diff --git a/backend/app/routers/integrations.py b/backend/app/routers/integrations.py
index e3eb075..0aa52a5 100644
--- a/backend/app/routers/integrations.py
+++ b/backend/app/routers/integrations.py
@@ -55,7 +55,7 @@ async def strava_callback(
     from app.config import get_settings
     _settings = get_settings()
     try:
-        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm])
+        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"])
         user_id = uuid_mod.UUID(payload["sub"])
     except (JWTError, KeyError, ValueError):
         raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")
@@ -117,7 +117,7 @@ async def polar_callback(
     from app.config import get_settings
     _settings = get_settings()
     try:
-        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=[_settings.algorithm])
+        payload = jose_jwt.decode(state, _settings.secret_key, algorithms=["HS256"])
         user_id = uuid_mod.UUID(payload["sub"])
     except (JWTError, KeyError, ValueError):
         raise HTTPException(status_code=400, detail="Invalid or expired OAuth state")
diff --git a/backend/app/utils/auth.py b/backend/app/utils/auth.py
index 74e9ba2..65bcbf8 100644
--- a/backend/app/utils/auth.py
+++ b/backend/app/utils/auth.py
@@ -65,7 +65,7 @@ async def get_current_user(
 
     # Standard JWT validation
     try:
-        payload = jwt.decode(token, settings.secret_key, algorithms=[settings.algorithm])
+        payload = jwt.decode(token, settings.secret_key, algorithms=[ALGORITHM])
         user_id: str = payload.get("sub")
         if user_id is None:
             raise credentials_exception