diff --git a/apps/app-frontend/src/App.vue b/apps/app-frontend/src/App.vue
index 86f38a1141..64c4c433a2 100644
--- a/apps/app-frontend/src/App.vue
+++ b/apps/app-frontend/src/App.vue
@@ -15,6 +15,7 @@ import {
 	LeftArrowIcon,
 	LibraryIcon,
 	NotepadTextIcon,
+	OrganizationIcon,
 	RefreshCwIcon,
 	RightArrowIcon,
 	SettingsIcon,
@@ -582,9 +583,15 @@ watch(incompatibilityWarningModal, (modal) => {
 	}
 })
 
-setupAuthProvider(credentials, async (_redirectPath) => {
-	await signIn()
-})
+setupAuthProvider(
+	credentials,
+	async (_redirectPath) => {
+		await signIn()
+	},
+	async () => {
+		await fetchCredentials()
+	},
+)
 
 async function validateSession(sessionToken) {
 	try {
@@ -1280,6 +1287,13 @@ provideAppUpdateDownloadProgress(appUpdateDownload)
 			<NavButton v-tooltip.right="'Skin selector'" to="/skins">
 				<ChangeSkinIcon />
 			</NavButton>
+			<NavButton
+				v-if="themeStore.featureFlags.your_projects_tab"
+				v-tooltip.right="'Your projects'"
+				to="/your-projects"
+			>
+				<OrganizationIcon />
+			</NavButton>
 			<NavButton
 				v-tooltip.right="'Library'"
 				to="/library"
diff --git a/apps/app-frontend/src/helpers/mr_auth.ts b/apps/app-frontend/src/helpers/mr_auth.ts
index d28ad63db4..b6df3740df 100644
--- a/apps/app-frontend/src/helpers/mr_auth.ts
+++ b/apps/app-frontend/src/helpers/mr_auth.ts
@@ -24,6 +24,44 @@ export async function get(): Promise<ModrinthCredentials | null> {
 	return await invoke('plugin:mr-auth|get')
 }
 
+export type UserProject = {
+	id: string
+	slug: string | null
+	name: string
+	summary: string
+	description: string
+	icon_url: string | null
+	color: number | null
+	status: string
+	project_types: string[]
+	organization: string | null
+	downloads: number
+	followers: number
+}
+
+export type UserOrganization = {
+	id: string
+	slug: string
+	name: string
+	description: string
+	icon_url: string | null
+	color: number | null
+}
+
+export type UserAllProjects = {
+	projects: UserProject[]
+	organizations: Record<string, UserOrganization>
+}
+
+/**
+ * Returns every project the signed-in user can access — their own projects plus
+ * every project owned by an organization they belong to — including non-public
+ * statuses (unlisted, private). Resolves to `null` when no user is signed in.
+ */
+export async function getUserProjects(): Promise<UserAllProjects | null> {
+	return await invoke('plugin:mr-auth|get_user_projects')
+}
+
 export async function cancelLogin(): Promise<void> {
 	return await invoke('plugin:mr-auth|cancel_modrinth_login')
 }
diff --git a/apps/app-frontend/src/pages/Index.vue b/apps/app-frontend/src/pages/Index.vue
index 69850eda17..cb9ccc91d1 100644
--- a/apps/app-frontend/src/pages/Index.vue
+++ b/apps/app-frontend/src/pages/Index.vue
@@ -1,13 +1,18 @@
 <script setup>
 import { DownloadIcon, PlayIcon } from '@modrinth/assets'
-import { ButtonStyled, injectNotificationManager } from '@modrinth/ui'
+import { ButtonStyled, injectAuth, injectNotificationManager } from '@modrinth/ui'
 import dayjs from 'dayjs'
 import { computed, onMounted, onUnmounted, ref, watch } from 'vue'
 import { useRoute } from 'vue-router'
 
