => {
   })
 
   describe('handleBackToPricing', () => {
+    it('surfaces a subscription operation recovered from billing status', async () => {
+      mockSubscriptionActionOperation.value = {
+        status: 'pending',
+        workspaceId: 'workspace-1',
+        actionUrl: 'https://verify.example/sensitive-token'
+      }
+
+      const checkout = await setup()
+
+      expect(checkout.activeCheckoutActionUrl.value).toBe(
+        'https://verify.example/sensitive-token'
+      )
+      expect(checkout.isPolling.value).toBe(true)
+    })
+
     it('resets to pricing step and clears preview data', async () => {
       const checkout = await setup()
       checkout.checkoutStep.value = 'preview'
@@ -1265,6 +1318,79 @@ describe('useSubscriptionCheckout', () => {
       expect(checkout.checkoutStep.value).toBe('pricing')
       expect(checkout.selectedTeamStop.value).toBeNull()
     })
+
+    it('keeps the active payment preview open while polling', async () => {
+      const checkout = await setup()
+      checkout.checkoutStep.value = 'preview'
+      checkout.selectedTierKey.value = 'standard'
+      mockSubscribe.mockResolvedValueOnce({
+        status: 'pending_payment',
+        billing_op_id: 'op-pending'
+      })
+      mockGetOperation.mockImplementation((opId) =>
+        opId === 'op-pending'
+          ? { status: 'pending', workspaceId: 'workspace-1' }
+          : undefined
+      )
+      let resolveOperation!: (operation: { status: 'failed' }) => void
+      mockStartOperation.mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveOperation = resolve
+          })
+      )
+
+      const payment = checkout.handleAddCreditCard()
+      await vi.waitFor(() => expect(mockStartOperation).toHaveBeenCalledOnce())
+      checkout.handleBackToPricing()
+
+      expect(checkout.checkoutStep.value).toBe('preview')
+
+      resolveOperation({ status: 'failed' })
+      await payment
+    })
+
+    it('does not apply an operation result after switching workspaces', async () => {
+      const checkout = await setup()
+      checkout.selectedTierKey.value = 'standard'
+      mockSubscribe.mockResolvedValueOnce({
+        status: 'pending_payment',
+        billing_op_id: 'op-pending'
+      })
+      mockGetOperation.mockReturnValue({
+        status: 'pending',
+        workspaceId: 'workspace-1',
+        actionUrl: 'https://verify.example/sensitive-token'
+      })
+      let resolveOperation!: (operation: {
+        status: 'succeeded'
+        workspaceId: string
+      }) => void
+      mockStartOperation.mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveOperation = resolve
+          })
+      )
+
+      const payment = checkout.handleAddCreditCard()
+      await vi.waitFor(() =>
+        expect(checkout.activeCheckoutActionUrl.value).not.toBeNull()
+      )
+
+      mockSetActiveWorkspaceId('workspace-2')
+
+      expect(checkout.activeCheckoutActionUrl.value).toBeNull()
+      expect(checkout.isPolling.value).toBe(false)
+
+      resolveOperation({
+        status: 'succeeded',
+        workspaceId: 'workspace-1'
+      })
+      await payment
+
+      expect(checkout.checkoutStep.value).not.toBe('success')
+    })
   })
 
   describe('handleAddCreditCard', () => {
@@ -1392,7 +1518,10 @@ describe('useSubscriptionCheckout', () => {
         status: 'needs_payment_method',
         billing_op_id: 'op-no-url'
       })
-      mockStartOperation.mockResolvedValueOnce({ status: 'succeeded' })
+      mockStartOperation.mockResolvedValueOnce({
+        status: 'succeeded',
+        workspaceId: 'workspace-1'
+      })
       const openSpy = vi.spyOn(window, 'open').mockImplementation(() => null)
 
       await checkout.handleAddCreditCard()
@@ -1421,7 +1550,10 @@ describe('useSubscriptionCheckout', () => {
         billing_op_id: 'op-async-1',
         payment_method_url: 'https://stripe.com/pay'
       })
-      mockStartOperation.mockResolvedValueOnce({ status: 'succeeded' })
+      mockStartOperation.mockResolvedValueOnce({
+        status: 'succeeded',
+        workspaceId: 'workspace-1'
+      })
       const openSpy = vi.spyOn(window, 'open').mockImplementation(() => null)
 
       await checkout.handleAddCreditCard()
diff --git a/src/platform/workspace/composables/useSubscriptionCheckout.ts b/src/platform/workspace/composables/useSubscriptionCheckout.ts
index 2815fc49e75..5dbeaf1cf3b 100644
--- a/src/platform/workspace/composables/useSubscriptionCheckout.ts
+++ b/src/platform/workspace/composables/useSubscriptionCheckout.ts
@@ -22,6 +22,7 @@ import type {
 } from '@/platform/workspace/api/workspaceApi'
 import { useWorkspaceUI } from '@/platform/workspace/composables/useWorkspaceUI'
 import { useBillingOperationStore } from '@/platform/workspace/stores/billingOperationStore'
+import { useTeamWorkspaceStore } from '@/platform/workspace/stores/teamWorkspaceStore'
 import { trackWorkspaceCheckoutStarted } from '@/platform/workspace/utils/workspaceCheckoutTelemetry'
 
 type CheckoutStep = 'pricing' | 'preview' | 'success'
@@ -103,6 +104,7 @@ export function useSubscriptionCheckout(
   const { permissions } = useWorkspaceUI()
   const telemetry = useTelemetry()
   const billingOperationStore = useBillingOperationStore()
+  const workspaceStore = useTeamWorkspaceStore()
 
   const checkoutStep = ref<CheckoutStep>('pricing')
   const isLoadingPreview = ref(false)
@@ -113,7 +115,24 @@ export function useSubscriptionCheckout(
   const selectedTierKey = ref<CheckoutTierKey | null>(null)
   const selectedTeamCheckout = ref<SelectedTeamCheckout | null>(null)
   const selectedBillingCycle = ref<BillingCycle>('yearly')
-  const isPolling = computed(() => billingOperationStore.hasPendingOperations)
+  const activeCheckoutOperationId = ref<string | null>(null)
+  const activeCheckoutOperation = computed(() => {
+    if (!activeCheckoutOperationId.value) {
+      return billingOperationStore.subscriptionActionOperation
+    }
+    const operation = billingOperationStore.getOperation(
+      activeCheckoutOperationId.value
+    )
+    return operation?.workspaceId === workspaceStore.activeWorkspaceId
+      ? operation
+      : undefined
+  })
+  const activeCheckoutActionUrl = computed(
+    () => activeCheckoutOperation.value?.actionUrl ?? null
+  )
+  const isPolling = computed(
+    () => activeCheckoutOperation.value?.status === 'pending'
+  )
   const selectedTeamStop = computed(
     () => selectedTeamCheckout.value?.stop ?? null
   )
@@ -393,9 +412,11 @@ export function useSubscriptionCheckout(
   }
 
   function handleBackToPricing() {
+    if (isPolling.value) return
     checkoutStep.value = 'pricing'
     previewData.value = null
     selectedTeamCheckout.value = null
+    activeCheckoutOperationId.value = null
   }
 
   function handleSuccessClose() {
@@ -552,6 +573,7 @@ export function useSubscriptionCheckout(
     opId: string,
     context: SubscriptionOutcomeContext
   ) {
+    activeCheckoutOperationId.value = opId
     const operation = await billingOperationStore.startOperation(
       opId,
       'subscription',
@@ -562,7 +584,13 @@ export function useSubscriptionCheckout(
         paymentIntentSource
       }
     )
-    if (operation.status === 'succeeded') checkoutStep.value = 'success'
+    if (
+      operation.status === 'succeeded' &&
+      activeCheckoutOperationId.value === opId &&
+      operation.workspaceId === workspaceStore.activeWorkspaceId
+    ) {
+      checkoutStep.value = 'success'
+    }
   }
 
