diff --git a/app/templates/header.html b/app/templates/header.html
index 8074986..1958614 100644
--- a/app/templates/header.html
+++ b/app/templates/header.html
@@ -189,7 +189,11 @@
                     <span class="header-user-role">{{ user_info.role|upper }} {% if user_info.unit_name %} | {{ user_info.unit_name }}{% endif %}</span>
                 {% endif %}
             </div>
+            {% if user_info.role == 'dev_guest' %}
+            <a href="{{ url_for('login') }}" class="header-action-btn">🔐 Đăng nhập Admin/Analyzer</a>
+            {% else %}
             <a href="{{ url_for('logout') }}" class="header-action-btn">🚪 Đăng xuất</a>
+            {% endif %}
         {% else %}
             <div class="header-guest">
                 👤 Khách
diff --git a/app/web_app_fastapi.py b/app/web_app_fastapi.py
index b79ff16..323af4b 100644
--- a/app/web_app_fastapi.py
+++ b/app/web_app_fastapi.py
@@ -845,9 +845,9 @@ def get_current_user(credentials: HTTPBasicCredentials = Depends(security)) -> O
 
 @app.get("/login", response_class=HTMLResponse, name="login")
 async def login_page(request: Request, next: str = "/"):
-    """Trang đăng nhập — nếu đã login rồi thì redirect ngay"""
-    # Nếu đã đăng nhập thì không cần vào trang login nữa
-    if get_session_user(request):
+    """Trang đăng nhập; dev_guest vẫn được phép chuyển sang tài khoản thật."""
+    current_user = get_session_user(request)
+    if current_user and current_user.get("role") != "dev_guest":
         return RedirectResponse(url=next, status_code=303)
     return templates.TemplateResponse(
         "login.html",
diff --git a/tests/test_dev_mode_login.py b/tests/test_dev_mode_login.py
new file mode 100644
index 0000000..202f787
--- /dev/null
+++ b/tests/test_dev_mode_login.py
@@ -0,0 +1,15 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP = (ROOT / "app" / "web_app_fastapi.py").read_text(encoding="utf-8")
+HEADER = (ROOT / "app" / "templates" / "header.html").read_text(encoding="utf-8")
+
+
+def test_dev_guest_is_allowed_to_open_login_page():
+    assert 'current_user.get("role") != "dev_guest"' in APP
+
+
+def test_dev_guest_header_offers_real_login_instead_of_logout():
+    assert "user_info.role == 'dev_guest'" in HEADER
+    assert "url_for('login')" in HEADER