diff --git a/src/app/start.ts b/src/app/start.ts
index 7f79732..4e96775 100644
--- a/src/app/start.ts
+++ b/src/app/start.ts
@@ -1,8 +1,13 @@
-import { createStart } from "@tanstack/react-start";
+import { createCsrfMiddleware, createStart } from "@tanstack/react-start";
 import { serverFnLoggingMiddleware } from "@/utils/activities";
 
+const csrfMiddleware = createCsrfMiddleware({
+  filter: (ctx) => ctx.handlerType === "serverFn",
+});
+
 // Global function middleware: every server fn (current and future) is audited
 // without opting in at the definition site.
 export const startInstance = createStart(() => ({
+  requestMiddleware: [csrfMiddleware],
   functionMiddleware: [serverFnLoggingMiddleware],
 }));