diff --git a/src/backend/controllers/feedback/AppFeedbackController.ts b/src/backend/controllers/feedback/AppFeedbackController.ts
index 2e972ef68..c1fbd590f 100644
--- a/src/backend/controllers/feedback/AppFeedbackController.ts
+++ b/src/backend/controllers/feedback/AppFeedbackController.ts
@@ -62,6 +62,7 @@ export class AppFeedbackController extends PuterController {
     @Get('/target', {
         subdomain: 'api',
         requireUserActor: true,
+        requireVerified: true,
         rateLimit: {
             scope: 'app-feedback-target',
             limit: 60,
@@ -93,6 +94,7 @@ export class AppFeedbackController extends PuterController {
     @Post('/', {
         subdomain: 'api',
         requireUserActor: true,
+        requireVerified: true,
         // Submissions only ever originate from our own GUI pages (desktop
         // dialog / popup). Cross-origin browser pages get stopped here even
         // if they somehow hold a user token; non-browser clients still pass