diff --git a/apps/console/src/pages/iam/auth/ActivateAccountPage.tsx b/apps/console/src/pages/iam/auth/ActivateAccountPage.tsx
index 63dda7ef2..c91d90162 100644
--- a/apps/console/src/pages/iam/auth/ActivateAccountPage.tsx
+++ b/apps/console/src/pages/iam/auth/ActivateAccountPage.tsx
@@ -76,7 +76,7 @@ export default function ActivateAccountPage() {
 
         if (activateAccount.ssoLoginUrl) {
           const url = new URL(activateAccount.ssoLoginUrl);
-          url.search = searchParams.toString();
+          url.searchParams.set("continue", safeContinueUrl.toString());
 
           window.location.href = url.toString();
           return;
diff --git a/pkg/server/api/connect/v1/v1_resolver.go b/pkg/server/api/connect/v1/v1_resolver.go
index 096ab4711..3099edafe 100644
--- a/pkg/server/api/connect/v1/v1_resolver.go
+++ b/pkg/server/api/connect/v1/v1_resolver.go
@@ -427,7 +427,8 @@ func (r *mutationResolver) ActivateAccount(ctx context.Context, input types.Acti
 	if identity.HashedPassword == nil {
 		token, err := r.iam.AuthService.GetResetPasswordToken(ctx, identity.EmailAddress)
 		if err != nil {
-			return nil, fmt.Errorf("cannot generate password create token: %w", err)
+			r.logger.ErrorCtx(ctx, "cannot generate password create token", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
 		}
 
 		createPasswordToken = &token