diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9ccfc75..22d4d26 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -48,6 +48,7 @@
 - **Security**: Added `frame-src 'self'` to the Content-Security-Policy header so that the embedded API docs iframe can load from our own origin without relaxing JS restrictions.  
 - **Controller**: Updated `FolderController::shareFolder()` (folderController) to include the gallery-view toggle script block intact, ensuring the “Switch to Gallery View” button works when sharing folders.  
 - **UI (fileListView.js)**: Refactored `renderGalleryView` to remove all inline `onclick=` handlers; switched to using data-attributes and `addEventListener()` for preview, download, edit and rename buttons, fully CSP-compliant.
+- Moved logout button handler out of inline `<script>` in `index.html` and into the `DOMContentLoaded` init in **main.js** (via `auth.js`), so it now attaches reliably after the CSRF token is loaded and DOM is ready.
 
 ---
 
diff --git a/public/js/auth.js b/public/js/auth.js
index d64d96d..fdedcac 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -437,27 +437,7 @@ function initAuth() {
       submitLogin(formData);
     });
   }
-  // handle ?logout=1 query
-  const params = new URLSearchParams(window.location.search);
-  if (params.get('logout') === '1') {
-    localStorage.removeItem("username");
-    localStorage.removeItem("userTOTPEnabled");
-  }
   
-  // attach logout button listener
-  document.addEventListener('DOMContentLoaded', () => {
-    const btn = document.getElementById('logoutBtn');
-    if (!btn) return;
-    btn.addEventListener('click', () => {
-      fetch('/api/auth/logout.php', {
-        method: 'POST',
-        credentials: 'include',
-        headers: { 'X-CSRF-Token': window.csrfToken }
-      })
-        .then(() => window.location.reload(true))
-        .catch(() => { });
-    });
-  });
   document.getElementById("addUserBtn").addEventListener("click", function () {
     resetUserForm();
     toggleVisibility("addUserModal", true);
diff --git a/public/js/main.js b/public/js/main.js
index 5dc9b3a..abb26ee 100644
--- a/public/js/main.js
+++ b/public/js/main.js
@@ -48,6 +48,27 @@ export function loadCsrfToken() {
     });
 }
 
+// 1) Immediately clear “?logout=1” flag
+const params = new URLSearchParams(window.location.search);
+if (params.get('logout') === '1') {
+  localStorage.removeItem("username");
+  localStorage.removeItem("userTOTPEnabled");
+}
+
+// 2) Wire up logoutBtn right away
+const logoutBtn = document.getElementById("logoutBtn");
+if (logoutBtn) {
+  logoutBtn.addEventListener("click", () => {
+    fetch("/api/auth/logout.php", {
+      method: "POST",
+      credentials: "include",
+      headers: { "X-CSRF-Token": window.csrfToken }
+    })
+      .then(() => window.location.reload(true))
+      .catch(() => {});
+  });
+}
+
 
 // Expose functions for inline handlers.
 window.sendRequest = sendRequest;