diff --git a/client/src/components/admin/LumaGuestsSection.tsx b/client/src/components/admin/LumaGuestsSection.tsx
new file mode 100644
index 0000000..9e2bad6
--- /dev/null
+++ b/client/src/components/admin/LumaGuestsSection.tsx
@@ -0,0 +1,268 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { Loader2, RefreshCw, Trash2, Plus, Check, AlertTriangle } from "lucide-react";
+import { useToast } from "@/hooks/use-toast";
+import { api, type ApiProgram, type ApiProgramSignup, type AdminAuthArg, ApiError } from "@/lib/api";
+
+interface Props {
+  program: ApiProgram;
+  signAuthHeader: () => Promise<AdminAuthArg>;
+  /** Reflect saved event id / sync state back into the parent program state. */
+  onProgramChange?: (patch: Partial<ApiProgram>) => void;
+}
+
+const relativeTime = (iso?: string | null) => {
+  if (!iso) return "NEVER";
+  const ms = Date.now() - new Date(iso).getTime();
+  if (!Number.isFinite(ms) || ms < 0) return "JUST NOW";
+  const mins = Math.floor(ms / 60000);
+  if (mins < 1) return "JUST NOW";
+  if (mins < 60) return `${mins} MIN AGO`;
+  const hrs = Math.floor(mins / 60);
+  if (hrs < 24) return `${hrs} HR AGO`;
+  return `${Math.floor(hrs / 24)} DAY AGO`;
+};
+
+const errMessage = (e: unknown) =>
+  e instanceof ApiError ? e.message : (e as Error)?.message || "Unknown error";
+
+// Admin guest panel for Luma-gated programs. Replaces the CSV uploader: the
+// checked-in list is pulled from the Luma API on demand, with a manual single
+// email add as the event-day fallback.
+export function LumaGuestsSection({ program, signAuthHeader, onProgramChange }: Props) {
+  const { toast } = useToast();
+  const slug = program.slug;
+
+  const [eventId, setEventId] = useState(program.lumaEventId ?? "");
+  const [savingEventId, setSavingEventId] = useState(false);
+  const [syncing, setSyncing] = useState(false);
+
+  const [lumaCount, setLumaCount] = useState<number | null>(null);
+  const [manual, setManual] = useState<ApiProgramSignup[]>([]);
+  const [loading, setLoading] = useState(true);
+
+  const [newEmail, setNewEmail] = useState("");
+  const [newName, setNewName] = useState("");
+  const [adding, setAdding] = useState(false);
+  const [busyId, setBusyId] = useState<string | null>(null);
+
+  const load = useCallback(() => {
+    let active = true;
+    setLoading(true);
+    (async () => {
+      try {
+        const auth = await signAuthHeader();
+        const r = await api.listProgramSignups(slug, auth);
+        if (!active) return;
+        setLumaCount(r.data.filter((s) => s.source === "luma_api").length);
+        setManual(r.data.filter((s) => s.source === "manual"));
+      } catch (e) {
+        if (active) toast({ title: "Couldn't load guests", description: errMessage(e), variant: "destructive" });
+      } finally {
+        if (active) setLoading(false);
+      }
+    })();
+    return () => {
+      active = false;
+    };
+  }, [slug, signAuthHeader, toast]);
+
+  useEffect(() => load(), [load]);
+
+  const hasEventId = Boolean(program.lumaEventId);
+  const eventIdDirty = eventId.trim() !== (program.lumaEventId ?? "");
+
+  const status = program.lastGuestSyncStatus;
+  const statusBad = typeof status === "string" && (status.startsWith("error") || status === "truncated" || status === "empty_guard");
+
+  const saveEventId = async () => {
+    setSavingEventId(true);
+    try {
+      const auth = await signAuthHeader();
+      const r = await api.updateProgram(slug, { lumaEventId: eventId.trim() || null }, auth);
+      onProgramChange?.({ lumaEventId: r.data.lumaEventId ?? null });
+      toast({ title: "Luma event id saved" });
+    } catch (e) {
+      toast({ title: "Couldn't save event id", description: errMessage(e), variant: "destructive" });
+    } finally {
+      setSavingEventId(false);
+    }
+  };
+
+  const syncNow = async () => {
+    setSyncing(true);
+    try {
+      const auth = await signAuthHeader();
+      const r = await api.syncProgramGuests(slug, auth);
+      setLumaCount(r.data.checkedInCount);
+      onProgramChange?.({ lastGuestSyncAt: r.data.syncedAt, lastGuestSyncStatus: r.data.syncStatus });
+      if (r.data.syncStatus === "ok") {
+        toast({ title: `Synced ${r.data.checkedInCount} checked-in guests` });
+      } else {
+        toast({
+          title: "Sync returned a warning",
+          description: `Status: ${r.data.syncStatus}. Last good list kept.`,
+          variant: "destructive",
+        });
+      }
+    } catch (e) {
+      toast({ title: "Sync failed", description: errMessage(e), variant: "destructive" });
+    } finally {
+      setSyncing(false);
+    }
+  };
+
+  const addManual = async () => {
+    const email = newEmail.trim();
+    if (!email) return;
+    setAdding(true);
+    try {
+      const auth = await signAuthHeader();
+      const r = await api.addProgramSignup(slug, { email, name: newName.trim() || null }, auth);
+      setManual((prev) => [r.data, ...prev.filter((m) => m.id !== r.data.id)]);
+      setNewEmail("");
+      setNewName("");
+      toast({ title: `Added ${r.data.email}` });
+    } catch (e) {
+      toast({ title: "Couldn't add email", description: errMessage(e), variant: "destructive" });
+    } finally {
+      setAdding(false);
+    }
+  };
+
+  const removeManual = async (id: string) => {
+    setBusyId(id);
+    try {
+      const auth = await signAuthHeader();
+      await api.deleteProgramSignup(slug, id, auth);
+      setManual((prev) => prev.filter((m) => m.id !== id));
+      toast({ title: "Removed" });
+    } catch (e) {
+      toast({ title: "Couldn't remove", description: errMessage(e), variant: "destructive" });
+    } finally {
+      setBusyId(null);
+    }
+  };
+
+  const countLabel = useMemo(() => (lumaCount === null ? "…" : String(lumaCount)), [lumaCount]);
+
+  return (
+    <div className="panel p-4 mb-3">
+      <div className="flex items-center justify-between mb-3 pb-3 border-b border-hairline-subtle">
+        <div className="flex items-center gap-3 flex-wrap">
+          <span className="label-hw text-display">·LUMA-APPROVED GUESTS</span>
+          <span className="lcd px-2 py-[1px] font-mono text-[10px] text-display tabular-nums" title="Checked-in guests synced from Luma">
+            {countLabel} CHECKED-IN
+          </span>
+          <span className={statusBad ? "label-hw text-amber-500" : "label-hw-dim"}>
+            ·SYNCED {relativeTime(program.lastGuestSyncAt)}
+            {statusBad ? ` (${status})` : ""}
+          </span>
+        </div>
+        <span className="label-hw-dim">LUMA API</span>
+      </div>
+
+      {/* Luma event id */}
+      <div className="lcd p-3 mb-3 space-y-2">
+        <label htmlFor="luma-event-id" className="label-hw-dim block">
+          ·LUMA EVENT ID
+        </label>
+        <div className="flex flex-wrap items-center gap-2">
