diff --git a/apps/server/src/config.ts b/apps/server/src/config.ts
index 51b82bd..4cab1b1 100644
--- a/apps/server/src/config.ts
+++ b/apps/server/src/config.ts
@@ -5,6 +5,15 @@ const envNumber = (value: string | undefined, fallback: number) => {
   return Number.isFinite(parsed) ? parsed : fallback;
 };
 
+const jwtSecret = process.env.JWT_SECRET ?? "";
+
+if (!jwtSecret) {
+  throw new Error(
+    "JWT_SECRET environment variable is required. " +
+    "Set a strong random string (min 32 characters) to secure authentication."
+  );
+}
+
 export const config = {
   port: envNumber(process.env.SERVER_PORT, 3001),
   nodeEnv: process.env.NODE_ENV ?? "development",
@@ -13,7 +22,7 @@ export const config = {
   qbitPassword: process.env.QBIT_PASSWORD ?? "",
   appUsername: process.env.APP_USERNAME ?? "",
   appPassword: process.env.APP_PASSWORD ?? "",
-  jwtSecret: process.env.JWT_SECRET ?? "",
+  jwtSecret,
   pollIntervalMs: envNumber(process.env.POLL_INTERVAL_MS, 3000),
   enforceIntervalMs: envNumber(process.env.ENFORCE_INTERVAL_MS, 2000),
   defaultDelayMs: envNumber(process.env.DEFAULT_DELAY_MS, 3000),