diff --git a/frontend/src/admin/AdminDialogs.vue b/frontend/src/admin/AdminDialogs.vue
index 9a5a92d..18c7f58 100644
--- a/frontend/src/admin/AdminDialogs.vue
+++ b/frontend/src/admin/AdminDialogs.vue
@@ -1,5 +1,5 @@
 <script setup>
-import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
+import { computed, nextTick, onBeforeUnmount, onMounted, ref, watch } from 'vue'
 import Modal from '@/components/Modal.vue'
 import NameEditForm from '@/components/NameEditForm.vue'
 import { useAuthStore } from '@/stores/auth'
@@ -128,16 +128,17 @@ function pageOriginAllowed(rows, rpId) {
   return probe(`https://${window.location.host}`) || probe(`http://${window.location.host}`)
 }
 
-function addOrigin() {
+const originInputs = ref([])
+
+async function addOrigin() {
   const d = props.dialog?.data
   if (!d) return
-  // Prefill with the origin the admin is currently on when editing that
-  // very domain (so saving never locks them out), else with the rp-id
-  // (https default).
-  const onThisDomain = authStore.settings?.rp_id && dialogRpId.value === authStore.settings.rp_id
-  d.origins.push(onThisDomain ? window.location.origin : dialogRpId.value)
+  d.origins.push('')
   d.originValidation.push(null)
+  // An empty entry validates invalid, blocking save until it is filled
   validateOrigin(d.origins.length - 1)
+  await nextTick()
+  originInputs.value[originInputs.value.length - 1]?.focus()
 }
 function removeOrigin(i) {
   const d = props.dialog?.data
@@ -492,6 +493,7 @@ function onRemoveOrigin(i) {
           <div v-if="dialog.data.origins.length" class="origin-list">
             <div v-for="(_, i) in dialog.data.origins" :key="i" class="origin-row">
               <input
+                ref="originInputs"
                 :value="dialog.data.origins[i]"
                 @input="e => onOriginInput(i, e)"
                 @focus="focusOriginStart"