diff --git a/templates/registration/login.html b/templates/registration/login.html
index e0378147..c68b8f45 100644
--- a/templates/registration/login.html
+++ b/templates/registration/login.html
@@ -17,14 +17,26 @@ <h2>
 
 {% include "registration/reg-optional-text.html" %}
 
-<form action="." method="post">
+<form action="." method="post" id="login-form">
   <table class="table">
   {% csrf_token %}
   {{ form.as_table }}
   </table>
-  <input type="submit" value="Submit"> or <a href="{% url 'django_registration_register' %}">register</a>
+  <input type="submit" id="login-submit" value="Submit"> or <a href="{% url 'django_registration_register' %}">register</a>
 </form>
 
+<script>
+  // Prevent double-submits: a second POST after login rotates the CSRF
+  // token and fails CSRF verification.
+  document.getElementById('login-form').addEventListener('submit', function() {
+    document.getElementById('login-submit').disabled = true;
+  });
+  // Re-enable if the page is restored from the back/forward cache
+  window.addEventListener('pageshow', function() {
+    document.getElementById('login-submit').disabled = false;
+  });
+</script>
+
 <p class="mt-5"><a href="{% url 'password_reset' %}">Forgot password?</a></p>
 
 <script src="https://code.jquery.com/jquery-3.5.1.slim.min.js" integrity="sha256-4+XzXVhsDmqanXGHaHvgh1gMQKX40OUvDEBTu8JcmNs=" crossorigin="anonymous"></script>