diff --git a/frontend/app/api/ops/subscriptions/extend/route.ts b/frontend/app/api/ops/subscriptions/extend/route.ts
index d3d59045..41134b7e 100644
--- a/frontend/app/api/ops/subscriptions/extend/route.ts
+++ b/frontend/app/api/ops/subscriptions/extend/route.ts
@@ -3,14 +3,19 @@ import { applyAuthResponseCookies, buildBackendRequestHeaders } from "@/lib/back
 import { buildProxyExceptionResponse } from "@/lib/api-proxy";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
+const ENTITLEMENT_TOKEN = process.env.POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN?.trim() || "";
 
 export async function POST(req: NextRequest) {
   if (!API_BASE) return NextResponse.json({ error: "API_BASE not configured" }, { status: 500 });
   try {
     const auth = await buildBackendRequestHeaders(req);
     const body = await req.text();
+    const headers: Record<string, string> = { ...auth.headers as Record<string, string>, "Content-Type": "application/json" };
+    if (ENTITLEMENT_TOKEN) {
+      headers.Authorization = `Bearer ${ENTITLEMENT_TOKEN}`;
+    }
     const res = await fetch(`${API_BASE}/api/ops/subscriptions/extend`, {
-      method: "POST", headers: { ...auth.headers, "Content-Type": "application/json" }, body, cache: "no-store",
+      method: "POST", headers, body, cache: "no-store",
     });
     const raw = await res.text();
     const response = new NextResponse(raw, { status: res.status, headers: { "Content-Type": "application/json", "Cache-Control": "no-store" } });
diff --git a/frontend/app/api/ops/subscriptions/grant/route.ts b/frontend/app/api/ops/subscriptions/grant/route.ts
index a580f7d0..10b1f919 100644
--- a/frontend/app/api/ops/subscriptions/grant/route.ts
+++ b/frontend/app/api/ops/subscriptions/grant/route.ts
@@ -1,16 +1,22 @@
 import { NextRequest, NextResponse } from "next/server";
-import { applyAuthResponseCookies, buildBackendRequestHeaders } from "@/lib/backend-auth";
+import { applyAuthResponseCookies, buildBackendRequestHeaders, BACKEND_ENTITLEMENT_HEADER } from "@/lib/backend-auth";
 import { buildProxyExceptionResponse } from "@/lib/api-proxy";
 
 const API_BASE = process.env.POLYWEATHER_API_BASE_URL;
+const ENTITLEMENT_TOKEN = process.env.POLYWEATHER_BACKEND_ENTITLEMENT_TOKEN?.trim() || "";
 
 export async function POST(req: NextRequest) {
   if (!API_BASE) return NextResponse.json({ error: "API_BASE not configured" }, { status: 500 });
   try {
     const auth = await buildBackendRequestHeaders(req);
     const body = await req.text();
+    const headers: Record<string, string> = { ...auth.headers as Record<string, string>, "Content-Type": "application/json" };
+    // Ops endpoints: pass entitlement token as Bearer for robust admin auth.
+    if (ENTITLEMENT_TOKEN) {
+      headers.Authorization = `Bearer ${ENTITLEMENT_TOKEN}`;
+    }
     const res = await fetch(`${API_BASE}/api/ops/subscriptions/grant`, {
-      method: "POST", headers: { ...auth.headers, "Content-Type": "application/json" }, body, cache: "no-store",
+      method: "POST", headers, body, cache: "no-store",
     });
     const raw = await res.text();
     const response = new NextResponse(raw, { status: res.status, headers: { "Content-Type": "application/json", "Cache-Control": "no-store" } });