diff --git a/portal/settings.py b/portal/settings.py
index 57411d4..40787b3 100644
--- a/portal/settings.py
+++ b/portal/settings.py
@@ -62,6 +62,7 @@
     "django.contrib.messages.middleware.MessageMiddleware",
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "allauth.account.middleware.AccountMiddleware",
+    "portal_account.middleware.TOSRedirectMiddleware",
 ]
 
 ROOT_URLCONF = "portal.urls"
diff --git a/portal/views.py b/portal/views.py
index 32d8fdb..8cfb441 100644
--- a/portal/views.py
+++ b/portal/views.py
@@ -1,15 +1,6 @@
-from django.shortcuts import redirect, render
+from django.shortcuts import render
 
 
 def index(request):
-    """Redirect to profile creation page if user has not completed their profile."""
-    context = {}
-    from portal_account.models import PortalProfile
-
-    if (
-        request.user
-        and request.user.is_authenticated
-        and not PortalProfile.objects.filter(user=request.user).exists()
-    ):
-        return redirect("portal_account:portal_profile_new")
-    return render(request, "portal/index.html", context)
+    """Display the index page for all users."""
+    return render(request, "portal/index.html")
diff --git a/portal_account/forms.py b/portal_account/forms.py
index e56ab6b..eb110d4 100644
--- a/portal_account/forms.py
+++ b/portal_account/forms.py
@@ -10,8 +10,8 @@ class PortalProfileForm(ModelForm):
     first_name = forms.CharField()
     last_name = forms.CharField()
     email = forms.CharField(disabled=True)
-    coc_agreement = forms.BooleanField(disabled=True, required=False)
-    tos_agreement = forms.BooleanField(disabled=True, required=False)
+    coc_agreement = forms.BooleanField(required=False)
+    tos_agreement = forms.BooleanField(required=False)
 
     class Meta:
         model = PortalProfile
@@ -32,6 +32,11 @@ def __init__(self, *args, **kwargs):
             self.fields["first_name"].initial = self.user.first_name
             self.fields["last_name"].initial = self.user.last_name
 
+        if self.instance.pk:
+            if self.instance.coc_agreement and self.instance.tos_agreement:
+                self.fields["coc_agreement"].disabled = True
+                self.fields["tos_agreement"].disabled = True
+
         # fix field order
         self.order_fields(
             [
diff --git a/portal_account/middleware.py b/portal_account/middleware.py
new file mode 100644
index 0000000..3cd5502
--- /dev/null
+++ b/portal_account/middleware.py
@@ -0,0 +1,37 @@
+from django.shortcuts import redirect
+
+
+class TOSRedirectMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        if not request.user.is_authenticated:
+            return self.get_response(request)
+
+        excluded_path_prefixes = [
+            "/admin/",
+            "/accounts/",
+            "/portal_account/profile/new",
+            "/portal_account/profile/edit/",
+            "/portal_account/profile/view/",
+            "/volunteer/",
+        ]
+
+        current_path = request.path
+        if any(current_path.startswith(prefix) for prefix in excluded_path_prefixes):
+            return self.get_response(request)
+
+        try:
+            from portal_account.models import PortalProfile
+
+            profile = PortalProfile.objects.get(user=request.user)
+
+            if not profile.tos_agreement:
+                profile_edit_url = profile.get_absolute_url()
+                if current_path != profile_edit_url:
+                    return redirect(profile_edit_url)
+        except PortalProfile.DoesNotExist:
+            return redirect("portal_account:portal_profile_new")
+
+        return self.get_response(request)
diff --git a/templates/portal_account/portalprofile_edit.html b/templates/portal_account/portalprofile_edit.html
index bbffbb2..8f73ef1 100644
--- a/templates/portal_account/portalprofile_edit.html
+++ b/templates/portal_account/portalprofile_edit.html
@@ -15,14 +15,27 @@ <h1 class="display-5">
             {% bootstrap_form_errors form %}
             <form action="{% url 'portal_account:portal_profile_edit' object.pk %}"
                   method="post"
-                  class="form">
+                  class="form"
+                  enctype="multipart/form-data">
                 {% csrf_token %}
                 {% bootstrap_field form.username %}
                 {% bootstrap_field form.first_name %}
                 {% bootstrap_field form.last_name %}
                 {% bootstrap_field form.email %}
                 {% bootstrap_field form.pronouns %}
-                {% bootstrap_field form.coc_agreement %}
+                {% if form.coc_agreement.value and form.tos_agreement.value %}
+                    <div class="alert alert-success">
+                        You've already agreed to the Code of Conduct and Terms of Service.
+                    </div>
+                    {% bootstrap_field form.coc_agreement %}
+                    {% bootstrap_field form.tos_agreement %}
+                {% else %}
+                    <div class="alert alert-warning">
+                        <strong>Important:</strong> You must agree to both the Code of Conduct and Terms of Service to complete your profile.
+                    </div>
+                    {% bootstrap_field form.coc_agreement %}
+                    {% bootstrap_field form.tos_agreement %}
+                {% endif %}
                 <div class="mt-4">
                     <input type="submit" value="Update Profile" class="btn btn-primary" />
                     <a href="{% url 'portal_account:portal_profile_detail' object.pk %}"
diff --git a/templates/portal_account/portalprofile_form.html b/templates/portal_account/portalprofile_form.html
index d687ab3..4c92d6b 100644
--- a/templates/portal_account/portalprofile_form.html
+++ b/templates/portal_account/portalprofile_form.html
@@ -25,14 +25,27 @@ <h1 class="display-5">
 
