diff --git a/backend/lib/squid.js b/backend/lib/squid.js
index e55c927..7c39231 100644
--- a/backend/lib/squid.js
+++ b/backend/lib/squid.js
@@ -97,15 +97,16 @@ function httpsPost(url, body, extraHeaders) {
 async function getAltchaCookie() {
   if (_captchaCookie && Date.now() - _captchaAt < CAPTCHA_TTL) return _captchaCookie;
 
-  // 1. Fetch challenge
+  // 1. Fetch challenge — response may wrap params in a "parameters" key
   const chRes = await httpsGet(`${SQUID_BASE}/api/altcha/challenge`);
   if (chRes.status !== 200) throw new Error(`ALTCHA challenge HTTP ${chRes.status}`);
-  const challenge = JSON.parse(chRes.body);
+  const chBody    = JSON.parse(chRes.body);
+  const challenge = chBody.parameters ?? chBody; // unwrap { parameters: {...} } if present
 
   // 2. Solve PoW
   const solution = await solveAltcha(challenge);
 
-  // 3. Verify — server sets captcha_verified_at cookie
+  // 3. Verify — payload contains the unwrapped challenge params + our solution
   const payload = Buffer.from(JSON.stringify({ challenge, solution })).toString('base64');
   const vRes = await httpsPost(`${SQUID_BASE}/api/altcha/verify`, { payload });
   if (vRes.status !== 200) throw new Error(`ALTCHA verify HTTP ${vRes.status}`);