 import RecentWorldsList from '@/components/ui/world/RecentWorldsList.vue'
 import { trackEvent } from '@/helpers/analytics'
-import { get_project, get_search_results, get_version_many } from '@/helpers/cache.js'
+import {
+	get_organization,
+	get_project,
+	get_search_results,
+	get_version_many,
+} from '@/helpers/cache.js'
 import { instance_listener, process_listener } from '@/helpers/events'
 import { list, run, update_managed_modrinth_version } from '@/helpers/instance'
 import { injectContentInstall } from '@/providers/content-install'
@@ -15,11 +20,14 @@ import { useBreadcrumbs } from '@/store/breadcrumbs'
 
 const { handleError } = injectNotificationManager()
 const { install: installVersion } = injectContentInstall()
+const auth = injectAuth()
 
 const featuredModpacks = ref([])
 const featuredMods = ref([])
 const filter = ref('')
 
+let featuredLoadId = 0
+
 const route = useRoute()
 const breadcrumbs = useBreadcrumbs()
 
@@ -77,9 +85,68 @@ const fetchFeaturedProjects = async () => {
 	}
 }
 
+/**
+ * Hydrates featured packs that the search index can't return.
+ *
+ * Search only indexes public (approved/archived) projects, so a featured pack
+ * that is private or unlisted never appears in the hits. Fetching the project
+ * directly is authenticated, so it resolves for members who can see the pack
+ * and fails for everyone else.
+ */
+const hydrateNonPublicFeatured = async (hits) => {
+	const found = new Set(hits.map((hit) => hit.project_id))
+	const missing = featuredProjects.value.filter((p) => !found.has(p.id))
+
+	if (missing.length === 0) {
+		return []
+	}
+
+	// Bypass the cache: whether these resolve depends on the current session,
+	// so a copy cached while signed in must not leak into a signed-out view.
+	// A featured pack the current user has no access to is expected to fail
+	// here, so swallow the error instead of surfacing it as an app error.
+	const projects = await Promise.all(
+		missing.map((p) => get_project(p.id, 'bypass').catch(() => null)),
+	)
+
+	return await Promise.all(
+		projects
+			.filter((project) => project?.project_type === 'modpack')
+			.map(async (project) => {
+				const organization = project.organization
+					? await get_organization(project.organization).catch(() => null)
+					: null
+
+				return {
+					project_id: project.id,
+					project_type: project.project_type,
+					slug: project.slug,
+					title: project.title,
+					description: project.description,
+					icon_url: project.icon_url,
+					author: organization?.name,
+					// Marks an entry the search index wouldn't return, so it can
+					// be dropped the moment the session that revealed it ends.
+					nonPublic: true,
+				}
+			}),
+	)
+}
+
 const getFeaturedModpacks = async () => {
+	// Guards against overlapping loads (mount plus a sign-in) clobbering each
+	// other, since which packs resolve depends on the session in effect.
+	const loadId = ++featuredLoadId
+
 	await fetchFeaturedProjects()
 
+	if (featuredProjects.value.length === 0) {
+		if (loadId === featuredLoadId) {
+			featuredModpacks.value = []
+		}
+		return
+	}
+
 	// Create structured filters exactly like in the browse file
 	const filters = []
 
@@ -88,11 +155,7 @@ const getFeaturedModpacks = async () => {
 
 	// Project ID filter - each project_id is its own entry in the inner array,
 	// which the Modrinth search API treats as OR (there is no `OR` keyword)
-	if (featuredProjects.value.length > 0) {
-		filters.push(featuredProjects.value.map((p) => `project_id:${p.id}`))
-	} else {
-		filters.push(['project_id:none'])
-	}
+	filters.push(featuredProjects.value.map((p) => `project_id:${p.id}`))
 
 	// Build the facets parameter in the format the API expects
 	const facetsParam = JSON.stringify(filters)
@@ -101,57 +164,87 @@ const getFeaturedModpacks = async () => {
 	const query = `?facets=${facetsParam}&limit=10&index=follows${filter.value ? `&query=${filter.value}` : ''}`
 
 	const response = await get_search_results(query)
+	const hits = response?.result?.hits ?? []
+	const entries = [...hits, ...(await hydrateNonPublicFeatured(hits))]
 
