diff --git a/lib/auth/auth.ts b/lib/auth/auth.ts
index e496d59..d18a7cc 100644
--- a/lib/auth/auth.ts
+++ b/lib/auth/auth.ts
@@ -131,10 +131,13 @@ export const auth = betterAuth({
 
   emailAndPassword: {
     enabled: true,
-    // SECURITY GATE: unverified emails CANNOT sign in. Verification emails are sent
-    // on signup (see emailVerification.sendOnSignUp below), so users can verify before
-    // their first login.
-    requireEmailVerification: true,
+    // Sign-in does NOT require a verified email. This is deliberate: verification
+    // mail only sends when RESEND_API_KEY is configured, and without it sendEmail()
+    // silently no-ops — gating sign-in on verification would lock out every new
+    // account. Verification mail is still sent when email is configured (see
+    // emailVerification.sendOnSignUp below); it just isn't a barrier to logging in.
+    // Turn this back on once transactional email is live and proven.
+    requireEmailVerification: false,
     minPasswordLength: 8,
     async sendResetPassword({ user, url }) {
       await sendEmail({