diff --git a/.github/workflows/password-loader-patch-v1774.yml b/.github/workflows/password-loader-patch-v1774.yml
new file mode 100644
index 0000000..b3e37dc
--- /dev/null
+++ b/.github/workflows/password-loader-patch-v1774.yml
@@ -0,0 +1,50 @@
+name: Caterium One-Time Password Loader Patch
+on:
+  push:
+    branches: ["fix/password-security-v1774"]
+permissions:
+  contents: write
+concurrency:
+  group: caterium-password-loader-patch-v1774
+  cancel-in-progress: false
+jobs:
+  patch:
+    if: ${{ !contains(github.event.head_commit.message, '[password-loader-patch]') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: fix/password-security-v1774
+          fetch-depth: 0
+      - name: Patch account-security loader and PWA core
+        shell: bash
+        run: |
+          node <<'NODE'
+          const fs=require('fs');
+          const replaceOnce=(src,from,to,label)=>{
+            const count=src.split(from).length-1;
+            if(count!==1)throw new Error(`${label}: expected one occurrence, found ${count}`);
+            return src.replace(from,to);
+          };
+          const perfPath='public/core/performance.js';
+          let perf=fs.readFileSync(perfPath,'utf8');
+          const loader=`  function loadAccountSecurity(){\n    if(window.CateriumAccountSecurityV1774||document.getElementById('cateriumAccountSecurityV1774Script'))return;\n    const script=document.createElement('script');script.id='cateriumAccountSecurityV1774Script';script.src=\`core/account-security-v1774.js?v=\${RELEASE}\`;script.async=false;script.onerror=()=>console.error('[Caterium] Не загрузился модуль account-security-v1774.js');document.head.appendChild(script);\n  }\n`;
+          perf=replaceOnce(perf,'  const start=()=>{',loader+'  const start=()=>{','performance loader insertion');
+          perf=replaceOnce(perf,'loadOfferWorkspace();loadAuthSecurity();scan(document);','loadOfferWorkspace();loadAuthSecurity();loadAccountSecurity();scan(document);','performance startup');
+          perf=replaceOnce(perf,'loadOfferWorkspace,loadAuthSecurity,disconnect:','loadOfferWorkspace,loadAuthSecurity,loadAccountSecurity,disconnect:','performance api');
+          fs.writeFileSync(perfPath,perf);
+
+          const swPath='public/service-worker.js';
+          let sw=fs.readFileSync(swPath,'utf8');
+          sw=replaceOnce(sw,'`./core/offer-workspace-v1769.js?v=${VERSION}`,`./legacy/bootstrap.js?v=${VERSION}`','`./core/offer-workspace-v1769.js?v=${VERSION}`,`./core/auth-security-v1774.js?v=${VERSION}`,`./core/account-security-v1774.js?v=${VERSION}`,`./legacy/bootstrap.js?v=${VERSION}`','service worker core');
+          fs.writeFileSync(swPath,sw);
+          NODE
+      - name: Commit loader patch
+        shell: bash
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add public/core/performance.js public/service-worker.js
+          git commit -m "security: load account password guard [password-loader-patch]"
+          git push origin HEAD:fix/password-security-v1774