diff --git a/mfa/controllers/Mfa.php b/mfa/controllers/Mfa.php
index 2ff3de7..0a9aa97 100644
--- a/mfa/controllers/Mfa.php
+++ b/mfa/controllers/Mfa.php
@@ -106,11 +106,11 @@ public function index()
 
                     $sRedirectUrl = $oToken->getData(
                         $oMfaService::TOKEN_DATA_KEY_RETURN_TO
-                    );
+                    ) ?: siteUrl();
 
                     $this->log(sprintf(
                         'User verified successfully, redirecting to "%s"',
-                        $sRedirectUrl ?? siteUrl()
+                        $sRedirectUrl
                     ));
 
                     redirect(
diff --git a/src/Service/MultiFactorAuth.php b/src/Service/MultiFactorAuth.php
index 6429cad..ae8fbba 100644
--- a/src/Service/MultiFactorAuth.php
+++ b/src/Service/MultiFactorAuth.php
@@ -164,7 +164,9 @@ private function generateToken(User $oUser, bool $bIsRemembered, string $sIp): T
         //  @todo (Pablo 2023-02-23) - persist session data?
 
         $oData = (object) [
-            static::TOKEN_DATA_KEY_RETURN_TO     => $oInput::get('return_to') ?: $oInput::server('URI_STRING'),
+            //  Mirrors module-auth's own post-login destination; the MFA redirect
+            //  happens during the log in event, so that never gets a chance to run
+            static::TOKEN_DATA_KEY_RETURN_TO     => $oInput::get('return_to') ?: $oUser->group_homepage,
             static::TOKEN_DATA_KEY_IS_REMEMBERED => $bIsRemembered,
         ];