diff --git a/app/lib/payload.ts b/app/lib/payload.ts
index 5f4e301..1af5c36 100644
--- a/app/lib/payload.ts
+++ b/app/lib/payload.ts
@@ -49,6 +49,11 @@ type PayloadPost = {
 export async function getBlogPosts(limit = 3): Promise<BlogPost[]> {
   const params = new URLSearchParams({
     "where[tenant.slug][equals]": TENANT_SLUG,
+    // Draft/scheduled posts never appear publicly — same "filter, not
+    // access-control" pattern as Products.active. Live preview
+    // (LivePostContent.tsx) bypasses this entirely since it fetches the
+    // one specific document by id directly, not through this list.
+    "where[status][equals]": "published",
     sort: "-featured,-publishedAt",
     depth: "2",
     limit: String(limit),
@@ -144,6 +149,10 @@ export async function getPostBySlug(slug: string, options?: { draft?: boolean })
     depth: "2",
     limit: "1",
   });
+  // Draft/scheduled posts 404 for a normal visitor — draftMode's preview
+  // (options.draft, wired from the page's own draftMode() call) is the
+  // one legitimate way to view one before its scheduledPublishAt fires.
+  if (!options?.draft) params.set("where[status][equals]", "published");
 
   const res = await fetch(`${PAYLOAD_URL}/api/posts?${params}`, livePreviewCacheOption(Boolean(options?.draft)));
   if (!res.ok) {