   async function handleTeamSubscription(confirmReactivation = false) {
@@ -690,6 +718,7 @@ export function useSubscriptionCheckout(
     selectedTierKey,
     selectedTeamStop,
     selectedBillingCycle,
+    activeCheckoutActionUrl,
     isPolling,
     isTeamCheckout,
     previewVariant,
diff --git a/src/platform/workspace/composables/useWorkspaceBilling.test.ts b/src/platform/workspace/composables/useWorkspaceBilling.test.ts
index 966f62688c2..0411fe023b7 100644
--- a/src/platform/workspace/composables/useWorkspaceBilling.test.ts
+++ b/src/platform/workspace/composables/useWorkspaceBilling.test.ts
@@ -28,7 +28,9 @@ const mockBillingPlans = vi.hoisted(() => ({
 
 const mockShow = vi.hoisted(() => vi.fn())
 const mockStartOperation = vi.hoisted(() => vi.fn())
+const mockGetOperation = vi.hoisted(() => vi.fn())
 const mockSetWorkspaceBillingRail = vi.hoisted(() => vi.fn())
+const mockActiveWorkspaceId = vi.hoisted(() => ({ value: 'workspace-1' }))
 
 // Hoisted so the vi.mock factory below can reference it: a plain top-level
 // const is in its temporal dead zone when the hoisted factory runs under
@@ -67,13 +69,16 @@ vi.mock(
 
 vi.mock('@/platform/workspace/stores/billingOperationStore', () => ({
   useBillingOperationStore: () => ({
+    getOperation: mockGetOperation,
     startOperation: mockStartOperation
   })
 }))
 
 vi.mock('@/platform/workspace/stores/teamWorkspaceStore', () => ({
   useTeamWorkspaceStore: () => ({
-    activeWorkspace: { id: 'workspace-1' },
+    get activeWorkspace() {
+      return { id: mockActiveWorkspaceId.value }
+    },
     setWorkspaceBillingRail: mockSetWorkspaceBillingRail
   })
 }))
@@ -149,6 +154,7 @@ const subscribeResponses = [
 describe('useWorkspaceBilling', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockActiveWorkspaceId.value = 'workspace-1'
     mockBillingPlans.plans.value = []
     mockBillingPlans.currentPlanSlug.value = null
     mockBillingPlans.error.value = null
@@ -255,6 +261,68 @@ describe('useWorkspaceBilling', () => {
       )
     })
 