             <form action="{% if object.pk %}{% url 'portal_account:portal_profile_edit' object.pk %}{% else %}{% url 'portal_account:portal_profile_new' %}{% endif %}"
                   method="post"
-                  class="form">
+                  class="form"
+                  enctype="multipart/form-data">
                 {% csrf_token %}
                 {% bootstrap_field form.username %}
                 {% bootstrap_field form.first_name %}
                 {% bootstrap_field form.last_name %}
                 {% bootstrap_field form.email %}
                 {% bootstrap_field form.pronouns %}
-                {% bootstrap_field form.coc_agreement %}
+                {% if form.coc_agreement.value and form.tos_agreement.value %}
+                    <div class="alert alert-success">
+                        You've already agreed to the Code of Conduct and Terms of Service.
+                    </div>
+                    {% bootstrap_field form.coc_agreement %}
+                    {% bootstrap_field form.tos_agreement %}
+                {% else %}
+                    <div class="alert alert-warning">
+                        <strong>Important:</strong> You must agree to both the Code of Conduct and Terms of Service to complete your profile.
+                    </div>
+                    {% bootstrap_field form.coc_agreement %}
+                    {% bootstrap_field form.tos_agreement %}
+                {% endif %}
               
                 <div class="mt-4">
                     <input type="submit"
diff --git a/tests/portal/test_views.py b/tests/portal/test_views.py
index 9bb56fa..3850ff7 100644
--- a/tests/portal/test_views.py
+++ b/tests/portal/test_views.py
@@ -1,36 +1,16 @@
 import pytest
 from django.urls import reverse
-from pytest_django.asserts import assertRedirects
-
-from portal_account.models import PortalProfile
+from pytest_django.asserts import assertTemplateUsed
 
 
 @pytest.mark.django_db
-class TestPortalIndex:
-
-    def test_index_unauthenticated(self, client):
-
+class TestIndexView:
+    def test_access(self, client):
+        """
+        Test users can access the index page.
+        Should return 200 status code and render the correct template.
+        """
         response = client.get(reverse("index"))
-        assert response.status_code == 200
-        assert "Sign up" in response.content.decode()
-        assert "Login" in response.content.decode()
-
-    def test_index_authenticated_no_profile_created(self, client, portal_user):
 
