diff --git a/lib/towerops_web/controllers/api/mobile_auth_controller.ex b/lib/towerops_web/controllers/api/mobile_auth_controller.ex
index 9deb1a16..8749cab5 100644
--- a/lib/towerops_web/controllers/api/mobile_auth_controller.ex
+++ b/lib/towerops_web/controllers/api/mobile_auth_controller.ex
@@ -98,7 +98,7 @@ defmodule ToweropsWeb.Api.MobileAuthController do
           session = Towerops.Repo.preload(session, :user)
 
           json(conn, %{
-            session_token: session.token,
+            session_token: session.raw_token,
             expires_at: session.expires_at,
             user: %{
               id: session.user.id,
diff --git a/test/towerops_web/controllers/api/mobile_auth_controller_test.exs b/test/towerops_web/controllers/api/mobile_auth_controller_test.exs
index 2c41423a..0e66a88e 100644
--- a/test/towerops_web/controllers/api/mobile_auth_controller_test.exs
+++ b/test/towerops_web/controllers/api/mobile_auth_controller_test.exs
@@ -1,6 +1,10 @@
 defmodule ToweropsWeb.Api.MobileAuthControllerTest do
   use ToweropsWeb.ConnCase, async: true
 
+  import Towerops.AccountsFixtures
+
+  alias Towerops.MobileSessions
+
   describe "verify_qr_token" do
     test "returns error for missing token", %{conn: conn} do
       conn = post(conn, ~p"/api/v1/mobile/auth/qr/verify", %{})
@@ -31,5 +35,29 @@ defmodule ToweropsWeb.Api.MobileAuthControllerTest do
 
       assert json_response(conn, 401)["error"] == "Invalid or expired token"
     end
+
+    test "returns a usable session token on success", %{conn: conn} do
+      user = user_fixture()
+      {:ok, qr_token} = MobileSessions.create_qr_login_token(user.id)
+
+      conn =
+        post(conn, ~p"/api/v1/mobile/auth/qr/complete", %{
+          "token" => qr_token.token,
+          "device_name" => "Test iPhone",
+          "device_os" => "iOS 17.2",
+          "app_version" => "1.0.0"
+        })
+
+      assert %{"session_token" => session_token} = json_response(conn, 200)
+      assert is_binary(session_token)
+
+      # The returned token must be usable for subsequent authenticated requests
+      authed_conn =
+        build_conn()
+        |> put_req_header("authorization", "Bearer #{session_token}")
+        |> get(~p"/api/v1/mobile/organizations")
+
+      assert json_response(authed_conn, 200)
+    end
   end
 end