-	if (response?.result?.hits) {
-		const instances = (await list().catch(handleError)) ?? []
+	if (entries.length === 0) {
+		if (loadId === featuredLoadId) {
+			featuredModpacks.value = []
+		}
+		return
+	}
 
-		const latestVersions = await Promise.all(
-			response.result.hits.map(async (hit) => {
-				try {
-					const project = await get_project(hit.project_id)
+	const instances = (await list().catch(handleError)) ?? []
 
-					if (!project?.versions?.length) {
-						return null
-					}
+	const latestVersions = await Promise.all(
+		entries.map(async (entry) => {
+			try {
+				const project = await get_project(entry.project_id)
 
-					const versions = await get_version_many(project.versions)
-					return versions.sort((a, b) => new Date(b.date_published) - new Date(a.date_published))[0]
-				} catch (error) {
-					handleError(error)
+				if (!project?.versions?.length) {
 					return null
 				}
-			}),
-		)
 
-		featuredModpacks.value = response.result.hits.map((hit, index) => {
-			const instance = instances.find((p) => p.link?.project_id === hit.project_id)
+				const versions = await get_version_many(project.versions)
+				return versions.sort((a, b) => new Date(b.date_published) - new Date(a.date_published))[0]
+			} catch (error) {
+				handleError(error)
+				return null
+			}
+		}),
+	)
 
-			const isInstalled = !!instance
-			installed.value[hit.project_id] = isInstalled
+	if (loadId !== featuredLoadId) {
+		return
+	}
 
-			if (isInstalled && latestVersions[index]) {
-				const currentVersion = instance.link.version_id
-				const latestVersion = latestVersions[index].id
-				hasUpdate.value[hit.project_id] = currentVersion !== latestVersion
-			}
+	featuredModpacks.value = entries.map((entry, index) => {
+		const instance = instances.find((p) => p.link?.project_id === entry.project_id)
 
-			return {
-				...hit,
-				project_id: hit.project_id,
-				project_type: hit.project_type,
-				slug: hit.slug,
-				latestVersionId: latestVersions[index]?.id,
-			}
-		})
+		const isInstalled = !!instance
+		installed.value[entry.project_id] = isInstalled
 
-		if (!selectedModpackId.value && featuredModpacks.value.length > 0) {
-			selectedModpackId.value = featuredModpacks.value[0].project_id
+		if (isInstalled && latestVersions[index]) {
+			const currentVersion = instance.link.version_id
+			const latestVersion = latestVersions[index].id
+			hasUpdate.value[entry.project_id] = currentVersion !== latestVersion
 		}
-	} else {
-		featuredModpacks.value = []
+
+		return {
+			...entry,
+			project_id: entry.project_id,
+			project_type: entry.project_type,
+			slug: entry.slug,
+			latestVersionId: latestVersions[index]?.id,
+		}
+	})
+
+	if (!selectedModpackId.value && featuredModpacks.value.length > 0) {
+		selectedModpackId.value = featuredModpacks.value[0].project_id
 	}
 }
 
