diff --git a/CLAUDE.md b/CLAUDE.md
index 4764cc4..67ae77c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -81,6 +81,6 @@ python3 -m pytest tests/test_pki.py::test_sorted_ascending -v  # single test
 - EasyRSA called with `--batch`; `--passin=pass:<CA_PASSPHRASE>` omitted when `CA_PASSPHRASE=""`
 - Cryptgeon: `raw_key=os.urandom(32)`, `aes_key=SHA-256(raw_key)`, AES-256-GCM, URL fragment=`base64url(raw_key)`
 - `copy_crl()` does `chmod 644` after copy
-- Password: pos 1=uppercase, pos 2=lowercase (no j), pos 3-27=alphanumeric, pos 28=lowercase (no j); `oO01lI` banned everywhere
+- Password: pos 1=uppercase, pos 2=lowercase (no j), pos 3-27=alphanumeric, pos 28=lowercase (no j); `oO01lIQ5S2Z8B` banned everywhere
 - Inline file path: `<PKI_DIR>/inline/private/<CN>.inline`
 - User emails stored in `<PKI_DIR>/openvpncertupdate-metadata.json`
diff --git a/openvpncertupdate.py b/openvpncertupdate.py
index 0f4a3b0..db30751 100644
--- a/openvpncertupdate.py
+++ b/openvpncertupdate.py
@@ -154,7 +154,7 @@ def load_all_certs(pki_dir: str) -> list[CertInfo]:
 # === PASSWORD ===
 # ============================================================
 
-_BANNED_ALL       = frozenset("oO01lI")
+_BANNED_ALL       = frozenset("oO01lIQ5S2Z8B")
 _BANNED_POS2_LAST = _BANNED_ALL | frozenset("j")
 
 _UPPER            = [c for c in string.ascii_uppercase if c not in _BANNED_ALL]
@@ -636,6 +636,12 @@ def show_cert_form(
             except curses.error:
                 pass
 
+        hint = "Tab=next  F5=regen pwd  Ctrl-G=confirm  Esc=cancel"
+        try:
+            win.addstr(h - 2, 2, hint[:w - 4], curses.color_pair(COLOR_DISABLED))
+        except curses.error:
+            pass
+
         if current == _BTN_CONTINUE:
             try:
                 win.move(_BTN_Y, _btn_x_cont)
@@ -649,11 +655,6 @@ def show_cert_form(
         else:
             fields[current].place_cursor()
 
-        hint = "Tab=next  F5=regen pwd  Ctrl-G=confirm  Esc=cancel"
-        try:
-            win.addstr(h - 2, 2, hint[:w - 4], curses.color_pair(COLOR_DISABLED))
-        except curses.error:
-            pass
         win.refresh()
 
         key = win.getch()
@@ -677,6 +678,11 @@ def show_cert_form(
             )
             continue
         if current in (_BTN_CONTINUE, _BTN_CANCEL):
+            if key in (curses.KEY_LEFT, curses.KEY_RIGHT):
+                focus = active.index(
+                    _BTN_CANCEL if current == _BTN_CONTINUE else _BTN_CONTINUE
+                )
+                continue
             if key in (10, 13, curses.KEY_ENTER, ord(" ")):
                 curses.curs_set(0)
                 if current == _BTN_CONTINUE:
diff --git a/tests/test_password.py b/tests/test_password.py
index 3ccc553..a41fb88 100644
--- a/tests/test_password.py
+++ b/tests/test_password.py
@@ -1,6 +1,6 @@
 from openvpncertupdate import generate_password
 
-BANNED_ALL       = set("oO01lI")
+BANNED_ALL       = set("oO01lIQ5S2Z8B")
 BANNED_POS2_LAST = BANNED_ALL | {"j"}