diff --git a/app/login/onboarding.php b/app/login/onboarding.php
index 5a329a3..f63c3d6 100644
--- a/app/login/onboarding.php
+++ b/app/login/onboarding.php
@@ -1,7 +1,6 @@
 <?php
     require '../session.php';
     require '../config.php';
-    require '../include_header.php';
 
     // Must come from email verification
     if (empty($_SESSION['onboarding_user_id'])) {
@@ -9,11 +8,13 @@
         exit;
     }
 
-    // Generate CSRF token if not already set
+    // Generate CSRF token before include_header.php outputs the meta tag
     if (empty($_SESSION['csrf_token'])) {
         $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
     }
 
+    require '../include_header.php';
+
     $user_name = htmlspecialchars($_SESSION['onboarding_name'] ?? 'there');
 ?>