+          <input
+            id="luma-event-id"
+            value={eventId}
+            onChange={(e) => setEventId(e.target.value)}
+            placeholder="evt-XXXXXXXXXXXX"
+            className="flex-1 min-w-[220px] bg-panel-deep border border-hairline px-2 py-1.5 font-mono text-[12px] text-display placeholder:text-label-dim"
+          />
+          <button
+            type="button"
+            onClick={saveEventId}
+            disabled={!eventIdDirty || savingEventId}
+            className="inline-flex items-center gap-1.5 font-mono text-[10px] tracking-[0.14em] border border-display bg-display text-shell hover:bg-display-dim disabled:bg-panel-deep disabled:text-label-dim disabled:border-hairline px-3 py-1.5"
+          >
+            {savingEventId ? <Loader2 className="h-3 w-3 animate-spin" /> : <Check className="h-3 w-3" />}
+            SAVE
+          </button>
+          <button
+            type="button"
+            onClick={syncNow}
+            disabled={!hasEventId || syncing}
+            className="inline-flex items-center gap-1.5 font-mono text-[10px] tracking-[0.14em] border border-hairline text-display hover:bg-panel-deep disabled:opacity-50 px-3 py-1.5"
+          >
+            {syncing ? <Loader2 className="h-3 w-3 animate-spin" /> : <RefreshCw className="h-3 w-3" />}
+            SYNC NOW
+          </button>
+        </div>
+        <p className="label-hw-dim">
+          THE CHECKED-IN GUEST LIST IS PULLED FROM LUMA. SUBMISSIONS ALSO TRIGGER A SYNC AUTOMATICALLY.
+          {!hasEventId ? " SET AN EVENT ID TO ACTIVATE THE GATE." : ""}
+        </p>
+      </div>
+
+      {/* Manual fallback add */}
+      <div className="lcd p-3 mb-3 space-y-2">
+        <div className="flex items-center gap-2">
+          <AlertTriangle className="h-3 w-3 text-label-mid" />
+          <span className="label-hw-dim">·MANUAL ADD (FALLBACK)</span>
+        </div>
+        <div className="flex flex-wrap items-center gap-2">
+          <input
+            value={newEmail}
+            onChange={(e) => setNewEmail(e.target.value)}
+            type="email"
+            placeholder="email@checked-in.com"
+            className="flex-1 min-w-[200px] bg-panel-deep border border-hairline px-2 py-1.5 font-mono text-[12px] text-display placeholder:text-label-dim"
+          />
+          <input
+            value={newName}
+            onChange={(e) => setNewName(e.target.value)}
+            placeholder="name (optional)"
+            className="w-[160px] bg-panel-deep border border-hairline px-2 py-1.5 font-mono text-[12px] text-display placeholder:text-label-dim"
+          />
+          <button
+            type="button"
+            onClick={addManual}
+            disabled={!newEmail.trim() || adding}
+            className="inline-flex items-center gap-1.5 font-mono text-[10px] tracking-[0.14em] border border-hairline text-display hover:bg-panel-deep disabled:opacity-50 px-3 py-1.5"
+          >
+            {adding ? <Loader2 className="h-3 w-3 animate-spin" /> : <Plus className="h-3 w-3" />}
+            ADD
+          </button>
+        </div>
+        <p className="label-hw-dim">
+          USE FOR ATTENDEES LUMA CAN'T COVER (CHECKED IN ON ANOTHER DEVICE, REGISTERED WITH A DIFFERENT EMAIL).
+        </p>
+      </div>
+
+      {/* Manual entries list (Luma-synced rows are not listed to minimize stored PII on screen) */}
+      {loading ? (
+        <div className="flex items-center gap-2 label-hw-dim py-2">
+          <Loader2 className="h-3 w-3 animate-spin" /> LOADING…
+        </div>
+      ) : manual.length === 0 ? (
+        <p className="label-hw-dim">·NO MANUAL ENTRIES.</p>
+      ) : (
+        <div className="space-y-1.5">
+          <div className="label-hw-dim">·MANUAL ENTRIES ({manual.length})</div>
+          {manual.map((m) => (
+            <div key={m.id} className="lcd px-3 py-2 flex items-center justify-between gap-3">
+              <div className="min-w-0">
+                <div className="font-mono text-[12px] text-display truncate">{m.email}</div>
+                {m.name ? <div className="label-hw-dim truncate">{m.name}</div> : null}
+              </div>
+              <button
+                type="button"
+                onClick={() => removeManual(m.id)}
+                disabled={busyId === m.id}
+                aria-label="Remove manual entry"
+                className="inline-flex items-center justify-center border border-hairline text-label-mid hover:text-destructive hover:border-destructive hover:bg-panel-deep disabled:opacity-50 w-7 h-7 flex-shrink-0"
+              >
+                {busyId === m.id ? <Loader2 className="h-3 w-3 animate-spin" /> : <Trash2 className="h-3 w-3" />}
+              </button>
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/client/src/components/program/SubmitProjectModal.tsx b/client/src/components/program/SubmitProjectModal.tsx
index c31d744..0ebeb53 100644
--- a/client/src/components/program/SubmitProjectModal.tsx
+++ b/client/src/components/program/SubmitProjectModal.tsx
@@ -343,6 +343,11 @@ export function SubmitProjectModal({
                   className="hidden"
                 />
               </div>
+              {submitting && (
+                <p className="font-mono text-[10px] tracking-[0.14em] text-label-mid text-center pt-1" role="status" aria-live="polite">
+                  CHECKING YOU AGAINST THE LUMA GUEST LIST. THIS CAN TAKE A FEW SECONDS.
+                </p>
+              )}
               <DialogFooter>
                 <button
                   type="button"
@@ -360,7 +365,7 @@ export function SubmitProjectModal({
                 >
                   {submitting ? (
                     <>
-                      <Loader2 className="h-3 w-3 animate-spin" aria-hidden="true" /> SUBMITTING…
+                      <Loader2 className="h-3 w-3 animate-spin" aria-hidden="true" /> VERIFYING CHECK-IN…
                     </>
                   ) : (
                     "SUBMIT PROJECT ▸"
diff --git a/client/src/lib/api.ts b/client/src/lib/api.ts
index 41a70bc..18e3bd9 100644
--- a/client/src/lib/api.ts
+++ b/client/src/lib/api.ts
@@ -421,10 +421,26 @@ export type ApiProgram = {
   prizeTiers?: ApiPrizeTier[] | null;
   /** Set when a platform admin publishes results to the public program page. */
   resultsPublishedAt?: string | null;
+  /** Luma event id (evt-…). When set + server has LUMA_API_KEY, the submit gate
+   *  verifies emails against the event's checked-in guests synced from Luma. */
+  lumaEventId?: string | null;
+  /** Last time the checked-in guest list was synced from Luma (admin display). */
+  lastGuestSyncAt?: string | null;
+  /** Outcome of the last sync: 'ok' | 'truncated' | 'empty_guard' | 'error:…'. */
+  lastGuestSyncStatus?: string | null;
   createdAt?: string;
   updatedAt?: string;
 };
 
