diff --git a/apps/machine/src/services/lightning.ts b/apps/machine/src/services/lightning.ts
index e471bc8..8c32c01 100644
--- a/apps/machine/src/services/lightning.ts
+++ b/apps/machine/src/services/lightning.ts
@@ -22,6 +22,7 @@ import {
   type MachineIdentity,
   type Event as NostrEvent,
 } from '@lamassu/nostr-client'
+import { verifyEvent } from 'nostr-tools'
 import { LightningPubClient } from '@lamassu/lightning'
 import {
   CLINKClient,
@@ -533,6 +534,12 @@ function startDebitApprovalService(
       return
     }
 
+    // Verify event signature (defense-in-depth: relay can't forge, but verify anyway)
+    if (!verifyEvent(event as any)) {
+      console.warn('[Debit] SECURITY: Event failed signature verification:', event.id.slice(0, 16))
+      return
+    }
+
     try {
       console.log('[Debit] Decrypting event content...')
       const decrypted = decryptContent(identity, CONFIG.lightningPubPubkey, event.content)