diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index bb4c633..725ea20 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -17,7 +17,6 @@ import { groomingLogsRouter } from "./routes/groomingLogs.js";
 import { impersonationRouter } from "./routes/impersonation.js";
 import { settingsRouter } from "./routes/settings.js";
 import { searchRouter } from "./routes/search.js";
-import { calendarRouter } from "./routes/calendar.js";
 import { getDb, businessSettings } from "@groombook/db";
 import { authMiddleware } from "./middleware/auth.js";
 import { resolveStaffMiddleware, requireRole } from "./middleware/rbac.js";
@@ -62,11 +61,6 @@ app.get("/api/branding", async (c) => {
   });
 });
 
-// Portal routes — no staff auth required, uses impersonation session for client auth
-app.route("/api/portal", portalRouter);
-
-// Public iCal calendar feed — token auth in URL, no auth middleware required
-app.route("/api/calendar", calendarRouter);
 // Protected API routes
 const api = app.basePath("/api");
 api.use("*", authMiddleware);
diff --git a/apps/api/src/routes/portal.ts b/apps/api/src/routes/portal.ts
index dc663c5..b779add 100644
--- a/apps/api/src/routes/portal.ts
+++ b/apps/api/src/routes/portal.ts
@@ -86,7 +86,7 @@ const createWaitlistEntrySchema = z.object({
 });
 
 const updateWaitlistEntrySchema = z.object({
-  status: z.enum(["active", "notified", "expired", "cancelled"]).optional(),
+  status: z.literal("cancelled").optional(),
   preferredDate: z.string().optional(),
   preferredTime: z.string().optional(),
 });