+/** Result of a manual "Sync now" against the Luma API. */
+export type ProgramGuestSyncResult = {
+  syncStatus: string;
+  checkedInCount: number;
+  syncedAt: string;
+  upserted: number;
+  removed: number;
+};
+
 /** At-a-glance counts for the program admin/judge header (no PII). */
 export type ApiProgramStats = { confirmedParticipants: number; submissionsCount: number };
 
@@ -1528,6 +1544,61 @@ export const api = {
     return { status: "success" };
   },
 
+  // --- Luma guest sync (replaces CSV for Luma-gated programs) ---
+
+  /** Pull the event's checked-in guests from Luma into program_signups now. */
+  syncProgramGuests: async (
+    slug: string,
+    authHeader?: AdminAuthArg,
+  ): Promise<{ status: string; data: ProgramGuestSyncResult }> => {
+    if (USE_MOCK_DATA) {
+      return {
+        status: "success",
+        data: {
+          syncStatus: "ok",
+          checkedInCount: 0,
+          syncedAt: new Date().toISOString(),
+          upserted: 0,
+          removed: 0,
+        },
+      };
+    }
+    return request(`/programs/${encodeURIComponent(slug)}/signups/sync`, {
+      method: "POST",
+      headers: adminAuthHeaders(authHeader),
+    });
+  },
+
+  /** Manually add a single checked-in email (event-day fallback). Idempotent. */
+  addProgramSignup: async (
+    slug: string,
+    payload: { email: string; name?: string | null },
+    authHeader?: AdminAuthArg,
+  ): Promise<{ status: string; data: ApiProgramSignup }> => {
+    if (USE_MOCK_DATA) {
+      const { mockProgramSignups } = await import("./mockPrograms");
+      const row: ApiProgramSignup = {
+        id: `manual-${Date.now()}`,
+        programId: slug,
+        email: payload.email.trim().toLowerCase(),
+        name: payload.name ?? null,
+        wallet: null,
+        registeredAt: null,
+        source: "manual",
+        rawRow: null,
+        importedInBatchAt: new Date().toISOString(),
+        createdAt: new Date().toISOString(),
+      };
+      mockProgramSignups[slug] = [row, ...(mockProgramSignups[slug] || [])];
+      return { status: "success", data: row };
+    }
+    return request(`/programs/${encodeURIComponent(slug)}/signups`, {
+      method: "POST",
+      headers: { ...adminAuthHeaders(authHeader), "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+    });
+  },
+
   /**
    * Phase 2 revamp: admin create project (issue #80).
    */
diff --git a/client/src/pages/AdminProgramPage.tsx b/client/src/pages/AdminProgramPage.tsx
index 7bf2edd..e40613d 100644
--- a/client/src/pages/AdminProgramPage.tsx
+++ b/client/src/pages/AdminProgramPage.tsx
@@ -19,6 +19,7 @@ import { ProgramStatsHeader } from "@/components/admin/ProgramStatsHeader";
 import { ProgramFormModal } from "@/components/admin/ProgramFormModal";
 import { ProgramSponsorsSection } from "@/components/admin/ProgramSponsorsSection";
 import { ProgramSignupsSection } from "@/components/admin/ProgramSignupsSection";
+import { LumaGuestsSection } from "@/components/admin/LumaGuestsSection";
 import { ProgramAuditLogSection } from "@/components/admin/ProgramAuditLogSection";
 import { useToast } from "@/hooks/use-toast";
 import { cn } from "@/lib/utils";
@@ -371,11 +372,18 @@ const AdminProgramPage = () => {
                   />
                 )}
 
-                <ProgramSignupsSection
-                  programSlug={program.slug}
-                  signAuthHeader={getAdminAuth}
-                  title={program.programType === "hackathon" ? "·LUMA-APPROVED GUESTS" : undefined}
-                />
+                {program.programType === "hackathon" ? (
+                  <LumaGuestsSection
+                    program={program}
+                    signAuthHeader={getAdminAuth}
+                    onProgramChange={(patch) => setProgram((p) => (p ? { ...p, ...patch } : p))}
+                  />
+                ) : (
+                  <ProgramSignupsSection
+                    programSlug={program.slug}
+                    signAuthHeader={getAdminAuth}
+                  />
+                )}
 
                 {program.programType !== "hackathon" && (
                   <ProgramAuditLogSection
@@ -480,11 +488,18 @@ const AdminProgramPage = () => {
                     {program.programType !== "hackathon" && (
                       <ProgramSponsorsSection programSlug={program.slug} signAuthHeader={getJudgeAuth} />
                     )}
-                    <ProgramSignupsSection
-                      programSlug={program.slug}
-                      signAuthHeader={getJudgeAuth}
-                      title={program.programType === "hackathon" ? "·LUMA-APPROVED GUESTS" : undefined}
-                    />
+                    {program.programType === "hackathon" ? (
+                      <LumaGuestsSection
+                        program={program}
+                        signAuthHeader={getJudgeAuth}
+                        onProgramChange={(patch) => setProgram((p) => (p ? { ...p, ...patch } : p))}
+                      />
+                    ) : (
+                      <ProgramSignupsSection
+                        programSlug={program.slug}
+                        signAuthHeader={getJudgeAuth}
+                      />
+                    )}
                   </>
                 )}
 
diff --git a/server/.env.example b/server/.env.example
index 791255d..e2433ee 100644
--- a/server/.env.example
+++ b/server/.env.example
@@ -58,6 +58,20 @@ PRIZE_CONTACT_EMAIL=
 #   SUBMIT_TEST_EMAILS=sacha@joinwebzero.com
 SUBMIT_TEST_EMAILS=
 
+# Optional: Luma public API key (https://docs.luma.com). When set AND a program
+# has a luma_event_id, the submit gate verifies the email against the event's
+# CHECKED-IN guests, mirrored from Luma into program_signups (no CSV upload).
+# Requires a Luma Plus subscription on the calendar. Leave empty to keep the
+# CSV / SUBMIT_TEST_EMAILS gate behavior.
+LUMA_API_KEY=
+
+# Which Luma guests count as eligible to submit. 'checked_in' (default) requires
+# a physical check-in (in-person events). 'approved' accepts any approved
+# registrant — use it to dry-run the submit flow BEFORE an event starts, when
+# nobody is checked in yet.
+#   LUMA_GATE_MODE=approved
+LUMA_GATE_MODE=
+
 # Public base URL of the client, used to build links in outbound email (e.g. the
 # program-admin onboarding link). Defaults to the prod URL if unset.
 FRONTEND_URL=https://stadium.joinwebzero.com
diff --git a/server/api/controllers/__tests__/submission.controller.test.js b/server/api/controllers/__tests__/submission.controller.test.js
index 8b94c3c..89fb107 100644
--- a/server/api/controllers/__tests__/submission.controller.test.js
+++ b/server/api/controllers/__tests__/submission.controller.test.js
@@ -34,6 +34,9 @@ vi.mock('../../services/program-audit-log.service.js', () => ({ default: { logSa
 vi.mock('../../services/prize-award.service.js', () => ({
   default: { notifyWinners: vi.fn() },
 }));
+vi.mock('../../services/luma-sync.service.js', () => ({
+  default: { isActive: vi.fn(() => false), syncProgram: vi.fn() },
+}));
 
 const programService = (await import('../../services/program.service.js')).default;
 const scoringService = (await import('../../services/scoring.service.js')).default;
@@ -44,6 +47,7 @@ const scoreRepo = (await import('../../repositories/submission-score.repository.
 const signupRepo = (await import('../../repositories/program-signup.repository.js')).default;
 const confirmationService = (await import('../../services/submission-confirmation.service.js')).default;
 const prizeAwardService = (await import('../../services/prize-award.service.js')).default;
+const lumaSyncService = (await import('../../services/luma-sync.service.js')).default;
 const submissionController = (await import('../submission.controller.js')).default;
 
 const mockRes = () => {
@@ -173,6 +177,65 @@ describe('SubmissionController.submit (public)', () => {
   });
 });
 
+describe('SubmissionController.submit — Luma-gated JIT verification', () => {
+  // A program whose gate is backed by the Luma API (event id set + key present).
+  const LUMA_PROGRAM = { ...PROGRAM, lumaEventId: 'evt-1', lastGuestSyncAt: null, lastGuestSyncStatus: null };
+
+  it('cache-miss → JIT sync finds the just-checked-in email → 201', async () => {
+    programService.findBySlug.mockResolvedValue(LUMA_PROGRAM);
+    lumaSyncService.isActive.mockReturnValue(true);
+    // absent before the sync, present after it
+    signupRepo.existsByEmail.mockResolvedValueOnce(false).mockResolvedValueOnce(true);
+    lumaSyncService.syncProgram.mockResolvedValue({ status: 'ok' });
+    submissionRepo.findByEmail.mockResolvedValue(null);
+    submissionRepo.create.mockResolvedValue({ submission: { id: 'x', lumaEmail: 'ada@example.com' }, duplicate: false });
+    confirmationService.send.mockResolvedValue({ ok: true });
+
+    const res = mockRes();
+    await submissionController.submit({ params: { slug: 'bitrefill' }, body: GOOD_BODY }, res);
+    expect(lumaSyncService.syncProgram).toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(201);
+  });
+
+  it('cache-miss + Luma unreachable (sync error) → 503 transient, NOT a 403', async () => {
+    programService.findBySlug.mockResolvedValue(LUMA_PROGRAM);
+    lumaSyncService.isActive.mockReturnValue(true);
+    signupRepo.existsByEmail.mockResolvedValue(false); // absent before and after
+    lumaSyncService.syncProgram.mockResolvedValue({ status: 'error:Luma 429' });
+
+    const res = mockRes();
+    await submissionController.submit({ params: { slug: 'bitrefill' }, body: GOOD_BODY }, res);
+    expect(res.status).toHaveBeenCalledWith(503);
+    expect(submissionRepo.create).not.toHaveBeenCalled();
+  });
+
+  it('cache-miss + healthy sync still absent → 403 definitive', async () => {
+    programService.findBySlug.mockResolvedValue(LUMA_PROGRAM);
+    lumaSyncService.isActive.mockReturnValue(true);
+    signupRepo.existsByEmail.mockResolvedValue(false);
+    lumaSyncService.syncProgram.mockResolvedValue({ status: 'ok' });
+
+    const res = mockRes();
+    await submissionController.submit({ params: { slug: 'bitrefill' }, body: GOOD_BODY }, res);
+    expect(res.status).toHaveBeenCalledWith(403);
+  });
+
+  it('recently synced (within floor) + last sync errored → 503 without re-syncing', async () => {
+    programService.findBySlug.mockResolvedValue({
+      ...LUMA_PROGRAM,
+      lastGuestSyncAt: new Date().toISOString(), // fresh → inside the JIT floor
+      lastGuestSyncStatus: 'error:Luma 500',
+    });
+    lumaSyncService.isActive.mockReturnValue(true);
+    signupRepo.existsByEmail.mockResolvedValue(false);
+
+    const res = mockRes();
+    await submissionController.submit({ params: { slug: 'bitrefill' }, body: GOOD_BODY }, res);
+    expect(lumaSyncService.syncProgram).not.toHaveBeenCalled();
+    expect(res.status).toHaveBeenCalledWith(503);
+  });
+});
+
 describe('SubmissionController.upsertScore (judge)', () => {
   it('lets a judge re-save a score after submitting (editable, not locked)', async () => {
     ballotRepo.isSubmitted.mockResolvedValue(true); // already submitted
diff --git a/server/api/controllers/program.controller.js b/server/api/controllers/program.controller.js
index e029c5a..d0cecaa 100644
--- a/server/api/controllers/program.controller.js
+++ b/server/api/controllers/program.controller.js
@@ -2,6 +2,7 @@ import programService from '../services/program.service.js';
 import programApplicationService from '../services/program-application.service.js';
 import programSponsorService from '../services/program-sponsor.service.js';
 import programSignupService from '../services/program-signup.service.js';
+import lumaSyncService from '../services/luma-sync.service.js';
 import programInboxService, { inboxToCsv } from '../services/program-inbox.service.js';
 import auditLog from '../services/program-audit-log.service.js';
 import projectService from '../services/project.service.js';
@@ -796,6 +797,78 @@ class ProgramController {
     }
   }
 
+  // Admin: pull the checked-in guest list from Luma now. Mirrors into
+  // program_signups (source='luma_api'). Returns the sync status + counts so the
+  // admin UI can show "synced just now · M checked-in".
+  async syncGuests(req, res) {
+    try {
+      const { slug } = req.params;
+      const program = await programService.findBySlug(slug);
+      if (!program) {
+        return res.status(404).json({ status: 'error', message: 'Program not found' });
+      }
+      if (!program.lumaEventId) {
+        return res.status(422).json({
+          status: 'error',
+          message: 'No Luma event id set for this program. Save one first.',
+        });
+      }
+      if (!lumaSyncService.isActive(program)) {
+        return res.status(503).json({
+          status: 'error',
+          message: 'Luma is not configured on the server (LUMA_API_KEY missing).',
+        });
+      }
+      const result = await lumaSyncService.syncProgram(program);
+      const checkedInCount = await programSignupRepository.countBySource(program.id, 'luma_api');
+      res.status(200).json({
+        status: 'success',
+        data: { ...result, syncStatus: result.status, checkedInCount, syncedAt: new Date().toISOString() },
+      });
+      auditLog.logSafe({
+        programId: program.id,
+        actor: { chain: req.user?.chain, wallet: req.user?.address, email: req.user?.email },
+        action: 'signups.luma_sync',
+        targetType: 'signups_batch',
+        targetId: null,
+        metadata: { syncStatus: result.status, upserted: result.upserted, removed: result.removed },
+      });
+    } catch (error) {
+      console.error('❌ Error syncing Luma guests:', error);
+      res.status(500).json({ status: 'error', message: 'Failed to sync Luma guests' });
+    }
+  }
+
+  // Admin: manually add a single checked-in email (event-day fallback for the
+  // cases Luma can't cover). Idempotent.
+  async addSignup(req, res) {
+    try {
+      const { slug } = req.params;
+      const program = await programService.findBySlug(slug);
+      if (!program) {
+        return res.status(404).json({ status: 'error', message: 'Program not found' });
+      }
+      const email = typeof req.body?.email === 'string' ? req.body.email.trim() : '';
+      const name = typeof req.body?.name === 'string' && req.body.name.trim() ? req.body.name.trim() : null;
+      if (!EMAIL_RE.test(email)) {
+        return res.status(400).json({ status: 'error', message: 'A valid email is required' });
+      }
+      const signup = await programSignupRepository.addManual(program.id, email, name);
+      res.status(201).json({ status: 'success', data: signup });
+      auditLog.logSafe({
+        programId: program.id,
+        actor: { chain: req.user?.chain, wallet: req.user?.address, email: req.user?.email },
+        action: 'signup.manual_add',
+        targetType: 'signup',
+        targetId: signup.id,
+        metadata: { email: signup.email },
+      });
+    } catch (error) {
+      console.error('❌ Error adding signup:', error);
+      res.status(500).json({ status: 'error', message: 'Failed to add signup' });
+    }
+  }
+
   async deleteSignup(req, res) {
     try {
       const { slug, signupId } = req.params;
diff --git a/server/api/controllers/submission.controller.js b/server/api/controllers/submission.controller.js
index 41f20be..e66bc58 100644
--- a/server/api/controllers/submission.controller.js
+++ b/server/api/controllers/submission.controller.js
@@ -8,8 +8,14 @@ import programJudgeBallotRepository from '../repositories/program-judge-ballot.r
 import { validateSubmission, validateScore, validatePrize, prizeTiersFor } from '../utils/submission.validator.js';
 import submissionConfirmationService from '../services/submission-confirmation.service.js';
 import prizeAwardService from '../services/prize-award.service.js';
+import lumaSyncService from '../services/luma-sync.service.js';
 import auditLog from '../services/program-audit-log.service.js';
 
