diff --git a/apps/web/src/dashboard/app.js b/apps/web/src/dashboard/app.js
index e09bf5e..2fe555c 100644
--- a/apps/web/src/dashboard/app.js
+++ b/apps/web/src/dashboard/app.js
@@ -92,3 +92,55 @@ function watchAccount(onPing) {
   connect();
   return ac;
 }
+
+// Status page edit form: Change/Remove flow for the password field. The
+// section is only present when an existing page already has a password set;
+// the helper is a no-op on every other page. Lives here (rather than inline
+// in the .eta template) because Eta's parser chokes on stray `%` characters
+// inside <script> blocks — see feedback_eta_no_inline_js.
+function initPasswordSection() {
+  var section = document.querySelector('[data-password-section]');
+  if (!section) return;
+  var locked     = section.querySelector('[data-password-locked]');
+  var inputWrap  = section.querySelector('[data-password-input-wrap]');
+  var input      = section.querySelector('[data-password-input]');
+  var removing   = section.querySelector('[data-password-removing]');
+  var removeFlag = section.querySelector('[data-remove-password-flag]');
+  if (!locked || !inputWrap || !input || !removing || !removeFlag) return;
+
+  var change   = section.querySelector('[data-password-change]');
+  var cancel   = section.querySelector('[data-password-cancel]');
+  var remove   = section.querySelector('[data-password-remove]');
+  var undoRemove = section.querySelector('[data-password-undo-remove]');
+
+  if (change) change.addEventListener('click', function() {
+    locked.classList.add('hidden');
+    inputWrap.classList.remove('hidden');
+    removing.classList.add('hidden');
+    removeFlag.value = '';
+    input.focus();
+  });
+  if (cancel) cancel.addEventListener('click', function() {
+    inputWrap.classList.add('hidden');
+    locked.classList.remove('hidden');
+    input.value = '';
+  });
+  if (remove) remove.addEventListener('click', function() {
+    locked.classList.add('hidden');
+    inputWrap.classList.add('hidden');
+    removing.classList.remove('hidden');
+    removeFlag.value = '1';
+    input.value = '';
+  });
+  if (undoRemove) undoRemove.addEventListener('click', function() {
+    removing.classList.add('hidden');
+    locked.classList.remove('hidden');
+    removeFlag.value = '';
+  });
+}
+
+if (document.readyState === 'loading') {
+  document.addEventListener('DOMContentLoaded', initPasswordSection);
+} else {
+  initPasswordSection();
+}
diff --git a/apps/web/src/views/status-page-edit.ejs b/apps/web/src/views/status-page-edit.ejs
index 36874a3..27cc89c 100644
--- a/apps/web/src/views/status-page-edit.ejs
+++ b/apps/web/src/views/status-page-edit.ejs
@@ -217,44 +217,9 @@
           class="w-full bg-surface-solid border border-border-subtle rounded-lg px-4 py-2.5 text-gray-100 placeholder-gray-600 focus:outline-none focus:border-blue-500">
       <% } %>
     </div>
-    <% if (hasPassword) { %>
-    <script>
-    (function() {
-      var section    = document.querySelector('[data-password-section]');
-      if (!section) return;
-      var locked     = section.querySelector('[data-password-locked]');
-      var inputWrap  = section.querySelector('[data-password-input-wrap]');
-      var input      = section.querySelector('[data-password-input]');
-      var removing   = section.querySelector('[data-password-removing]');
-      var removeFlag = section.querySelector('[data-remove-password-flag]');
-
-      section.querySelector('[data-password-change]').addEventListener('click', function() {
-        locked.classList.add('hidden');
-        inputWrap.classList.remove('hidden');
-        removing.classList.add('hidden');
-        removeFlag.value = '';
-        input.focus();
-      });
-      section.querySelector('[data-password-cancel]').addEventListener('click', function() {
-        inputWrap.classList.add('hidden');
-        locked.classList.remove('hidden');
-        input.value = '';
-      });
-      section.querySelector('[data-password-remove]').addEventListener('click', function() {
-        locked.classList.add('hidden');
-        inputWrap.classList.add('hidden');
-        removing.classList.remove('hidden');
-        removeFlag.value = '1';
-        input.value = '';
-      });
-      section.querySelector('[data-password-undo-remove]').addEventListener('click', function() {
-        removing.classList.add('hidden');
-        locked.classList.remove('hidden');
-        removeFlag.value = '';
-      });
-    })();
-    </script>
-    <% } %>
+    <%# Password section behavior lives in apps/web/src/dashboard/app.js
+        (initPasswordSection). It's loaded by partials/head.ejs on every
+        dashboard page and self-attaches when [data-password-section] exists. %>
 
     <div>
       <label class="block text-sm text-gray-400 mb-1.5">Custom CSS <span class="text-gray-600">(optional)</span></label>