diff --git a/test/towerops_web/controllers/user_session_html_test.exs b/test/towerops_web/controllers/user_session_html_test.exs
new file mode 100644
index 00000000..dc2a67bd
--- /dev/null
+++ b/test/towerops_web/controllers/user_session_html_test.exs
@@ -0,0 +1,97 @@
+defmodule ToweropsWeb.UserSessionHTMLTest do
+  use ToweropsWeb.ConnCase, async: true
+
+  import Phoenix.Component, only: [to_form: 1]
+  import Phoenix.Template, only: [render_to_string: 4]
+
+  alias Towerops.Accounts.User
+
+  describe "new.html" do
+    test "renders login form" do
+      form = to_form(%{"email" => "", "password" => ""})
+
+      html =
+        render_to_string(ToweropsWeb.UserSessionHTML, "new", "html",
+          flash: %{},
+          current_scope: nil,
+          form: form
+        )
+
+      assert html =~ "Log in"
+      assert html =~ "Sign up"
+      assert html =~ "Log in with passkey"
+      assert html =~ "or use email"
+      assert html =~ "or use password"
+    end
+
+    test "renders reauthentication message when current_scope is present" do
+      form = to_form(%{"email" => "user@example.com", "password" => ""})
+
+      html =
+        render_to_string(ToweropsWeb.UserSessionHTML, "new", "html",
+          flash: %{},
+          current_scope: :elevated,
+          form: form
+        )
+
+      assert html =~ "You need to reauthenticate to perform sensitive actions"
+      refute html =~ "Don't have an account?"
+    end
+  end
+
+  describe "confirm.html" do
+    test "renders confirmation form for unconfirmed user" do
+      user = %User{email: "test@example.com", confirmed_at: nil}
+      form = to_form(%{"token" => "some-token"})
+
+      html =
+        render_to_string(ToweropsWeb.UserSessionHTML, "confirm", "html",
+          flash: %{},
+          current_scope: nil,
+          user: user,
+          form: form
+        )
+
+      assert html =~ "Welcome test@example.com"
+      assert html =~ "Confirm and stay logged in"
+      assert html =~ "Confirm and log in only this time"
+      assert html =~ "If you prefer passwords, you can enable them"
+    end
+
+    test "renders login form for confirmed user" do
+      user = %User{email: "test@example.com", confirmed_at: DateTime.utc_now()}
+      form = to_form(%{"token" => "some-token"})
+
+      html =
+        render_to_string(ToweropsWeb.UserSessionHTML, "confirm", "html",
+          flash: %{},
+          current_scope: nil,
+          user: user,
+          form: form
+        )
+
+      assert html =~ "Welcome test@example.com"
+      assert html =~ "Log in and stay logged in"
+      assert html =~ "Log in only this time"
+      refute html =~ "Confirm"
+    end
+
+    test "renders simplified login for confirmed user with current_scope" do
+      user = %User{email: "test@example.com", confirmed_at: DateTime.utc_now()}
+      form = to_form(%{"token" => "some-token"})
+
+      html =
+        render_to_string(ToweropsWeb.UserSessionHTML, "confirm", "html",
+          flash: %{},
+          current_scope: :elevated,
+          user: user,
+          form: form
+        )
+
+      assert html =~ "Welcome test@example.com"
+      assert html =~ "Log in"
+      # Should not show "stay logged in" options when reauthenticating
+      refute html =~ "Log in and stay logged in"
+    end
+  end
+end