diff --git a/browser.py b/browser.py
index 651ed67..1959581 100755
--- a/browser.py
+++ b/browser.py
@@ -5,7 +5,7 @@ Navigation: ◀ ▶ ⌂ icon buttons + ☰ hamburger menu for bookmarks.
 Chrome is controlled via Chrome DevTools Protocol (CDP) over WebSocket.
 """
 import sys, json, os, subprocess, time, threading, urllib.request
-from PyQt5.QtCore    import Qt, QTimer
+from PyQt5.QtCore    import Qt, QTimer, QPoint
 from PyQt5.QtGui     import QFont, QColor, QPalette
 from PyQt5.QtWidgets import (
     QApplication, QWidget, QHBoxLayout, QVBoxLayout,
@@ -418,10 +418,14 @@ class KioskOverlay(QWidget):
         mgr_act = QAction("  ⚙  Manage Bookmarks…", menu)
         mgr_act.triggered.connect(self.open_manager)
         menu.addAction(mgr_act)
-        # Show menu below the hamburger button, anchored to right edge so
-        # Qt's overflow logic flips it leftward (avoids clipping off-screen).
-        menu.exec_(self.burger_btn.mapToGlobal(
-            self.burger_btn.rect().bottomRight()))
+        # Explicitly position menu just below the toolbar, right-aligned.
+        # sizeHint() gives the menu's preferred width before it is painted;
+        # fall back to 360px if it hasn't been computed yet.
+        mw = menu.sizeHint().width()
+        if mw < 100:
+            mw = 360
+        x = max(0, SCREEN_W - mw - 6)
+        menu.exec_(QPoint(x, TOOLBAR_H))
 
     def _build_menu(self, items):
         menu = QMenu()
@@ -496,6 +500,23 @@ def launch_chrome():
         except Exception:
             pass
 
+    # Clear the stale Roundcube session cookie so the autologin plugin always
+    # fires cleanly.  Without this, Chrome sends the old cookie after a reboot,
+    # the PHP session in MariaDB has expired, and Roundcube shows
+    # "session is invalid or expired" instead of auto-logging in.
+    cookies_db = profile_dir / "Default" / "Cookies"
+    if cookies_db.exists():
+        try:
+            import sqlite3
+            conn = sqlite3.connect(str(cookies_db))
+            conn.execute(
+                "DELETE FROM cookies WHERE host_key LIKE '%mail.jgitta.com%'")
+            conn.commit()
+            conn.close()
+            print("Cleared stale Roundcube session cookie")
+        except Exception as e:
+            print(f"Cookie clear warning: {e}")
+
     chrome_h = SCREEN_H - TOP_H
     cmd = [
         "google-chrome",