diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml
index 6671a53..ce86f96 100644
--- a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/etc/nevis/k8s-nevisauth-7022472ae407577ae604bbb8.yaml
@@ -45,7 +45,7 @@ spec:
   podDisruptionBudget:
     maxUnavailable: "50%"
   git:
-    tag: "r-20a60efb7465c08b914996cdae59dd87fd1052d1"
+    tag: "r-3661d1b94c95cb7ba123e574390d8dbaaed8e7a2"
     dir: "DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth"
     credentials: "git-credentials"
   keystores:
diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml
index 434e6ce..38d6ba7 100644
--- a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/esauth4.xml
@@ -1671,7 +1671,7 @@
             <!-- source: pattern://bea3ca0c85381d07d632be52 -->
             <property name="script" value="file:///var/opt/nevisauth/default/conf/recovery_fetchcaptchainfos.groovy"/>
         </AuthState>
-        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_loginFactorQuestion" class="ch.nevis.esauth.auth.states.standard.ConditionalDispatcherState" final="true" resumeState="true">
+        <AuthState name="Auth_Realm_Recovery_Recovery_Auth_loginFactorQuestion" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="true" resumeState="true">
             <!-- source: pattern://584964c837512845d7940809 -->
             <ResultCond name="cancel" next="Auth_Realm_Recovery_Recovery_handleCode"/>
             <!-- source: pattern://584964c837512845d7940809 -->
@@ -1693,11 +1693,7 @@
                 </Gui>
             </Response>
             <!-- source: pattern://584964c837512845d7940809 -->
-            <property name="condition:cancel" value="${inargs:cancel}==cancel"/>
-            <!-- source: pattern://584964c837512845d7940809 -->
-            <property name="condition:loginFactorYes" value="${inargs:continue}==yes"/>
-            <!-- source: pattern://584964c837512845d7940809 -->
-            <property name="condition:loginFactorNo" value="${inargs:continue}==no"/>
+            <property name="script" value="file:///var/opt/nevisauth/default/conf/questionnaireLfProcessing.groovy"/>
         </AuthState>
         <AuthState name="Auth_Realm_Recovery_Recovery_fetchCaptchaResult" class="ch.nevis.esauth.auth.states.scripting.ScriptState" final="false">
             <!-- source: pattern://717094cbd4ddbadeab4b2cc1 -->
@@ -1825,7 +1821,7 @@
                     <!-- source: pattern://584964c837512845d7940809 -->
                     <GuiElem name="reason" type="hidden" value="None" optional="true"/>
                     <!-- source: pattern://584964c837512845d7940809 -->
-                    <GuiElem name="question" type="hidden" value="${inargs:continue}" optional="true"/>
+                    <GuiElem name="question" type="hidden" value="${sess:agov.recovery.moreThanOneLf}" optional="true"/>
                     <!-- source: pattern://584964c837512845d7940809 -->
                     <GuiElem name="cancel" type="submit" label="cancel.button.label" value="cancel"/>
                     <!-- source: pattern://584964c837512845d7940809 -->
diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireLfProcessing.groovy b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireLfProcessing.groovy
new file mode 100644
index 0000000..9feef83
--- /dev/null
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireLfProcessing.groovy
@@ -0,0 +1,25 @@
+import ch.nevis.esauth.auth.engine.AuthResponse
+
+if (inargs['cancel'] && inargs['cancel'] == 'cancel') {
+  def s = request.getAuthSession(true)
+  s.removeAttribute('agov.recovery.moreThanOneLf')
+
+  response.setResult('cancel')
+  return
+}
+
+if (inargs['continue'] && inargs['continue'] == 'yes') {
+  response.setSessionAttribute('agov.recovery.moreThanOneLf', 'yes')
+  response.setResult('loginFactorYes')
+  return
+}
+
+if (inargs['continue'] && inargs['continue'] == 'no') {
+  response.setSessionAttribute('agov.recovery.moreThanOneLf', 'no')
+  response.setResult('loginFactorNo')
+  return
+}
+
+// if we reach this, display the GUI again
+response.setStatus(AuthResponse.AUTH_CONTINUE)
+return
\ No newline at end of file
diff --git a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireReasonProcessing.groovy b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireReasonProcessing.groovy
index bd2b86e..07f9f3c 100644
--- a/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireReasonProcessing.groovy
+++ b/DEFAULT-ADN-AGOV-PROJECT/DEFAULT-ADN-AGOV-INV/auth/var/opt/nevisauth/default/conf/questionnaireReasonProcessing.groovy
@@ -5,6 +5,10 @@ if (inargs['reason']) {
 }
 
 if (inargs['cancel'] && inargs['cancel'] == 'cancel') {
+  def s = request.getAuthSession(true)
+  s.removeAttribute('agov.recovery.moreThanOneLf')
+  s.removeAttribute('agov.recovery.reason')
+
   response.setResult('cancel')
   return
 }