+// On a Luma-gated cache-miss we lazily re-sync, but only if the last sync is
+// older than this floor. Bounds Luma calls when not-on-list emails retry, while
+// keeping the worst-case "checked in seconds ago" wait small.
+const JIT_SYNC_FLOOR_MS = 25 * 1000;
+
 // Winner selection + publishing are platform-admin only. After requireProgramAdmin,
 // a global admin carries isGlobalAdmin === true; per-program admins do not.
 const isPlatformAdmin = (req) => req.user?.isGlobalAdmin === true;
@@ -99,14 +105,41 @@ class SubmissionController {
           .filter(Boolean),
       );
       const submitterEmail = String(v.value.lumaEmail || '').trim().toLowerCase();
-      if (
-        !testEmails.has(submitterEmail) &&
-        !(await programSignupRepository.existsByEmail(program.id, v.value.lumaEmail))
-      ) {
-        return res.status(403).json({
-          status: 'error',
-          message: 'Only checked-in attendees can submit. Use the email you checked in with on Luma.',
-        });
+      if (!testEmails.has(submitterEmail)) {
+        let present = await programSignupRepository.existsByEmail(program.id, submitterEmail);
+        // Luma-gated programs: on a miss, lazily re-sync the checked-in list
+        // (someone may have checked in seconds ago) before deciding. Respect a
+        // floor so repeated not-on-list retries can't hammer Luma. A sync
+        // FAILURE must not be reported to a legit attendee as "not on the list"
+        // — distinguish transient (retry) from definitive (rejected).
+        let transient = false;
+        if (!present && lumaSyncService.isActive(program)) {
+          const lastSync = program.lastGuestSyncAt ? Date.parse(program.lastGuestSyncAt) : 0;
+          const stale = !lastSync || Date.now() - lastSync > JIT_SYNC_FLOOR_MS;
+          if (stale) {
+            const sync = await lumaSyncService.syncProgram(program);
+            transient = sync.status === 'truncated' || String(sync.status).startsWith('error');
+            present = await programSignupRepository.existsByEmail(program.id, submitterEmail);
+          } else {
+            // Synced very recently and still absent → treat the last sync's
+            // health as the verdict's confidence.
+            transient =
+              program.lastGuestSyncStatus === 'truncated' ||
+              String(program.lastGuestSyncStatus || '').startsWith('error');
+          }
+        }
+        if (!present) {
+          if (transient) {
+            return res.status(503).json({
+              status: 'error',
+              message: "Couldn't verify your check-in right now. Please try again in a moment.",
+            });
+          }
+          return res.status(403).json({
+            status: 'error',
+            message: 'Only checked-in attendees can submit. Use the email you checked in with on Luma.',
+          });
+        }
       }
       // Deadline is informational: a submit after event end is flagged late, not blocked.
       const late = !!(program.eventEndsAt && Date.now() > Date.parse(program.eventEndsAt));
diff --git a/server/api/repositories/program-signup.repository.js b/server/api/repositories/program-signup.repository.js
index 0a3a4d6..c565372 100644
--- a/server/api/repositories/program-signup.repository.js
+++ b/server/api/repositories/program-signup.repository.js
@@ -75,6 +75,87 @@ class ProgramSignupRepository {
     return (data || []).map(transformSignup);
   }
 
+  // Reconcile the synced Luma check-in set into program_signups. Upserts every
+  // currently-checked-in guest as source='luma_api', then deletes any prior
+  // 'luma_api' row whose email is no longer in the set. Rows from other sources
+  // ('luma' CSV import, 'manual' admin fallback) are never touched, so the
+  // manual escape hatch survives every sync. Returns { upserted, removed }.
+  //
+  // `guests` is [{ email, name }] (already lowercased + checked-in by the
+  // caller). The caller is responsible for the sanity guard (never call this
+  // with an empty set when the cache is non-empty).
+  async replaceLumaGuests(programId, guests) {
+    const batchAt = new Date().toISOString();
+    const seen = new Set();
+    const payload = [];
+    for (const g of guests) {
+      const email = typeof g.email === 'string' ? g.email.trim().toLowerCase() : '';
+      if (!email || seen.has(email)) continue;
+      seen.add(email);
+      payload.push({
+        program_id: programId,
+        email,
+        name: g.name ?? null,
+        source: 'luma_api',
+        imported_in_batch_at: batchAt,
+      });
+    }
+
+    if (payload.length) {
+      const { error } = await supabase
+        .from('program_signups')
+        .upsert(payload, { onConflict: 'program_id,email' });
+      if (error) throw error;
+    }
+
+    // Remove luma_api rows that fell out of the checked-in set (e.g. a check-in
+    // was undone, or the event id changed). Done in JS membership since
+    // Supabase can't express "delete where email NOT IN (large list)" cleanly.
+    const { data: existing, error: selErr } = await supabase
+      .from('program_signups')
+      .select('id, email')
+      .eq('program_id', programId)
+      .eq('source', 'luma_api');
+    if (selErr) throw selErr;
+    const stale = (existing || []).filter(
+      (r) => !seen.has(String(r.email).trim().toLowerCase()),
+    );
+    let removed = 0;
+    if (stale.length) {
+      const { error: delErr } = await supabase
+        .from('program_signups')
+        .delete()
+        .in('id', stale.map((r) => r.id));
+      if (delErr) throw delErr;
+      removed = stale.length;
+    }
+    return { upserted: payload.length, removed };
+  }
+
+  // Manual single-email add (admin fallback for the event-day edge cases Luma
+  // can't cover). Idempotent: re-adding an existing email is a no-op success.
+  // Returns the row.
+  async addManual(programId, email, name = null) {
+    const normalized = typeof email === 'string' ? email.trim().toLowerCase() : '';
+    if (!normalized) throw new Error('email required');
+    const { data, error } = await supabase
+      .from('program_signups')
+      .upsert(
+        {
+          program_id: programId,
+          email: normalized,
+          name: name ?? null,
+          source: 'manual',
+          imported_in_batch_at: new Date().toISOString(),
+        },
+        { onConflict: 'program_id,email' },
+      )
+      .select('*')
+      .single();
+    if (error) throw error;
+    return transformSignup(data);
+  }
+
   async lastImportedAt(programId) {
     const { data, error } = await supabase
       .from('program_signups')
@@ -106,6 +187,16 @@ class ProgramSignupRepository {
     return false;
   }
 
