diff --git a/backend/routes/auth.js b/backend/routes/auth.js
index aa315e4..d9ef54e 100644
--- a/backend/routes/auth.js
+++ b/backend/routes/auth.js
@@ -236,8 +236,9 @@ async function redeemTicket(ticket) {
   } finally {
     clearTimeout(timer);
   }
-  if (resp.status === 404) {
-    // Ticket unknown or already redeemed (single-use)
+  if (resp.status === 404 || resp.status === 401 || resp.status === 403) {
+    // Ticket unknown / already redeemed (single-use) or bad server-to-server
+    // credentials — indistinguishable from the client's perspective.
     throw Object.assign(new Error('Invalid or expired ticket'), { status: 401 });
   }
   if (!resp.ok) {