diff --git a/pkg/billing/billing.go b/pkg/billing/billing.go
index 34f16b8..39f9416 100644
--- a/pkg/billing/billing.go
+++ b/pkg/billing/billing.go
@@ -658,9 +658,14 @@ func (m *Manager) getOrCreateCustomer(userDID, userHandle string) (*stripe.Custo
 
 // findCustomerByDID searches Stripe for a customer with matching DID metadata.
 func (m *Manager) findCustomerByDID(userDID string) (*stripe.Customer, error) {
+	// DIDs reaching here are OAuth-validated (the DID grammar forbids quotes),
+	// but escape defensively so the query's safety doesn't silently depend on a
+	// validator several layers away. Stripe search escapes ' and \ with a
+	// backslash.
+	escaped := strings.NewReplacer(`\`, `\\`, `'`, `\'`).Replace(userDID)
 	params := &stripe.CustomerSearchParams{
 		SearchParams: stripe.SearchParams{
-			Query: fmt.Sprintf("metadata['user_did']:'%s'", userDID),
+			Query: fmt.Sprintf("metadata['user_did']:'%s'", escaped),
 		},
 	}