diff --git a/static/auth-client.js b/static/auth-client.js
index 4093881..eb9860b 100644
--- a/static/auth-client.js
+++ b/static/auth-client.js
@@ -1,5 +1,8 @@
 // TODO: we need a bundler, so we can re-use what we have in node_modules already
-import { createAuthClient } from "https://esm.sh/better-auth@latest/client";
+// Pinned to the server's better-auth version: the browser client must match
+// what the server runs. Update this pin whenever package-lock.json bumps
+// better-auth. No bundler yet — see TODO above.
+import { createAuthClient } from "https://esm.sh/better-auth@1.7.6/client";
 
 export const authClient = createAuthClient({
   baseURL: window.location.origin,