+    it('recovers a pending subscription operation from billing status', async () => {
+      const actionUrl = 'https://invoice.stripe.com/sensitive-token'
+      mockWorkspaceApi.getBillingStatus.mockResolvedValue({
+        ...activeStatus,
+        billing_status: 'pending_payment',
+        pending_billing_op_id: 'op-recovered',
+        action_url: actionUrl
+      } satisfies BillingStatusResponse)
+
+      const billing = setupBilling()
+      await billing.fetchStatus()
+
+      expect(mockStartOperation).toHaveBeenCalledWith(
+        'op-recovered',
+        'subscription',
+        undefined,
+        actionUrl
+      )
+    })
+
+    it('does not restart an operation recovered by an earlier status read', async () => {
+      mockWorkspaceApi.getBillingStatus.mockResolvedValue({
+        ...activeStatus,
+        billing_status: 'pending_payment',
+        pending_billing_op_id: 'op-recovered'
+      } satisfies BillingStatusResponse)
+      mockGetOperation
+        .mockReturnValueOnce(undefined)
+        .mockReturnValue({ status: 'pending' })
+
+      const billing = setupBilling()
+      await billing.fetchStatus()
+      await billing.fetchStatus()
+
+      expect(mockStartOperation).toHaveBeenCalledOnce()
+      expect(mockStartOperation).toHaveBeenCalledWith(
+        'op-recovered',
+        'subscription',
+        undefined,
+        undefined
+      )
+    })
+
+    it('does not recover an operation from a stale workspace response', async () => {
+      const status = createDeferred<BillingStatusResponse>()
+      mockWorkspaceApi.getBillingStatus.mockReturnValue(status.promise)
+      const billing = setupBilling()
+
+      const fetch = billing.fetchStatus()
+      mockActiveWorkspaceId.value = 'workspace-2'
+      status.resolve({
+        ...activeStatus,
+        billing_status: 'pending_payment',
+        pending_billing_op_id: 'op-workspace-1',
+        action_url: 'https://invoice.stripe.com/sensitive-token'
+      })
+      await fetch
+
+      expect(mockStartOperation).not.toHaveBeenCalled()
+      expect(billing.subscription.value).toBeNull()
+    })
+
     it("keeps a 'scheduled' subscription on the active treatment", async () => {
       mockWorkspaceApi.getBillingStatus.mockResolvedValue({
         ...activeStatus,
diff --git a/src/platform/workspace/composables/useWorkspaceBilling.ts b/src/platform/workspace/composables/useWorkspaceBilling.ts
index 27600d02b65..e7149f3486e 100644
--- a/src/platform/workspace/composables/useWorkspaceBilling.ts
+++ b/src/platform/workspace/composables/useWorkspaceBilling.ts
@@ -160,14 +160,27 @@ export function useWorkspaceBilling(): BillingState & BillingActions {
     error.value = null
     try {
       const status = await workspaceApi.getBillingStatus()
-      if (requestId === latestBillingReadIds.status) {
-        statusData.value = status
-        if (workspaceId && status.billing_rail) {
-          workspaceStore.setWorkspaceBillingRail(
-            workspaceId,
-            status.billing_rail
-          )
-        }
+      if (
+        requestId !== latestBillingReadIds.status ||
+        workspaceId !== workspaceStore.activeWorkspace?.id
+      ) {
+        return
+      }
+
+      statusData.value = status
+      if (workspaceId && status.billing_rail) {
+        workspaceStore.setWorkspaceBillingRail(workspaceId, status.billing_rail)
+      }
+      if (
+        status.pending_billing_op_id &&
+        !billingOperationStore.getOperation(status.pending_billing_op_id)
+      ) {
+        void billingOperationStore.startOperation(
+          status.pending_billing_op_id,
+          'subscription',
+          undefined,
+          status.action_url
+        )
       }
     } catch (err) {
       if (requestId === latestBillingReadIds.status) {
diff --git a/src/platform/workspace/stores/billingOperationStore.test.ts b/src/platform/workspace/stores/billingOperationStore.test.ts
index 76af6b9297f..8ce63d31c2f 100644
--- a/src/platform/workspace/stores/billingOperationStore.test.ts
+++ b/src/platform/workspace/stores/billingOperationStore.test.ts
@@ -1,5 +1,6 @@
 import { setActivePinia, createPinia } from 'pinia'
 import { beforeEach, describe, expect, it, vi, afterEach } from 'vitest'
+import { ref } from 'vue'
 
 import type { BillingOpStatusResponse } from '@/platform/workspace/api/workspaceApi'
 
@@ -62,9 +63,13 @@ vi.mock('@/platform/telemetry', () => ({
 }))
 
 const mockUpdateActiveWorkspace = vi.fn()
+const mockActiveWorkspaceId = ref('workspace-1')
 
 vi.mock('@/platform/workspace/stores/teamWorkspaceStore', () => ({
   useTeamWorkspaceStore: () => ({
+    get activeWorkspaceId() {
+      return mockActiveWorkspaceId.value
+    },
     updateActiveWorkspace: mockUpdateActiveWorkspace
   })
 }))
@@ -78,6 +83,7 @@ describe('billingOperationStore', () => {
     setActivePinia(createPinia())
     vi.clearAllMocks()
     vi.useFakeTimers()
+    mockActiveWorkspaceId.value = 'workspace-1'
   })
 
   afterEach(() => {
@@ -103,6 +109,46 @@ describe('billingOperationStore', () => {
       expect(store.hasPendingOperations).toBe(true)
     })
 
+    it('exposes a validated recovered action before the first poll completes', () => {
+      vi.mocked(workspaceApi.getBillingOpStatus).mockReturnValue(
+        new Promise(() => {})
+      )
+
+      const store = useBillingOperationStore()
+      void store.startOperation(
+        'op-recovered',
+        'subscription',
+        undefined,
+        'https://invoice.stripe.com/sensitive-token'
+      )
+
+      expect(store.subscriptionActionOperation).toMatchObject({
+        opId: 'op-recovered',
+        actionUrl: 'https://invoice.stripe.com/sensitive-token',
+        authenticationRequiredSeen: true
+      })
+    })
+
+    it('rejects an insecure recovered action URL', () => {
+      vi.mocked(workspaceApi.getBillingOpStatus).mockReturnValue(
+        new Promise(() => {})
+      )
+
+      const store = useBillingOperationStore()
+      void store.startOperation(
+        'op-recovered',
+        'subscription',
+        undefined,
+        'http://invoice.stripe.com/sensitive-token'
+      )
+
+      expect(store.getOperation('op-recovered')).toMatchObject({
+        actionUrl: null,
+        authenticationRequiredSeen: false
+      })
+      expect(store.subscriptionActionOperation).toBeUndefined()
+    })
+
     it('does not create duplicate operations', () => {
       vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
         id: 'op-1',
@@ -435,7 +481,23 @@ describe('billingOperationStore', () => {
   })
 
