diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 812bf23a0..77157422c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -1,13 +1,18 @@
-name: Deploy Schej
+name: Deploy Timeful
 
 on:
+  push:
+    branches:
+      - main
   workflow_dispatch:
-    inputs:
-      target:
-        description: "What to deploy?"
-        required: true
-        type: choice
-        options: [server, frontend, both]
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: timeful-production
+  cancel-in-progress: false
 
 jobs:
   deploy:
@@ -15,47 +20,102 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+
+      # -----------------------------
+      # Frontend
+      # -----------------------------
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
         with:
-          ref: ${{ github.ref_name }}
+          node-version: "18"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
 
-      - name: Prepare SSH
-        shell: bash
+      - name: Build frontend
+        working-directory: frontend
+        env:
+          VUE_APP_GOOGLE_CLIENT_ID: ${{ vars.GOOGLE_CLIENT_ID }}
+          VUE_APP_POSTHOG_API_KEY: ""
+          VUE_APP_MICROSOFT_CLIENT_ID: ""
         run: |
-          set -euo pipefail
-          mkdir -p ~/.ssh
-          echo "${{ secrets.SSH_PRIVATE_KEY }}" > aws-key
-          chmod 600 aws-key
-          ssh-keyscan -H "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts
+          npm ci
+          npm run build
 
-      - name: Ensure deploy scripts are executable
-        run: chmod +x ./deploy_scripts/*.sh
+      # -----------------------------
+      # Backend
+      # -----------------------------
 
