diff --git a/backend/src/auth.js b/backend/src/auth.js
index 28ae80f..ab5594c 100644
--- a/backend/src/auth.js
+++ b/backend/src/auth.js
@@ -11,7 +11,9 @@ export async function requireAuth(request, reply) {
   // each other in the same browser — see project_hvac_kiosk memory, hit
   // 2026-08-26 when kiosk login on a desktop browser interfered with normal
   // staff login while both shared the 'hnf_session' name.
-  const token = request.cookies?.hnf_session || request.cookies?.hvac_kiosk_session
+  // hnf_kiosk_session is the shared back-of-house kiosk session minted by central
+  // auth (portal /kiosk); its token carries only hvac's registered kiosk caps.
+  const token = request.cookies?.hnf_session || request.cookies?.hnf_kiosk_session || request.cookies?.hvac_kiosk_session
   if (!token) return reply.status(401).send({ error: 'Not authenticated' })
 
   let payload