diff --git a/internal/auth/handlers.go b/internal/auth/handlers.go
index f873528..325c45b 100644
--- a/internal/auth/handlers.go
+++ b/internal/auth/handlers.go
@@ -172,7 +172,7 @@ func (h *Handler) Login(w http.ResponseWriter, r *http.Request) {
 
 	var userID, hash string
 	err := h.db.QueryRowContext(r.Context(), `
-		SELECT id, password_hash FROM users WHERE email = $1 OR username = $1
+		SELECT id, password_hash FROM users WHERE LOWER(email) = LOWER($1) OR LOWER(username) = LOWER($1)
 	`, login).Scan(&userID, &hash)
 	if err != nil {
 		http.Error(w, `{"error":"invalid credentials"}`, http.StatusUnauthorized)