diff --git a/src/core/auth/auth-provider.tsx b/src/core/auth/auth-provider.tsx
index 638a88e..f91719d 100644
--- a/src/core/auth/auth-provider.tsx
+++ b/src/core/auth/auth-provider.tsx
@@ -30,16 +30,7 @@ interface AuthProviderProps {
 function AuthProviderInner({ children }: AuthProviderProps) {
   const { data: session, status } = useSession();
 
-  // Show loading spinner while session is being validated
-  if (status === "loading") {
-    return (
-      <div className="flex h-screen items-center justify-center">
-        <div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
-      </div>
-    );
-  }
-
-  // Use session user if available, otherwise fallback to stub in dev mode
+  // Derive user from session (all hooks must be called unconditionally)
   const user: User | null = session?.user
     ? {
         id: (session.user as any).id || "unknown",
@@ -79,6 +70,15 @@ function AuthProviderInner({ children }: AuthProviderProps) {
     [user, hasRole, canAccessModule],
   );
 
+  // Show loading spinner while session is being validated (after all hooks)
+  if (status === "loading") {
+    return (
+      <div className="flex h-screen items-center justify-center">
+        <div className="h-8 w-8 animate-spin rounded-full border-4 border-primary border-t-transparent" />
+      </div>
+    );
+  }
+
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
 }