diff --git a/.env.example b/.env.example
index 260f92752..330f286c5 100644
--- a/.env.example
+++ b/.env.example
@@ -1,9 +1,8 @@
 # Thunderbolt Cloud URL (optional, defaults to http://localhost:8000)
 VITE_THUNDERBOLT_CLOUD_URL="http://localhost:8000/v1"
 
-# Bypass waitlist routes for UI development (set to "true" to skip waitlist)
-# Note: This only bypasses frontend routing, not backend auth
-# VITE_BYPASS_WAITLIST="true"
+# Enable the waitlist gate (opt-in; leave unset to bypass the waitlist)
+# VITE_ENABLE_WAITLIST="true"
 
 # Show app download links/banners in the web UI (set to "true" for internal testing deployments)
 # When enabled, desktop users see a sidebar section + bottom-right banner; mobile users see a top banner
diff --git a/src/app.tsx b/src/app.tsx
index 5b8a348f9..87497737d 100644
--- a/src/app.tsx
+++ b/src/app.tsx
@@ -87,7 +87,7 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
   })
 
   const oidcMode = isOidcMode()
-  const shouldBypassWaitlist = import.meta.env.VITE_BYPASS_WAITLIST === 'true' || isPrPreview()
+  const waitlistEnabled = import.meta.env.VITE_ENABLE_WAITLIST === 'true' && !isPrPreview()
 
   return (
     <Routes>
@@ -107,8 +107,8 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
         />
       )}
 
-      {/* Waitlist routes - unauthenticated only (skip when bypass or OIDC mode) */}
-      {!oidcMode && !shouldBypassWaitlist && (
+      {/* Waitlist routes - unauthenticated only (only when enabled and not OIDC mode) */}
+      {!oidcMode && waitlistEnabled && (
         <Route element={<AuthGate require="unauthenticated" redirectTo="/" />}>
           <Route path="waitlist" element={<WaitlistLayout />}>
             <Route index element={<WaitlistPage />} />
@@ -116,13 +116,13 @@ const AppRoutes = ({ initData }: { initData: InitData }) => {
         </Route>
       )}
 
-      {/* Main app routes - authenticated only (pass-through when bypass enabled) */}
+      {/* Main app routes - authenticated only (pass-through when waitlist and OIDC both disabled) */}
       <Route
         element={
-          shouldBypassWaitlist ? (
-            <Outlet />
-          ) : (
+          oidcMode || waitlistEnabled ? (
             <AuthGate require="authenticated" redirectTo={oidcMode ? '/oidc-redirect' : '/waitlist'} />
+          ) : (
+            <Outlet />
           )
         }
       >