+// Which featured packs resolve depends on the session, so reload when the user
+// signs in or out. Without this, a user who signs in while sitting on the home
+// screen wouldn't see the private packs they just gained access to.
+watch(
+	() => auth.session_token.value,
+	() => {
+		// Any identity change invalidates packs only the previous session could
+		// see, whether that's a sign-out or a switch straight to another
+		// account. Drop them synchronously: the reload below is async, so until
+		// it finishes the list would keep showing them. Public packs stay, so
+		// the list doesn't blank out.
+		featuredModpacks.value = featuredModpacks.value.filter((modpack) => !modpack.nonPublic)
+
+		if (!featuredModpacks.value.some((m) => m.project_id === selectedModpackId.value)) {
+			selectedModpackId.value = featuredModpacks.value[0]?.project_id ?? ''
+		}
+
+		getFeaturedModpacks()
+	},
+)
+
 watch(selectedModpackId, (newValue) => {
 	if (newValue) {
 		localStorage.setItem('lastSelectedModpack', newValue)
diff --git a/apps/app-frontend/src/pages/YourProjects.vue b/apps/app-frontend/src/pages/YourProjects.vue
new file mode 100644
index 0000000000..8d884be2a8
--- /dev/null
+++ b/apps/app-frontend/src/pages/YourProjects.vue
@@ -0,0 +1,272 @@
+<script setup lang="ts">
+import { OrganizationIcon, SpinnerIcon, UserIcon } from '@modrinth/assets'
+import { Avatar, ButtonStyled, injectAuth, injectNotificationManager } from '@modrinth/ui'
+import { computed, ref, watch } from 'vue'
+import { useRouter } from 'vue-router'
+
+import {
+	getUserProjects,
+	type UserAllProjects,
+	type UserOrganization,
+	type UserProject,
+} from '@/helpers/mr_auth.ts'
+
+const { handleError } = injectNotificationManager()
+const auth = injectAuth()
+const router = useRouter()
+
+const loading = ref(false)
+const loadFailed = ref(false)
+const serverUnauthenticated = ref(false)
+const data = ref<UserAllProjects | null>(null)
+
+let loadId = 0
+
+const authReady = computed(() => auth.isReady.value)
+const signedIn = computed(() => !!auth.session_token.value && !serverUnauthenticated.value)
+
+type ProjectGroup = {
+	key: string
+	name: string
+	slug: string | null
+	icon_url: string | null
+	personal: boolean
+	projects: UserProject[]
+}
+
+const groups = computed<ProjectGroup[]>(() => {
+	if (!data.value) return []
+
+	const organizations = data.value.organizations ?? {}
+	const personal: UserProject[] = []
+	const byOrg = new Map<string, UserProject[]>()
+
+	for (const project of data.value.projects ?? []) {
+		if (project.organization && organizations[project.organization]) {
+			const bucket = byOrg.get(project.organization) ?? []
+			bucket.push(project)
+			byOrg.set(project.organization, bucket)
+		} else {
+			personal.push(project)
+		}
+	}
+
+	const orgGroups: ProjectGroup[] = [...byOrg.entries()]
+		.map(([id, projects]) => {
+			const org: UserOrganization | undefined = organizations[id]
+			return {
+				key: id,
+				name: org?.name ?? 'Organization',
+				slug: org?.slug ?? null,
+				icon_url: org?.icon_url ?? null,
+				personal: false,
+				projects: sortProjects(projects),
+			}
+		})
+		.sort((a, b) => a.name.localeCompare(b.name))
+
+	const result: ProjectGroup[] = []
+	if (personal.length > 0) {
+		result.push({
+			key: '__personal__',
+			name: 'Personal',
+			slug: null,
+			icon_url: null,
+			personal: true,
+			projects: sortProjects(personal),
+		})
+	}
+	result.push(...orgGroups)
+	return result
+})
+
+const totalProjects = computed(() =>
+	groups.value.reduce((total, group) => total + group.projects.length, 0),
+)
+
+function sortProjects(projects: UserProject[]): UserProject[] {
+	return [...projects].sort((a, b) => a.name.localeCompare(b.name))
+}
+
+type StatusBadge = { label: string; class: string }
+
+const PUBLIC_STATUSES = new Set(['approved', 'archived'])
+
+function statusBadge(status: string): StatusBadge {
+	switch (status) {
+		case 'approved':
+			return { label: 'Public', class: 'bg-highlight text-brand' }
+		case 'archived':
+			return { label: 'Archived', class: 'bg-button-bg text-secondary' }
+		case 'unlisted':
+			return { label: 'Unlisted', class: 'bg-highlight-orange text-orange' }
+		case 'private':
+			return { label: 'Private', class: 'bg-highlight-red text-red' }
+		case 'draft':
+			return { label: 'Draft', class: 'bg-button-bg text-secondary' }
+		case 'processing':
+			return { label: 'In review', class: 'bg-highlight-blue text-blue' }
+		case 'scheduled':
+			return { label: 'Scheduled', class: 'bg-highlight-blue text-blue' }
+		case 'rejected':
+			return { label: 'Rejected', class: 'bg-highlight-red text-red' }
+		case 'withheld':
+			return { label: 'Withheld', class: 'bg-highlight-red text-red' }
+		default:
+			return { label: 'Unknown', class: 'bg-button-bg text-secondary' }
+	}
+}
+
+function isPublic(status: string): boolean {
+	return PUBLIC_STATUSES.has(status)
+}
+
+function openProject(project: UserProject) {
+	router.push(`/project/${project.slug ?? project.id}`)
+}
+
+async function load() {
+	if (!auth.session_token.value) {
+		data.value = null
+		return
+	}
