diff --git a/assets/custom2.js b/assets/custom2.js
index e51d49b..c41df88 100644
--- a/assets/custom2.js
+++ b/assets/custom2.js
@@ -2,6 +2,22 @@
 // The auth form and footer are client-rendered (React), so a plain `load`
 // listener runs too early — a MutationObserver re-checks on every DOM change.
 (function () {
+  // One-time pin migration (2026-10-20): before the server sent
+  // interface.defaultPinnedTools, the client eager-seeded PIN_MCP_ and
+  // LAST_WEB_SEARCH_TOGGLE_pinned as 'false' — artifacts of the old default,
+  // not user choices (there is no unpin UI yet). Those stored values override
+  // the new server defaults forever, leaving Tools/Web Search unpinned.
+  // Clear them ONCE per browser; deliberate unpinning afterwards sticks.
+  try {
+    if (!localStorage.getItem('coopPinMigration20261020')) {
+      if (localStorage.getItem('PIN_MCP_') === 'false') localStorage.removeItem('PIN_MCP_');
+      if (localStorage.getItem('LAST_WEB_SEARCH_TOGGLE_pinned') === 'false') {
+        localStorage.removeItem('LAST_WEB_SEARCH_TOGGLE_pinned');
+      }
+      localStorage.setItem('coopPinMigration20261020', '1');
+    }
+  } catch (e) { /* storage unavailable — non-fatal */ }
+
   function hideSignupPrompt() {
     document.querySelectorAll('p').forEach(function (p) {
       var link = p.querySelector('a[href*="register"]');