diff --git a/frontend/app/api/cities/detail-batch/route.ts b/frontend/app/api/cities/detail-batch/route.ts
index e697aebc..a305bf8f 100644
--- a/frontend/app/api/cities/detail-batch/route.ts
+++ b/frontend/app/api/cities/detail-batch/route.ts
@@ -106,6 +106,7 @@ export async function GET(req: NextRequest) {
           ? NO_STORE_CACHE_CONTROL
           : cachePolicy.responseCacheControl,
       fetchCache: "no-store",
+      includeSupabaseIdentity: true,
       publicMessage: "Failed to fetch city detail batch",
       revalidateSeconds: cachePolicy.revalidateSeconds,
       signal: controller.signal,
diff --git a/frontend/app/api/scan/terminal/route.ts b/frontend/app/api/scan/terminal/route.ts
index 2a0947ab..657eb181 100644
--- a/frontend/app/api/scan/terminal/route.ts
+++ b/frontend/app/api/scan/terminal/route.ts
@@ -75,6 +75,7 @@ export async function GET(req: NextRequest) {
       fetchCache: "no-store",
       publicMessage: "Failed to fetch scan terminal data",
       revalidateSeconds: cachePolicy.revalidateSeconds,
+      includeSupabaseIdentity: true,
       signal: controller.signal,
       timeoutPublicMessage: "Scan terminal request timed out",
       timing: timer,
diff --git a/frontend/components/ops/__tests__/backendAuthHeaders.test.ts b/frontend/components/ops/__tests__/backendAuthHeaders.test.ts
index 42c49b18..ac7087ad 100644
--- a/frontend/components/ops/__tests__/backendAuthHeaders.test.ts
+++ b/frontend/components/ops/__tests__/backendAuthHeaders.test.ts
@@ -50,4 +50,21 @@ export function runTests() {
       helperSource.includes("authEmail: identity?.email || null"),
     "backend auth helper must verify incoming Supabase bearer tokens and forward trusted user identity headers to backend services",
   );
+
+  const scanTerminalRoute = fs.readFileSync(
+    path.join(projectRoot, "app", "api", "scan", "terminal", "route.ts"),
+    "utf8",
+  );
+  const cityDetailBatchRoute = fs.readFileSync(
+    path.join(projectRoot, "app", "api", "cities", "detail-batch", "route.ts"),
+    "utf8",
+  );
+  assert(
+    scanTerminalRoute.includes("includeSupabaseIdentity: true"),
+    "scan terminal proxy must forward the Supabase identity; otherwise paid users hit backend 401 even when /api/auth/me is active",
+  );
+  assert(
+    cityDetailBatchRoute.includes("includeSupabaseIdentity: true"),
+    "city detail batch proxy must forward the Supabase identity; otherwise paid users see empty charts with backend 401",
+  );
 }