+	const id = ++loadId
+	loading.value = true
+	loadFailed.value = false
+	serverUnauthenticated.value = false
+	try {
+		const result = await getUserProjects()
+		// Discard if the auth state changed (sign-out / account switch) while
+		// this request was in flight, so a stale response can't repopulate
+		// private project metadata on a screen that no longer owns it.
+		if (id !== loadId) return
+		if (result === null) {
+			// Backend has no active credentials — the session expired
+			// server-side and was cleared. Flag this page as signed out, then
+			// reconcile the app-wide auth state so the rest of the UI stops
+			// showing the user as signed in. The flag covers the case where no
+			// refresh hook is available.
+			serverUnauthenticated.value = true
+			data.value = null
+			await auth.refreshSession?.()
+			return
+		}
+		data.value = result
+	} catch (err) {
+		if (id !== loadId) return
+		data.value = null
+		loadFailed.value = true
+		handleError(err)
+	} finally {
+		if (id === loadId) loading.value = false
+	}
+}
+
+function signIn() {
+	void auth.requestSignIn('/your-projects')
+}
+
+watch(
+	() => auth.session_token.value,
+	(token) => {
+		if (token) {
+			load()
+		} else {
+			// Signed out (or not yet signed in): invalidate any in-flight load
+			// and drop fetched project metadata so private/unlisted projects
+			// don't linger on screen.
+			loadId++
+			loading.value = false
+			loadFailed.value = false
+			serverUnauthenticated.value = false
+			data.value = null
+		}
+	},
+	{ immediate: true },
+)
+</script>
+
+<template>
+	<div class="p-6 flex flex-col gap-6">
+		<div class="flex flex-col gap-1">
+			<h1 class="m-0 text-2xl font-extrabold text-contrast">Your projects</h1>
+			<p class="m-0 text-secondary">
+				Projects you own and projects from organizations you belong to, including unlisted and
+				private ones only you and other members can see.
+			</p>
+		</div>
+
+		<div v-if="!authReady || loading" class="flex items-center gap-2 text-secondary">
+			<SpinnerIcon class="animate-spin" />
+			<span>Loading your projects…</span>
+		</div>
+
+		<div
+			v-else-if="!signedIn"
+			class="flex flex-col items-center gap-3 rounded-xl bg-bg-raised p-8 text-center"
+		>
+			<p class="m-0 text-secondary">Sign in with your Modrinth account to see your projects.</p>
+			<ButtonStyled color="brand">
+				<button @click="signIn">Sign in</button>
+			</ButtonStyled>
+		</div>
+
+		<div
+			v-else-if="loadFailed"
+			class="flex flex-col items-center gap-3 rounded-xl bg-bg-raised p-8 text-center"
+		>
+			<p class="m-0 text-secondary">Couldn't load your projects.</p>
+			<ButtonStyled color="brand">
+				<button @click="load">Try again</button>
+			</ButtonStyled>
+		</div>
+
+		<div
+			v-else-if="totalProjects === 0"
+			class="flex flex-col items-center gap-2 rounded-xl bg-bg-raised p-8 text-center text-secondary"
+		>
+			<p class="m-0">You don't have access to any projects yet.</p>
+		</div>
+
+		<template v-else>
+			<section v-for="group in groups" :key="group.key" class="flex flex-col gap-3">
+				<div class="flex items-center gap-2">
+					<Avatar v-if="group.icon_url" :src="group.icon_url" size="32px" />
+					<UserIcon v-else-if="group.personal" class="size-6 text-secondary" />
+					<OrganizationIcon v-else class="size-6 text-secondary" />
+					<h2 class="m-0 text-lg font-bold text-contrast">{{ group.name }}</h2>
+					<span class="text-sm text-secondary">{{ group.projects.length }}</span>
+				</div>
+
+				<div class="grid grid-cols-1 gap-3 sm:grid-cols-2 xl:grid-cols-3">
+					<button
+						v-for="project in group.projects"
+						:key="project.id"
+						class="flex flex-col gap-2 rounded-xl border-none bg-bg-raised p-4 text-left cursor-pointer transition-all hover:brightness-90"
+						@click="openProject(project)"
+					>
+						<div class="flex items-center gap-3">
+							<Avatar :src="project.icon_url" size="48px" />
+							<div class="flex min-w-0 flex-col">
+								<span class="truncate font-bold text-contrast">{{ project.name }}</span>
+								<span class="text-xs text-secondary">
+									{{ project.project_types.join(', ') || 'project' }}
+								</span>
+							</div>
+						</div>
+						<p class="m-0 line-clamp-2 text-sm text-secondary">{{ project.summary }}</p>
+						<div class="mt-auto flex items-center gap-2">
+							<span
+								v-if="!isPublic(project.status)"
+								class="rounded-full px-2 py-0.5 text-xs font-semibold"
+								:class="statusBadge(project.status).class"
+							>
+								{{ statusBadge(project.status).label }}
+							</span>
+						</div>
+					</button>
+				</div>
+			</section>
+		</template>
+	</div>
+</template>
diff --git a/apps/app-frontend/src/pages/index.js b/apps/app-frontend/src/pages/index.js
index d08a3fbeb6..b7a3c82b7b 100644
--- a/apps/app-frontend/src/pages/index.js
+++ b/apps/app-frontend/src/pages/index.js
@@ -2,5 +2,6 @@ import Browse from './Browse.vue'
 import Index from './Index.vue'
 import Skins from './Skins.vue'
 import Worlds from './Worlds.vue'
+import YourProjects from './YourProjects.vue'
 
