diff --git a/app/routers/admin.py b/app/routers/admin.py
index 272ddcd..c29767b 100644
--- a/app/routers/admin.py
+++ b/app/routers/admin.py
@@ -9,8 +9,15 @@ router = APIRouter(tags=["admin"], prefix="/api/admin")
 async def admin_required(request: Request):
     from app.auth.session import get_current_user
     user = await get_current_user(request)
-    if not user or not user.get("is_admin"):
+    if not user:
         raise HTTPException(status_code=403, detail="Admin access required")
+    # Also check DB directly (session cookie may be stale)
+    if not user.get("is_admin"):
+        from app.db import get_conn
+        with get_conn() as conn:
+            row = conn.execute("SELECT is_admin FROM users WHERE id=?", (user.get("id"),)).fetchone()
+            if not row or not row["is_admin"]:
+                raise HTTPException(status_code=403, detail="Admin access required")
     return user