diff --git a/internal/handlers/auth.go b/internal/handlers/auth.go
index febe2ab..bc2bd7d 100644
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -114,8 +114,13 @@ func (h *AuthHandler) RequestOTP(w http.ResponseWriter, r *http.Request) {
 
 	// Deliver OTP via email. Log the error but do not fail the request —
 	// during development the code is visible in server logs.
-	if err := h.EmailSender.SendOTP(emailAddr, code); err != nil {
-		log.Printf("ERROR [%s] handlers: RequestOTP SendOTP(%s): %v", time.Now().Format(time.RFC3339), emailAddr, err)
+	if h.EmailSender != nil {
+		if err := h.EmailSender.SendOTP(emailAddr, code); err != nil {
+			log.Printf("ERROR [%s] handlers: RequestOTP SendOTP(%s): %v", time.Now().Format(time.RFC3339), emailAddr, err)
+		}
+	} else {
+		log.Printf("WARN  [%s] handlers: RequestOTP(%s): SMTP not configured — OTP code %s not delivered via email",
+			time.Now().Format(time.RFC3339), emailAddr, code)
 	}
 
 	// Render the OTP verification form as an HTMX fragment.
diff --git a/internal/handlers/file.go b/internal/handlers/file.go
index c06f9cf..632f794 100644
--- a/internal/handlers/file.go
+++ b/internal/handlers/file.go
@@ -139,6 +139,12 @@ func (h *FileHandler) FileEvent(w http.ResponseWriter, r *http.Request) {
 	}
 
 	// 6. Send the report as an email attachment.
+	if h.EmailSender == nil {
+		log.Printf("ERROR [%s] handlers: FileEvent: SMTP not configured, cannot send email",
+			time.Now().Format(time.RFC3339))
+		http.Error(w, "SMTP not configured. Please set SMTP environment variables.", http.StatusInternalServerError)
+		return
+	}
 	subject := "Expense report for event " + event.Name
 	body := "Please find attached the expense report."
 	if err := h.EmailSender.SendReport(to, subject, body, attachment); err != nil {