diff --git a/config/db.php b/config/db.php
index 176b605..7776411 100644
--- a/config/db.php
+++ b/config/db.php
@@ -40,16 +40,19 @@ if (getenv('DB_PASS') === false) {
     _bootstrap_fail('required env var DB_PASS is not set (empty string is allowed)');
 }
 
-$host = env('DB_HOST', '127.0.0.1');
-$port = (int) env('DB_PORT', 3306);
-$db   = env('DB_NAME');
-$user = env('DB_USER');
-$pass = env('DB_PASS');
+$host   = env('DB_HOST', '127.0.0.1');
+$port   = (int) env('DB_PORT', 3306);
+$db     = env('DB_NAME');
+// Not $user: that name leaks into the router's flat include scope (router.php
+// requires this file at top level, no function wrapper) and would shadow the
+// real logged-in user array that includes/header.php expects.
+$dbUser = env('DB_USER');
+$pass   = env('DB_PASS');
 
 $dsn = "mysql:host=$host;port=$port;dbname=$db;charset=utf8mb4";
 
 try {
-    $pdo = new PDO($dsn, $user, $pass, [
+    $pdo = new PDO($dsn, $dbUser, $pass, [
         PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
         // Real server-side prepares (not driver emulation): a tighter defence
         // against injection than emulated string-interpolation. Safe here — the