diff --git a/services/collector/src/app.module.ts b/services/collector/src/app.module.ts
index 3dda6e5..985f0e1 100644
--- a/services/collector/src/app.module.ts
+++ b/services/collector/src/app.module.ts
@@ -1,4 +1,5 @@
 import { Module } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
 import { ConfigModule, ConfigService } from '@nestjs/config';
 import { ThrottlerModule } from '@nestjs/throttler';
 import { BullModule } from '@nestjs/bullmq';
@@ -7,6 +8,7 @@ import { TrackingModule } from './tracking/tracking.module';
 import { HealthModule } from './health/health.module';
 import { RawEvent } from './entities/raw-event.entity';
 import { SessionFingerprint } from './entities/session-fingerprint.entity';
+import { WriteKeyGuard } from './auth/write-key.guard';
 
 @Module({
   imports: [
@@ -35,7 +37,7 @@ import { SessionFingerprint } from './entities/session-fingerprint.entity';
         password: config.get('DATABASE_PASSWORD', 'analytics'),
         database: config.get('DATABASE_NAME', 'analytics'),
         entities: [RawEvent, SessionFingerprint],
-        synchronize: config.get('NODE_ENV') !== 'production',
+        synchronize: false,
         logging: config.get('NODE_ENV') === 'development',
       }),
     }),
@@ -63,5 +65,11 @@ import { SessionFingerprint } from './entities/session-fingerprint.entity';
     TrackingModule,
     HealthModule,
   ],
+  providers: [
+    {
+      provide: APP_GUARD,
+      useClass: WriteKeyGuard,
+    },
+  ],
 })
 export class AppModule {}
diff --git a/services/collector/src/main.ts b/services/collector/src/main.ts
index 3a3a798..57bc18d 100644
--- a/services/collector/src/main.ts
+++ b/services/collector/src/main.ts
@@ -1,5 +1,5 @@
 import { NestFactory } from '@nestjs/core';
-import { ValidationPipe } from '@nestjs/common';
+import { RequestMethod, ValidationPipe } from '@nestjs/common';
 import { SwaggerModule, DocumentBuilder } from '@nestjs/swagger';
 import { AppModule } from './app.module';
 
@@ -32,6 +32,12 @@ async function bootstrap() {
     SwaggerModule.setup('docs', app, document);
   }
 
+  // Global prefix — aligns with @lilith/analytics-client which POSTs to /analytics/track/*
+  // Health endpoint excluded so Docker healthchecks can hit /health directly
+  app.setGlobalPrefix('analytics', {
+    exclude: [{ path: 'health', method: RequestMethod.GET }],
+  });
+
   const port = process.env['PORT'] || 4001;
   await app.listen(port);