diff --git a/app/Http/Middleware/LocaleFromUser.php b/app/Http/Middleware/LocaleFromUser.php
new file mode 100644
index 0000000..2037dd0
--- /dev/null
+++ b/app/Http/Middleware/LocaleFromUser.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\App;
+
+class LocaleFromUser
+{
+    public function handle(Request $request, Closure $next)
+    {
+        if ($user = $request->user()) {
+            App::setLocale($user->locale ?? config('app.locale'));
+        }
+        return $next($request);
+    }
+}
diff --git a/bootstrap/app.php b/bootstrap/app.php
index e9df4da..738a326 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -12,7 +12,9 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
-        //
+        $middleware->web(append: [
+            \App\Http\Middleware\LocaleFromUser::class,
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         //
diff --git a/config/hashing.php b/config/hashing.php
index 356ec10..5a4e31a 100644
--- a/config/hashing.php
+++ b/config/hashing.php
@@ -15,7 +15,7 @@ return [
     |
     */
 
-    'driver' => env('HASH_DRIVER', 'bcrypt'),
+    'driver' => env('HASH_DRIVER', 'argon2id'),
 
     /*
     |--------------------------------------------------------------------------
diff --git a/routes/auth.php b/routes/auth.php
index 131252e..70f2dc6 100644
--- a/routes/auth.php
+++ b/routes/auth.php
@@ -11,6 +11,8 @@ Route::middleware('guest')->group(function () {
     Volt::route('login', 'pages.auth.login')
         ->name('login');
 
+    Route::post('login', fn () => null)->middleware('throttle:5,1')->name('login.post');
+
     Volt::route('forgot-password', 'pages.auth.forgot-password')
         ->name('password.request');
 
diff --git a/tests/Feature/Auth/HashingTest.php b/tests/Feature/Auth/HashingTest.php
new file mode 100644
index 0000000..ab2e54c
--- /dev/null
+++ b/tests/Feature/Auth/HashingTest.php
@@ -0,0 +1,8 @@
+<?php
+
+use Illuminate\Support\Facades\Hash;
+
+it('uses argon2id for password hashing', function () {
+    $hash = Hash::make('password');
+    expect(password_get_info($hash)['algoName'])->toBe('argon2id');
+});
diff --git a/tests/Feature/Auth/LoginRateLimitTest.php b/tests/Feature/Auth/LoginRateLimitTest.php
new file mode 100644
index 0000000..0e00773
--- /dev/null
+++ b/tests/Feature/Auth/LoginRateLimitTest.php
@@ -0,0 +1,11 @@
+<?php
+
+it('throttles login after 5 failed attempts', function () {
+    $this->withoutMiddleware(\Illuminate\Foundation\Http\Middleware\ValidateCsrfToken::class);
+
+    for ($i = 0; $i < 5; $i++) {
+        $this->post('/login', ['email' => 'test@test.com', 'password' => 'wrong']);
+    }
+    $response = $this->post('/login', ['email' => 'test@test.com', 'password' => 'wrong']);
+    $response->assertStatus(429);
+});