The sign-in page is served by oCIS's idp service, which the web theme.json cannot touch. Inject hub-signin.css via sub_filter on /signin/ until oCIS sits behind the Hub OIDC issuer (see docs/design/2026-10-13-files-oidc-sso.md).
