diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/delete/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/delete/route.ts
index 769742f9b..b36f4433b 100644
--- a/apps/backend/src/app/api/latest/internal/mcp-review/delete/route.ts
+++ b/apps/backend/src/app/api/latest/internal/mcp-review/delete/route.ts
@@ -13,7 +13,7 @@ export const POST = createSmartRouteHandler({
       project: adaptSchema,
     }).defined(),
     body: yupObject({
-      qaId: yupString().defined(),
+      qaId: yupString().matches(/^\d+$/, "qaId must be a non-negative decimal integer").defined(),
     }).defined(),
     method: yupString().oneOf(["POST"]).defined(),
   }),
diff --git a/apps/backend/src/app/api/latest/internal/mcp-review/update-qa-entry/route.ts b/apps/backend/src/app/api/latest/internal/mcp-review/update-qa-entry/route.ts
index 573dbf411..66bf5529d 100644
--- a/apps/backend/src/app/api/latest/internal/mcp-review/update-qa-entry/route.ts
+++ b/apps/backend/src/app/api/latest/internal/mcp-review/update-qa-entry/route.ts
@@ -13,7 +13,7 @@ export const POST = createSmartRouteHandler({
       project: adaptSchema,
     }).defined(),
     body: yupObject({
-      qaId: yupString().defined(),
+      qaId: yupString().matches(/^\d+$/, "qaId must be a non-negative decimal integer").defined(),
       question: yupString().defined(),
       answer: yupString().defined(),
       publish: yupBoolean().defined(),