diff --git a/server/src/utils/auth.js b/server/src/utils/auth.js
index f8f7c62..5b6aa40 100644
--- a/server/src/utils/auth.js
+++ b/server/src/utils/auth.js
@@ -4,16 +4,27 @@ require('dotenv').config()
 const log = require('./logger')('auth')
 const users = require('../model/users/users.model')
 
-const JWT_SECRET = process.env.JWT_SECRET
 const JWT_EXPIRES_IN = process.env.JWT_EXPIRES_IN || '1d'
 const COOKIE_NAME = process.env.COOKIE_NAME || 'uomm_token'
 // Lifetime of the short-lived "password verified, awaiting TOTP" token.
 const TOTP_CHALLENGE_TTL = process.env.TOTP_CHALLENGE_TTL || '5m'
 
-if (!JWT_SECRET) {
-  log.warn('JWT_SECRET is not set — set it in .env before going to production')
+// Resolve the signing secret. Without one, jwt.sign/verify can't produce or
+// validate a usable token, so every login is silently broken. Fail fast in
+// production rather than booting into that state; in dev fall back to a known
+// insecure secret so login still works locally (with a loud warning).
+function resolveJwtSecret() {
+  const secret = process.env.JWT_SECRET
+  if (secret) return secret
+  if (process.env.NODE_ENV === 'production') {
+    throw new Error('JWT_SECRET must be set in production')
+  }
+  log.warn('JWT_SECRET is not set — using an insecure development fallback. Set JWT_SECRET in .env before deploying.')
+  return 'dev-insecure-jwt-secret-do-not-use-in-production'
 }
 
+const JWT_SECRET = resolveJwtSecret()
+
 function signToken(user) {
   const payload = { id: user.id, username: user.username, role: user.role }
   return jwt.sign(payload, JWT_SECRET, { expiresIn: JWT_EXPIRES_IN })