-export { Browse, Index, Skins, Worlds }
+export { Browse, Index, Skins, Worlds, YourProjects }
diff --git a/apps/app-frontend/src/providers/setup/auth.ts b/apps/app-frontend/src/providers/setup/auth.ts
index 8832c09c6a..cefbf307cb 100644
--- a/apps/app-frontend/src/providers/setup/auth.ts
+++ b/apps/app-frontend/src/providers/setup/auth.ts
@@ -10,6 +10,7 @@ type AppCredentials = {
 export function setupAuthProvider(
 	credentials: Ref<AppCredentials | null | undefined>,
 	requestSignIn: (redirectPath: string) => void | Promise<void>,
+	refreshSession?: () => Promise<void>,
 ) {
 	const sessionToken = ref<string | null>(null)
 	const user = ref<AuthUser | null>(null)
@@ -20,6 +21,7 @@ export function setupAuthProvider(
 		user,
 		isReady,
 		requestSignIn,
+		refreshSession,
 	}
 
 	watchEffect(() => {
diff --git a/apps/app-frontend/src/routes.js b/apps/app-frontend/src/routes.js
index d8d0343e23..4bcf31163a 100644
--- a/apps/app-frontend/src/routes.js
+++ b/apps/app-frontend/src/routes.js
@@ -44,6 +44,14 @@ export default new createRouter({
 				breadcrumb: [{ name: 'Skin selector' }],
 			},
 		},
+		{
+			path: '/your-projects',
+			name: 'Your projects',
+			component: Pages.YourProjects,
+			meta: {
+				breadcrumb: [{ name: 'Your projects' }],
+			},
+		},
 		{
 			path: '/library',
 			name: 'Library',
diff --git a/apps/app-frontend/src/store/theme.ts b/apps/app-frontend/src/store/theme.ts
index d06ab07bae..e5411d9f87 100644
--- a/apps/app-frontend/src/store/theme.ts
+++ b/apps/app-frontend/src/store/theme.ts
@@ -7,6 +7,7 @@ export const DEFAULT_FEATURE_FLAGS = {
 	page_path: false,
 	worlds_tab: false,
 	worlds_in_home: true,
+	your_projects_tab: false,
 	skip_non_essential_warnings: false,
 	i18n_debug: false,
 	show_instance_play_time: true,
diff --git a/apps/app/src/api/mr_auth.rs b/apps/app/src/api/mr_auth.rs
index 2143d20c5e..a39bb1edfe 100644
--- a/apps/app/src/api/mr_auth.rs
+++ b/apps/app/src/api/mr_auth.rs
@@ -14,6 +14,7 @@ pub fn init<R: tauri::Runtime>() -> TauriPlugin<R> {
             modrinth_login,
             logout,
             get,
+            get_user_projects,
             cancel_modrinth_login,
         ])
         .build()
@@ -77,6 +78,11 @@ pub async fn get() -> Result<Option<ModrinthCredentials>> {
     Ok(theseus::mr_auth::get_credentials().await?)
 }
 
