diff --git a/app/static/js/vault.js b/app/static/js/vault.js
index 9561861..f791f0e 100644
--- a/app/static/js/vault.js
+++ b/app/static/js/vault.js
@@ -307,6 +307,14 @@ const Vault = (() => {
     const sectionsEl = document.getElementById('security-sections');
     if (!summaryEl || !sectionsEl) return;
 
+    // If vault hasn't loaded yet, wait for it then re-render
+    if (!_items.length && VaultSession.getKey()) {
+      summaryEl.innerHTML = '<div class="sec-notice">Loading…</div>';
+      sectionsEl.innerHTML = '';
+      loadVault().then(() => renderSecurityDashboard());
+      return;
+    }
+
     const pwItems = _items.filter(i => i.item_type === 'password' && i.plain?.password);
     if (!pwItems.length) {
       summaryEl.innerHTML = '<div class="sec-notice">No passwords to analyze.</div>';