diff --git a/cmd/server/tests/progress_service_test.go b/cmd/server/tests/progress_service_test.go
index 84d3048c..239d99e5 100644
--- a/cmd/server/tests/progress_service_test.go
+++ b/cmd/server/tests/progress_service_test.go
@@ -717,7 +717,7 @@ func TestDeletedUserTokenRejected(t *testing.T) {
 
 	var errBody map[string]string
 	require.NoError(t, json.NewDecoder(resp.Body).Decode(&errBody))
-	assert.Equal(t, "user_not_found", errBody["error"])
+	assert.Contains(t, errBody["message"], "user_not_found")
 }
 
 // TestProgressWeb_LocatorCoherence pins the locator coherence rule: a
diff --git a/internal/router/router.go b/internal/router/router.go
index f2d9c31f..e4eb7093 100644
--- a/internal/router/router.go
+++ b/internal/router/router.go
@@ -132,10 +132,11 @@ func createJWTMiddleware(cfg *Config) echo.MiddlewareFunc {
 				if wantsHTML(c.Request().Header) {
 					return c.Redirect(http.StatusFound, "/login?session=invalid")
 				}
-				return c.JSON(http.StatusUnauthorized, map[string]string{
-					"error":   "user_not_found",
-					"message": "This account no longer exists. Please log in again.",
-				})
+				// Non-nil error is REQUIRED: returning c.JSON's nil would
+				// let the chain continue into handlers whose c.Get("user")
+				// assertion panics on the never-set user.
+				return echo.NewHTTPError(http.StatusUnauthorized,
+					"user_not_found: this account no longer exists; please log in again")
 			}
 
 			c.Set("user", database.Users{