-      - name: Deploy
-        shell: bash
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: "1.25"
+          cache-dependency-path: server/go.sum
+
+      - name: Build backend
+        working-directory: server
         env:
-          TARGET: ${{ github.event.inputs.target }}
-          SSH_USER: ${{ secrets.SSH_USER }}
-          SSH_HOST: ${{ secrets.SSH_HOST }}
+          CGO_ENABLED: "0"
+          GOOS: linux
+          GOARCH: amd64
+        run: |
+          go build \
+            -buildvcs=false \
+            -trimpath \
+            -ldflags="-s -w" \
+            -o ../timeful-server \
+            .
+
+      # -----------------------------
+      # Release archive
+      # -----------------------------
+
+      - name: Package release
+        run: |
+          mkdir -p release/frontend
+
+          cp timeful-server release/timeful-server
+          cp -a frontend/dist release/frontend/dist
+
+          chmod +x release/timeful-server
+
+          tar -C release -czf timeful-release.tar.gz .
+
+      # -----------------------------
+      # Authenticate to Google Cloud
+      # -----------------------------
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          project_id: ${{ vars.GCP_PROJECT_ID }}
+          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
+
+      - name: Set up gcloud
+        uses: google-github-actions/setup-gcloud@v3
+
+      # -----------------------------
+      # Deploy through IAP
+      # -----------------------------
+
+      - name: Upload release
+        run: |
+          gcloud compute scp \
+            timeful-release.tar.gz \
+            "${{ vars.GCP_VM }}:/tmp/timeful-release.tar.gz" \
+            --project="${{ vars.GCP_PROJECT_ID }}" \
+            --zone="${{ vars.GCP_ZONE }}" \
+            --tunnel-through-iap \
+            --quiet
+
+      - name: Activate release
         run: |
-          set -euo pipefail
-          DEPLOY_SCRIPT_DIRECTORY="./deploy_scripts/"
-          HOST="${SSH_USER}@${SSH_HOST}"
-
-          if [ "$TARGET" = "server" ]; then
-            DEPLOY_SCRIPT="deploy_server.sh"
-          elif [ "$TARGET" = "frontend" ]; then
-            DEPLOY_SCRIPT="deploy_frontend.sh"
-          elif [ "$TARGET" = "both" ]; then
-            for DEPLOY_SCRIPT in deploy_frontend.sh deploy_server.sh; do
-              echo "${DEPLOY_SCRIPT_DIRECTORY}${DEPLOY_SCRIPT}"
-              /bin/bash "${DEPLOY_SCRIPT_DIRECTORY}${DEPLOY_SCRIPT}" "$HOST" "./aws-key"
-            done
-            exit 0
-          else
-            echo "Invalid script name!"
-            exit 1
-          fi
-
-          echo "${DEPLOY_SCRIPT_DIRECTORY}${DEPLOY_SCRIPT}"
-          /bin/bash "${DEPLOY_SCRIPT_DIRECTORY}${DEPLOY_SCRIPT}" "$HOST" "./aws-key"
+          gcloud compute ssh \
+            "${{ vars.GCP_VM }}" \
+            --project="${{ vars.GCP_PROJECT_ID }}" \
+            --zone="${{ vars.GCP_ZONE }}" \
+            --tunnel-through-iap \
+            --quiet \
+            --command="sudo /usr/local/sbin/deploy-timeful /tmp/timeful-release.tar.gz && rm -f /tmp/timeful-release.tar.gz"
diff --git a/frontend/public/index.html b/frontend/public/index.html
index a300a8a4a..8b08dcbbd 100644
--- a/frontend/public/index.html
+++ b/frontend/public/index.html
@@ -1,6 +1,18 @@
 <!DOCTYPE html>
 <html lang="en">
   <head>
+    <!-- Applies dark mode before first paint to avoid a flash of the wrong theme -->
+    <script>
+      ;(function (d) {
+        var stored = localStorage["darkMode"]
+        var dark =
+          stored == undefined
+            ? window.matchMedia &&
+              window.matchMedia("(prefers-color-scheme: dark)").matches
+            : stored == "true"
+        if (dark) d.documentElement.classList.add("dark")
+      })(document)
+    </script>
     <!-- Google Tag Manager -->
     <script>
       ;(function (w, d, s, l, i) {
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 176178b5c..9645f7afe 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -69,6 +69,16 @@
         >
           Donate
         </v-btn> -->
+        <v-btn
+          id="dark-mode-toggle-btn"
+          icon
+          :aria-label="darkMode ? 'Switch to light mode' : 'Switch to dark mode'"
+          @click="toggleDarkMode"
+        >
+          <v-icon>{{
+            darkMode ? "mdi-white-balance-sunny" : "mdi-weather-night"
+          }}</v-icon>
+        </v-btn>
         <v-btn
           v-if="$route.name === 'home' && !isPhone"
           color="primary"
@@ -238,6 +248,7 @@ import {
   signInGoogle,
   signInOutlook,
   isPremiumUser,
+  setDarkModePreference,
 } from "@/utils"
 import {
   authTypes,
@@ -295,6 +306,7 @@ export default {
       "enablePaywall",
       "upgradeDialogVisible",
       "newDialogOptions",
+      "darkMode",
     ]),
     isPhone() {
       return isPhone(this.$vuetify)
@@ -331,6 +343,7 @@ export default {
       "setPricingPageConversion",
       "setEnablePaywall",
       "setFeatureFlagsLoaded",
+      "setDarkMode",
     ]),
     ...mapActions([
       "getEvents",
@@ -341,6 +354,12 @@ export default {
     handleScroll(e) {
       this.scrollY = window.scrollY
     },
+    toggleDarkMode() {
+      const darkMode = !this.darkMode
+      this.setDarkMode(darkMode)
+      setDarkModePreference(darkMode)
+      this.$posthog?.capture("dark_mode_toggled", { darkMode })
+    },
     _createNew(eventOnly = false) {
       this.$posthog.capture("create_new_button_clicked", {
         eventOnly: eventOnly,
@@ -460,6 +479,13 @@ export default {
   },
 