+  async countBySource(programId, source) {
+    const { count, error } = await supabase
+      .from('program_signups')
+      .select('*', { count: 'exact', head: true })
+      .eq('program_id', programId)
+      .eq('source', source);
+    if (error) throw error;
+    return count ?? 0;
+  }
+
   async countByProgramId(programId) {
     const { count, error } = await supabase
       .from('program_signups')
diff --git a/server/api/repositories/program.repository.js b/server/api/repositories/program.repository.js
index 65146f5..74aa3b4 100644
--- a/server/api/repositories/program.repository.js
+++ b/server/api/repositories/program.repository.js
@@ -22,6 +22,9 @@ const transformProgram = (row) => {
     content: row.content ?? null,
     prizeTiers: row.prize_tiers ?? null,
     resultsPublishedAt: row.results_published_at ?? null,
+    lumaEventId: row.luma_event_id ?? null,
+    lastGuestSyncAt: row.last_guest_sync_at ?? null,
+    lastGuestSyncStatus: row.last_guest_sync_status ?? null,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
   };
@@ -46,6 +49,11 @@ const toSnakeCase = (data) => {
   if ('coverImageUrl' in data) row.cover_image_url = data.coverImageUrl ?? null;
   if ('content' in data) row.content = data.content ?? null;
   if ('prizeTiers' in data) row.prize_tiers = data.prizeTiers ?? null;
+  // Normalize an empty/whitespace luma_event_id to null (gate stays off).
+  if ('lumaEventId' in data) {
+    const v = typeof data.lumaEventId === 'string' ? data.lumaEventId.trim() : data.lumaEventId;
+    row.luma_event_id = v || null;
+  }
   return row;
 };
 
@@ -90,6 +98,18 @@ class ProgramRepository {
     return transformProgram(data);
   }
 