   describe('polling timeout', () => {
-    it('times out after 2 minutes and shows error toast', async () => {
+    it('times out a subscription while its workspace is inactive', async () => {
+      vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
+        id: 'op-1',
+        status: 'pending',
+        started_at: new Date().toISOString()
+      })
+
+      const store = useBillingOperationStore()
+      void store.startOperation('op-1', 'subscription')
+      mockActiveWorkspaceId.value = 'workspace-2'
+
+      await vi.advanceTimersByTimeAsync(5 * 60_000 + 8001)
+
+      expect(store.getOperation('op-1')?.status).toBe('timeout')
+    })
+
+    it('allows five minutes to discover a subscription action', async () => {
       vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
         id: 'op-1',
         status: 'pending',
@@ -448,6 +510,9 @@ describe('billingOperationStore', () => {
       await vi.advanceTimersByTimeAsync(0)
 
       await vi.advanceTimersByTimeAsync(121_000)
+      expect(store.getOperation('op-1')?.status).toBe('pending')
+
+      await vi.advanceTimersByTimeAsync(181_000)
       await vi.runAllTimersAsync()
 
       const operation = store.getOperation('op-1')
@@ -460,12 +525,180 @@ describe('billingOperationStore', () => {
       })
     })
 
-    it('shows topup timeout message for topup operations', async () => {
-      vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
+    it('keeps a valid action URL pending past discovery and clears it on success', async () => {
+      const actionUrl = 'https://verify.example/sensitive-token'
+      vi.mocked(workspaceApi.getBillingOpStatus)
+        .mockResolvedValueOnce({
+          id: 'op-1',
+          status: 'pending',
+          started_at: new Date().toISOString(),
+          action_url: actionUrl
+        })
+        .mockResolvedValue({
+          id: 'op-1',
+          status: 'pending',
+          started_at: new Date().toISOString()
+        })
+
+      const store = useBillingOperationStore()
+      const terminal = store.startOperation('op-1', 'subscription')
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect(store.getOperation('op-1')?.actionUrl).toBe(actionUrl)
+      await vi.advanceTimersByTimeAsync(30_000)
+      expect(store.getOperation('op-1')).toMatchObject({
+        status: 'pending',
+        actionUrl: null,
+        authenticationRequiredSeen: true
+      })
+
+      await vi.advanceTimersByTimeAsync(4.5 * 60_000)
+      expect(store.getOperation('op-1')?.status).toBe('pending')
+
+      vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValueOnce({
+        id: 'op-1',
+        status: 'succeeded',
+        started_at: new Date().toISOString()
+      })
+      await vi.advanceTimersByTimeAsync(30_000)
+      expect((await terminal).status).toBe('succeeded')
+      expect(store.getOperation('op-1')?.actionUrl).toBeNull()
+      expect(JSON.stringify(mockToastAdd.mock.calls)).not.toContain(actionUrl)
+      expect(JSON.stringify(mockTrackBillingEvent.mock.calls)).not.toContain(
+        actionUrl
+      )
+    })
+
+    it('rejects an action URL received after the discovery deadline', async () => {
+      const actionUrl = 'https://verify.example/sensitive-token'
+      let resolveStatus!: (response: BillingOpStatusResponse) => void
+      vi.mocked(workspaceApi.getBillingOpStatus).mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveStatus = resolve
+          })
+      )
+
+      const store = useBillingOperationStore()
+      const terminal = store.startOperation('op-1', 'subscription')
+      await vi.advanceTimersByTimeAsync(5 * 60_000 + 1)
+
+      resolveStatus({
         id: 'op-1',
         status: 'pending',
+        started_at: new Date().toISOString(),
+        action_url: actionUrl
+      })
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect((await terminal).status).toBe('timeout')
+      expect(store.getOperation('op-1')?.actionUrl).toBeNull()
+      expect(JSON.stringify([...store.operations.values()])).not.toContain(
+        actionUrl
+      )
+    })
+
+    it('accepts a terminal response received after the discovery deadline', async () => {
