diff --git a/src/KitsuneCommand/Web/OwinStartup.cs b/src/KitsuneCommand/Web/OwinStartup.cs
index 14c3fe3..35f74f2 100644
--- a/src/KitsuneCommand/Web/OwinStartup.cs
+++ b/src/KitsuneCommand/Web/OwinStartup.cs
@@ -125,8 +125,16 @@ public void Configuration(IAppBuilder app)
 
             config.EnsureInitialized();
 
-            app.UseAutofacMiddleware(_container);
-            app.UseAutofacWebApi(config);
+            // NOTE: deliberately NOT using app.UseAutofacMiddleware / app.UseAutofacWebApi.
+            // Those register Autofac.Integration.Owin's per-request lifetime-scope injector,
+            // which disposes the scope with `await using` → IAsyncDisposable.DisposeAsync().
+            // 7D2D's Mono runtime does not implement that method, so it throws
+            // MissingMethodException at JIT in front of the whole pipeline — taking down EVERY
+            // /api/* request on Linux/Mono. Web API's own AutofacWebApiDependencyResolver (set
+            // above) creates and disposes the per-request lifetime scope SYNCHRONOUSLY via
+            // IDisposable.Dispose(), which Mono has. InstancePerRequest registrations still
+            // resolve correctly (same RequestLifetimeScopeTag). Do not re-add the injector
+            // without confirming Mono gained IAsyncDisposable support.
             app.UseWebApi(config);
         }
     }
diff --git a/src/KitsuneCommand/Web/WebServerHost.cs b/src/KitsuneCommand/Web/WebServerHost.cs
index e099330..b81d65a 100644
--- a/src/KitsuneCommand/Web/WebServerHost.cs
+++ b/src/KitsuneCommand/Web/WebServerHost.cs
@@ -205,7 +205,10 @@ private void HandleLogin(HttpListenerContext ctx)
                     body = reader.ReadToEnd();
 
                 var loginReq = JsonConvert.DeserializeObject<LoginPayload>(body);
-                string username = loginReq?.username;
+                // Normalize to match how accounts are stored: UserController.Create lowercases +
+                // trims the username, and SQLite compares TEXT case-sensitively. Without this, a
+                // username created/typed as "KCAdmin" is stored "kcadmin" and never matches at login.
+                string username = loginReq?.username?.Trim().ToLowerInvariant();
                 string password = loginReq?.password;
 
                 if (string.IsNullOrWhiteSpace(username) || string.IsNullOrWhiteSpace(password))