diff --git a/apps/api/src/config.ts b/apps/api/src/config.ts
index a7c38c1..bb2f7b4 100644
--- a/apps/api/src/config.ts
+++ b/apps/api/src/config.ts
@@ -23,7 +23,19 @@ export type AppConfig = z.infer<typeof configSchema>
 
 export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
   const isProd = env.NODE_ENV === 'production'
-  const jwtSecret = env.JWT_SECRET ?? (isProd ? '' : 'dev-secret-change-me')
+  const jwtFromEnv = env.JWT_SECRET?.trim()
+  const jwtSecret =
+    jwtFromEnv && jwtFromEnv.length > 0
+      ? jwtFromEnv
+      : isProd
+        ? ''
+        : 'dev-secret-change-me'
+
+  if (isProd && jwtSecret.length < 8) {
+    throw new Error(
+      'JWT_SECRET is required in production and must be at least 8 characters (e.g. openssl rand -hex 32)',
+    )
+  }
 
   return configSchema.parse({
     databaseUrl: env.DATABASE_URL ?? 'sqlite:data/app.db',