diff --git a/server/src/index.js b/server/src/index.js
index f4a84c2..71f4268 100644
--- a/server/src/index.js
+++ b/server/src/index.js
@@ -193,15 +193,24 @@ io.on('connection', socket => {
     }
   });
 
-  // very basic server-side movement (trusting client target)
+  // Optional: keep click target for future pathing/validation
   socket.on('move:click', target => {
     const p = socketsToPlayers.get(socket.id);
     if (!p) return;
-    // You can store target on the server if you want later:
     p.targetX = Math.max(0, Math.min(WORLD.width,  target.x));
     p.targetY = Math.max(0, Math.min(WORLD.height, target.y));
   });
 
+  // Authoritative position updates from the client
+  socket.on('pos:update', ({ x, y }) => {
+    const p = socketsToPlayers.get(socket.id);
+    if (!p) return;
+    const clampedX = Math.max(0, Math.min(WORLD.width,  x));
+    const clampedY = Math.max(0, Math.min(WORLD.height, y));
+    p.x = clampedX;
+    p.y = clampedY;
+  });
+
   socket.on('gather', async ({ nodeId }, ack) => {
     const p = socketsToPlayers.get(socket.id);
     if (!p) return ack?.({ error: 'not authed' });
@@ -240,6 +249,7 @@ io.on('connection', socket => {
   });
 });
 
+
 // game loop: respawn nodes + broadcast positions
 setInterval(() => {
   const now = Date.now();