-        client.force_login(portal_user)
-        response = client.get(reverse("index"), follow=True)
-
-        assert "Sign out" not in response.content.decode()
-        assert "Login" not in response.content.decode()
-        assertRedirects(response, reverse("portal_account:portal_profile_new"))
-
-    def test_index_authenticated_profile_already_created(self, client, portal_user):
-
-        portal_profile = PortalProfile(user=portal_user)
-        portal_profile.save()
-
-        client.force_login(portal_user)
-        response = client.get(reverse("index"))
         assert response.status_code == 200
-        assert "Sign out" not in response.content.decode()
-        assert "Login" not in response.content.decode()
+        assertTemplateUsed(response, "portal/index.html")
diff --git a/tests/portal_account/test_forms.py b/tests/portal_account/test_forms.py
index 13eea84..128387c 100644
--- a/tests/portal_account/test_forms.py
+++ b/tests/portal_account/test_forms.py
@@ -40,6 +40,56 @@ def test_profile_form_required_fields(self, portal_user):
         assert not form.is_valid()
 
 
+@pytest.mark.django_db
+class TestPortalProfileFormAgreements:
+    def test_agreements_disabled_when_both_true(self, portal_user):
+        portal_profile, _ = PortalProfile.objects.get_or_create(
+            user=portal_user, defaults={"coc_agreement": True, "tos_agreement": True}
+        )
+        portal_profile.coc_agreement = True
+        portal_profile.tos_agreement = True
+        portal_profile.save()
+
+        form = PortalProfileForm(user=portal_user, instance=portal_profile)
+
+        assert form.fields["coc_agreement"].disabled is True
+        assert form.fields["tos_agreement"].disabled is True
+
+    def test_agreements_not_disabled_when_not_both_true(self, portal_user):
+        portal_profile, _ = PortalProfile.objects.get_or_create(user=portal_user)
+
+        portal_profile.coc_agreement = True
+        portal_profile.tos_agreement = False
+        portal_profile.save()
+
+        form = PortalProfileForm(user=portal_user, instance=portal_profile)
+        assert form.fields["coc_agreement"].disabled is False
+        assert form.fields["tos_agreement"].disabled is False
+
+        portal_profile.coc_agreement = False
+        portal_profile.tos_agreement = True
+        portal_profile.save()
+
+        form = PortalProfileForm(user=portal_user, instance=portal_profile)
+        assert form.fields["coc_agreement"].disabled is False
+        assert form.fields["tos_agreement"].disabled is False
+
+        portal_profile.coc_agreement = False
+        portal_profile.tos_agreement = False
+        portal_profile.save()
+
+        form = PortalProfileForm(user=portal_user, instance=portal_profile)
+        assert form.fields["coc_agreement"].disabled is False
+        assert form.fields["tos_agreement"].disabled is False
+
+    def test_agreements_not_disabled_for_new_profile(self, portal_user):
+        PortalProfile.objects.filter(user=portal_user).delete()
+
+        form = PortalProfileForm(user=portal_user)
+        assert form.fields["coc_agreement"].disabled is False
+        assert form.fields["tos_agreement"].disabled is False
+
+
 @pytest.mark.django_db
 class TestSignupView:
     def test_error_styling_on_invalid_signup(self, client):
diff --git a/tests/portal_account/test_views.py b/tests/portal_account/test_views.py
index 6fdcf62..fcbf406 100644
--- a/tests/portal_account/test_views.py
+++ b/tests/portal_account/test_views.py
@@ -1,97 +1,181 @@
 import pytest
+from django.test import RequestFactory
 from django.urls import reverse
 from pytest_django.asserts import assertRedirects
 
 from portal_account.models import PortalProfile
+from portal_account.views import index
 
 
 @pytest.mark.django_db
 class TestPortalProfile:
-
     def test_portal_profile_view_requires_login(self, client):
-
         response = client.get(reverse("portal_account:index"))
         assertRedirects(response, reverse("account_login") + "?next=/portal_account/")
 
-    def test_portal_profile_view_no_profile(self, client, portal_user):
+    def test_index_view_with_profile(self, client, portal_user):
+        """Test index view when user has a profile"""
+        profile = PortalProfile.objects.create(user=portal_user, tos_agreement=True)
         client.force_login(portal_user)
+
         response = client.get(reverse("portal_account:index"))
+
         assert response.status_code == 200
-        assert response.context["profile_id"] is None
+        assert response.context["profile_id"] == profile.id
+
+    def test_index_view_no_profile_direct(self, portal_user):
+        """Test index view directly (bypassing middleware) when user has no profile"""
+        request = RequestFactory().get(reverse("portal_account:index"))
+        request.user = portal_user
+
+        PortalProfile.objects.filter(user=portal_user).delete()
 