   watch: {
+    darkMode: {
+      immediate: true,
+      handler(darkMode) {
+        document.documentElement.classList.toggle("dark", darkMode)
+        this.$vuetify.theme.dark = darkMode
+      },
+    },
     $route: {
       immediate: true,
       async handler() {
diff --git a/frontend/src/components/AuthUserMenu.vue b/frontend/src/components/AuthUserMenu.vue
index d19e06130..a92534b5a 100644
--- a/frontend/src/components/AuthUserMenu.vue
+++ b/frontend/src/components/AuthUserMenu.vue
@@ -30,13 +30,13 @@
           target="_blank"
         >
           <v-list-item-title class="tw-flex tw-items-center tw-gap-1">
-            <v-icon class="tw-mr-1" small color="black">mdi-message</v-icon>
+            <v-icon class="tw-mr-1" small>mdi-message</v-icon>
             Give feedback
           </v-list-item-title>
         </v-list-item>
         <v-list-item id="settings-btn" @click="goToSettings">
           <v-list-item-title class="tw-flex tw-items-center tw-gap-1">
-            <v-icon class="tw-mr-1" small color="black">mdi-cog</v-icon>
+            <v-icon class="tw-mr-1" small>mdi-cog</v-icon>
             Settings
           </v-list-item-title>
         </v-list-item>
diff --git a/frontend/src/index.css b/frontend/src/index.css
index b5c61c956..b92c96a39 100644
--- a/frontend/src/index.css
+++ b/frontend/src/index.css
@@ -1,3 +1,30 @@
+:root {
+  --color-white: 255 255 255;
+  --color-off-white: 242 242 242;
+  --color-black: 0 0 0;
+  --color-gray: 189 189 189;
+  --color-dark-gray: 107 107 107;
+  --color-very-dark-gray: 79 79 79;
+  --color-light-gray: 243 244 246;
+  --color-light-gray-stroke: 223 223 223;
+}
+
+html.dark {
+  --color-white: 30 30 30;
+  --color-off-white: 42 42 42;
+  --color-black: 242 242 242;
+  --color-gray: 92 92 92;
+  --color-dark-gray: 168 168 168;
+  --color-very-dark-gray: 208 208 208;
+  --color-light-gray: 38 38 38;
+  --color-light-gray-stroke: 58 58 58;
+}
+
+html,
+body {
+  background-color: rgb(var(--color-white));
+}
+
 @tailwind base;
 @tailwind components;
 @tailwind utilities;
diff --git a/frontend/src/plugins/vuetify.js b/frontend/src/plugins/vuetify.js
index 14eccb9b8..7b244a2b7 100644
--- a/frontend/src/plugins/vuetify.js
+++ b/frontend/src/plugins/vuetify.js
@@ -1,16 +1,24 @@
 import Vue from "vue"
 import Vuetify from "vuetify/lib"
 import tailwind from "../../tailwind.config"
+import { prefersDarkMode } from "@/utils/general_utils"
 
 Vue.use(Vuetify)
 
 export default new Vuetify({
   theme: {
+    dark: prefersDarkMode(),
     themes: {
       light: {
         primary: tailwind.theme.colors.green,
         error: tailwind.theme.colors.red,
       },
+      dark: {
+        primary: tailwind.theme.colors["light-green"],
+        error: tailwind.theme.colors.red,
+        background: "#1e1e1e",
+        surface: "#1e1e1e",
+      },
     },
   },
   breakpoint: {
diff --git a/frontend/src/store/index.js b/frontend/src/store/index.js
index a0770841a..30b886719 100644
--- a/frontend/src/store/index.js
+++ b/frontend/src/store/index.js
@@ -1,7 +1,7 @@
 import Vue from "vue"
 import Vuex from "vuex"
-import { numFreeEvents, upgradeDialogTypes } from "@/constants"
-import { get, isPremiumUser } from "@/utils"
+import { upgradeDialogTypes } from "@/constants"
+import { get, isPremiumUser, prefersDarkMode } from "@/utils"
 import {
   createFolder,
   deleteFolder,
@@ -19,6 +19,8 @@ export default new Vuex.Store({
 
     authUser: null,
 
+    darkMode: prefersDarkMode(),
+
     events: [],
     folders: [],
 
@@ -29,7 +31,7 @@ export default new Vuex.Store({
     signUpFormEnabled: false,
     daysOnlyEnabled: true,
     overlayAvailabilitiesEnabled: true,
-    enablePaywall: true,
+    enablePaywall: false,
 
     // Experiments
     pricingPageConversion: "control",
@@ -61,6 +63,10 @@ export default new Vuex.Store({
       state.info = info
     },
 
+    setDarkMode(state, darkMode) {
+      state.darkMode = darkMode
+    },
+
     setAuthUser(state, authUser) {
       state.authUser = authUser
     },
@@ -163,21 +169,7 @@ export default new Vuex.Store({
       commit("setAuthUser", authUser)
     },
 
