diff --git a/main.py b/main.py
index 202de40..c576f95 100644
--- a/main.py
+++ b/main.py
@@ -16,7 +16,7 @@ import pathlib
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), "agents", "core-logic"))
 
 from fastapi import FastAPI, HTTPException, Request
-from fastapi.responses import FileResponse, JSONResponse, RedirectResponse
+from fastapi.responses import FileResponse, JSONResponse, RedirectResponse, Response
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, Field
 from typing import List
@@ -51,6 +51,18 @@ app = FastAPI(
     version="0.1.0",
 )
 
+# Paths exempt from IAP enforcement (health/readiness probes reach Cloud Run
+# directly without the IAP-injected x-goog-authenticated-user-email header).
+IAP_EXEMPT_PATHS = {"/health", "/healthz", "/readiness", "/liveness"}
+
+@app.middleware("http")
+async def require_iap(request: Request, call_next):
+    if request.url.path in IAP_EXEMPT_PATHS:
+        return await call_next(request)
+    if not request.headers.get("x-goog-authenticated-user-email"):
+        return Response(status_code=401, content="Unauthorized")
+    return await call_next(request)
+
 # ── FIREBASE & FIRESTORE INIT ───────────────────────────────────────────────
 db = None
 try: