diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index c89be9cd..8bf0f723 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -18,6 +18,7 @@ import { AppsRedirect } from "src/components/redirects/AppsRedirect";
 import { StartRedirect } from "src/components/redirects/StartRedirect";
 import { HomeRedirect } from "src/components/redirects/HomeRedirect";
 import Unlock from "src/screens/Unlock";
+import { SetupRedirect } from "src/components/redirects/SetupRedirect";
 
 function App() {
   return (
@@ -36,7 +37,7 @@ function App() {
               }
             ></Route>
             <Route path="welcome" element={<Welcome />}></Route>
-            <Route path="setup">
+            <Route path="setup" element={<SetupRedirect />}>
               <Route path="" element={<Navigate to="password" replace />} />
               <Route path="password" element={<SetupPassword />} />
               <Route path="node" element={<SetupNode />} />
diff --git a/frontend/src/components/redirects/SetupRedirect.tsx b/frontend/src/components/redirects/SetupRedirect.tsx
new file mode 100644
index 00000000..ddd22483
--- /dev/null
+++ b/frontend/src/components/redirects/SetupRedirect.tsx
@@ -0,0 +1,25 @@
+import { useInfo } from "src/hooks/useInfo";
+import { Outlet, useLocation, useNavigate } from "react-router-dom";
+import React from "react";
+import Loading from "src/components/Loading";
+
+export function SetupRedirect() {
+  const { data: info } = useInfo();
+  const location = useLocation();
+  const navigate = useNavigate();
+
+  React.useEffect(() => {
+    if (!info) {
+      return;
+    }
+    if (info.running && !info.unlocked) {
+      navigate("/");
+    }
+  }, [info, location, navigate]);
+
+  if (!info) {
+    return <Loading />;
+  }
+
+  return <Outlet />;
+}
diff --git a/http_service.go b/http_service.go
index 4fccb19e..7976f08c 100644
--- a/http_service.go
+++ b/http_service.go
@@ -251,6 +251,10 @@ func (httpSvc *HttpService) setupHandler(c echo.Context) error {
 		})
 	}
 
+	if httpSvc.svc.lnClient != nil && !httpSvc.isUnlocked(c) {
+		return c.NoContent(http.StatusUnauthorized)
+	}
+
 	err := httpSvc.api.Setup(&setupRequest)
 	if err != nil {
 		return c.JSON(http.StatusInternalServerError, ErrorResponse{