diff --git a/src/KArtSell.Host/Program.cs b/src/KArtSell.Host/Program.cs
index 22601b4a..7c2f4b8c 100644
--- a/src/KArtSell.Host/Program.cs
+++ b/src/KArtSell.Host/Program.cs
@@ -234,7 +234,8 @@ var authenticationBuilder = builder.Services
         options.DefaultChallengeScheme = authenticationScheme;
     });
 
-if (authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
+if (builder.Environment.IsDevelopment()
+    && authenticationMode.Equals("DevelopmentHeader", StringComparison.OrdinalIgnoreCase))
 {
     authenticationBuilder.AddScheme<AuthenticationSchemeOptions, DevelopmentHeaderAuthenticationHandler>(
         authenticationScheme,
diff --git a/src/KArtSell.Host/Security/DevelopmentHeaderAuthenticationHandler.cs b/src/KArtSell.Host/Security/DevelopmentHeaderAuthenticationHandler.cs
index 3eb1077e..1ac601c9 100644
--- a/src/KArtSell.Host/Security/DevelopmentHeaderAuthenticationHandler.cs
+++ b/src/KArtSell.Host/Security/DevelopmentHeaderAuthenticationHandler.cs
@@ -18,6 +18,12 @@ public sealed class DevelopmentHeaderAuthenticationHandler(
 {
     protected override Task<AuthenticateResult> HandleAuthenticateAsync()
     {
+        if (!environment.IsDevelopment())
+        {
+            return Task.FromResult(AuthenticateResult.Fail(
+                "Development header authentication is disabled outside Development."));
+        }
+
         var user = Request.Headers["X-KArtSell-User"].ToString();
         var role = Request.Headers["X-KArtSell-Role"].ToString();
         if (string.IsNullOrWhiteSpace(user) || string.IsNullOrWhiteSpace(role))
diff --git a/src/KArtSell.Host/appsettings.json b/src/KArtSell.Host/appsettings.json
index e3d18394..534246e5 100644
--- a/src/KArtSell.Host/appsettings.json
+++ b/src/KArtSell.Host/appsettings.json
@@ -16,7 +16,7 @@
     }
   },
   "Authentication": {
-    "Mode": "DevelopmentHeader"
+    "Mode": "FailClosed"
   },
   "Capabilities": {
     "AutomaticOrder": false,