+#[tauri::command]
+pub async fn get_user_projects() -> Result<Option<serde_json::Value>> {
+    Ok(theseus::mr_auth::get_user_projects().await?)
+}
+
 #[tauri::command]
 pub fn cancel_modrinth_login() {
     oauth_utils::auth_code_reply::stop_listeners();
diff --git a/packages/app-lib/src/api/mr_auth.rs b/packages/app-lib/src/api/mr_auth.rs
index 42ce41fe5e..1df7a0e225 100644
--- a/packages/app-lib/src/api/mr_auth.rs
+++ b/packages/app-lib/src/api/mr_auth.rs
@@ -1,4 +1,6 @@
-use crate::state::ModrinthCredentials;
+use crate::state::{AUTHENTICATED_CACHE_TYPES, CachedEntry, ModrinthCredentials};
+use crate::util::fetch::fetch_json;
+use reqwest::Method;
 
 #[tracing::instrument]
 pub fn authenticate_begin_flow() -> &'static str {
@@ -19,6 +21,13 @@ pub async fn authenticate_finish_flow(
     .await?;
 
     creds.upsert(&state.pool).await?;
+
+    // Signing in deactivates any other account without removing it, so this is
+    // the one identity change that doesn't go through `remove`. Drop the cached
+    // data the previous session was allowed to see before this one reads it.
+    CachedEntry::purge_cache_types(AUTHENTICATED_CACHE_TYPES, &state.pool)
+        .await?;
+
     state
         .friends_socket
         .connect(&state.pool, &state.api_semaphore, &state.process_manager)
@@ -33,6 +42,8 @@ pub async fn logout() -> crate::Result<()> {
     let current = ModrinthCredentials::get_active(&state.pool).await?;
 
     if let Some(current) = current {
+        // Removing the credentials also purges the cached data they gave
+        // access to.
         ModrinthCredentials::remove(&current.user_id, &state.pool).await?;
         state.friends_socket.disconnect().await?;
     }
@@ -40,6 +51,44 @@ pub async fn logout() -> crate::Result<()> {
     Ok(())
 }
 
