diff --git a/bot/src/db/queries.ts b/bot/src/db/queries.ts
index 1bd2cd8..12a3969 100644
--- a/bot/src/db/queries.ts
+++ b/bot/src/db/queries.ts
@@ -21,7 +21,16 @@ export async function findLinkByUserId(userId: string) {
 export async function validateLinkCode(code: string): Promise<string | null> {
   const key = `link_code:${code}`;
   const setting = await db.globalSetting.findUnique({ where: { key } });
-  return setting?.value ?? null;
+  if (!setting) return null;
+
+  try {
+    const parsed = JSON.parse(setting.value);
+    if (parsed.expiresAt && new Date(parsed.expiresAt) < new Date()) return null;
+    return parsed.userId ?? null;
+  } catch {
+    // Legacy format: value is the userId directly
+    return setting.value;
+  }
 }
 
 export async function deleteLinkCode(code: string): Promise<void> {
diff --git a/src/app/(app)/stls/actions.ts b/src/app/(app)/stls/actions.ts
index 0e1835c..9693355 100644
--- a/src/app/(app)/stls/actions.ts
+++ b/src/app/(app)/stls/actions.ts
@@ -60,7 +60,7 @@ export async function uploadPackagePreview(
       data: {
         previewData: buffer,
         // Set previewMsgId to 0 as sentinel so hasPreview checks work
-        previewMsgId: 0n,
+        previewMsgId: BigInt(0),
       },
     });
 
@@ -125,7 +125,7 @@ export async function setPreviewFromExtract(
         previewData: extractReq.imageData,
         // Set previewMsgId to 0 as sentinel so hasPreview checks work
         // (original Telegram-matched previews have the actual message ID)
-        previewMsgId: 0n,
+        previewMsgId: BigInt(0),
       },
     });