diff --git a/src/auth.config.ts b/src/auth.config.ts
new file mode 100644
index 0000000..0e74ab0
--- /dev/null
+++ b/src/auth.config.ts
@@ -0,0 +1,40 @@
+import type { NextAuthConfig } from "next-auth";
+
+// Edge-safe subset of the full Auth.js config (src/auth.ts). Deliberately
+// has NO providers here: the Credentials provider's authorize() calls
+// verifyUserCredentials() (src/lib/users.ts), which pulls in bcryptjs — a
+// Node.js API, not Edge-Runtime-compatible (see
+// https://authjs.dev/guides/edge-compatibility). middleware.ts runs on the
+// Edge Runtime in this project's Next.js 14.2.35 and only ever needs to
+// decode/validate the JWT session cookie, never to run a provider's
+// authorize() — so it builds its own lightweight NextAuth instance from
+// just this config (see src/middleware.ts), instead of importing the full
+// src/auth.ts (which previously got bcryptjs/jose Node-API warnings bundled
+// into the Edge middleware build even though that code path never actually
+// ran there). src/auth.ts spreads this same config and adds the real
+// Credentials provider on top, for use everywhere else (API routes, Server
+// Components) where the Node.js runtime is available.
+export default {
+  // Required by NextAuthConfig's type, but deliberately empty here — the
+  // real Credentials provider is added in src/auth.ts, not here. See this
+  // file's top comment for why.
+  providers: [],
+  session: { strategy: "jwt" },
+  pages: {
+    signIn: "/login",
+  },
+  callbacks: {
+    jwt({ token, user }) {
+      if (user) {
+        token.id = user.id;
+      }
+      return token;
+    },
+    session({ session, token }) {
+      if (session.user) {
+        session.user.id = token.id as string;
+      }
+      return session;
+    },
+  },
+} satisfies NextAuthConfig;
diff --git a/src/auth.ts b/src/auth.ts
index 0c08f2e..677fbbf 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -1,6 +1,7 @@
 import NextAuth from "next-auth";
 import Credentials from "next-auth/providers/credentials";
 import { verifyUserCredentials } from "@/lib/users";
+import authConfig from "@/auth.config";
 
 // Minimal internal auth — Auth.js v5 (next-auth@beta) Credentials provider
 // only, no OAuth/SSO providers (company SSO was explicitly ruled out — see
@@ -14,11 +15,16 @@ import { verifyUserCredentials } from "@/lib/users";
 // session only needs to carry the user's id (used to identify who did what,
 // not to gate what they can do) — see the module augmentation in
 // src/types/next-auth.d.ts.
+//
+// This is the full config (session strategy + pages + jwt/session callbacks
+// spread in from src/auth.config.ts, plus the real Credentials provider
+// added here). Used by API routes and Server Components, which run on the
+// Node.js runtime. middleware.ts deliberately does NOT import this file —
+// it builds its own lightweight NextAuth instance from src/auth.config.ts
+// alone (no Credentials provider, so no bcryptjs) to stay Edge-Runtime
+// compatible; see that config file's comment for why.
 export const { handlers, signIn, signOut, auth } = NextAuth({
-  session: { strategy: "jwt" },
-  pages: {
-    signIn: "/login",
-  },
+  ...authConfig,
   providers: [
     Credentials({
       credentials: {
@@ -31,18 +37,4 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
       },
     }),
   ],
-  callbacks: {
-    jwt({ token, user }) {
-      if (user) {
-        token.id = user.id;
-      }
-      return token;
-    },
-    session({ session, token }) {
-      if (session.user) {
-        session.user.id = token.id as string;
-      }
-      return session;
-    },
-  },
 });