diff --git a/daemon/server.py b/daemon/server.py
index a008855..11aef5f 100644
--- a/daemon/server.py
+++ b/daemon/server.py
@@ -372,7 +372,6 @@ async def _handle_ws(request: web.Request) -> web.Response:
     Authentication: JWT access token passed via:
     1. WebSocket subprotocol header (Sec-WebSocket-Protocol: "Bearer <token>")
     2. X-Auth-Token header (nginx-injected)
-    3. token query parameter (dev fallback)
     """
     from lib.auth import validate_token
 
@@ -388,9 +387,6 @@ async def _handle_ws(request: web.Request) -> web.Response:
     if token_param is None:
         token_param = request.headers.get("X-Auth-Token")
 
-    if token_param is None:
-        token_param = request.query.get("token")
-
     if token_param is None:
         return web.json_response(
             {"ok": False, "error": "authentication required"}, status=401