diff --git a/app/(auth)/reset-password/page.tsx b/app/(auth)/reset-password/page.tsx
index d0c531c5..86c555a6 100644
--- a/app/(auth)/reset-password/page.tsx
+++ b/app/(auth)/reset-password/page.tsx
@@ -21,7 +21,11 @@ import { Loader2, KeyRound } from 'lucide-react'
  *   links but do not click buttons, so the one-time token survives
  *   scanning. Never verify in an effect; that re-opens the burn.
  * - 'enter-code': no session, no token_hash. The email also carries a
- *   6-digit code the user can type together with their email address.
+ *   one-time code the user can type together with their email address.
+ *   The code length follows the project's Email OTP Length setting
+ *   (this project uses 8, gotrue allows 6-10), so the input must never
+ *   cap at 6: a maxLength shorter than the real code silently truncates
+ *   what the user types and every verify fails.
  */
 type Mode = 'loading' | 'set-password' | 'confirm-link' | 'enter-code'
 
@@ -242,7 +246,7 @@ function ResetPasswordInner() {
                   onChange={(e) => setCode(e.target.value)}
                   required
                   minLength={6}
-                  maxLength={6}
+                  maxLength={10}
                   disabled={isLoading}
                   className="h-11 tracking-widest"
                 />
diff --git a/messages/en.json b/messages/en.json
index 286e8fbb..3174e634 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -858,7 +858,7 @@
     "code_subtitle": "Enter your email and the one-time code from the email.",
     "email_label": "Email address",
     "code_label": "One-time code",
-    "code_placeholder": "6-digit code",
+    "code_placeholder": "The code from the email",
     "code_button": "Verify code",
     "code_verifying": "Verifying...",
     "code_hint": "The code is in the password reset email. If no email arrived, request a new reset from the login page.",
diff --git a/messages/sv.json b/messages/sv.json
index 6f825274..94fc3465 100644
--- a/messages/sv.json
+++ b/messages/sv.json
@@ -858,7 +858,7 @@
     "code_subtitle": "Ange din e-post och engångskoden från mailet.",
     "email_label": "E-postadress",
     "code_label": "Engångskod",
-    "code_placeholder": "6-siffrig kod",
+    "code_placeholder": "Koden från mailet",
     "code_button": "Verifiera kod",
     "code_verifying": "Verifierar...",
     "code_hint": "Koden finns i mailet om lösenordsåterställning. Hittar du inget mail kan du begära en ny återställning från inloggningssidan.",