@@ -38,6 +38,7 @@ import {
 	promptGitSource,
 	logGitSourceOutcome,
 	runGitSourceFlow,
+	toGitAccount,
 } from '../lib/git-source/gitSource.js';
 import { usePythonRuntime } from '../lib/hooks/runtimes/python.js';
 import { getInstallCommandSuggestion } from '../lib/hooks/runtimes/utils.js';
@@ -49,6 +50,7 @@ import { LANGUAGE_FLAG_CHOICES, USE_CASE_FLAG_CHOICES } from '../lib/templates/c
 import {
 	downloadAndUnzip,
 	getJsonFileContent,
+	getLocalUserInfo,
 	getLoggedClientOrThrow,
 	isNodeVersionSupported,
 	isPythonVersionSupported,
@@ -302,6 +304,8 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 			? {
 					provider: gitProvider,
 					client: await getLoggedClientOrThrow(),
+					// Read after the client, which refreshes auth.json from the token the run resolved.
+					account: toGitAccount(await getLocalUserInfo()),
 					...parseGitRepoFlag(gitRepo, actorName),
 				}
 			: null;
@@ -343,6 +347,7 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 				templateArchiveUrl,
 				client: gitSetup.client,
 				isInteractive,
+				account: gitSetup.account,
 				customize: applyLocalConfig,
 			});
 		}
@@ -567,6 +572,7 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 						repoName: gitSetup.repoName,
 						scaffolded: gitResult.scaffolded,
 						actorId: gitResult.actorId,
+						account: gitSetup.account,
 					})
 				: buildNextSteps({ actorName, dependenciesInstalled, installCommandSuggestion });
 
@@ -586,7 +592,9 @@ export class CreateCommand extends ApifyCommand<typeof CreateCommand> {
 				actorId: gitResult?.actorId ?? null,
 				stopReason: gitResult?.stopReason ?? null,
 				error: gitResult?.error ?? null,
-				gitConnectUrl: gitProvider ? getGitStopUrl(gitProvider, gitResult?.stopReason ?? null) : null,
+				gitConnectUrl: gitProvider
+					? getGitStopUrl(gitProvider, gitResult?.stopReason ?? null, gitSetup?.account)
+					: null,
 				workspaces: gitResult?.workspaces ?? null,
 			});
 		} else if (reportSuccess) {
 
@@ -11,6 +11,7 @@ import { getConsoleUrl } from '../console-url.js';
 import { useSelectFromList } from '../hooks/user-confirmations/useSelectFromList.js';
 import { useUserInput } from '../hooks/user-confirmations/useUserInput.js';
 import { info, warning } from '../outputs.js';
+import type { AuthJSON } from '../types.js';
 import { cliDebugPrint } from '../utils/cliDebugPrint.js';
 
 /** Where a new Actor's source code lives. `apify` is the existing, Git-less path. */
@@ -84,11 +85,37 @@ const GIT_PROVIDERS = {
 	},
 } satisfies Record<GitProvider, GitProviderConfig>;
 
+/**
+ * The Apify account the CLI token belongs to, as `auth.json` records it. An organization login is the case
+ * that matters: Console completes the exchange as whichever account its own route prefix selects, so
+ * without that prefix the grant lands on the personal account behind the organization instead.
+ */
+export interface GitAccount {
+	id?: string;
+	username?: string;
+	organizationOwnerUserId?: string;
+}
+
+/** Narrows the stored login to what the handoff needs, so the token is not carried around with it. */
+export const toGitAccount = ({ id, username, organizationOwnerUserId }: AuthJSON): GitAccount => ({
+	id,
+	username,
+	organizationOwnerUserId,
+});
+
+/** The Console route the callback page has to run under to complete the exchange as this account. */
+const getConsoleRoutePrefix = (account?: GitAccount) =>
+	account?.organizationOwnerUserId && account.id ? `/organization/${account.id}` : null;
+
 /** Where to send a user who has not connected this provider to Apify yet. */
-export const getGitConnectUrl = (provider: GitProvider) => {
+export const getGitConnectUrl = (provider: GitProvider, account?: GitAccount) => {
 	const { authorizeEndpoint, defaultClientId, clientIdEnvVar, redirectPath } = GIT_PROVIDERS[provider];
 
 	const redirectUri = new URL(redirectPath, getConsoleUrl());
+	const routePrefix = getConsoleRoutePrefix(account);
+	// Encoded twice on purpose, matching Console: it encodes the prefix into the query it builds, and the
+	// callback page decodes it once of its own accord before navigating there.
+	if (routePrefix) redirectUri.searchParams.set('routePrefix', encodeURIComponent(routePrefix));
 
 	const url = new URL(authorizeEndpoint);
 	url.searchParams.set('client_id', process.env[clientIdEnvVar] || defaultClientId);
@@ -208,7 +235,7 @@ const POLL_TIMEOUT_MS = 3 * 60_000;
  */
 const ensureUsableIntegration = async (
 	provider: GitProvider,
-	{ client, isInteractive }: ApiCallOptions & { isInteractive: boolean },
+	{ client, isInteractive, account }: ApiCallOptions & { isInteractive: boolean; account?: GitAccount },
 ): Promise<GitProviderIntegration | null> => {
 	const load = async () => findIntegration(await fetchGitIntegrations({ client }), provider);
 
