diff --git a/CHANGELOG.md b/CHANGELOG.md
index c62cef9..eea7c72 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -114,6 +114,27 @@ merge now runs in a scratch worktree and a failed run can be retried.
   the site's real `Host` header so the rendered page is unchanged and the
   internal address never reaches the output. The stack sets it by default.
 
+### The login address can move
+
+- **Sirius Press → Sign-in** now has a *Login address* field. Set it and the
+  sign-in screen answers at `https://yoursite/<slug>`; `wp-login.php` answers
+  404, rendering the theme's own 404 page rather than redirecting, because a
+  redirect would hand the new address to the first scanner that asked for the
+  old one. Everything that builds a login URL follows — `wp_login_url()`,
+  logout, lost password, registration, and the redirect `auth_redirect()`
+  sends a logged-out visitor to `wp-admin` with.
+- Not about brute force: there is no password to guess. It is about
+  `wp-login.php` being the most-requested path on the internet, and a wallet
+  login screen answering it telling every scanner what runs here.
+- **It does not rename `wp-admin`, and will not.** WordPress has no supported
+  way to do that — the path is built into `ABSPATH . 'wp-admin/'`, into core's
+  own asset loaders, and into a great deal of plugin JavaScript. A proxy plus
+  a filtered `admin_url()` gets perhaps nine tenths of the way and then breaks
+  plugins silently, which is the one thing this fork promises not to do.
+- Locked out? `wp option delete sirius_press_login_slug` puts it back, and
+  `SIRIUS_PRESS_LOGIN_SLUG` in `wp-config.php` overrides the option for anyone
+  who can still edit a file but not reach a browser.
+
 ### Fixed while building a real site on it
 
