diff --git a/server/index.js b/server/index.js
index da36db9..10450b9 100644
--- a/server/index.js
+++ b/server/index.js
@@ -2047,6 +2047,12 @@ function preferredAuthMethodId(methods) {
 
 function resolveAuthMethodForUser(user, requestedMethodId) {
   const all = listPublicAuthMethods();
+  if (requestedMethodId) {
+    const requestedPublic = all.find((entry) => entry.id === requestedMethodId) || null;
+    if (requestedPublic && requestedPublic.type === "otp") {
+      return requestedPublic;
+    }
+  }
   const enabledSet = new Set(Array.isArray(user.enabledAuthMethods) ? user.enabledAuthMethods : []);
   const allowed = all.filter((entry) => enabledSet.has(entry.id));
   if (allowed.length === 0) {