diff --git a/routes/web.php b/routes/web.php
index 56e9815..ea3f3c3 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -64,7 +64,9 @@ Route::middleware('auth')->group(function () {
         // unused grant cannot linger and be replayed later in the session. ->block() below
         // serializes racing reads of the grant.
         $grantedAt = session()->pull('2fa.download_grant');
-        abort_unless(is_int($grantedAt) && now()->timestamp - $grantedAt <= 600, 403);
+        $age = is_int($grantedAt) ? now()->timestamp - $grantedAt : null;
+        // Valid only within [now-600s, now]: rejects stale, non-timestamp, and future grants.
+        abort_unless($age !== null && $age >= 0 && $age <= 600, 403);
 
         $codes = AuthFacade::user()->recoveryCodes();