-    createNew(
-      { state, getters, commit, dispatch },
-      { eventOnly = false, folderId = null }
-    ) {
-      if (
-        state.enablePaywall &&
-        !getters.isPremiumUser &&
-        state.authUser?.numEventsCreated >= numFreeEvents
-      ) {
-        dispatch("showUpgradeDialog", {
-          type: upgradeDialogTypes.CREATE_EVENT,
-        })
-        return
-      }
-
+    createNew({ commit }, { eventOnly = false, folderId = null }) {
       commit("setNewDialogOptions", {
         show: true,
         contactsPayload: {},
diff --git a/frontend/src/utils/general_utils.js b/frontend/src/utils/general_utils.js
index 72b1d6932..75c7ed93f 100644
--- a/frontend/src/utils/general_utils.js
+++ b/frontend/src/utils/general_utils.js
@@ -215,15 +215,7 @@ export const lightOrDark = (color) => {
 
 /** Returns whether the given user is a premium user */
 export const isPremiumUser = (authUser) => {
-  if (!authUser) return false
-
-  if (authUser.stripeCustomerId) {
-    if (authUser.isPremium !== null) {
-      return authUser.isPremium
-    }
-    return true
-  }
-  return false
+  return !!authUser
 }
 
 /** Adds an event ID to the 'eventsCreated' list in localStorage */
@@ -247,6 +239,19 @@ export const deleteEventsCreated = () => {
   localStorage.removeItem("eventsCreated")
 }
 
+/** Returns whether dark mode should be enabled, checking localStorage first
+ * and falling back to the OS/browser's preferred color scheme */
+export const prefersDarkMode = () => {
+  return localStorage["darkMode"] == undefined
+    ? window.matchMedia?.("(prefers-color-scheme: dark)").matches ?? false
+    : localStorage["darkMode"] == "true"
+}
+
+/** Persists the user's dark mode preference to localStorage */
+export const setDarkModePreference = (darkMode) => {
+  localStorage["darkMode"] = darkMode
+}
+
 export const prefersStartOnMonday = () => {
   let defaultStartOnMonday = false
   try {
diff --git a/frontend/tailwind.config.js b/frontend/tailwind.config.js
index 398b49236..ba589cfdf 100644
--- a/frontend/tailwind.config.js
+++ b/frontend/tailwind.config.js
@@ -7,6 +7,7 @@ module.exports = {
     "./src/**/*.{vue,js,ts,jsx,tsx}",
   ],
   important: true,
+  darkMode: "class",
   theme: {
     extend: {
       fontSize: {
@@ -27,14 +28,19 @@ module.exports = {
       orange: "#E5A800",
       yellow: "#FFE8B8",
       "dark-yellow": "#997700",
-      white: "#FFFFFF",
-      "off-white": "#F2F2F2",
-      black: "#000000",
-      gray: "#BDBDBD",
-      "dark-gray": "#6B6B6B",
-      "very-dark-gray": "#4F4F4F",
-      "light-gray": "#f3f4f6",
-      "light-gray-stroke": "#dfdfdf",
+      // Neutral/surface colors are backed by CSS variables (see index.css)
+      // so that they automatically flip when the `dark` class is toggled,
+      // without needing to touch every component that uses them. The
+      // variables hold "R G B" channel triplets so tw-*/opacity modifiers
+      // (e.g. tw-text-white/80) keep working via Tailwind's <alpha-value>.
+      white: "rgb(var(--color-white) / <alpha-value>)",
+      "off-white": "rgb(var(--color-off-white) / <alpha-value>)",
+      black: "rgb(var(--color-black) / <alpha-value>)",
+      gray: "rgb(var(--color-gray) / <alpha-value>)",
+      "dark-gray": "rgb(var(--color-dark-gray) / <alpha-value>)",
+      "very-dark-gray": "rgb(var(--color-very-dark-gray) / <alpha-value>)",
+      "light-gray": "rgb(var(--color-light-gray) / <alpha-value>)",
+      "light-gray-stroke": "rgb(var(--color-light-gray-stroke) / <alpha-value>)",
       "avail-green": colors.emerald, // The green used for marking availability
       red: "#DB1616",
     },
diff --git a/server/.env.template b/server/.env.template
index 84618e524..df6efbdc0 100644
--- a/server/.env.template
+++ b/server/.env.template
@@ -55,4 +55,11 @@ SESSION_SECRET=?
 # CORS
 # - Comma-separated list of allowed origins
 # - For local development, set to: http://localhost:8080
-CORS_ORIGINS=?
\ No newline at end of file
+CORS_ORIGINS=?
+
+# Auth allowlist (optional)
+# - If both are empty, sign-in is unrestricted.
+# - ALLOWED_EMAILS: exact email allowlist.
+# - ALLOWED_EMAIL_DOMAINS: domain allowlist (e.g. berkeley.edu).
+ALLOWED_EMAILS=? # optional
+ALLOWED_EMAIL_DOMAINS=? # optional
\ No newline at end of file
diff --git a/server/go.mod b/server/go.mod
index 2cbc99600..852735327 100644
--- a/server/go.mod
+++ b/server/go.mod
@@ -21,7 +21,7 @@ require (
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 )
 