 - **Turning passwords off made the login screen fail on arrival.**
diff --git a/plugins/sirius-press-auth/includes/class-spa-login-url.php b/plugins/sirius-press-auth/includes/class-spa-login-url.php
new file mode 100644
index 0000000..dab1356
--- /dev/null
+++ b/plugins/sirius-press-auth/includes/class-spa-login-url.php
@@ -0,0 +1,317 @@
+<?php
+/**
+ * Move the login screen off wp-login.php.
+ *
+ * Why this is worth having on a site with no passwords: not brute force —
+ * there is nothing to guess — but noise and fingerprinting. `wp-login.php`
+ * is the single most-requested path on the internet, and a wallet login
+ * screen answering it serves a few hundred bots a day a page they cannot
+ * use, in exchange for announcing what software is running here.
+ *
+ * What this deliberately does NOT do is rename `wp-admin`. WordPress has no
+ * supported way to do that — the path is built into `ABSPATH . 'wp-admin/'`,
+ * into core's own asset loaders, and into a great deal of plugin JavaScript —
+ * and faking it with a proxy and a filtered `admin_url()` gets perhaps nine
+ * tenths of the way before breaking plugins silently. Breaking plugins is the
+ * one thing this fork promises not to do. `wp-login.php` is different: it is
+ * a single entry point, so moving it is honest work rather than a disguise.
+ *
+ * Locked out? The slug is an option, so it can be read or cleared from the
+ * command line without a browser:
+ *
+ *     wp option get sirius_press_login_slug
+ *     wp option delete sirius_press_login_slug
+ *
+ * Or pin it in wp-config.php, where it overrides the option entirely:
+ *
+ *     define( 'SIRIUS_PRESS_LOGIN_SLUG', 'admin' );
+ *
+ * @package SiriusPress
+ */
+
+defined( 'ABSPATH' ) || exit;
+
+class SPA_Login_URL {
+
+	const OPT_SLUG = 'sirius_press_login_slug';
+
+	/** This request came in on the renamed login path. */
+	private static $is_login = false;
+
+	/** This request asked for wp-login.php, which no longer answers. */
+	private static $blocked = false;
+
+	public static function hooks() {
+		// The settings screen has to be able to show and change the slug even
+		// when the feature is off, so those hooks are registered either way.
+		add_filter( 'sirius_press_login_slug', array( __CLASS__, 'slug' ) );
+
+		if ( '' === self::slug() ) {
+			return;
+		}
+
+		if ( is_multisite() ) {
+			// Multisite resolves wp-login.php through the network, and
+			// half-moving it is worse than not moving it.
+			return;
+		}
+
+		add_action( 'plugins_loaded', array( __CLASS__, 'route' ), 1 );
+		add_action( 'wp_loaded', array( __CLASS__, 'serve' ) );
+
+		// Everything that builds a login URL goes through one of these two,
+		// including wp_login_url(), wp_logout_url(), wp_lostpassword_url(),
+		// wp_registration_url() and auth_redirect().
+		add_filter( 'site_url', array( __CLASS__, 'filter_site_url' ), 10, 3 );
+		add_filter( 'network_site_url', array( __CLASS__, 'filter_site_url' ), 10, 3 );
+
+		// A backstop for code that builds the URL itself instead of asking.
+		add_filter( 'wp_redirect', array( __CLASS__, 'filter_redirect' ), 10, 1 );
+	}
+
+	/**
+	 * The configured slug, or '' when the login has not been moved.
+	 *
+	 * A constant wins over the option, so an operator who has locked
+	 * themselves out of the admin can fix it in a file they can still edit.
+	 */
+	public static function slug() {
+		if ( defined( 'SIRIUS_PRESS_LOGIN_SLUG' ) ) {
+			return self::sanitize( SIRIUS_PRESS_LOGIN_SLUG );
+		}
+
+		return self::sanitize( get_option( self::OPT_SLUG, '' ) );
+	}
+
+	/**
+	 * A slug is one path segment of lowercase letters, digits and hyphens.
+	 *
+	 * Anything else returns '', which turns the feature off rather than
+	 * producing a login URL nobody can reach.
+	 */
+	public static function sanitize( $value ) {
+		$value = strtolower( trim( (string) $value ) );
+		$value = trim( $value, "/ \t\n\r\0" );
+
+		if ( ! preg_match( '/^[a-z0-9][a-z0-9-]{1,62}[a-z0-9]$/', $value ) ) {
+			return '';
+		}
+
+		// Paths WordPress owns. Taking one of these would shadow something
+		// that has to keep working.
+		$reserved = array( 'wp-admin', 'wp-login', 'wp-login-php', 'wp-content', 'wp-includes', 'wp-json', 'feed', 'index-php' );
+		if ( in_array( $value, $reserved, true ) ) {
+			return '';
+		}
+
+		return $value;
+	}
+
+	/** The login URL this site actually uses. */
+	public static function url( $scheme = 'login' ) {
+		$slug = self::slug();
+
+		if ( '' === $slug ) {
+			return site_url( 'wp-login.php', $scheme );
+		}
+
+		return set_url_scheme( home_url( '/' ) . $slug, $scheme );
+	}
+
+	/**
+	 * Is this request on the moved login path, and is wp-login.php being
+	 * refused?
+	 *
+	 * Decided on `plugins_loaded` because `$pagenow` has to be right before
+	 * anything that branches on it runs — which includes the cookie path
+	 * logic and every `is_login()` check in core and in plugins.
+	 */
+	public static function route() {
+		global $pagenow;
+
+		$path = self::request_path();
+		if ( null === $path ) {
+			return;
+		}
+
+		if ( $path === self::home_path() . '/' . self::slug() ) {
+			self::$is_login = true;
+			$pagenow        = 'wp-login.php';
+			return;
+		}
+
+		if ( $path === self::site_path() . '/wp-login.php' ) {
+			self::$blocked = true;
+
+			/*
+			 * Point the request at something that cannot exist, so core
+			 * reaches its own 404 by the normal route. Answering 404 rather
+			 * than redirecting matters: a redirect to the new address would
+			 * hand the slug to the first scanner that asked.
+			 */
