diff --git a/js/app.js b/js/app.js
index 7349418..7a094f7 100644
--- a/js/app.js
+++ b/js/app.js
@@ -1501,6 +1501,13 @@ async function loadEntries() {
         const r = await api('/entries', { headers: authHeaders() });
         state.entries = Array.isArray(r) ? r : [];
         await decryptEntryMeta(state.entries);
+        // The entry list just changed → the health dashboard's decrypted cache
+        // is stale. Invalidating HERE covers every mutation path at once
+        // (import, sync, delete, batch, duplicate, restore, master-pw change)
+        // instead of one opt-in per caller — which is how import and sync were
+        // left showing a pre-import score. Recompute is lazy: it only runs when
+        // the dashboard is actually rendered.
+        if (typeof healthCache !== 'undefined') healthCache = null;
     } catch (e) {
         if (e.message === 'Invalid session' || e.message === 'Session expired') {
             return doLogout();