diff --git a/app/(auth)/update-password/page.tsx b/app/(auth)/update-password/page.tsx
index 22bf9f8..e77154a 100644
--- a/app/(auth)/update-password/page.tsx
+++ b/app/(auth)/update-password/page.tsx
@@ -1,7 +1,16 @@
+import type { Metadata } from "next"
 import Link from "next/link"
 import { Logo } from "@/components/shared/logo"
+import { TurnstileWidget } from "@/components/shared/turnstile-widget"
 import { updatePassword } from "@/app/actions/auth"
 
+// A password-reset form reached from a one-time emailed link — nothing here
+// should ever enter the index.
+export const metadata: Metadata = {
+  title: "Set a new password",
+  robots: { index: false, follow: false },
+}
+
 export default async function UpdatePasswordPage({
   searchParams,
 }: {
@@ -43,6 +52,8 @@ export default async function UpdatePasswordPage({
             />
           </div>
 
+          <TurnstileWidget />
+
           <button
             type="submit"
             className="w-full rounded-lg bg-indigo-600 px-4 py-2.5 text-sm font-semibold text-white transition hover:bg-indigo-500 active:scale-[0.98]"
diff --git a/app/actions/auth.ts b/app/actions/auth.ts
index 7762971..278aea1 100644
--- a/app/actions/auth.ts
+++ b/app/actions/auth.ts
@@ -131,15 +131,26 @@ export async function signOut() {
 export async function updatePassword(formData: FormData) {
   const password = formData.get("password") as string
   const token = formData.get("token") as string
+  const captchaToken = formData.get("cf-turnstile-response") as string | null
 
   if (!token) {
     redirect(`/update-password?error=${encodeURIComponent("Reset link is invalid or expired.")}`)
   }
 
+  const h = await headers()
+  // Same bot protection as the other credential forms. The reset token is
+  // carried through so a failed challenge doesn't strand the user on a form
+  // whose link can't be replayed.
+  if (!(await verifyTurnstile(captchaToken, h.get("x-forwarded-for")))) {
+    redirect(
+      `/update-password?error=${encodeURIComponent(CAPTCHA_ERROR)}&token=${encodeURIComponent(token)}`
+    )
+  }
+
   try {
     await auth.api.resetPassword({
       body: { newPassword: password, token },
-      headers: await headers(),
+      headers: h,
     })
   } catch (e) {
     const msg = e instanceof APIError ? e.message : "Could not update password"
diff --git a/app/api/auth/[...all]/route.ts b/app/api/auth/[...all]/route.ts
index 59baab1..c43cc36 100644
--- a/app/api/auth/[...all]/route.ts
+++ b/app/api/auth/[...all]/route.ts
@@ -1,4 +1,66 @@
+import { NextResponse } from "next/server"
 import { auth } from "@/lib/auth"
 import { toNextJsHandler } from "better-auth/next-js"
+import { verifyTurnstile } from "@/lib/turnstile"
 
-export const { GET, POST } = toNextJsHandler(auth)
+const handlers = toNextJsHandler(auth)
+
+// The auth pages post to server actions, which call `auth.api.*` in-process and
+// run their own verifyTurnstile() check. This route is the *other* door into the
+// same endpoints — a direct HTTP POST — and without this gate it accepts
+// unlimited credential guesses and email sends with no bot protection at all.
+//
+// Only credential-bearing / email-triggering POSTs are gated. GET is untouched
+// (OAuth callbacks, verify-email links, get-session), and `/sign-in/social` is
+// left open because it only starts a redirect to the provider.
+const CAPTCHA_PROTECTED = new Set([
+  "/sign-in/email",
+  "/sign-up/email",
+  "/request-password-reset",
+  "/reset-password",
+  "/send-verification-email",
+])
+
+/**
+ * Turnstile token from a header (preferred — leaves the body stream untouched)
+ * or, for clients that submit it inline, from a cloned JSON body.
+ */
+async function captchaToken(request: Request): Promise<string | null> {
+  const header =
+    request.headers.get("x-captcha-response") ??
+    request.headers.get("cf-turnstile-response")
+  if (header) return header
+
+  try {
+    const body = (await request.clone().json()) as Record<string, unknown>
+    const inline = body?.["cf-turnstile-response"] ?? body?.captchaToken
+    return typeof inline === "string" ? inline : null
+  } catch {
+    // Not JSON, or no body — treated as a missing token, which fails closed.
+    return null
+  }
+}
+
+export const GET = handlers.GET
+
+export async function POST(request: Request) {
+  const path = new URL(request.url).pathname.replace(/^\/api\/auth/, "")
+
+  if (CAPTCHA_PROTECTED.has(path)) {
+    const ok = await verifyTurnstile(
+      await captchaToken(request),
+      request.headers.get("x-forwarded-for")
+    )
+    if (!ok) {
+      return NextResponse.json(
+        {
+          message: "Verification challenge required.",
+          code: "CAPTCHA_VERIFICATION_FAILED",
+        },
+        { status: 403 }
+      )
+    }
+  }
+
+  return handlers.POST(request)
+}
diff --git a/components/shared/turnstile-widget.tsx b/components/shared/turnstile-widget.tsx
index 0d2c69c..6e8ace7 100644
--- a/components/shared/turnstile-widget.tsx
+++ b/components/shared/turnstile-widget.tsx
@@ -38,6 +38,23 @@ export function TurnstileWidget({ className }: { className?: string }) {
       widgetIdRef.current = window.turnstile.render(containerRef.current, {
         sitekey: siteKey,
         theme: "dark",
+        // A Turnstile token is only valid for ~5 minutes. Without these the
+        // widget goes quietly stale on a form left open, and the submit fails
+        // server-side with "complete the verification challenge" even though
+        // the challenge visibly passed. Re-running it keeps the hidden
+        // cf-turnstile-response input fresh.
+        "refresh-expired": "auto",
+        "expired-callback": () => {
+          if (widgetIdRef.current) window.turnstile?.reset(widgetIdRef.current)
+        },
+        "timeout-callback": () => {
+          if (widgetIdRef.current) window.turnstile?.reset(widgetIdRef.current)
+        },
+        "error-callback": () => {
+          // Returning false lets Turnstile surface its own error UI rather than
+          // leaving an empty box the user can't act on.
+          return false
+        },
       })
     }