diff --git a/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java b/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java
index a29252f1..bdeffc80 100644
--- a/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java
+++ b/RestroHub/src/main/java/com/restroly/qrmenu/security/JwtTokenProvider.java
@@ -22,6 +22,9 @@
 @Slf4j
 public class JwtTokenProvider {
 
+    private static final String INSECURE_DEFAULT_SECRET =
+            "your-256-bit-secret-key-here-change-in-production";
+
     @Value("${security.jwt.secret}")
     private String jwtSecret;
 
@@ -35,6 +38,14 @@ public class JwtTokenProvider {
 
     @PostConstruct
     public void init() {
+        if (jwtSecret == null || jwtSecret.isBlank()) {
+            throw new IllegalStateException(
+                    "JWT secret must be configured via the JWT_SECRET environment variable.");
+        }
+        if (INSECURE_DEFAULT_SECRET.equals(jwtSecret)) {
+            throw new IllegalStateException(
+                    "JWT secret is using the insecure default value. Set JWT_SECRET to a secure random key.");
+        }
         this.key = Keys.hmacShaKeyFor(jwtSecret.getBytes(StandardCharsets.UTF_8));
     }
 
diff --git a/RestroHub/src/main/resources/application.properties b/RestroHub/src/main/resources/application.properties
index e812b174..38ff8eaf 100644
--- a/RestroHub/src/main/resources/application.properties
+++ b/RestroHub/src/main/resources/application.properties
@@ -86,6 +86,7 @@ api.license.url=https://www.apache.org/licenses/LICENSE-2.0
 # ===============================
 # Security / JWT
 # ===============================
+# Set JWT_SECRET in production; startup fails if the insecure default is used.
 security.jwt.secret=${JWT_SECRET:your-256-bit-secret-key-here-change-in-production}
 security.jwt.expiration=${JWT_EXPIRATION:86400000}
 security.jwt.refresh-expiration=${JWT_REFRESH_EXPIRATION:604800000}