diff --git a/src/middleware.ts b/src/middleware.ts
index bb34766..1d4c8d5 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -49,9 +49,12 @@ export async function middleware(req: NextRequest) {
     }
   );
 
+  // Prefer local session from cookie. getUser() revalidates via Auth network and
+  // fails in this Edge runtime when Kong/hairpin is broken → endless login loop.
   const {
-    data: { user },
-  } = await supabase.auth.getUser();
+    data: { session },
+  } = await supabase.auth.getSession();
+  const user = session?.user ?? null;
 
   const url = req.nextUrl.clone();
   const path = url.pathname;