diff --git a/frontend/src/app/auth/callback/page.tsx b/frontend/src/app/auth/callback/page.tsx
index a31bb8c..4cafc36 100644
--- a/frontend/src/app/auth/callback/page.tsx
+++ b/frontend/src/app/auth/callback/page.tsx
@@ -9,7 +9,7 @@ export default function SignInCallback() {
 
   useEffect(() => {
     userManager.signinCallback();
-    router.push("/");
+    router.push("/nominations");
   }, []);
 
   return <></>;
diff --git a/frontend/src/app/page.tsx b/frontend/src/app/page.tsx
index f7aac18..4a73c5e 100644
--- a/frontend/src/app/page.tsx
+++ b/frontend/src/app/page.tsx
@@ -44,9 +44,7 @@ export default function Page() {
             className="w-full rounded bg-blue-500 px-4 py-2 text-center font-bold text-white hover:bg-blue-400"
             onClick={() => void auth.signinRedirect()}
           >
-            <Link href="/nominations" className="w-full">
-              Inloggen
-            </Link>
+            Inloggen
           </button>
         </div>
       )}
diff --git a/frontend/src/components/AuthStatus.tsx b/frontend/src/components/AuthStatus.tsx
index bdf6527..de1a32d 100644
--- a/frontend/src/components/AuthStatus.tsx
+++ b/frontend/src/components/AuthStatus.tsx
@@ -1,7 +1,7 @@
 "use client";
 import { useAuth } from "react-oidc-context";
 import { useState, useEffect } from "react";
-import { useRouter } from "next/navigation";
+import { useRouter, usePathname } from "next/navigation";
 import { Source_Sans_3, Nunito } from "next/font/google";
 
 const nunito = Nunito({
@@ -11,6 +11,7 @@ const nunito = Nunito({
 export default function AuthStatus() {
   const auth = useAuth();
   const router = useRouter();
+  const pathname = usePathname();
   const [persistentAuthState, setPersistentAuthState] = useState<{
     isAuthenticated: boolean;
     user: any;
@@ -32,6 +33,22 @@ export default function AuthStatus() {
     }
   }, [auth.isLoading, auth.isAuthenticated, auth.user, auth.error]);
 
+  useEffect(() => {
+    // Redirect to / if user is definitely not logged in and not already on /
+    if (
+      persistentAuthState.hasInitialized &&
+      !persistentAuthState.isAuthenticated &&
+      pathname !== "/"
+    ) {
+      router.push("/");
+    }
+  }, [
+    persistentAuthState.hasInitialized,
+    persistentAuthState.isAuthenticated,
+    pathname,
+    router,
+  ]);
+
   // Show loading only on first load, not on subsequent navigations
   if (!persistentAuthState.hasInitialized && auth.isLoading) {
     return (
diff --git a/frontend/src/config/auth.ts b/frontend/src/config/auth.ts
index 96246df..ffddcfa 100644
--- a/frontend/src/config/auth.ts
+++ b/frontend/src/config/auth.ts
@@ -11,13 +11,27 @@ const userConfig: AuthProviderProps = {
   redirect_uri: REDIRECT_URI,
   response_type: "code",
   includeIdTokenInSilentRenew: true,
-  automaticSilentRenew: false, //TODO: Dit moet dus denk ik wel gewoon aan?
+  automaticSilentRenew: false, // We skippen automatic silent en doen het zelf hieronder.
   scope: "openid profile email offline_access", //TODO: Iets met scopes.
-  accessTokenExpiringNotificationTimeInSeconds: 5 * 60,
+  //accessTokenExpiringNotificationTimeInSeconds: 1 * 60,
   loadUserInfo: true,
   post_logout_redirect_uri: ORIGIN_URI,
   response_mode: "query",
+  revokeTokensOnSignout: true,
 };
 
 export const userManager = new UserManager(userConfig);
+
+// Some handling of token expiration.
+// Hopefully this means login timeout issues are prevented somewhat.
+userManager.events.addAccessTokenExpiring(() => {
+  console.warn("Access token expiring, silently renewing...");
+  userManager.signinSilent(); //TODO: uitzoeken bij welke callback dit trecht komt
+});
+
+userManager.events.addAccessTokenExpired(() => {
+  console.warn("Access token expired, redirecting to login...");
+  userManager.signinRedirect();
+});
+
 export const oidcConfig = { ...userConfig, userManager };