diff --git a/delphi-backend/Handlers/PM.Handler.Recovery.pas b/delphi-backend/Handlers/PM.Handler.Recovery.pas
index 928bb54..5625708 100644
--- a/delphi-backend/Handlers/PM.Handler.Recovery.pas
+++ b/delphi-backend/Handlers/PM.Handler.Recovery.pas
@@ -82,11 +82,15 @@ begin
 
   if AVerifier <> '' then
   begin
-    // ZK: client computed PBKDF2 hex locally. Server only does the wrap.
+    // ZK: client computed the verifier locally. Server only wraps it — legacy
+    // pbkdf2 stores it raw, EVERY other algo (pbkdf2-sha256, pbkdf2-sha256-v2,
+    // argon2id-v2) is SHA256-wrapped identically. Mirrors VerifierToStoredHash
+    // in PM.Handler.Auth — keep in sync. The old `else if =CURRENT` silently
+    // rejected -v2 / argon2id accounts (the current default) as wrong-password.
     if Length(AVerifier) <> 64 then Exit;
     if SameText(LAlgo, HASH_ALGO_LEGACY) then
       Result := ConstantTimeEquals(AVerifier, LStoredHash)
-    else if SameText(LAlgo, HASH_ALGO_CURRENT) then
+    else
       Result := ConstantTimeEquals(SHA256Hex(AVerifier), LStoredHash);
     Exit;
   end;