+/// Fetches every project the signed-in user has access to (their personal
+/// projects plus every project owned by an organization they belong to),
+/// including non-public statuses such as unlisted and private.
+///
+/// Returns `None` when no user is signed in. The result is fetched fresh on
+/// each call rather than cached, so it always reflects the currently active
+/// credentials instead of a response captured under a different auth state.
+#[tracing::instrument]
+pub async fn get_user_projects() -> crate::Result<Option<serde_json::Value>> {
+    let state = crate::State::get().await?;
+
+    let Some(creds) =
+        ModrinthCredentials::get_and_refresh(&state.pool, &state.api_semaphore)
+            .await?
+    else {
+        return Ok(None);
+    };
+
+    let url = format!(
+        "{}user/{}/all-projects",
+        env!("MODRINTH_API_URL_V3"),
+        creds.user_id
+    );
+
+    let projects = fetch_json(
+        Method::GET,
+        &url,
+        None,
+        None,
+        Some("/v3/user/all-projects"),
+        &state.api_semaphore,
+        &state.pool,
+    )
+    .await?;
+
+    Ok(Some(projects))
+}
+
 #[tracing::instrument]
 pub async fn get_credentials() -> crate::Result<Option<ModrinthCredentials>> {
     let state = crate::State::get().await?;
diff --git a/packages/app-lib/src/state/mr_auth.rs b/packages/app-lib/src/state/mr_auth.rs
index 09b735ea53..2adce19a46 100644
--- a/packages/app-lib/src/state/mr_auth.rs
+++ b/packages/app-lib/src/state/mr_auth.rs
@@ -1,4 +1,4 @@
-use crate::state::{CacheBehaviour, CachedEntry};
+use crate::state::{CacheBehaviour, CacheValueType, CachedEntry};
 use crate::util::fetch::{FetchSemaphore, fetch_advanced};
 use chrono::{DateTime, Duration, TimeZone, Utc};
 use dashmap::DashMap;
@@ -6,6 +6,19 @@ use futures::TryStreamExt;
 use reqwest::Method;
 use serde::{Deserialize, Serialize};
 
+/// Cache types whose entries can hold data only a signed-in user was allowed to
+/// see, such as private and unlisted projects. The cache is keyed by id and not
+/// partitioned by account, so these must not outlive the session that was
+/// allowed to see them.
+pub const AUTHENTICATED_CACHE_TYPES: &[CacheValueType] = &[
+    CacheValueType::Project,
+    CacheValueType::ProjectV3,
+    CacheValueType::ProjectVersions,
+    CacheValueType::Version,
+    CacheValueType::Team,
+    CacheValueType::Organization,
+];
+
 #[derive(Serialize, Deserialize, Clone, Debug)]
 pub struct ModrinthCredentials {
     pub session: String,
@@ -159,7 +172,7 @@ impl ModrinthCredentials {
 
     pub async fn remove(
         user_id: &str,
-        exec: impl sqlx::Executor<'_, Database = sqlx::Sqlite>,
+        exec: impl sqlx::Executor<'_, Database = sqlx::Sqlite> + Copy,
     ) -> crate::Result<()> {
         sqlx::query!(
             "
@@ -170,6 +183,10 @@ impl ModrinthCredentials {
         .execute(exec)
         .await?;
 
+        // Purging here covers every way a session ends: signing out, and a
+        // session expiring when its refresh fails.
+        CachedEntry::purge_cache_types(AUTHENTICATED_CACHE_TYPES, exec).await?;
+
         Ok(())
     }
 
diff --git a/packages/ui/src/providers/auth.ts b/packages/ui/src/providers/auth.ts
index b9de5eb62b..5094a3ac86 100644
--- a/packages/ui/src/providers/auth.ts
+++ b/packages/ui/src/providers/auth.ts
@@ -11,6 +11,12 @@ export interface AuthProvider {
 	/** True once the initial auth check has completed (regardless of result). */
 	isReady?: Ref<boolean>
 	requestSignIn: (redirectPath: string) => void | Promise<void>
+	/**
+	 * Re-reads the stored credentials and updates this provider. Use when a
+	 * request reveals the session is no longer valid, so the rest of the app
+	 * doesn't keep showing the user as signed in.
+	 */
+	refreshSession?: () => Promise<void>
 }
 
 export const [injectAuth, provideAuth] = createContext<AuthProvider>('root', 'auth')