diff --git a/src/webui/internal/handlers/configure_system.go b/src/webui/internal/handlers/configure_system.go
index b7fedbd7..21673733 100644
--- a/src/webui/internal/handlers/configure_system.go
+++ b/src/webui/internal/handlers/configure_system.go
@@ -381,9 +381,8 @@ func renderSaveError(w http.ResponseWriter, err error) {
 		msg = err.Error()
 	}
 	w.Header().Set("Content-Type", "text/html")
-	w.WriteHeader(http.StatusUnprocessableEntity)
-	// Encode the message safely for HTML output.
 	b, _ := json.Marshal(msg)
-	_ = b // used below via template-escaped string
+	w.Header().Set("HX-Trigger", `{"cfgError":`+string(b)+`}`)
+	w.WriteHeader(http.StatusUnprocessableEntity)
 	w.Write([]byte(`<span class="cfg-save-error">` + template.HTMLEscapeString(msg) + `</span>`))
 }
diff --git a/src/webui/internal/handlers/configure_users.go b/src/webui/internal/handlers/configure_users.go
index 489bd26d..fd511a35 100644
--- a/src/webui/internal/handlers/configure_users.go
+++ b/src/webui/internal/handlers/configure_users.go
@@ -339,6 +339,7 @@ func (h *ConfigureUsersHandler) DeleteKey(w http.ResponseWriter, r *http.Request
 		renderSaveError(w, err)
 		return
 	}
+
 	var userEntry map[string]any
 	for _, u := range raw.System.Auth.Users {
 		if u.Name != name {
@@ -390,7 +391,7 @@ func (h *ConfigureUsersHandler) DeleteKey(w http.ResponseWriter, r *http.Request
 		renderSaveError(w, err)
 		return
 	}
-	renderSavedRedirect(w, "SSH key deleted", "/configure/users")
+	w.WriteHeader(http.StatusOK)
 }
 
 // fetchAllGroups reads NACM groups from candidate, falling back to running on 404.