+      let resolveStatus!: (response: BillingOpStatusResponse) => void
+      vi.mocked(workspaceApi.getBillingOpStatus).mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveStatus = resolve
+          })
+      )
+
+      const store = useBillingOperationStore()
+      const terminal = store.startOperation('op-1', 'subscription')
+      await vi.advanceTimersByTimeAsync(5 * 60_000 + 1)
+
+      resolveStatus({
+        id: 'op-1',
+        status: 'succeeded',
         started_at: new Date().toISOString()
       })
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect((await terminal).status).toBe('succeeded')
+    })
+
+    it('ignores non-HTTPS action URLs', async () => {
+      vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
+        id: 'op-1',
+        status: 'pending',
+        started_at: new Date().toISOString(),
+        action_url: 'http://verify.example/sensitive-token'
+      })
+
+      const store = useBillingOperationStore()
+      void store.startOperation('op-1', 'subscription')
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect(store.getOperation('op-1')?.actionUrl).toBeNull()
+    })
+
+    it('only exposes subscription actions for the active workspace', async () => {
+      const actionUrl = 'https://verify.example/sensitive-token'
+      vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
+        id: 'op-1',
+        status: 'pending',
+        started_at: new Date().toISOString(),
+        action_url: actionUrl
+      })
+
+      const store = useBillingOperationStore()
+      void store.startOperation('op-1', 'subscription')
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect(store.subscriptionActionOperation?.actionUrl).toBe(actionUrl)
+      expect(store.isSettingUp).toBe(true)
+
+      mockActiveWorkspaceId.value = 'workspace-2'
+
+      expect(store.subscriptionActionOperation).toBeUndefined()
+      expect(store.isSettingUp).toBe(false)
+    })
+
+    it('ignores a response that completes after switching workspaces', async () => {
+      const actionUrl = 'https://verify.example/sensitive-token'
+      let resolveStatus!: (response: BillingOpStatusResponse) => void
+      vi.mocked(workspaceApi.getBillingOpStatus).mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            resolveStatus = resolve
+          })
+      )
+
+      const store = useBillingOperationStore()
+      void store.startOperation('op-1', 'subscription')
+      mockActiveWorkspaceId.value = 'workspace-2'
+
+      resolveStatus({
+        id: 'op-1',
+        status: 'pending',
+        started_at: new Date().toISOString(),
+        action_url: actionUrl
+      })
+      await vi.advanceTimersByTimeAsync(0)
+
+      expect(store.getOperation('op-1')).toMatchObject({
+        status: 'pending',
+        actionUrl: null
+      })
+      expect(store.subscriptionActionOperation).toBeUndefined()
+    })
+
+    it('shows topup timeout message for topup operations', async () => {
+      const startedAt = Date.now()
+      vi.mocked(workspaceApi.getBillingOpStatus).mockImplementation(
+        async () => ({
+          id: 'op-1',
+          status:
+            Date.now() - startedAt > 120_000
+              ? ('succeeded' as const)
+              : ('pending' as const),
+          started_at: new Date().toISOString()
+        })
+      )
 
       const store = useBillingOperationStore()
       void store.startOperation('op-1', 'topup')
@@ -583,11 +816,17 @@ describe('billingOperationStore', () => {
     })
 
     it('resolves with a timeout operation after 2 minutes, no toast', async () => {
-      vi.mocked(workspaceApi.getBillingOpStatus).mockResolvedValue({
-        id: 'op-1',
-        status: 'pending',
-        started_at: new Date().toISOString()
-      })
+      const startedAt = Date.now()
+      vi.mocked(workspaceApi.getBillingOpStatus).mockImplementation(
+        async () => ({
+          id: 'op-1',
+          status:
+            Date.now() - startedAt > 120_000
+              ? ('succeeded' as const)
+              : ('pending' as const),
+          started_at: new Date().toISOString()
+        })
+      )
 