+			$_SERVER['REQUEST_URI'] = self::home_path() . '/' . str_repeat( '-/', 10 );
+			$pagenow                = 'index.php';
+		}
+	}
+
+	/**
+	 * Render the login screen for the moved path.
+	 *
+	 * On `wp_loaded`, which is after plugins and the theme are up but before
+	 * the main query runs — the same point in the request wp-login.php would
+	 * have reached on its own. Requiring it is safe: everything it pulls in
+	 * is `require_once`, so the bootstrap does not run twice.
+	 */
+	public static function serve() {
+		if ( self::$blocked ) {
+			self::render_404();
+		}
+
+		if ( ! self::$is_login ) {
+			return;
+		}
+
+		global $pagenow, $error, $interim_login, $action, $user_login, $user, $errors, $redirect_to;
+
+		require_once ABSPATH . 'wp-login.php';
+		exit;
+	}
+
+	/**
+	 * Refuse wp-login.php.
+	 *
+	 * This has to actively end the request rather than redirect it, and it
+	 * has to do so here. The web server sends `/wp-login.php` to that file
+	 * directly, not through index.php, so by the time `wp_loaded` fires we
+	 * are inside its `require wp-load.php` — and the moment that returns, the
+	 * login screen renders. Rewriting `$pagenow` earlier changes what
+	 * WordPress thinks the request is; it does not stop the script that is
+	 * already running.
+	 *
+	 * A 404 and not a redirect: sending callers to the new address would hand
+	 * the slug to the first scanner that asked for the old one.
+	 */
+	private static function render_404() {
+		global $wp_query;
+
+		if ( ! defined( 'WP_USE_THEMES' ) ) {
+			define( 'WP_USE_THEMES', true );
+		}
+
+		// REQUEST_URI was pointed at a path that cannot exist, so the normal
+		// query produces a normal 404 and the theme renders its own page.
+		wp();
+
+		if ( $wp_query instanceof WP_Query ) {
+			$wp_query->set_404();
+		}
+
+		status_header( 404 );
+		nocache_headers();
+
+		require_once ABSPATH . WPINC . '/template-loader.php';
+		exit;
+	}
+
+	/**
+	 * Rewrite every URL core builds for wp-login.php.
+	 *
+	 * @param string $url
+	 * @param string $path
+	 * @param string $scheme
+	 * @return string
+	 */
+	public static function filter_site_url( $url, $path, $scheme ) {
+		if ( ! is_string( $path ) || 0 !== strpos( ltrim( $path, '/' ), 'wp-login.php' ) ) {
+			return $url;
+		}
+
+		// The caller may have appended a query — "wp-login.php?action=logout".
+		$query = '';
+		$mark  = strpos( $url, '?' );
+		if ( false !== $mark ) {
+			$query = substr( $url, $mark );
+		}
+
+		return self::url( $scheme ) . $query;
+	}
+
+	/**
+	 * Catch redirects built by hand rather than through site_url().
+	 */
+	public static function filter_redirect( $location ) {
+		if ( ! is_string( $location ) || false === strpos( $location, 'wp-login.php' ) ) {
+			return $location;
+		}
+
+		return str_replace( site_url( 'wp-login.php', 'login' ), self::url(), $location );
+	}
+
+	// ------------------------------------------------------------------ paths
+
+	/** The request path, trimmed of its trailing slash, or null. */
+	private static function request_path() {
+		if ( empty( $_SERVER['REQUEST_URI'] ) ) {
+			return null;
+		}
+
+		$uri  = rawurldecode( wp_unslash( $_SERVER['REQUEST_URI'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput
+		$path = wp_parse_url( $uri, PHP_URL_PATH );
+
+		return is_string( $path ) ? untrailingslashit( $path ) : null;
+	}
+
+	/** The path WordPress is served from, '' at the document root. */
+	private static function home_path() {
+		return untrailingslashit( (string) wp_parse_url( home_url(), PHP_URL_PATH ) );
+	}
+
+	private static function site_path() {
+		return untrailingslashit( (string) wp_parse_url( site_url(), PHP_URL_PATH ) );
+	}
+
+	// --------------------------------------------------------------- warnings
+
+	/**
+	 * Reasons a slug would not do what the operator expects, for the settings
+	 * screen to show before it is saved rather than after.
+	 *
+	 * @return string[]
+	 */
+	public static function problems( $slug ) {
+		$problems = array();
+
+		if ( '' === self::sanitize( $slug ) && '' !== trim( (string) $slug ) ) {
+			$problems[] = __( 'A login address is one path segment of lowercase letters, digits and hyphens — and not a name WordPress already uses.', 'sirius-press' );
+			return $problems;
+		}
+
+		$slug = self::sanitize( $slug );
+		if ( '' === $slug ) {
+			return $problems;
+		}
+
+		if ( is_multisite() ) {
+			$problems[] = __( 'This site is part of a network, and a network resolves wp-login.php itself. Moving it here would only half work, so it is left alone.', 'sirius-press' );
+		}
+
+		$clash = get_page_by_path( $slug, OBJECT, array( 'page', 'post' ) );
+		if ( $clash ) {
+			$problems[] = sprintf(
+				/* translators: %s: the conflicting post title. */
+				__( 'There is already a page at that address — “%s”. The login screen would hide it.', 'sirius-press' ),
+				get_the_title( $clash )
+			);
+		}
+
+		if ( defined( 'SIRIUS_PRESS_LOGIN_SLUG' ) ) {
+			$problems[] = sprintf(
+				/* translators: %s: the slug set in wp-config.php. */
+				__( 'wp-config.php pins the login address to “%s”, which overrides whatever is saved here.', 'sirius-press' ),
+				esc_html( self::sanitize( SIRIUS_PRESS_LOGIN_SLUG ) )
+			);
+		}
+
+		return $problems;
+	}
+}
diff --git a/plugins/sirius-press-auth/includes/class-spa-settings.php b/plugins/sirius-press-auth/includes/class-spa-settings.php
index 17d8c00..d392715 100644
--- a/plugins/sirius-press-auth/includes/class-spa-settings.php
+++ b/plugins/sirius-press-auth/includes/class-spa-settings.php
@@ -56,6 +56,26 @@ final class SPA_Settings {
 			}
 
