diff --git a/products/02-iac-drift-detection/saas/src/data/db.ts b/products/02-iac-drift-detection/saas/src/data/db.ts
index c5852d7..6753403 100644
--- a/products/02-iac-drift-detection/saas/src/data/db.ts
+++ b/products/02-iac-drift-detection/saas/src/data/db.ts
@@ -15,7 +15,9 @@ export function createPool(connectionString: string): pg.Pool {
  * MUST be cleared when returning the connection to the pool.
  */
 export async function setTenantContext(client: pg.PoolClient, tenantId: string): Promise<void> {
-  await client.query('SET LOCAL app.tenant_id = $1', [tenantId]);
+  // SET doesn't support parameterized queries — validate UUID format then interpolate
+  if (!/^[0-9a-f-]{36}$/i.test(tenantId)) throw new Error('Invalid tenant ID');
+  await client.query(`SET LOCAL app.tenant_id = '${tenantId}'`);
 }
 
 /**