diff --git a/src/routes/idaa/(idaa)/+layout.svelte b/src/routes/idaa/(idaa)/+layout.svelte
index 867f7a60..b9865d08 100644
--- a/src/routes/idaa/(idaa)/+layout.svelte
+++ b/src/routes/idaa/(idaa)/+layout.svelte
@@ -251,5 +251,21 @@ async function verify_novi_uuid(
         {:else}
             <p>IDAA Novi UUID not found!</p>
         {/if}
+
+        {#if $ae_loc.iframe}
+            <!-- WHY: In iframe mode the Novi UUID is passed via URL param on first load.
+                 If verification hasn't completed yet (timing race on Novi API), the user
+                 lands on Access Denied. Reloading the iframe re-triggers verification. -->
+            <button
+                type="button"
+                class="btn btn-sm preset-tonal-primary border-primary-500 mt-4 border"
+                onclick={() => location.reload()}>
+                <span class="fas fa-redo m-1"></span>
+                Reload / Retry
+            </button>
+            <p class="mt-1 text-xs text-gray-500">
+                If your session just started, try reloading.
+            </p>
+        {/if}
     </div>
 {/if}