diff --git a/internal/gateway/router.go b/internal/gateway/router.go
index 4b51c59c..2c62717b 100644
--- a/internal/gateway/router.go
+++ b/internal/gateway/router.go
@@ -145,7 +145,10 @@ func (r *MethodRouter) handleConnect(ctx context.Context, client *Client, req *p
 			// Non-owner with gateway token: resolve tenant via hint or membership
 			hint := params.TenantID
 			if hint == "" {
-				hint = params.TenantScope
+				hint = params.TenantHint
+			}
+			if hint == "" {
+				hint = params.TenantScope // deprecated
 			}
 			tid, errCode := r.resolveTenantHint(ctx, hint, params.UserID)
 			if errCode != "" {
diff --git a/ui/web/src/components/layout/topbar.tsx b/ui/web/src/components/layout/topbar.tsx
index 8f859d72..dc451f69 100644
--- a/ui/web/src/components/layout/topbar.tsx
+++ b/ui/web/src/components/layout/topbar.tsx
@@ -131,11 +131,10 @@ function UserMenu() {
   const tenantLabel = currentTenant?.name || currentTenantName || "";
 
   const handleSwitchTenant = (_tenantId: string, slug: string) => {
-    // Owner: narrow scope to specific tenant
-    // Non-owner: use tenant_hint for pairing
-    if (isOwner) {
-      localStorage.setItem(LOCAL_STORAGE_KEYS.TENANT_ID, slug);
-    } else {
+    // Always set TENANT_ID so WS and HTTP both resolve the correct tenant.
+    localStorage.setItem(LOCAL_STORAGE_KEYS.TENANT_ID, slug);
+    // Non-owner: also set TENANT_HINT for browser pairing backward compat (Path 3a).
+    if (!isOwner) {
       localStorage.setItem(LOCAL_STORAGE_KEYS.TENANT_HINT, slug);
     }
     window.location.reload();