diff --git a/bootstrap/app.php b/bootstrap/app.php
index a32e4a0..dd0f103 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -13,6 +13,12 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        // Public Payment QR POSTs are proxied ladl.link → platform → Mini without the
+        // browser session cookie; satellite-rendered CSRF tokens cannot bind here.
+        $middleware->validateCsrfTokens(except: [
+            'q/*/pay',
+        ]);
+
         $middleware->redirectGuestsTo(fn (Request $request) => route('sso.connect', [
             'redirect' => $request->fullUrl(),
         ]));