diff --git a/backend/services/garmin.py b/backend/services/garmin.py
index 808ac9c..668a4a5 100644
--- a/backend/services/garmin.py
+++ b/backend/services/garmin.py
@@ -496,10 +496,22 @@ def delete_token(user_id):
     """Forget the stored Garmin OAuth token.
 
     The next sync or login will have to re-authenticate and mint a fresh token.
-    garmin_email on the user record is left in place so re-login only needs the
-    password. The cached client — built from the old token's session — is dropped
-    in the same step so a stale session can't keep being reused.
+    garmin_email is meant to survive this — the UI's own "只需一次" promise is
+    that a disconnect still leaves the address remembered — but for every
+    auth-hub-era account (i.e. all of them now) that address lives *only* on
+    the row this deletes: `users.garmin_email` is a legacy column nothing
+    since auth-hub has ever written to (see `get_remembered_email`). Without
+    copying it forward first, "退出 Garmin 账号" quietly erases the one thing
+    it promised to keep, and the next bind attempt 400s on a blank email field
+    with no visible connection to the disconnect that caused it.
+
+    The cached client — built from the old token's session — is dropped in
+    the same step so a stale session can't keep being reused.
     """
+    row = query_one("SELECT garmin_email FROM garmin_tokens WHERE user_id = ?", [user_id])
+    email = (row or {}).get("garmin_email")
+    if email:
+        execute("UPDATE users SET garmin_email = ? WHERE id = ?", [email, user_id])
     execute("DELETE FROM garmin_tokens WHERE user_id = ?", [user_id])
     forget_client(user_id)
 
diff --git a/backend/tests/test_garmin_sync.py b/backend/tests/test_garmin_sync.py
index 3c3f363..0340cac 100644
--- a/backend/tests/test_garmin_sync.py
+++ b/backend/tests/test_garmin_sync.py
@@ -338,16 +338,41 @@ class TestRememberedEmail:
         )
         assert garmin_svc.get_remembered_email(user["id"]) == "legacy@example.com"
 
-    def test_disconnecting_drops_the_current_binding_but_not_the_legacy_value(
+    def test_disconnecting_remembers_the_most_recent_email_not_a_stale_legacy_one(
         self, db, user
     ):
+        """The current binding's email is copied forward on disconnect (see
+        `delete_token`), so it wins over whatever older address happened to be
+        sitting in the legacy column — the account last used `current@…`, and
+        that is what the next bind attempt should be offered."""
         db.execute(
             "UPDATE users SET garmin_email = ? WHERE id = ?",
             ["legacy@example.com", user["id"]],
         )
         garmin_svc.save_token(user["id"], "tok", "current@example.com")
         garmin_svc.delete_token(user["id"])
-        assert garmin_svc.get_remembered_email(user["id"]) == "legacy@example.com"
+        assert garmin_svc.get_remembered_email(user["id"]) == "current@example.com"
+
+    def test_disconnecting_an_auth_hub_account_still_remembers_the_email(
+        self, db, user
+    ):
+        """The case the test above does not cover, and the one that actually
+        broke: an auth-hub account has no pre-existing legacy row — the only
+        copy of the email is the one `delete_token` is about to remove. Without
+        copying it forward first, 退出 Garmin 账号 silently breaks its own
+        "只需一次" promise, and the next bind attempt 400s on a blank email
+        with no visible link back to the disconnect that caused it.
+        """
+        assert garmin_svc.get_remembered_email(user["id"]) == ""
+        garmin_svc.save_token(user["id"], "tok", "current@example.com")
+        garmin_svc.delete_token(user["id"])
+        assert garmin_svc.get_remembered_email(user["id"]) == "current@example.com"
+
+    def test_disconnecting_twice_does_not_forget_the_email(self, db, user):
+        garmin_svc.save_token(user["id"], "tok", "current@example.com")
+        garmin_svc.delete_token(user["id"])
+        garmin_svc.delete_token(user["id"])  # no token row left to read from
+        assert garmin_svc.get_remembered_email(user["id"]) == "current@example.com"
 
 
 class TestMfaHandling: