diff --git a/app/api/subscribe.py b/app/api/subscribe.py
index 6875a46..68259a4 100644
--- a/app/api/subscribe.py
+++ b/app/api/subscribe.py
@@ -63,6 +63,18 @@ async def subscribe(request: Request, db: AsyncSession = Depends(get_db)):
         # Re-subscribing is allowed to change paper mode (e.g. user wants to
         # promote from paper to live). Otherwise leave existing flag alone.
         if paper_mode != sub.paper_mode:
+            # SAFETY: promoting paper → live raises the risk level from
+            # "simulated" to "real money". Force Auto-Trade OFF on that
+            # transition so a switch the user flipped while it was harmless
+            # (paper) can NEVER carry over and silently start opening real
+            # positions the moment they add an API key. They must re-enable
+            # Auto-Trade explicitly while live — an intentional, signed action.
+            if sub.paper_mode and not paper_mode and sub.auto_trade:
+                sub.auto_trade = False
+                logger.info(
+                    "Subscription %s promoted paper→live — Auto-Trade forced "
+                    "OFF (must be re-enabled explicitly while live)", wallet,
+                )
             sub.paper_mode = paper_mode
 
     await db.commit()