diff --git a/packages/challenger-webui/src/Routing.tsx b/packages/challenger-webui/src/Routing.tsx
index 5723d901d..8ad764e54 100644
--- a/packages/challenger-webui/src/Routing.tsx
+++ b/packages/challenger-webui/src/Routing.tsx
@@ -137,6 +137,7 @@ function PublicRouting(): VNode {
 
       return (
         <Setup
+          focus
           clientId={safeDecodeURIComponent(location.values.client)}
           secret={secret}
           redirectURL={redirectURL}
diff --git a/packages/challenger-webui/src/pages/Setup.tsx b/packages/challenger-webui/src/pages/Setup.tsx
index c76ac982e..dc084e818 100644
--- a/packages/challenger-webui/src/pages/Setup.tsx
+++ b/packages/challenger-webui/src/pages/Setup.tsx
@@ -85,6 +85,15 @@ export function Setup({ clientId, secret, redirectURL, focus }: Props): VNode {
         ? invalidUrlMessage
         : undefined,
   });
+  // Values passed in the URL are read-only; start on the first field the
+  // developer still has to fill in.
+  const focusField = !focus
+    ? undefined
+    : secret === undefined
+      ? "password"
+      : redirectURL === undefined
+        ? "redirect_url"
+        : undefined;
   const startArgs =
     errors || !password || !url
       ? undefined
@@ -138,7 +147,7 @@ export function Setup({ clientId, secret, redirectURL, focus }: Props): VNode {
             {clientPasswordLabel}
           </label>
           <input
-            ref={focus ? doAutoFocus : undefined}
+            ref={focusField === "password" ? doAutoFocus : undefined}
             id="password"
             name="password"
             type="password"
@@ -162,6 +171,7 @@ export function Setup({ clientId, secret, redirectURL, focus }: Props): VNode {
             {redirectUrlLabel}
           </label>
           <input
+            ref={focusField === "redirect_url" ? doAutoFocus : undefined}
             id="redirect_url"
             name="redirect_url"
             type="url"