-require github.com/stripe/stripe-go/v82 v82.0.0 // indirect
+require github.com/stripe/stripe-go/v82 v82.0.0
 
 require (
 	cloud.google.com/go/compute v1.23.3 // indirect
diff --git a/server/go.sum b/server/go.sum
index 500c2fca5..84cbf3e50 100644
--- a/server/go.sum
+++ b/server/go.sum
@@ -10,8 +10,6 @@ cloud.google.com/go/iam v1.1.5/go.mod h1:rB6P/Ic3mykPbFio+vo7403drjlgvoWfYpJhMXE
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
-github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
-github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 h1:JYp7IbQjafoB+tBA3gMyHYHrpOtNuDiK/uB5uXxq5wM=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/brianvoe/sjwt v0.5.1 h1:OKwnUrrVMnP81N9S5+ylgZECUEwW4Uw6W6J0FgcIZfw=
@@ -89,7 +87,6 @@ github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91
 github.com/go-playground/validator/v10 v10.10.0/go.mod h1:74x4gJWsvQexRdW8Pn3dXSGrTK4nAUsbPlLADvpJkos=
 github.com/go-playground/validator/v10 v10.15.0 h1:nDU5XeOKtB3GEa+uB7GNYwhVKsgjAR7VgKoNB6ryXfw=
 github.com/go-playground/validator/v10 v10.15.0/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/goccy/go-json v0.9.7/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
 github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
@@ -187,7 +184,6 @@ github.com/pelletier/go-toml/v2 v2.0.1/go.mod h1:r9LEWfGN8R5k0VXJ+0BkIe7MYkRdwZO
 github.com/pelletier/go-toml/v2 v2.0.9 h1:uH2qQXheeefCCkuBBSLi7jCiSmj3VRh2+Goq2N7Xxu0=
 github.com/pelletier/go-toml/v2 v2.0.9/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -256,8 +252,6 @@ golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
-golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
 golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
 golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -277,8 +271,6 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
-golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
 golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
@@ -303,8 +295,6 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
-golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
 golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
diff --git a/server/routes/auth.go b/server/routes/auth.go
index a894a1bb3..4b5731054 100644
--- a/server/routes/auth.go
+++ b/server/routes/auth.go
@@ -4,12 +4,14 @@ package routes
 import (
 	"context"
 	"crypto/rand"
+	"errors"
 	"fmt"
 	"math/big"
 	"net/http"
 	"os"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gin-contrib/sessions"
@@ -30,6 +32,19 @@ import (
 	"schej.it/server/utils"
 )
 
+var errEmailNotAllowed = errors.New("email is not allowed for this deployment")
+
+var allowedEmailState = struct {
+	sync.RWMutex
+	rawEmails      string
+	rawDomains     string
+	allowedEmails  map[string]struct{}
+	allowedDomains map[string]struct{}
+}{
+	allowedEmails:  map[string]struct{}{},
+	allowedDomains: map[string]struct{}{},
+}
+
 func InitAuth(router *gin.RouterGroup) {
 	authRouter := router.Group("/auth")
 
@@ -43,6 +58,66 @@ func InitAuth(router *gin.RouterGroup) {
 	authRouter.POST("/otp/verify", verifyOtp)
 }
 