-    def test_portal_profile_view_with_profile(self, client, portal_user):
-        profile = PortalProfile(user=portal_user)
-        profile.save()
+        response = index(request)
 
+        assert response.status_code == 200
+        assert b"profile_id" not in response.content
+
+    def test_index_view_no_profile_with_middleware(self, client, portal_user):
+        """Test index view with middleware when user has no profile"""
         client.force_login(portal_user)
-        response = client.get(reverse("portal_account:index"))
+        PortalProfile.objects.filter(user=portal_user).delete()
 
-        assert response.context["profile_id"] == profile.id
+        response = client.get(reverse("portal_account:index"), follow=True)
+
+        assertRedirects(response, reverse("portal_account:portal_profile_new"))
+        assert len(response.redirect_chain) == 1
+        assert response.redirect_chain[0][0].endswith(
+            reverse("portal_account:portal_profile_new")
+        )
+
+    def test_portal_profile_create_if_doesnt_exist(self, client, portal_user):
+        client.force_login(portal_user)
+        response = client.get(reverse("portal_account:portal_profile_new"))
         assert response.status_code == 200
 
-    def test_portal_profile_update_own_profile(self, client, portal_user):
-        profile = PortalProfile(user=portal_user)
-        profile.save()
+    def test_portal_profile_cannot_create_another(self, client, portal_user):
+        PortalProfile.objects.create(user=portal_user, tos_agreement=True)
+        client.force_login(portal_user)
+        response = client.get(reverse("portal_account:portal_profile_new"))
+        assertRedirects(response, reverse("portal_account:index"))
+
+    def test_portal_profile_view_own_profile(self, client, portal_user):
+        profile = PortalProfile.objects.create(user=portal_user, tos_agreement=True)
         client.force_login(portal_user)
         response = client.get(
-            reverse("portal_account:portal_profile_edit", kwargs={"pk": profile.id})
+            reverse("portal_account:portal_profile_detail", kwargs={"pk": profile.id})
         )
         assert response.status_code == 200
 
-    def test_portal_profile_cannot_edit_other_profile(
+    def test_portal_profile_cannot_view_other_profile(
         self, client, portal_user, django_user_model
     ):
-        another_user = django_user_model.objects.create_user(
-            username="other",
+        other_user = django_user_model.objects.create_user(username="other")
+        other_profile = PortalProfile.objects.create(
+            user=other_user, tos_agreement=True
         )
-        another_profile = PortalProfile(user=another_user)
-        another_profile.save()
+        PortalProfile.objects.create(user=portal_user, tos_agreement=True)
 
         client.force_login(portal_user)
         response = client.get(
             reverse(
-                "portal_account:portal_profile_edit", kwargs={"pk": another_profile.id}
+                "portal_account:portal_profile_detail", kwargs={"pk": other_profile.id}
             )
         )
         assertRedirects(response, reverse("portal_account:index"))
 
-    def test_portal_profile_cannot_view_other_profile(
+    def test_portal_profile_update_own_profile(self, client, portal_user):
+        profile = PortalProfile.objects.create(user=portal_user, tos_agreement=True)
+        client.force_login(portal_user)
+        response = client.get(
+            reverse("portal_account:portal_profile_edit", kwargs={"pk": profile.id})
+        )
+        assert response.status_code == 200
+
+    def test_portal_profile_update_redirects_for_other_user(
         self, client, portal_user, django_user_model
     ):
-        another_user = django_user_model.objects.create_user(
-            username="other",
+        other_user = django_user_model.objects.create_user(username="intruder")
+        other_profile = PortalProfile.objects.create(
+            user=other_user, tos_agreement=True
         )
-        another_profile = PortalProfile(user=another_user)
-        another_profile.save()
+        PortalProfile.objects.create(user=portal_user, tos_agreement=True)
 
         client.force_login(portal_user)
         response = client.get(
             reverse(
-                "portal_account:portal_profile_detail",
-                kwargs={"pk": another_profile.id},
+                "portal_account:portal_profile_edit", kwargs={"pk": other_profile.id}
             )
         )
         assertRedirects(response, reverse("portal_account:index"))
 
