diff --git a/internal/webapp/authcli.go b/internal/webapp/authcli.go
index 820088b..32b8665 100644
--- a/internal/webapp/authcli.go
+++ b/internal/webapp/authcli.go
@@ -162,7 +162,7 @@ func (c *CLIAuth) pageAuth(w http.ResponseWriter, r *http.Request, req authReque
 	}
 	authPage(w, req.title, fmt.Sprintf(`<p class="lede">%s</p>
 %s%s
-<form method="post"><button>Approve</button></form>
+<form method="post"><button type="submit">Approve</button></form>
 <p class="alt">%s</p>`,
 		html.EscapeString(req.lede), whoBlock(user, r.URL.RequestURI()), rows(req.detail()...), req.note))
 }
diff --git a/internal/webapp/authlocal.go b/internal/webapp/authlocal.go
index e0c89f8..1964dcc 100644
--- a/internal/webapp/authlocal.go
+++ b/internal/webapp/authlocal.go
@@ -721,7 +721,7 @@ func (a *BuiltinAuth) pageLogin(w http.ResponseWriter, r *http.Request) {
 	if a.Brand != "" {
 		brand = `<p class="alt" style="margin:0 0 14px;color:var(--dim)">` + html.EscapeString(a.Brand) + `</p>`
 	}
-	authPage(w, "Sign in", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/login?next=%s">%s%s%s<button>Sign in</button></form>
+	authPage(w, "Sign in", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/login?next=%s">%s%s%s<button type="submit">Sign in</button></form>
 %s<p class="alt"><a href="/auth/reset">Forgot password?</a></p>`,
 		url.QueryEscape(next),
 		field("Email", "email", "email", r.FormValue("email")),
@@ -787,7 +787,7 @@ func (a *BuiltinAuth) pageSignup(w http.ResponseWriter, r *http.Request) {
 	if a.Brand != "" {
 		brand = `<p class="alt" style="margin:0 0 14px;color:var(--dim)">` + html.EscapeString(a.Brand) + `</p>`
 	}
-	authPage(w, "Create account", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/signup?next=%s">%s%s%s%s%s<button>Sign up</button></form>
+	authPage(w, "Create account", brand+inviteBanner(next)+cliBanner(next)+fmt.Sprintf(`<form method="post" action="/auth/signup?next=%s">%s%s%s%s%s<button type="submit">Sign up</button></form>
 <p class="alt">Have an account? <a href="/auth/login?next=%s">Sign in</a></p>`,
 		url.QueryEscape(next),
 		field("Name", "name", "text", r.FormValue("name")),
@@ -863,7 +863,7 @@ func (a *BuiltinAuth) pageReset(w http.ResponseWriter, r *http.Request) {
 <p class="alt">No email configured on this server? The link is in the server log.</p>`)
 		return
 	}
-	authPage(w, "Reset password", fmt.Sprintf(`<form method="post">%s<button>Send reset link</button></form>
+	authPage(w, "Reset password", fmt.Sprintf(`<form method="post">%s<button type="submit">Send reset link</button></form>
 <p class="alt"><a href="/auth/login">Back to sign in</a></p>`,
 		field("Email", "email", "email", "")))
 }
@@ -900,7 +900,7 @@ func (a *BuiltinAuth) pageResetConfirm(w http.ResponseWriter, r *http.Request) {
 }
 
 func resetForm(token, msg string) string {
-	return fmt.Sprintf(`<form method="post"><input type="hidden" name="token" value=%q>%s%s<button>Set password</button></form>`,
+	return fmt.Sprintf(`<form method="post"><input type="hidden" name="token" value=%q>%s%s<button type="submit">Set password</button></form>`,
 		html.EscapeString(token), newPasswordField("New password (min 8 chars)", "password"), msg)
 }
 
diff --git a/internal/webapp/frontend/e2e/helpers.ts b/internal/webapp/frontend/e2e/helpers.ts
index c67c5a1..165c278 100644
--- a/internal/webapp/frontend/e2e/helpers.ts
+++ b/internal/webapp/frontend/e2e/helpers.ts
@@ -26,7 +26,7 @@ export async function login(page: Page, email: string = ADMIN) {
   await page.waitForURL(/auth\/login/);
   await page.fill('input[name="email"]', email);
   await page.fill('input[name="password"]', PASSWORD);
-  await page.click("form button");
+  await page.click("button[type=submit]");
   await page.waitForSelector("#sidebar");
   sessions.set(email, await page.context().cookies());
 }
diff --git a/internal/webapp/frontend/e2e/hub.spec.ts b/internal/webapp/frontend/e2e/hub.spec.ts
index 68d2bee..22e0ce1 100644
--- a/internal/webapp/frontend/e2e/hub.spec.ts
+++ b/internal/webapp/frontend/e2e/hub.spec.ts
@@ -63,7 +63,7 @@ test("join link accepts an invite after sign-in", async ({ page, browser }) => {
   await p2.waitForURL(/auth\/login/);
   await p2.fill('input[name="email"]', MEMBER);
   await p2.fill('input[name="password"]', PASSWORD);
-  await p2.click("form button");
+  await p2.click("button[type=submit]");
   await expectToast(p2, "you joined");
   await p2.waitForURL(/\/[0-9a-f-]{36}$/); // lands on the org's project
   await ctx.close();