diff --git a/CHANGELOG.md b/CHANGELOG.md
index e8e3938..d6af94c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ the app store accepts a `-beta` suffix, but Nextcloud servers then only offer th
 beta/daily update channel, which would hide the app from most admins. The stability stage is
 instead carried by the app description, the git tag, the release, and this file.
 
+## [Unreleased]
+
+### Fixed
+- Adding a backup location in the web interface failed with "Request failed with status code 403"
+  when the login was more than 30 minutes old: the form did not ask for password confirmation.
+
 ## [0.9.1-beta.2] - 2026-10-07
 
 Second beta, the first release in the Nextcloud app store (signed).
diff --git a/src/components/Locations.vue b/src/components/Locations.vue
index 1b23cf3..2131c7c 100644
--- a/src/components/Locations.vue
+++ b/src/components/Locations.vue
@@ -104,6 +104,7 @@ async function add() {
 	busy.value = true
 	error.value = ''
 	try {
+		await confirmPassword()
 		await api.addTarget({ name: form.name, backend: backend.value.id, auth: auth.value.id, options: form.options, path: form.path,
 			maxGb: form.maxGb === '' ? null : Number(form.maxGb) })
 		adding.value = false