diff --git a/.env.example b/.env.example
index 00f34bc..d2e36c8 100644
--- a/.env.example
+++ b/.env.example
@@ -1,7 +1,7 @@
 # ── Bill Tracker — Environment Variables ──────────────────────────────────────
 # Copy this file to .env and fill in your values before deploying.
 # Docker Compose reads .env automatically.
-# For direct Node.js: NODE_ENV=production node server.js (or use PM2).
+# For direct Node.js: NODE_ENV=production node server.cts (or use PM2).
 
 # ── Server ─────────────────────────────────────────────────────────────────────
 PORT=3000
diff --git a/e2e/setup/prepare-db.js b/e2e/setup/prepare-db.js
index 0937c85..8ad3b43 100644
--- a/e2e/setup/prepare-db.js
+++ b/e2e/setup/prepare-db.js
@@ -29,13 +29,13 @@ fs.mkdirSync(path.dirname(dbPath), { recursive: true });
 
 // db/database.js reads DB_PATH at require-time — set it BEFORE requiring.
 process.env.DB_PATH = dbPath;
-const { getDb, ensureUserDefaultCategories } = require('../../db/database');
-const { seedDemoData } = require('../../scripts/seedDemoData');
+const { getDb, ensureUserDefaultCategories } = require('../../db/database.cts');
+const { seedDemoData } = require('../../scripts/seedDemoData.cts');
 
 const db = getDb(); // initializes schema + runs migrations
 
 // Regular `user` (role 'user', no forced password change) — mirrors the app's
-// own INIT_REGULAR_USER seed path in server.js.
+// own INIT_REGULAR_USER seed path in server.cts.
 let user = db.prepare('SELECT id FROM users WHERE username = ?').get(E2E_USER);
 if (!user) {
   const hash = bcrypt.hashSync(E2E_PASS, 12);
diff --git a/playwright.config.js b/playwright.config.js
index 63e4d6f..03fa72b 100644
--- a/playwright.config.js
+++ b/playwright.config.js
@@ -73,7 +73,7 @@ module.exports = defineConfig({
   // `url` to respond before starting tests.
   webServer: [
     {
-      command: 'node server.js',
+      command: 'node server.cts',
       url: `http://localhost:${API_PORT}/api/version`,
       reuseExistingServer: false,
       timeout: 120_000,
diff --git a/scripts/prod-smoke.sh b/scripts/prod-smoke.sh
index 135eadf..40d60ea 100755
--- a/scripts/prod-smoke.sh
+++ b/scripts/prod-smoke.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Production-build smoke (QA_PLAN B15): builds the app, boots `node server.js`
+# Production-build smoke (QA_PLAN B15): builds the app, boots `node server.cts`
 # serving dist/ against a scratch DB, and drives the real artifact with Playwright
 # to confirm the split vendor chunks load and the app works in production.
 set -euo pipefail
@@ -15,7 +15,7 @@ echo "[prod-smoke] preparing scratch DB…"
 node e2e/setup/prepare-db.js >/dev/null 2>&1
 
 echo "[prod-smoke] starting production server on :${PORT}…"
-DB_PATH="db/e2e.db" PORT="${PORT}" BIND_HOST=127.0.0.1 node server.js >/tmp/prod-smoke-server.log 2>&1 &
+DB_PATH="db/e2e.db" PORT="${PORT}" BIND_HOST=127.0.0.1 node server.cts >/tmp/prod-smoke-server.log 2>&1 &
 SRV=$!
 trap 'kill "${SRV}" 2>/dev/null || true' EXIT
 
diff --git a/server.cts b/server.cts
index e92e516..86d672d 100644
--- a/server.cts
+++ b/server.cts
@@ -231,7 +231,7 @@ async function main() {
   }
   
   const userCount = db.prepare('SELECT COUNT(*) AS count FROM users').get().count;
-  if (userCount === 0) await require('./setup/firstRun').run(db);
+  if (userCount === 0) await require('./setup/firstRun.cts').run(db);
 
   // [seed] Check for and create regular user if INIT_REGULAR_USER/INIT_REGULAR_PASS are set
   if (process.env.INIT_REGULAR_USER && process.env.INIT_REGULAR_PASS) {
diff --git a/setup/firstRun.js b/setup/firstRun.cts
similarity index 99%
rename from setup/firstRun.js
rename to setup/firstRun.cts
index 9b44883..6c79beb 100644
--- a/setup/firstRun.js
+++ b/setup/firstRun.cts
@@ -1,6 +1,6 @@
 const readline = require('readline');
 const bcrypt = require('bcryptjs');
-const { logAudit } = require('../services/auditService');
+const { logAudit } = require('../services/auditService.cts');
 
 function line(char = '─', len = 56) {
   return char.repeat(len);