diff --git a/apps/api/src/lib/auth.ts b/apps/api/src/lib/auth.ts
index a1f3a95..3dda63b 100644
--- a/apps/api/src/lib/auth.ts
+++ b/apps/api/src/lib/auth.ts
@@ -9,6 +9,12 @@ const OIDC_CLIENT_SECRET = process.env.OIDC_CLIENT_SECRET;
 const BETTER_AUTH_SECRET = process.env.BETTER_AUTH_SECRET;
 const BETTER_AUTH_URL = process.env.BETTER_AUTH_URL ?? "http://localhost:3000";
 
+if (!BETTER_AUTH_SECRET && process.env.AUTH_DISABLED !== "true") {
+  throw new Error(
+    "[FATAL] BETTER_AUTH_SECRET environment variable is required when auth is enabled"
+  );
+}
+
 export const auth = betterAuth({
   database: drizzleAdapter(getDb(), {
     provider: "pg",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1cc64c4..029de5c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -136,7 +136,7 @@ importers:
         specifier: ^26.1.0
         version: 26.1.0
       typescript:
-        specifier: ^5.9.3
+        specifier: ^5.7.3
         version: 5.9.3
       typescript-eslint:
         specifier: ^8.20.0