diff --git a/backend/src/index.ts b/backend/src/index.ts
index e0b0928..cb2e6cc 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -22,11 +22,22 @@ const apiRoot = config.apiPrefix || '/';
 app.use(apiRoot, createHealthRouter(config));
 app.use(apiRoot, createTodosRouter(config, db));
 
+app.post('/_cron/tick', (req, res) => {
+  const token = req.headers.authorization?.replace(/^Bearer\s+/i, '') || '';
+  const expected = process.env.CRON_TOKEN || '';
+  if (!expected || token !== expected) {
+    res.status(401).json({ success: false, error: 'Invalid cron token' });
+    return;
+  }
+  res.status(200).json({ success: true, ticked: new Date().toISOString() });
+});
+
 const publicDir = path.join(__dirname, '../public');
 app.use(express.static(publicDir));
 
 app.get('*', (req, res, next) => {
   if (req.path.startsWith(apiRoot)) return next();
+  if (req.path === '/_cron/tick') return next();
   res.sendFile(path.join(publicDir, 'index.html'), (err) => {
     if (err) next();
   });