diff --git a/web/apps/auth/package.json b/web/apps/auth/package.json
index d21e1dc05..463ff06e8 100644
--- a/web/apps/auth/package.json
+++ b/web/apps/auth/package.json
@@ -6,6 +6,7 @@
         "@/next": "*",
         "@ente/accounts": "*",
         "@ente/eslint-config": "*",
-        "@ente/shared": "*"
+        "@ente/shared": "*",
+        "otpauth": "^9"
     }
 }
diff --git a/web/apps/photos/package.json b/web/apps/photos/package.json
index 8d515c07c..1541878c5 100644
--- a/web/apps/photos/package.json
+++ b/web/apps/photos/package.json
@@ -28,7 +28,6 @@
         "localforage": "^1.9.0",
         "memoize-one": "^6.0.0",
         "ml-matrix": "^6.11",
-        "otpauth": "^9.0.2",
         "p-debounce": "^4.0.0",
         "p-queue": "^7.1.0",
         "photoswipe": "file:./thirdparty/photoswipe",
diff --git a/web/docs/dependencies.md b/web/docs/dependencies.md
index 2ff8e4017..83a2b2799 100644
--- a/web/docs/dependencies.md
+++ b/web/docs/dependencies.md
@@ -193,3 +193,8 @@ some cases.
 
 -   [hdbscan](https://github.com/shaileshpandit/hdbscan-js) is used for face
     clustering.
+
+## Auth app specific
+
+-   [otpauth](https://github.com/hectorm/otpauth) is used for the generation of
+    the actual OTP from the user's TOTP/HOTP secret.
diff --git a/web/yarn.lock b/web/yarn.lock
index bb1230831..894a44dd0 100644
--- a/web/yarn.lock
+++ b/web/yarn.lock
@@ -3700,10 +3700,10 @@ optionator@^0.9.3:
     prelude-ls "^1.2.1"
     type-check "^0.4.0"
 
-otpauth@^9.0.2:
-  version "9.2.2"
-  resolved "https://registry.yarnpkg.com/otpauth/-/otpauth-9.2.2.tgz#64bda9ea501a5d86e69a964a45062f1f17f740f4"
-  integrity sha512-2VcnYRUmq1dNckIfySNYP32ITWp1bvTeAEW0BSCR6G3GBf3a5zb9E+ubY62t3Dma9RjoHlvd7QpmzHfJZRkiNg==
+otpauth@^9:
+  version "9.2.4"
+  resolved "https://registry.yarnpkg.com/otpauth/-/otpauth-9.2.4.tgz#3b7941a689f63c31db43ab2494d3c2d90bc1f150"
+  integrity sha512-t0Nioq2Up2ZaT5AbpXZLTjrsNtLc/g/rVSaEThmKLErAuT9mrnAKJryiPOKc3rCH+3ycWBgKpRHYn+DHqfaPiQ==
   dependencies:
     jssha "~3.3.1"