diff --git a/services/nginx/app/traits/route_t.php b/services/nginx/app/traits/route_t.php
index ef6f38cc..141fbd9c 100644
--- a/services/nginx/app/traits/route_t.php
+++ b/services/nginx/app/traits/route_t.php
@@ -297,8 +297,10 @@ trait route_t
      * Order of precedence:
      * - Explicit `$customer_number` argument if provided
      * - Main authenticated user context (if available)
-     * - Request header X-Customer-Number
-     * - Query/post parameter `customer_number`
+     *
+     * Important: never derive this value from caller-controlled request
+     * headers/parameters at this layer. Route handlers must pass a trusted
+     * customer number that is bound to the target resource when needed.
      */
     private function resolveCustomerNumberForSubuser(authentication $auth, ?int $customer_number = null): ?int
     {
@@ -309,16 +311,6 @@ trait route_t
         if ($user_ctx !== false && isset($user_ctx->customer_number)) {
             return (int)$user_ctx->customer_number->value();
         }
-        $headers = function_exists('getallheaders') ? getallheaders() : [];
-        if (isset($headers['X-Customer-Number'])) {
-            return (int)$headers['X-Customer-Number'];
-        }
-        if (isset($_GET['customer_number'])) {
-            return (int)$_GET['customer_number'];
-        }
-        if (isset($_POST['customer_number'])) {
-            return (int)$_POST['customer_number'];
-        }
         return null;
     }