 			update_option( SP_Settings::OPT_OPEN_REG, ! empty( $_POST['sirius_open_registration'] ) );
+
+			$raw         = isset( $_POST['sirius_login_slug'] ) ? sanitize_text_field( wp_unslash( $_POST['sirius_login_slug'] ) ) : '';
+			$slug        = SPA_Login_URL::sanitize( $raw );
+			$slug_issues = SPA_Login_URL::problems( $raw );
+
+			if ( $slug_issues ) {
+				$errors = array_merge( $errors, $slug_issues );
+			} elseif ( $slug !== SPA_Login_URL::slug() ) {
+				if ( '' === $slug ) {
+					delete_option( SPA_Login_URL::OPT_SLUG );
+					$notes[] = __( 'The login screen is back at wp-login.php.', 'sirius-press' );
+				} else {
+					update_option( SPA_Login_URL::OPT_SLUG, $slug );
+					$notes[] = sprintf(
+						/* translators: %s: the new login URL. */
+						__( 'The login screen has moved to %s. Save it somewhere — wp-login.php now answers 404.', 'sirius-press' ),
+						home_url( '/' . $slug )
+					);
+				}
+			}
 		}
 
 		$stranded = self::accounts_without_wallets();
@@ -91,6 +111,31 @@ final class SPA_Settings {
 		);
 		echo '</label></td></tr>';
 
+		echo '<tr><th>' . esc_html__( 'Login address', 'sirius-press' ) . '</th><td>';
+		printf(
+			'<code>%s</code> <input type="text" name="sirius_login_slug" value="%s" class="regular-text" placeholder="%s" autocomplete="off" spellcheck="false">',
+			esc_html( trailingslashit( home_url( '/' ) ) ),
+			esc_attr( SPA_Login_URL::slug() ),
+			esc_attr__( 'wp-login.php', 'sirius-press' )
+		);
+		echo '<p class="description">';
+		esc_html_e( 'Move the sign-in screen somewhere other than wp-login.php. Leave it empty to keep the usual address.', 'sirius-press' );
+		echo ' ';
+		esc_html_e( 'This is not about brute force — there is no password to guess — but wp-login.php is the most-requested path on the internet, and answering it tells every scanner what is running here. Note that it does not move wp-admin: WordPress has no supported way to rename that, and pretending otherwise breaks plugins quietly.', 'sirius-press' );
+		echo '</p>';
+		if ( SPA_Login_URL::slug() ) {
+			echo '<p class="description"><strong>';
+			printf(
+				/* translators: %s: the current login URL. */
+				esc_html__( 'Signing in now happens at %s.', 'sirius-press' ),
+				'<code>' . esc_html( home_url( '/' . SPA_Login_URL::slug() ) ) . '</code>'
+			);
+			echo '</strong> ';
+			esc_html_e( 'If you lose it, `wp option get sirius_press_login_slug` on the server will tell you, and `wp option delete sirius_press_login_slug` will put the login back.', 'sirius-press' );
+			echo '</p>';
+		}
+		echo '</td></tr>';
+
 		echo '</table>';
 		submit_button();
 		echo '</form>';
diff --git a/plugins/sirius-press-auth/sirius-press-auth.php b/plugins/sirius-press-auth/sirius-press-auth.php
index 385f928..47c4c05 100644
--- a/plugins/sirius-press-auth/sirius-press-auth.php
+++ b/plugins/sirius-press-auth/sirius-press-auth.php
@@ -18,10 +18,19 @@
 
 defined( 'ABSPATH' ) || exit;
 
-define( 'SIRIUS_PRESS_AUTH_VERSION', '0.1.1' );
+define( 'SIRIUS_PRESS_AUTH_VERSION', '0.2.0' );
 define( 'SIRIUS_PRESS_AUTH_DIR', plugin_dir_path( __FILE__ ) );
 define( 'SIRIUS_PRESS_AUTH_URL', plugin_dir_url( __FILE__ ) );
 
+/*
+ * The login address is decided before everything else, and outside the
+ * `plugins_loaded` callback below, because it has to hook `plugins_loaded`
+ * itself at a priority earlier than that callback runs. It depends on nothing
+ * but WordPress, so there is nothing to wait for.
+ */
+require_once SIRIUS_PRESS_AUTH_DIR . 'includes/class-spa-login-url.php';
+SPA_Login_URL::hooks();
+
 add_action(
 	'plugins_loaded',
 	function () {