+  // Record the outcome of a Luma guest sync. `status` is a short machine string
+  // ('ok', 'empty_guard', 'truncated', 'error:<reason>') the admin UI surfaces.
+  // We always stamp last_guest_sync_at so the gate's TTL advances even on a
+  // guarded/failed sweep (prevents a hot retry loop on every miss).
+  async setGuestSyncState(programId, { syncedAt, status }) {
+    const { error } = await supabase
+      .from('programs')
+      .update({ last_guest_sync_at: syncedAt, last_guest_sync_status: status })
+      .eq('id', programId);
+    if (error) throw error;
+  }
+
   // Publish/unpublish the public results: set or clear results_published_at.
   async setResultsPublished(slug, publishedAt) {
     const { data, error } = await supabase
diff --git a/server/api/routes/program.routes.js b/server/api/routes/program.routes.js
index 8614ecb..83e4bda 100644
--- a/server/api/routes/program.routes.js
+++ b/server/api/routes/program.routes.js
@@ -147,6 +147,11 @@ router.delete(
 // shared SIWS middleware: parser runs first to produce req.body, then
 // requireProgramAdmin reads x-siws-auth from headers.
 router.get('/:slug/signups', requireProgramViewer('slug'), programController.listSignups);
+// Luma-gated programs: pull checked-in guests from the Luma API instead of a CSV.
+router.post('/:slug/signups/sync', requireProgramAdmin('slug'), programController.syncGuests);
+// Manual single-email add (event-day fallback). Sits before the CSV import and
+// :signupId routes; the static `import`/`sync` segments are matched first.
+router.post('/:slug/signups', requireProgramAdmin('slug'), programController.addSignup);
 router.post(
   '/:slug/signups/import',
   ...csvBody,
diff --git a/server/api/services/__tests__/luma-sync.service.test.js b/server/api/services/__tests__/luma-sync.service.test.js
new file mode 100644
index 0000000..dcbf77d
--- /dev/null
+++ b/server/api/services/__tests__/luma-sync.service.test.js
@@ -0,0 +1,116 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('../luma.client.js', () => ({
+  fetchEligibleGuests: vi.fn(),
+  isConfigured: vi.fn(() => true),
+}));
+vi.mock('../../repositories/program-signup.repository.js', () => ({
+  default: { replaceLumaGuests: vi.fn(), countBySource: vi.fn() },
+}));
+vi.mock('../../repositories/program.repository.js', () => ({
+  default: { setGuestSyncState: vi.fn() },
+}));
+
+const luma = await import('../luma.client.js');
+const signupRepo = (await import('../../repositories/program-signup.repository.js')).default;
+const programRepo = (await import('../../repositories/program.repository.js')).default;
+const service = (await import('../luma-sync.service.js')).default;
+
+const PROGRAM = { id: 'prog-1', slug: 'bitrefill-2026', lumaEventId: 'evt-1' };
+const G = (email) => ({ email, name: null });
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  luma.isConfigured.mockReturnValue(true);
+  signupRepo.replaceLumaGuests.mockResolvedValue({ upserted: 0, removed: 0 });
+  signupRepo.countBySource.mockResolvedValue(0);
+  programRepo.setGuestSyncState.mockResolvedValue();
+});
+
+describe('lumaSyncService.isActive', () => {
+  it('false without an event id', () => {
+    expect(service.isActive({ id: 'p', lumaEventId: null })).toBe(false);
+  });
+  it('false when the server has no LUMA_API_KEY', () => {
+    luma.isConfigured.mockReturnValue(false);
+    expect(service.isActive(PROGRAM)).toBe(false);
+  });
+  it('true with both', () => {
+    expect(service.isActive(PROGRAM)).toBe(true);
+  });
+});
+
+describe('lumaSyncService.syncProgram', () => {
+  it('not_configured short-circuits with no fetch', async () => {
+    luma.isConfigured.mockReturnValue(false);
+    const r = await service.syncProgram(PROGRAM);
+    expect(r.status).toBe('not_configured');
+    expect(luma.fetchEligibleGuests).not.toHaveBeenCalled();
+  });
+
+  it('ok: mirrors the checked-in set and stamps state', async () => {
+    luma.fetchEligibleGuests.mockResolvedValue({
+      total: 3,
+      eligible: [G('a@x.io'), G('b@x.io')],
+      truncated: false,
+    });
+    signupRepo.replaceLumaGuests.mockResolvedValue({ upserted: 2, removed: 0 });
+
+    const r = await service.syncProgram(PROGRAM);
+    expect(r).toMatchObject({ status: 'ok', checkedIn: 2, upserted: 2 });
+    expect(signupRepo.replaceLumaGuests).toHaveBeenCalledWith('prog-1', [G('a@x.io'), G('b@x.io')]);
+    expect(programRepo.setGuestSyncState).toHaveBeenCalledWith(
+      'prog-1',
+      expect.objectContaining({ status: 'ok' }),
+    );
+  });
+
+  it('empty_guard: a 0-result sweep does NOT wipe a non-empty cache', async () => {
+    luma.fetchEligibleGuests.mockResolvedValue({ total: 0, eligible: [], truncated: false });
+    signupRepo.countBySource.mockResolvedValue(120); // cache currently has 120
+
+    const r = await service.syncProgram(PROGRAM);
+    expect(r.status).toBe('empty_guard');
+    expect(signupRepo.replaceLumaGuests).not.toHaveBeenCalled();
+    expect(programRepo.setGuestSyncState).toHaveBeenCalledWith(
+      'prog-1',
+      expect.objectContaining({ status: 'empty_guard' }),
+    );
+  });
+
+  it('0 check-ins is allowed to write when the cache is also empty (pre-event)', async () => {
+    luma.fetchEligibleGuests.mockResolvedValue({ total: 50, eligible: [], truncated: false });
+    signupRepo.countBySource.mockResolvedValue(0);
+
+    const r = await service.syncProgram(PROGRAM);
+    expect(r.status).toBe('ok');
+    expect(signupRepo.replaceLumaGuests).toHaveBeenCalledWith('prog-1', []);
+  });
+
+  it('truncated: never overwrites on a partial sweep', async () => {
+    luma.fetchEligibleGuests.mockResolvedValue({ total: 9999, eligible: [G('a@x.io')], truncated: true });
+    const r = await service.syncProgram(PROGRAM);
+    expect(r.status).toBe('truncated');
+    expect(signupRepo.replaceLumaGuests).not.toHaveBeenCalled();
+  });
+
+  it('error: surfaces error:<msg> and still stamps the timestamp', async () => {
+    luma.fetchEligibleGuests.mockRejectedValue(new Error('Luma 429'));
+    const r = await service.syncProgram(PROGRAM);
+    expect(r.status).toMatch(/^error:/);
+    expect(programRepo.setGuestSyncState).toHaveBeenCalledWith(
+      'prog-1',
+      expect.objectContaining({ status: expect.stringMatching(/^error:/) }),
+    );
+  });
+
+  it('single-flight: concurrent syncs share one Luma sweep', async () => {
+    let resolve;
+    luma.fetchEligibleGuests.mockReturnValue(new Promise((r) => { resolve = r; }));
+    const p1 = service.syncProgram(PROGRAM);
+    const p2 = service.syncProgram(PROGRAM);
+    resolve({ total: 1, eligible: [G('a@x.io')], truncated: false });
+    await Promise.all([p1, p2]);
+    expect(luma.fetchEligibleGuests).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/server/api/services/luma-sync.service.js b/server/api/services/luma-sync.service.js
new file mode 100644
index 0000000..ab00c99
--- /dev/null
+++ b/server/api/services/luma-sync.service.js
@@ -0,0 +1,89 @@
+// Mirrors an event's checked-in Luma guests into program_signups so the
+// submission gate can verify "only checked-in attendees may submit" without us
+// hosting a guest CSV. Pull model: lazy (on a submission cache-miss) + manual
+// ("Sync now"). No background timer — freshness only matters at submit time,
+// which is exactly when the gate triggers a sync. See luma.client.js.
+
+import { fetchEligibleGuests, isConfigured } from './luma.client.js';
+import signupRepository from '../repositories/program-signup.repository.js';
+import programRepository from '../repositories/program.repository.js';
+
+// Which guests count as gate-eligible. Defaults to physical check-in; set
+// LUMA_GATE_MODE=approved to accept approved registrants (e.g. pre-event dry
+// runs, before anyone has checked in).
+function gateMode() {
+  return process.env.LUMA_GATE_MODE === 'approved' ? 'approved' : 'checked_in';
+}
+
+// One in-flight sync per program. Concurrent submitters that all miss the cache
+// share a single Luma sweep instead of stampeding the API.
+const inFlight = new Map();
+
+function shortError(err) {
+  const msg = (err && err.message ? String(err.message) : 'unknown').slice(0, 60);
+  return `error:${msg}`;
+}
+
+async function runSync(program) {
+  const programId = program.id;
+  const eventId = program.lumaEventId;
+  let status;
+  let result = { total: 0, checkedIn: 0, upserted: 0, removed: 0 };
+  try {
+    const { total, eligible, truncated } = await fetchEligibleGuests(eventId, gateMode());
+
+    if (truncated) {
+      // Partial sweep — never trust it enough to overwrite a good cache.
+      status = 'truncated';
+    } else if (eligible.length === 0 && (await signupRepository.countBySource(programId, 'luma_api')) > 0) {
+      // Sanity guard: a 0-result sweep against a non-empty cache is almost
+      // certainly a wrong event id / revoked key / Luma blip. Keep last-good.
+      status = 'empty_guard';
+    } else {
+      const { upserted, removed } = await signupRepository.replaceLumaGuests(programId, eligible);
+      status = 'ok';
+      result = { total, checkedIn: eligible.length, upserted, removed };
+    }
+  } catch (err) {