@@ -223,13 +250,27 @@ const ensureUsableIntegration = async (
 	// Agents and CI must never be parked on a browser; the caller emits the URL and stops instead.
 	if (!isInteractive) return integration ?? null;
 
-	const url = integration ? integration.addWorkspaceUrl || getAddWorkspaceUrl(provider) : getGitConnectUrl(provider);
-	const what = integration ? `Give Apify access to a ${provider} account` : `Connect your ${provider} account to Apify`;
+	// Which grant is missing decides the URL, and authorizing changes the answer: the integration then
+	// exists with no workspaces, and only installing the app fills them. So this is re-read every poll,
+	// and a URL that has already been opened is never opened twice.
+	let openedUrl: string | null = null;
+	const offer = async (current: GitProviderIntegration | undefined) => {
+		const url = current ? current.addWorkspaceUrl || getAddWorkspaceUrl(provider) : getGitConnectUrl(provider, account);
+		if (url === openedUrl) return;
+		openedUrl = url;
+
+		const what = current ? `Give Apify access to a ${provider} account` : `Connect your ${provider} account to Apify`;
+		info({ message: `${what}: ${url}` });
+		// Printed above as well — a headless session, or a machine with no usable default browser, still needs it.
+		await open(url).catch(() => undefined);
+		info({
+			message: account?.username
+				? `Waiting for authorization to complete in your browser. It connects ${provider} to the Apify account ${account.username}.`
+				: 'Waiting for authorization to complete in your browser...',
+		});
+	};
 
-	info({ message: `${what}: ${url}` });
-	// Printed above as well — a headless session, or a machine with no usable default browser, still needs it.
-	await open(url).catch(() => undefined);
-	info({ message: 'Waiting for authorization to complete in your browser...' });
+	await offer(integration);
 
 	const deadline = Date.now() + POLL_TIMEOUT_MS;
 	let interval = POLL_INTERVAL_START_MS;
@@ -238,6 +279,7 @@ const ensureUsableIntegration = async (
 		interval = Math.min(Math.round(interval * 1.5), POLL_INTERVAL_MAX_MS);
 		integration = await load();
 		if (integration?.workspaces.length) return integration;
+		await offer(integration);
 	}
 
 	return integration ?? null;
@@ -426,6 +468,8 @@ export interface RunGitSourceFlowOptions extends ApiCallOptions {
 	isPrivate: boolean;
 	templateArchiveUrl: string;
 	isInteractive: boolean;
+	/** The account the run authorizes as, so an organization login connects the organization. */
+	account?: GitAccount;
 	/** Local-only setup for the clone. Runs between the clone and the commit, so its changes land in git. */
 	customize: (dir: string) => Promise<void>;
 }
@@ -444,6 +488,7 @@ export const runGitSourceFlow = async ({
 	isPrivate,
 	templateArchiveUrl,
 	isInteractive,
+	account,
 	customize,
 }: RunGitSourceFlowOptions): Promise<GitSourceResult> => {
 	let scaffolded = false;
@@ -465,16 +510,17 @@ export const runGitSourceFlow = async ({
 
 	let integration: GitProviderIntegration | null;
 	try {
-		integration = await ensureUsableIntegration(provider, { client, isInteractive });
+		integration = await ensureUsableIntegration(provider, { client, isInteractive, account });
 	} catch (err) {
 		return stopped('lookupFailed', err);
 	}
 
