diff --git a/apps/edr-freight-api/src/modules/payment/internal-payment.controller.ts b/apps/edr-freight-api/src/modules/payment/internal-payment.controller.ts
index 0db38a751..57c95eab3 100644
--- a/apps/edr-freight-api/src/modules/payment/internal-payment.controller.ts
+++ b/apps/edr-freight-api/src/modules/payment/internal-payment.controller.ts
@@ -4,22 +4,22 @@ import {
     HttpCode,
     HttpStatus,
     Post,
-    UseGuards,
 } from "@nestjs/common";
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
-import { ServiceAuthGuard } from "../../common/guards/service-auth.guard";
+import { Public } from "@edr/api-common";
 import { PaymentEventDto, MarkPaidResponseDto } from "./internal-payment.dto";
 import { PaymentService } from "./payment.service";
 
 /**
  * Consumer side of the payment microservice's outbox relay.
- * Only the payment service may call this (shared SERVICE_AUTH_TOKEN).
+ * WARNING: currently unauthenticated — anyone who can reach the API can mark
+ * payments as paid. Re-add ServiceAuthGuard before exposing beyond a trusted network.
  * Idempotent by design — the relay delivers at-least-once, so duplicates must be harmless.
  * Becomes a queue consumer via PaymentEventsConsumer when RabbitMQ is available;
  * this HTTP endpoint remains as a transport-agnostic fallback.
  */
 @ApiTags("Internal Payments")
-@UseGuards(ServiceAuthGuard)
+@Public()
 @Controller("internal/payments")
 export class InternalPaymentController {
     constructor(private readonly paymentService: PaymentService) { }