+    status = shortError(err);
+  }
+
+  // Always advance the sync timestamp — even on guard/error — so the gate's TTL
+  // moves forward and a stream of cache-misses can't hammer Luma. The live
+  // return value (not the stamp) is what the gate reads to detect transients.
+  try {
+    await programRepository.setGuestSyncState(programId, {
+      syncedAt: new Date().toISOString(),
+      status,
+    });
+  } catch {
+    // Stamping is best-effort; a failure here must not mask the sync result.
+  }
+  return { status, ...result };
+}
+
+class LumaSyncService {
+  // Whether the Luma gate is active for this program: it has an event id AND the
+  // server has a LUMA_API_KEY. Until both are true the gate stays in its prior
+  // (CSV / test-email) mode so an unconfigured deploy can't lock everyone out.
+  isActive(program) {
+    return Boolean(program?.lumaEventId) && isConfigured();
+  }
+
+  // Sync a program's checked-in guests. Single-flighted per program. Returns
+  // { status, total, checkedIn, upserted, removed }. `status` is one of
+  // 'ok' | 'truncated' | 'empty_guard' | 'error:<msg>' | 'not_configured'.
+  async syncProgram(program) {
+    if (!this.isActive(program)) {
+      return { status: 'not_configured', total: 0, checkedIn: 0, upserted: 0, removed: 0 };
+    }
+    const programId = program.id;
+    if (inFlight.has(programId)) return inFlight.get(programId);
+
+    const promise = runSync(program).finally(() => inFlight.delete(programId));
+    inFlight.set(programId, promise);
+    return promise;
+  }
+}
+
+export default new LumaSyncService();
diff --git a/server/api/services/luma.client.js b/server/api/services/luma.client.js
new file mode 100644
index 0000000..3a51c1f
--- /dev/null
+++ b/server/api/services/luma.client.js
@@ -0,0 +1,132 @@
+// Thin, read-only client for the Luma public API (https://docs.luma.com).
+//
+// We use it to mirror an event's *checked-in* guests into program_signups so
+// the submission gate can verify "only checked-in attendees may submit" without
+// us hosting a CSV of attendee data. The Luma API has no per-email lookup, so we
+// page the full guest list (`get-guests`) and filter locally.
+//
+// Verified against a live event (evt-…, 464 guests, 10 pages @100, ~4.4s sweep):
+//   - auth header is `x-luma-api-key`
+//   - Luma's edge (Cloudflare) returns 403 for requests with a default runtime
+//     User-Agent, so we ALWAYS send an explicit one. This is not cosmetic.
+//   - check-in is `entry.checked_in_at` OR any `entry.event_tickets[].checked_in_at`
+//   - response shape: { entries: [...], has_more, next_cursor }, cursor via
+//     `pagination_cursor`, page size via `pagination_limit` (we use 100).
+
+const BASE = 'https://public-api.luma.com/v1';
+const USER_AGENT = 'stadium-webzero/1.0';
+const PAGE_LIMIT = 100;
+const MAX_PAGES = 100; // ~10k guests; guards against a bad cursor looping forever
+const REQUEST_TIMEOUT_MS = 8000;
+const RETRY_BACKOFF_MS = 750;
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function apiKey() {
+  const k = process.env.LUMA_API_KEY;
+  return typeof k === 'string' && k.trim() ? k.trim() : null;
+}
+
+// Whether the server is configured to talk to Luma at all. The gate stays in
+// CSV/test-email mode until this is true, so an unconfigured deploy can't lock
+// everyone out.
+export function isConfigured() {
+  return apiKey() !== null;
+}
+
+// Normalize a Luma guest entry to the minimal shape we persist. We deliberately
+// keep only email + name (not Luma's full payload) to minimize stored PII.
+export function normalizeGuest(entry) {
+  const email = String(entry?.email || entry?.user_email || '').trim().toLowerCase();
+  const name = entry?.name || entry?.user_name || null;
+  const tickets = Array.isArray(entry?.event_tickets) ? entry.event_tickets : [];
+  const checkedIn = Boolean(entry?.checked_in_at) || tickets.some((t) => Boolean(t?.checked_in_at));
+  return { email, name, checkedIn, approvalStatus: entry?.approval_status ?? null };
+}
+
+// Fetch one page. One retry on timeout / 429 / 5xx with a short backoff; any
+// other non-2xx fails fast (a 4xx won't fix itself on retry).
+async function getPage(eventId, cursor, key) {
+  const url = new URL(`${BASE}/event/get-guests`);
+  url.searchParams.set('event_api_id', eventId);
+  url.searchParams.set('pagination_limit', String(PAGE_LIMIT));
+  if (cursor) url.searchParams.set('pagination_cursor', cursor);
+
+  let lastErr;
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    if (attempt > 0) await sleep(RETRY_BACKOFF_MS);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const res = await fetch(url, {
+        headers: { 'x-luma-api-key': key, 'User-Agent': USER_AGENT, Accept: 'application/json' },
+        signal: controller.signal,
+      });
+      if (res.status === 429 || res.status >= 500) {
+        lastErr = new Error(`Luma get-guests transient ${res.status}`);
+        continue;
+      }
+      if (!res.ok) {
+        throw new Error(`Luma get-guests failed: ${res.status}`);
+      }
+      return await res.json();
+    } catch (err) {
+      lastErr = err;
+      // Retry once on abort (timeout); otherwise bail after the loop.
+      if (err?.name !== 'AbortError' && attempt > 0) throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  throw lastErr || new Error('Luma get-guests failed');
+}
+
+// Page the full guest list. Returns { guests, pages, truncated }. `truncated`
+// means we hit MAX_PAGES before Luma said it was done — the caller must treat a
+// truncated result as untrustworthy and NOT overwrite a good cache with it.
+export async function fetchAllGuests(eventId) {
+  const key = apiKey();
+  if (!key) throw new Error('LUMA_API_KEY not set');
+  if (!eventId) throw new Error('eventId required');
+
+  const guests = [];
+  let cursor = null;
+  for (let page = 0; page < MAX_PAGES; page += 1) {
+    // eslint-disable-next-line no-await-in-loop -- cursor pagination is inherently serial
+    const data = await getPage(eventId, cursor, key);
+    const entries = Array.isArray(data?.entries) ? data.entries : [];
+    for (const entry of entries) {
+      const guest = normalizeGuest(entry);
+      if (guest.email) guests.push(guest);
+    }
+    if (!data?.has_more || !data?.next_cursor) {
+      return { guests, pages: page + 1, truncated: false };
+    }
+    cursor = data.next_cursor;
+  }
+  return { guests, pages: MAX_PAGES, truncated: true };
+}
+
+// Gate modes. 'checked_in' (default, in-person events) requires a physical
+// check-in. 'approved' accepts any approved registrant — used to dry-run the
+// flow BEFORE an event starts (nobody is checked in yet), or if a program ever
+// wants "registered counts" rather than "checked-in counts".
+export const GATE_MODES = ['checked_in', 'approved'];
+
+function isEligible(guest, mode) {
+  // Checked-in guests are always eligible; 'approved' additionally lets through
+  // anyone whose registration is approved.
+  if (guest.checkedIn) return true;
+  return mode === 'approved' && guest.approvalStatus === 'approved';
+}
+
+// The gate-eligible subset plus totals, for the sync service.
+export async function fetchEligibleGuests(eventId, mode = 'checked_in') {
+  const { guests, pages, truncated } = await fetchAllGuests(eventId);
+  return {
+    total: guests.length,
+    eligible: guests.filter((g) => isEligible(g, mode)),
+    pages,
+    truncated,
+  };
+}
diff --git a/server/api/utils/validation.js b/server/api/utils/validation.js
index 72acf00..234f679 100644
--- a/server/api/utils/validation.js
+++ b/server/api/utils/validation.js
@@ -565,6 +565,11 @@ export const validateProgram = (data, { partial = false } = {}) => {
       return { valid: false, error: 'eventUrl must start with http:// or https://' };
     }
   }
+  if (has('lumaEventId') && data.lumaEventId !== null && data.lumaEventId !== '') {
+    if (typeof data.lumaEventId !== 'string' || data.lumaEventId.length > 100) {
+      return { valid: false, error: 'lumaEventId must be a string (max 100 characters)' };
+    }
+  }
   if (has('content')) {
     const c = validateProgramContent(data.content);
     if (!c.valid) return c;
diff --git a/supabase/migrations/20260615000000_program_luma_event.sql b/supabase/migrations/20260615000000_program_luma_event.sql
new file mode 100644
index 0000000..04e0414
--- /dev/null
+++ b/supabase/migrations/20260615000000_program_luma_event.sql
@@ -0,0 +1,15 @@
+-- Luma API guest verification.
+--
+-- A program with luma_event_id set has its checked-in guest list mirrored from
+-- the Luma public API into program_signups (source='luma_api') instead of an
+-- admin uploading a CSV. The submission gate verifies the submitter's email
+-- against that synced set. We store the last sync time + status so the admin UI
+-- can show "synced N min ago / ✓/✗" and the gate can decide when to lazily
+-- refresh (TTL).
+--
+-- Additive and idempotent — safe to re-run.
+
+ALTER TABLE programs
+  ADD COLUMN IF NOT EXISTS luma_event_id        TEXT,
+  ADD COLUMN IF NOT EXISTS last_guest_sync_at   TIMESTAMPTZ,
+  ADD COLUMN IF NOT EXISTS last_guest_sync_status TEXT;