diff --git a/server/src/routes/public.ts b/server/src/routes/public.ts
index 85e0b46..5e70de6 100644
--- a/server/src/routes/public.ts
+++ b/server/src/routes/public.ts
@@ -55,6 +55,13 @@ export function registerPublicRoutes(app: FastifyInstance, db: DB) {
     if (!Number.isInteger(bar_id)) {
       return sendProblem(req, reply, 400, 'Bad Request', 'bar_id required');
     }
+    // `crew ? 0 : total` below only works if `crew` is actually a boolean —
+    // any other truthy value (e.g. the string "false", or a stray object)
+    // would silently book a paid sale as a free crew drink, with nothing in
+    // the row afterwards to tell that apart from a genuine crew transaction.
+    if (crew !== undefined && typeof crew !== 'boolean') {
+      return sendProblem(req, reply, 400, 'Bad Request', 'crew must be a boolean');
+    }
     if (!Array.isArray(items)) {
       return sendProblem(req, reply, 400, 'Bad Request', 'items required');
     }