diff --git a/src/lib/auth.config.ts b/src/lib/auth.config.ts
index 26924cd..12b819e 100644
--- a/src/lib/auth.config.ts
+++ b/src/lib/auth.config.ts
@@ -61,6 +61,7 @@ export const authConfig: NextAuthConfig = {
         '/lunch/pick', // external attendees pick a dish via signed token (no account)
         '/api/auth',
         '/api/trpc', // tRPC handles its own auth via procedures
+        '/api/cron', // cron endpoints self-guard via x-cron-secret (CRON_SECRET)
       ]
 
       // Check if it's a public path