       const store = useBillingOperationStore()
       const terminal = store.startOperation('op-1', 'cancel')
diff --git a/src/platform/workspace/stores/billingOperationStore.ts b/src/platform/workspace/stores/billingOperationStore.ts
index 1c284f3457b..6f3815e8fbc 100644
--- a/src/platform/workspace/stores/billingOperationStore.ts
+++ b/src/platform/workspace/stores/billingOperationStore.ts
@@ -20,8 +20,11 @@ import { useDialogStore } from '@/stores/dialogStore'
 
 const INITIAL_INTERVAL_MS = 1000
 const MAX_INTERVAL_MS = 8000
+const ACTION_REQUIRED_INTERVAL_MS = 30_000
 const BACKOFF_MULTIPLIER = 1.5
-const TIMEOUT_MS = 120_000 // 2 minutes
+const TIMEOUT_MS = 120_000
+const SUBSCRIPTION_ACTION_DISCOVERY_TIMEOUT_MS = 5 * 60_000
+const SUBSCRIPTION_AUTHENTICATION_TIMEOUT_MS = 23 * 60 * 60_000
 
 type OperationType = 'subscription' | 'topup' | 'cancel'
 type OperationStatus = 'pending' | 'succeeded' | 'failed' | 'timeout'
@@ -44,6 +47,9 @@ interface BillingOperation {
   status: OperationStatus
   errorMessage: string | null
   startedAt: number
+  actionUrl: string | null
+  authenticationRequiredSeen: boolean
+  workspaceId: string | null
   tier?: SubscriptionCheckoutTier
   cycle?: BillingCycle
   checkoutType?: SubscriptionCheckoutType
@@ -54,6 +60,7 @@ interface BillingOperation {
 type TerminalResolver = (operation: BillingOperation) => void
 
 export const useBillingOperationStore = defineStore('billingOperation', () => {
+  const workspaceStore = useTeamWorkspaceStore()
   const operations = ref<Map<string, BillingOperation>>(new Map())
   const timeouts = new Map<string, ReturnType<typeof setTimeout>>()
   const intervals = new Map<string, number>()
@@ -67,7 +74,10 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
 
   const isSettingUp = computed(() =>
     [...operations.value.values()].some(
-      (op) => op.status === 'pending' && op.type === 'subscription'
+      (op) =>
+        op.status === 'pending' &&
+        op.type === 'subscription' &&
+        op.workspaceId === workspaceStore.activeWorkspaceId
     )
   )
 
@@ -77,6 +87,16 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
     )
   )
 
+  const subscriptionActionOperation = computed(() =>
+    [...operations.value.values()].find(
+      (op) =>
+        op.status === 'pending' &&
+        op.type === 'subscription' &&
+        op.workspaceId === workspaceStore.activeWorkspaceId &&
+        op.actionUrl !== null
+    )
+  )
+
   function getOperation(opId: string) {
     return operations.value.get(opId)
   }
@@ -84,19 +104,24 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
   function startOperation(
     opId: string,
     type: OperationType,
-    metadata?: StartOperationMetadata
+    metadata?: StartOperationMetadata,
+    initialActionUrl?: string
   ): Promise<BillingOperation> {
     const existing = operations.value.get(opId)
     if (existing) {
       return terminalPromises.get(opId) ?? Promise.resolve(existing)
     }
 
+    const actionUrl = validateActionUrl(initialActionUrl)
     const operation: BillingOperation = {
       opId,
       type,
       status: 'pending',
       errorMessage: null,
       startedAt: Date.now(),
+      actionUrl,
+      authenticationRequiredSeen: actionUrl !== null,
+      workspaceId: workspaceStore.activeWorkspaceId,
       tier: metadata?.tier,
       cycle: metadata?.cycle,
       checkoutType: metadata?.checkoutType,
@@ -136,13 +161,22 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
     const operation = operations.value.get(opId)
     if (!operation || operation.status !== 'pending') return
 
