diff --git a/apps/journal/app/routes/api.sync.connect.$provider.ts b/apps/journal/app/routes/api.sync.connect.$provider.ts
index e8923f4..fb32a3a 100644
--- a/apps/journal/app/routes/api.sync.connect.$provider.ts
+++ b/apps/journal/app/routes/api.sync.connect.$provider.ts
@@ -2,6 +2,7 @@ import { redirect, data } from "react-router";
 import type { Route } from "./+types/api.sync.connect.$provider";
 import { getSessionUser } from "~/lib/auth.server";
 import { getProvider } from "~/lib/sync/registry";
+import { encodeOAuthState } from "~/lib/sync/pushes.server";
 
 export async function loader({ params, request }: Route.LoaderArgs) {
   const user = await getSessionUser(request);
@@ -12,7 +13,7 @@ export async function loader({ params, request }: Route.LoaderArgs) {
 
   const origin = process.env.ORIGIN ?? "http://localhost:3000";
   const redirectUri = `${origin}/api/sync/callback/${params.provider}`;
-  const state = user.id; // Simple state — could use a CSRF token for production
+  const state = encodeOAuthState({ returnTo: "/settings/connections" });
 
   return redirect(provider.getAuthUrl(redirectUri, state));
 }