diff --git a/web/src/client/services/buffer-subscription-service.ts b/web/src/client/services/buffer-subscription-service.ts
index 4dadb19e..93e1209b 100644
--- a/web/src/client/services/buffer-subscription-service.ts
+++ b/web/src/client/services/buffer-subscription-service.ts
@@ -27,7 +27,20 @@ export class BufferSubscriptionService {
   private isConnecting = false;
   private messageQueue: Array<{ type: string; sessionId?: string }> = [];
 
+  private initialized = false;
+
+  // biome-ignore lint/complexity/noUselessConstructor: This constructor documents the intentional design decision to not auto-connect
   constructor() {
+    // Do not connect automatically - wait for initialize() to be called
+  }
+
+  /**
+   * Initialize the buffer subscription service and connect to WebSocket
+   * Should be called after authentication is complete
+   */
+  initialize() {
+    if (this.initialized) return;
+    this.initialized = true;
     this.connect();
   }
 
@@ -241,6 +254,11 @@ export class BufferSubscriptionService {
    * Returns an unsubscribe function
    */
   subscribe(sessionId: string, handler: BufferUpdateHandler): () => void {
+    // Ensure service is initialized when first subscription happens
+    if (!this.initialized) {
+      this.initialize();
+    }
+
     // Add handler to subscriptions
     if (!this.subscriptions.has(sessionId)) {
       this.subscriptions.set(sessionId, new Set());
diff --git a/web/src/client/services/push-notification-service.ts b/web/src/client/services/push-notification-service.ts
index f68fc740..b9ce76aa 100644
--- a/web/src/client/services/push-notification-service.ts
+++ b/web/src/client/services/push-notification-service.ts
@@ -1,5 +1,6 @@
 import { PushNotificationPreferences, PushSubscription } from '../../shared/types.js';
 import { createLogger } from '../utils/logger.js';
+import { authClient } from './auth-client.js';
 
 // Re-export types for components
 export { PushSubscription, PushNotificationPreferences };
@@ -23,14 +24,30 @@ export class PushNotificationService {
   private pushNotificationsAvailable = false;
   private initializationPromise: Promise<void> | null = null;
 
+  // biome-ignore lint/complexity/noUselessConstructor: This constructor documents the intentional design decision to not auto-initialize
   constructor() {
-    this.initializationPromise = this.initialize().catch((error) => {
-      logger.error('failed to initialize push notification service:', error);
-      throw error;
-    });
+    // Do not initialize automatically - wait for explicit initialization
   }
 
-  private async initialize(): Promise<void> {
+  /**
+   * Initialize the push notification service
+   * Should be called after authentication is complete
+   */
+  async initialize(): Promise<void> {
+    if (this.initializationPromise) {
+      return this.initializationPromise;
+    }
+
+    this.initializationPromise = this._initialize().catch((error) => {
+      logger.error('failed to initialize push notification service:', error);
+      // Don't throw here - just log the error
+      // Push notifications are optional functionality
+    });
+
+    return this.initializationPromise;
+  }
+
+  private async _initialize(): Promise<void> {
     if (this.initialized) return;
 
     try {
@@ -468,7 +485,9 @@ export class PushNotificationService {
    */
   private async fetchVapidPublicKey(): Promise<void> {
     try {
-      const response = await fetch('/api/push/vapid-public-key');
+      const response = await fetch('/api/push/vapid-public-key', {
+        headers: authClient.getAuthHeader(),
+      });
 
       if (!response.ok) {
         if (response.status === 503) {
diff --git a/web/src/client/utils/logger.ts b/web/src/client/utils/logger.ts
index 55c7bd17..14825db1 100644
--- a/web/src/client/utils/logger.ts
+++ b/web/src/client/utils/logger.ts
@@ -48,6 +48,13 @@ async function sendToServer(level: keyof LogLevel, module: string, args: unknown
     // Import authClient singleton dynamically to avoid circular dependencies
     const { authClient } = await import('../services/auth-client.js');
 
+    // Check if we have authentication before sending logs
+    const authHeader = authClient.getAuthHeader();
+    if (!authHeader.Authorization) {
+      // Skip sending logs if not authenticated
+      return;
+    }
+
     await fetch('/api/logs/client', {
       method: 'POST',
       headers: {