diff --git a/package.json b/package.json
index 612d1bc..3301a4e 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
     "dev:api": "npm run dev -w apps/api",
     "build": "npm run build -w apps/web",
     "build:check": "npm run build && npm run typecheck",
-    "start": "node server.js",
+    "start": "node server.cjs",
     "db:generate": "npm run generate -w packages/db",
     "db:migrate": "npm run migrate -w packages/db",
     "typecheck": "npm run typecheck --workspaces --if-present"
diff --git a/server.cjs b/server.cjs
new file mode 100644
index 0000000..f380bda
--- /dev/null
+++ b/server.cjs
@@ -0,0 +1,7 @@
+// CommonJS wrapper for Phusion Passenger.
+// Passenger's node-loader uses require(), which cannot load ES modules directly.
+// This shim bridges into the ESM entry point via dynamic import().
+import('./server.js').catch((err) => {
+  console.error(err);
+  process.exit(1);
+});