diff --git a/server/src/routes/bets.ts b/server/src/routes/bets.ts
index e1578e3..9e5712c 100644
--- a/server/src/routes/bets.ts
+++ b/server/src/routes/bets.ts
@@ -55,6 +55,10 @@ betsRouter.post('/place', rateLimit(60_000, 10), async (c) => {
     return c.json({ error: 'Missing required fields.' }, 400)
   }
 
+  if (typeof amountSats !== 'number' || !Number.isInteger(amountSats) || amountSats < 1 || amountSats > 1_000_000) {
+    return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400)
+  }
+
   // Verify fight is still open
   const fight = await db.select().from(schema.fights)
     .where(eq(schema.fights.id, fightId)).limit(1)
diff --git a/server/src/routes/payments.ts b/server/src/routes/payments.ts
index 83157b9..364ee8c 100644
--- a/server/src/routes/payments.ts
+++ b/server/src/routes/payments.ts
@@ -281,7 +281,10 @@ paymentsRouter.post('/zap', rateLimit(60_000, 10), async (c) => {
   }>()
 
   if (!winnerId || !fightId) return c.json({ error: 'Missing winnerId or fightId' }, 400)
-  const amount = amountSats || 21
+  if (typeof amountSats !== 'number' || !Number.isInteger(amountSats) || amountSats < 1 || amountSats > 1_000_000) {
+    return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400)
+  }
+  const amount = amountSats
 
   // Verify the fight exists and this bot actually won
   const fightRows = await db.select({