+func isAllowedEmail(email string) bool {
+	email = utils.NormalizeEmail(email)
+
+	rawEmails := os.Getenv("ALLOWED_EMAILS")
+	rawDomains := os.Getenv("ALLOWED_EMAIL_DOMAINS")
+	refreshAllowlistCache(rawEmails, rawDomains)
+
+	allowedEmailState.RLock()
+	defer allowedEmailState.RUnlock()
+
+	if len(allowedEmailState.allowedEmails) == 0 && len(allowedEmailState.allowedDomains) == 0 {
+		// Empty means unrestricted.
+		return true
+	}
+
+	if _, ok := allowedEmailState.allowedEmails[email]; ok {
+		return true
+	}
+
+	atIdx := strings.LastIndex(email, "@")
+	if atIdx == -1 || atIdx == len(email)-1 {
+		return false
+	}
+	emailDomain := email[atIdx+1:]
+	_, ok := allowedEmailState.allowedDomains[emailDomain]
+	return ok
+}
+
+func refreshAllowlistCache(rawEmails string, rawDomains string) {
+	allowedEmailState.RLock()
+	if rawEmails == allowedEmailState.rawEmails && rawDomains == allowedEmailState.rawDomains {
+		allowedEmailState.RUnlock()
+		return
+	}
+	allowedEmailState.RUnlock()
+
+	allowedEmailState.Lock()
+	defer allowedEmailState.Unlock()
+
+	if rawEmails == allowedEmailState.rawEmails && rawDomains == allowedEmailState.rawDomains {
+		return
+	}
+
+	allowedEmailState.rawEmails = rawEmails
+	allowedEmailState.rawDomains = rawDomains
+	allowedEmailState.allowedEmails = parseAllowlist(rawEmails)
+	allowedEmailState.allowedDomains = parseAllowlist(rawDomains)
+}
+
+func parseAllowlist(raw string) map[string]struct{} {
+	result := make(map[string]struct{})
+	for _, entry := range strings.Split(raw, ",") {
+		normalized := utils.NormalizeEmail(entry)
+		if normalized != "" {
+			result[normalized] = struct{}{}
+		}
+	}
+	return result
+}
+
 // @Summary Signs user in
 // @Description Signs user in and sets the access token session variable
 // @Tags auth
@@ -67,6 +142,13 @@ func signIn(c *gin.Context) {
 
 	user, err := signInHelper(c, tokens, models.WEB, payload.CalendarType, *payload.TimezoneOffset)
 	if err != nil {
+		if errors.Is(err, errEmailNotAllowed) {
+			c.JSON(http.StatusForbidden, gin.H{
+				"error":   "email-not-allowed",
+				"message": "sign-in is restricted for this email address",
+			})
+			return
+		}
 		c.JSON(http.StatusUnauthorized, responses.Error{Error: errs.InvalidIdToken})
 		return
 	}
@@ -119,6 +201,13 @@ func signInMobile(c *gin.Context) {
 		payload.TimezoneOffset,
 	)
 	if err != nil {
+		if errors.Is(err, errEmailNotAllowed) {
+			c.JSON(http.StatusForbidden, gin.H{
+				"error":   "email-not-allowed",
+				"message": "sign-in is restricted for this email address",
+			})
+			return
+		}
 		c.JSON(http.StatusUnauthorized, responses.Error{Error: errs.InvalidIdToken})
 		return
 	}
@@ -170,6 +259,9 @@ func signInHelper(c *gin.Context, token auth.TokenResponse, tokenOrigin models.T
 		picture = ""
 	}
 	email = utils.NormalizeEmail(email)
+	if !isAllowedEmail(email) {
+		return models.User{}, errEmailNotAllowed
+	}
 
 	primaryAccountKey := utils.GetCalendarAccountKey(email, calendarType)
 
@@ -344,7 +436,14 @@ func checkEmail(c *gin.Context) {
 		return
 	}
 
-	email := strings.ToLower(strings.TrimSpace(payload.Email))
+	email := utils.NormalizeEmail(payload.Email)
+	if !isAllowedEmail(email) {
+		c.JSON(http.StatusForbidden, gin.H{
+			"error":   "email-not-allowed",
+			"message": "sign-in is restricted for this email address",
+		})
+		return
+	}
 	isNewUser := db.GetUserByEmail(email) == nil
 
 	c.JSON(http.StatusOK, gin.H{"isNewUser": isNewUser})
@@ -365,7 +464,14 @@ func sendOtp(c *gin.Context) {
 		return
 	}
 