+	const who = account?.username ? `The Apify account ${account.username}` : 'Apify';
 	if (!integration) {
-		return stopped('notAuthorized', new Error(`Apify is not authorized to access your ${provider} account.`));
+		return stopped('notAuthorized', new Error(`${who} is not authorized to access ${provider}.`));
 	}
 	if (!integration.workspaces.length) {
-		return stopped('noWorkspace', new Error(`Apify has no ${provider} account to create the repository in.`));
+		return stopped('noWorkspace', new Error(`${who} has no ${provider} account to create the repository in.`));
 	}
 
 	const workspaces = integration.workspaces.map(({ id }) => id);
@@ -573,8 +619,12 @@ export const runGitSourceFlow = async ({
  * The URL that unblocks a stop, when one exists — `gitConnectUrl` in the `--json` payload. Authorization
  * and installation are separate grants, so the two stops resolve to different places.
  */
-export const getGitStopUrl = (provider: GitProvider, stopReason: GitSourceStopReason | null): string | null => {
-	if (stopReason === 'notAuthorized') return getGitConnectUrl(provider);
+export const getGitStopUrl = (
+	provider: GitProvider,
+	stopReason: GitSourceStopReason | null,
+	account?: GitAccount,
+): string | null => {
+	if (stopReason === 'notAuthorized') return getGitConnectUrl(provider, account);
 	if (stopReason === 'noWorkspace') return getAddWorkspaceUrl(provider);
 	return null;
 };
@@ -592,6 +642,7 @@ export interface GitSourceNextStepsOptions {
 	scaffolded: boolean;
 	/** Set once the Actor exists, so a later stop can link to it. */
 	actorId?: string | null;
+	account?: GitAccount;
 }
 
 /** What to tell the user, or hand an agent in `--json`, once the Git wiring has stopped. */
@@ -604,6 +655,7 @@ export const buildGitSourceNextSteps = ({
 	repoName,
 	scaffolded,
 	actorId,
+	account,
 }: GitSourceNextStepsOptions): string[] => {
 	const enter = `cd "${actorName}"`;
 
@@ -613,7 +665,10 @@ export const buildGitSourceNextSteps = ({
 		case 'lookupFailed':
 			return ['Re-run with APIFY_CLI_DEBUG=1 to see the failing request'];
 		case 'notAuthorized':
-			return [`Connect your ${provider} account to Apify: ${getGitConnectUrl(provider)}`, 'then re-run apify create'];
+			return [
+				`Connect your ${provider} account to Apify: ${getGitConnectUrl(provider, account)}`,
+				'then re-run apify create',
+			];
 		case 'noWorkspace':
 			return [`Give Apify access to an account: ${getAddWorkspaceUrl(provider)}`, 'then re-run apify create'];
 		case 'unknownWorkspace':
 
@@ -70,6 +70,31 @@ describe('getGitConnectUrl', () => {
 		);
 	});
 
+	// The callback page verifies the code as the account its route prefix selects, so an organization
+	// login without this connects the personal account behind it and the CLI waits for nothing.
+	it('sends an organization login to its own Console route', () => {
+		const url = new URL(
+			getGitConnectUrl('github', {
+				id: 'qTyaZThN7mnbef6iQ',
+				username: 'balrog',
+				organizationOwnerUserId: 'eCJxAGafqfxEVvmjx',
+			}),
+		);
+		const redirectUri = new URL(url.searchParams.get('redirect_uri')!);
+
+		// Double-encoded, as Console builds it: the page decodes the value once before navigating there.
+		expect(redirectUri.searchParams.get('routePrefix')).toBe('%2Forganization%2FqTyaZThN7mnbef6iQ');
+		expect(decodeURIComponent(redirectUri.searchParams.get('routePrefix')!)).toBe('/organization/qTyaZThN7mnbef6iQ');
+	});
+
+	it('leaves a personal login on the root Console route', () => {
+		const url = new URL(getGitConnectUrl('github', { id: 'eCJxAGafqfxEVvmjx', username: 'l2ysho' }));
+
+		expect(url.searchParams.get('redirect_uri')).toBe(
+			'https://console.apify.com/actors/new/git/connected?service=github',
+		);
+	});
+
 	it('honours the environment overrides', () => {
 		process.env.APIFY_GITHUB_APP_CLIENT_ID = 'Iv1.staging';
 		process.env.APIFY_CONSOLE_URL = 'https://console.staging.example.com';
@@ -157,6 +182,17 @@ describe('buildGitSourceNextSteps', () => {
 		expect(noWorkspace).toContainEqual(expect.stringContaining('installations/new'));
 	});
 
+	// The recovery URL has to carry the prefix too, or the re-run repeats the same dead end.
+	it('keeps an organization login on its own route in the recovery steps', () => {
+		const steps = buildGitSourceNextSteps({
+			...base,
+			stopReason: 'notAuthorized',
+			account: { id: 'qTyaZThN7mnbef6iQ', username: 'balrog', organizationOwnerUserId: 'eCJxAGafqfxEVvmjx' },
+		});
+
+		expect(steps.join('\n')).toContain('routePrefix');
+	});
+
 	// A clone that landed already has its remote, so re-adding one would exit with "remote origin
 	// already exists" — the only thing left undone is the local configuration.
 	it('does not rebuild the clone when only the local configuration failed', () => {