-    if (Date.now() - operation.startedAt > TIMEOUT_MS) {
-      handleTimeout(opId)
+    if (stopIfTimedOut(opId, operation)) return
+
+    if (operation.workspaceId !== workspaceStore.activeWorkspaceId) {
+      scheduleNextPoll(opId)
       return
     }
 
     try {
       const response = await workspaceApi.getBillingOpStatus(opId)
+      const currentOperation = operations.value.get(opId)
+      if (currentOperation !== operation) return
+      if (operation.workspaceId !== workspaceStore.activeWorkspaceId) {
+        if (stopIfTimedOut(opId, operation)) return
+        scheduleNextPoll(opId)
+        return
+      }
 
       if (response.status === 'succeeded') {
         await handleSuccess(opId)
@@ -154,28 +188,68 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
         return
       }
 
+      if (stopIfTimedOut(opId, operation)) return
+
+      updateOperationActionUrl(opId, validateActionUrl(response.action_url))
       scheduleNextPoll(opId)
     } catch {
-      if (Date.now() - operation.startedAt > TIMEOUT_MS) {
-        handleTimeout(opId)
-        return
-      }
+      const currentOperation = operations.value.get(opId)
+      if (currentOperation !== operation) return
+      if (stopIfTimedOut(opId, currentOperation)) return
       scheduleNextPoll(opId)
     }
   }
 
   function scheduleNextPoll(opId: string) {
-    const currentInterval = intervals.get(opId) ?? INITIAL_INTERVAL_MS
-    const nextInterval = Math.min(
-      currentInterval * BACKOFF_MULTIPLIER,
-      MAX_INTERVAL_MS
-    )
+    const operation = operations.value.get(opId)
+    if (!operation || operation.status !== 'pending') return
+    const nextInterval = operation.authenticationRequiredSeen
+      ? ACTION_REQUIRED_INTERVAL_MS
+      : Math.min(
+          (intervals.get(opId) ?? INITIAL_INTERVAL_MS) * BACKOFF_MULTIPLIER,
+          MAX_INTERVAL_MS
+        )
     intervals.set(opId, nextInterval)
 
     const timeoutId = setTimeout(() => void poll(opId), nextInterval)
     timeouts.set(opId, timeoutId)
   }
 
+  function validateActionUrl(value: string | undefined): string | null {
+    if (!value) return null
+    try {
+      const url = new URL(value)
+      return url.protocol === 'https:' ? value : null
+    } catch {
+      return null
+    }
+  }
+
+  function hasTimedOut(operation: BillingOperation): boolean {
+    const elapsed = Date.now() - operation.startedAt
+    if (operation.type !== 'subscription') return elapsed > TIMEOUT_MS
+    return operation.authenticationRequiredSeen
+      ? elapsed > SUBSCRIPTION_AUTHENTICATION_TIMEOUT_MS
+      : elapsed > SUBSCRIPTION_ACTION_DISCOVERY_TIMEOUT_MS
+  }
+
+  function stopIfTimedOut(opId: string, operation: BillingOperation): boolean {
+    if (!hasTimedOut(operation)) return false
+    handleTimeout(opId)
+    return true
+  }
+
+  function updateOperationActionUrl(opId: string, actionUrl: string | null) {
+    const operation = operations.value.get(opId)
+    if (!operation || operation.status !== 'pending') return
+    operations.value = new Map(operations.value).set(opId, {
+      ...operation,
+      actionUrl,
+      authenticationRequiredSeen:
+        operation.authenticationRequiredSeen || actionUrl !== null
+    })
+  }
+
   async function handleSuccess(opId: string) {
     const operation = operations.value.get(opId)
     if (!operation) return
@@ -388,7 +462,7 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
     const operation = operations.value.get(opId)
     if (!operation) return
 
-    const updated = { ...operation, status, errorMessage }
+    const updated = { ...operation, status, errorMessage, actionUrl: null }
     operations.value = new Map(operations.value).set(opId, updated)
   }
 
@@ -422,6 +496,7 @@ export const useBillingOperationStore = defineStore('billingOperation', () => {
     hasPendingOperations,
     isSettingUp,
     isAddingCredits,
+    subscriptionActionOperation,
     getOperation,
     startOperation,
     clearOperation