-	email := strings.ToLower(strings.TrimSpace(payload.Email))
+	email := utils.NormalizeEmail(payload.Email)
+	if !isAllowedEmail(email) {
+		c.JSON(http.StatusForbidden, gin.H{
+			"error":   "email-not-allowed",
+			"message": "sign-in is restricted for this email address",
+		})
+		return
+	}
 
 	// Delete any existing OTP codes for this email
 	db.OtpCodesCollection.DeleteMany(context.Background(), bson.M{"email": email})
@@ -414,7 +520,14 @@ func verifyOtp(c *gin.Context) {
 		return
 	}
 
-	email := strings.ToLower(strings.TrimSpace(payload.Email))
+	email := utils.NormalizeEmail(payload.Email)
+	if !isAllowedEmail(email) {
+		c.JSON(http.StatusForbidden, gin.H{
+			"error":   "email-not-allowed",
+			"message": "sign-in is restricted for this email address",
+		})
+		return
+	}
 
 	// Find the OTP document
 	var otpDoc models.OtpCode
diff --git a/server/routes/auth_allowlist_test.go b/server/routes/auth_allowlist_test.go
new file mode 100644
index 000000000..ef5f3df8a
--- /dev/null
+++ b/server/routes/auth_allowlist_test.go
@@ -0,0 +1,52 @@
+package routes
+
+import "testing"
+
+func resetAllowedEmailStateForTests() {
+	allowedEmailState.Lock()
+	defer allowedEmailState.Unlock()
+	allowedEmailState.rawEmails = ""
+	allowedEmailState.rawDomains = ""
+	allowedEmailState.allowedEmails = map[string]struct{}{}
+	allowedEmailState.allowedDomains = map[string]struct{}{}
+}
+
+func TestIsAllowedEmail_Unrestricted(t *testing.T) {
+	resetAllowedEmailStateForTests()
+	t.Setenv("ALLOWED_EMAILS", "")
+	t.Setenv("ALLOWED_EMAIL_DOMAINS", "")
+
+	if !isAllowedEmail("anyone@example.com") {
+		t.Fatal("expected unrestricted mode to allow any email")
+	}
+}
+
+func TestIsAllowedEmail_AllowsExactEmail(t *testing.T) {
+	resetAllowedEmailStateForTests()
+	t.Setenv("ALLOWED_EMAILS", "Person@One.com, someone@else.com")
+	t.Setenv("ALLOWED_EMAIL_DOMAINS", "")
+
+	if !isAllowedEmail("person@one.com") {
+		t.Fatal("expected exact email allowlist match")
+	}
+}
+
+func TestIsAllowedEmail_AllowsDomain(t *testing.T) {
+	resetAllowedEmailStateForTests()
+	t.Setenv("ALLOWED_EMAILS", "")
+	t.Setenv("ALLOWED_EMAIL_DOMAINS", "berkeley.edu, example.org")
+
+	if !isAllowedEmail("user@berkeley.edu") {
+		t.Fatal("expected domain allowlist match")
+	}
+}
+
+func TestIsAllowedEmail_RejectsUnknownEmail(t *testing.T) {
+	resetAllowedEmailStateForTests()
+	t.Setenv("ALLOWED_EMAILS", "allowed@other.com")
+	t.Setenv("ALLOWED_EMAIL_DOMAINS", "berkeley.edu")
+
+	if isAllowedEmail("blocked@example.com") {
+		t.Fatal("expected unknown email and domain to be rejected")
+	}
+}
diff --git a/server/routes/users.go b/server/routes/users.go
index 715a050d9..06397cc08 100644
--- a/server/routes/users.go
+++ b/server/routes/users.go
@@ -32,17 +32,7 @@ func getIsUserPremium(c *gin.Context) {
 		c.JSON(http.StatusOK, gin.H{"isPremium": false})
 		return
 	}
-
-	isPremium := false
-	if user.StripeCustomerId != nil {
-		if user.IsPremium != nil {
-			isPremium = *user.IsPremium
-		} else {
-			isPremium = true
-		}
-	}
-
-	c.JSON(http.StatusOK, gin.H{"isPremium": isPremium})
+	c.JSON(http.StatusOK, gin.H{"isPremium": true})
 }
 
 // @Summary Returns a minimal public user profile (safe for unauthenticated clients)