diff --git a/middleware/DbSessionHandler.php b/middleware/DbSessionHandler.php
new file mode 100644
index 0000000..08d028e
--- /dev/null
+++ b/middleware/DbSessionHandler.php
@@ -0,0 +1,38 @@
+<?php
+declare(strict_types=1);
+
+class DbSessionHandler implements SessionHandlerInterface
+{
+    private const TTL = 86400 * 30; // 30 days
+
+    public function open(string $path, string $name): bool { return true; }
+    public function close(): bool { return true; }
+
+    public function read(string $id): string|false
+    {
+        $stmt = db()->prepare("SELECT data FROM sessions WHERE id = ? AND updated_at > DATE_SUB(NOW(), INTERVAL " . self::TTL . " SECOND)");
+        $stmt->execute([$id]);
+        $row = $stmt->fetch();
+        return $row ? $row['data'] : '';
+    }
+
+    public function write(string $id, string $data): bool
+    {
+        db()->prepare("INSERT INTO sessions (id, data) VALUES (?, ?) ON DUPLICATE KEY UPDATE data = VALUES(data), updated_at = NOW()")
+            ->execute([$id, $data]);
+        return true;
+    }
+
+    public function destroy(string $id): bool
+    {
+        db()->prepare("DELETE FROM sessions WHERE id = ?")->execute([$id]);
+        return true;
+    }
+
+    public function gc(int $max_lifetime): int|false
+    {
+        $stmt = db()->prepare("DELETE FROM sessions WHERE updated_at < DATE_SUB(NOW(), INTERVAL ? SECOND)");
+        $stmt->execute([self::TTL]);
+        return $stmt->rowCount();
+    }
+}
diff --git a/middleware/SessionAuth.php b/middleware/SessionAuth.php
index bc0d036..1c591bc 100644
--- a/middleware/SessionAuth.php
+++ b/middleware/SessionAuth.php
@@ -1,13 +1,16 @@
 <?php
 declare(strict_types=1);
 
+require_once __DIR__ . '/DbSessionHandler.php';
+
 class SessionAuth
 {
     public static function start(): void
     {
         if (session_status() === PHP_SESSION_NONE) {
+            session_set_save_handler(new DbSessionHandler(), true);
             session_set_cookie_params([
-                'lifetime' => 0,
+                'lifetime' => 86400 * 30, // 30 days — survives deploys
                 'path'     => '/',
                 'secure'   => isset($_SERVER['HTTPS']),
                 'httponly' => true,