-    def test_portal_profile_view_own_profile(self, client, portal_user):
-        profile = PortalProfile(user=portal_user)
-        profile.save()
+    def test_get_form_kwargs_create(self, client, portal_user):
+        """Test that form kwargs include user in create view"""
+        client.force_login(portal_user)
+        response = client.get(reverse("portal_account:portal_profile_new"))
+        view = response.context_data["view"]
+        form_kwargs = view.get_form_kwargs()
+        assert "user" in form_kwargs
+        assert form_kwargs["user"] == portal_user
+
+    def test_get_form_kwargs_update(self, client, portal_user):
+        """Test that form kwargs include user in update view"""
+        profile = PortalProfile.objects.create(user=portal_user, tos_agreement=True)
         client.force_login(portal_user)
         response = client.get(
-            reverse("portal_account:portal_profile_detail", kwargs={"pk": profile.id})
+            reverse("portal_account:portal_profile_edit", kwargs={"pk": profile.id})
         )
-        assert response.status_code == 200
+        view = response.context_data["view"]
+        form_kwargs = view.get_form_kwargs()
+        assert "user" in form_kwargs
+        assert form_kwargs["user"] == portal_user
 
-    def test_portal_profile_cannot_create_another(self, client, portal_user):
-        profile = PortalProfile(user=portal_user)
-        profile.save()
+    def test_tos_redirect_middleware(self, client, portal_user):
+        profile = PortalProfile.objects.create(user=portal_user, tos_agreement=False)
         client.force_login(portal_user)
-        response = client.get(reverse("portal_account:portal_profile_new"))
+        response = client.get(reverse("portal_account:index"), follow=True)
+        assertRedirects(
+            response,
+            reverse("portal_account:portal_profile_edit", kwargs={"pk": profile.id}),
+        )
 
-        assertRedirects(response, reverse("portal_account:index"))
+    def test_tos_middleware_excluded_paths(self, client, portal_user):
+        """Test that middleware doesn't redirect for excluded paths"""
+        profile = PortalProfile.objects.create(user=portal_user, tos_agreement=False)
+        client.force_login(portal_user)
 
-    def test_portal_profile_create_if_doesnt_exist(self, client, portal_user):
+        excluded_paths = [
+            "/accounts/login/",
+            "/portal_account/profile/new",
+            f"/portal_account/profile/edit/{profile.id}/",
+            f"/portal_account/profile/view/{profile.id}/",
+        ]
+
+        for path in excluded_paths:
+            response = client.get(path)
+            assert not (
+                response.status_code == 302
+                and "/portal_account/profile/edit/" in response.url
+            )
+
+        admin_response = client.get("/admin/")
+        assert admin_response.status_code == 302
+        assert "/admin/login/" in admin_response.url
+
+    def test_tos_middleware_with_agreement(self, client, portal_user):
+        """Test middleware doesn't redirect when TOS is agreed"""
+        PortalProfile.objects.create(user=portal_user, tos_agreement=True)
         client.force_login(portal_user)
-        response = client.get(reverse("portal_account:portal_profile_new"))
+        response = client.get("/some-path/")
+        assert response.status_code == 404
 
-        assert response.status_code == 200
+    def test_tos_middleware_unauthenticated_user(self, client):
+        """Test middleware skips check for unauthenticated users"""
+        response = client.get("/any-path/")
+        assert response.status_code == 404
+
+    def test_tos_middleware_no_profile(self, client, portal_user):
+        """Test middleware redirects to profile creation when no profile exists"""
+        client.force_login(portal_user)
+        response = client.get("/any-path/", follow=True)
+        assertRedirects(response, reverse("portal_account:portal_profile_new"))