diff --git a/bootstrap/app.php b/bootstrap/app.php
index 08ada05..649b1d4 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -13,11 +13,16 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        // Public QR action POSTs land on ladl.link first; CSRF tokens from satellite HTML (Events/Mini)
-        // do not match Link's session — same failure mode as Laravel 419 Page Expired.
+        // Public QR/checkout POSTs land on ladl.link first; CSRF tokens rendered in
+        // satellite HTML (Merchant/Give/Events/Mini/Invoice) do not match Link's
+        // session — same failure mode as Laravel 419 Page Expired / "Could not start checkout".
         $middleware->validateCsrfTokens(except: [
             '*/register',
             '*/pay',
+            '*/order',
+            '*/booking',
+            '*/book/order',
+            'i/*/pay',
         ]);
 
         $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [