diff --git a/addon.json b/addon.json
index 9298ab4..f87b5b9 100644
--- a/addon.json
+++ b/addon.json
@@ -1,7 +1,7 @@
 {
   "id": "aegis",
   "name": "Aegis Wallet",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "category": "plugin",
   "description": "Multi-chain wallet (BCH, BTC, TRX, ETH, SOL, SC, DGB) derived from your Theseus vault. Dapps get window.bitcoincash and window.wizardconnect on any site; window.tronWeb / window.tronLink / window.ethereum / window.solana too. Every call needs your approval.",
   "author": "Silent Mode",
diff --git a/panel.html b/panel.html
index 594e547..117fb6b 100644
--- a/panel.html
+++ b/panel.html
@@ -1387,8 +1387,14 @@
     <span class="brandver" id="brandVer"></span>
   </span>
 </footer>
-<script src="lib/jsqr.js"></script>
-<script src="qr.js"></script>
-<script src="panel.js"></script>
+<!-- jsqr.js is deliberately NOT loaded here: 257 KB of vendored decoder,
+     parsed on every panel open (so on every hide/show), for a feature most
+     sessions never touch. panel.js fetches it the first time someone imports
+     a QR image. `defer` lets the browser paint the already-dark document
+     before executing 300 KB of panel.js, which shortens the blank window
+     while the view loads. Order is preserved, so qr.js is still defined
+     before panel.js runs. -->
+<script src="qr.js" defer></script>
+<script src="panel.js" defer></script>
 </body>
 </html>
diff --git a/panel.js b/panel.js
index d581797..dc501fa 100644
--- a/panel.js
+++ b/panel.js
@@ -1619,8 +1619,26 @@ function classifyScannedSecret(text) {
   return { kind: "unknown", value: s };
 }
 
+// jsQR is 257 KB of vendored decoder and it is only needed when someone
+// actually imports a QR image. Loading it from panel.html meant every panel
+// open — every hide/show — parsed all of it before panel.js even started.
+// Fetch it the first time it is wanted instead.
+let jsqrLoad = null;
+function loadJsQr() {
+  if (typeof jsQR === "function") return Promise.resolve();
+  if (jsqrLoad) return jsqrLoad;
+  jsqrLoad = new Promise((resolve, reject) => {
+    const el = document.createElement("script");
+    el.src = "lib/jsqr.js";
+    el.onload = () => (typeof jsQR === "function" ? resolve() : reject(new Error("the QR decoder loaded but exposed nothing")));
+    el.onerror = () => { jsqrLoad = null; reject(new Error("the QR decoder failed to load")); };
+    document.head.appendChild(el);
+  });
+  return jsqrLoad;
+}
+
 async function decodeQrFile(file) {
-  if (typeof jsQR !== "function") throw new Error("the QR decoder failed to load");
+  await loadJsQr();
   const bitmap = await createImageBitmap(file);
   try {
     // Very large photos cost time and memory for no accuracy gain; jsQR wants