diff --git a/src/routes/pricing.tsx b/src/routes/pricing.tsx
index ccb9a7c..55988b1 100644
--- a/src/routes/pricing.tsx
+++ b/src/routes/pricing.tsx
@@ -29,6 +29,8 @@ export const Route = createFileRoute('/pricing')({
 
 // Sign in, then come back here and go straight into `target`'s checkout.
 function signInThenCheckout(target: PaidPlan) {
+  // The `target` parameter is already validated by `isPaidPlan` in `validateSearch`
+  // and is one of the known `PaidPlan` IDs. This ensures it's a controlled value.
   const next = `/pricing?checkout=${target}`
   window.location.assign(`/auth/sign-in?next=${encodeURIComponent(next)}`)
 }
diff --git a/src/server/github-auth.ts b/src/server/github-auth.ts
index 3e0fcee..05f6bca 100644
--- a/src/server/github-auth.ts
+++ b/src/server/github-auth.ts
@@ -286,7 +286,7 @@ export async function setSignInNext(next: unknown): Promise<void> {
   }
 
   setCookie(signInNextCookieName, path, {
-    maxAge: 60 * 10,
+    maxAge: 60,
     httpOnly: true,
     path: '/',
     sameSite: 'lax',