diff --git a/products/02-iac-drift-detection/saas/src/auth/middleware.ts b/products/02-iac-drift-detection/saas/src/auth/middleware.ts
index 46a0617..ff679f6 100644
--- a/products/02-iac-drift-detection/saas/src/auth/middleware.ts
+++ b/products/02-iac-drift-detection/saas/src/auth/middleware.ts
@@ -159,7 +159,7 @@ export function registerAuthRoutes(app: FastifyInstance, jwtSecret: string, pool
     if (existing.rows[0]) return reply.status(409).send({ error: 'Email already registered' });
 
     const passwordHash = await hashPassword(body.password);
-    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 50);
+    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 42) + '-' + crypto.randomBytes(3).toString('hex');
 
     const client = await pool.connect();
     try {
diff --git a/products/03-alert-intelligence/src/auth/middleware.ts b/products/03-alert-intelligence/src/auth/middleware.ts
index 46a0617..ff679f6 100644
--- a/products/03-alert-intelligence/src/auth/middleware.ts
+++ b/products/03-alert-intelligence/src/auth/middleware.ts
@@ -159,7 +159,7 @@ export function registerAuthRoutes(app: FastifyInstance, jwtSecret: string, pool
     if (existing.rows[0]) return reply.status(409).send({ error: 'Email already registered' });
 
     const passwordHash = await hashPassword(body.password);
-    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 50);
+    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 42) + '-' + crypto.randomBytes(3).toString('hex');
 
     const client = await pool.connect();
     try {
diff --git a/products/04-lightweight-idp/src/auth/middleware.ts b/products/04-lightweight-idp/src/auth/middleware.ts
index 46a0617..ff679f6 100644
--- a/products/04-lightweight-idp/src/auth/middleware.ts
+++ b/products/04-lightweight-idp/src/auth/middleware.ts
@@ -159,7 +159,7 @@ export function registerAuthRoutes(app: FastifyInstance, jwtSecret: string, pool
     if (existing.rows[0]) return reply.status(409).send({ error: 'Email already registered' });
 
     const passwordHash = await hashPassword(body.password);
-    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 50);
+    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 42) + '-' + crypto.randomBytes(3).toString('hex');
 
     const client = await pool.connect();
     try {
diff --git a/products/05-aws-cost-anomaly/src/auth/middleware.ts b/products/05-aws-cost-anomaly/src/auth/middleware.ts
index 46a0617..ff679f6 100644
--- a/products/05-aws-cost-anomaly/src/auth/middleware.ts
+++ b/products/05-aws-cost-anomaly/src/auth/middleware.ts
@@ -159,7 +159,7 @@ export function registerAuthRoutes(app: FastifyInstance, jwtSecret: string, pool
     if (existing.rows[0]) return reply.status(409).send({ error: 'Email already registered' });
 
     const passwordHash = await hashPassword(body.password);
-    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 50);
+    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 42) + '-' + crypto.randomBytes(3).toString('hex');
 
     const client = await pool.connect();
     try {
diff --git a/products/06-runbook-automation/saas/src/auth/middleware.ts b/products/06-runbook-automation/saas/src/auth/middleware.ts
index 46a0617..ff679f6 100644
--- a/products/06-runbook-automation/saas/src/auth/middleware.ts
+++ b/products/06-runbook-automation/saas/src/auth/middleware.ts
@@ -159,7 +159,7 @@ export function registerAuthRoutes(app: FastifyInstance, jwtSecret: string, pool
     if (existing.rows[0]) return reply.status(409).send({ error: 'Email already registered' });
 
     const passwordHash = await hashPassword(body.password);
-    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 50);
+    const slug = body.tenant_name.toLowerCase().replace(/[^a-z0-9]+/g, '-').slice(0, 42) + '-' + crypto.randomBytes(3).toString('hex');
 
     const client = await pool.connect();
     try {