diff --git a/backend/src/config/env.js b/backend/src/config/env.js
index 2e099d23..5dd65010 100644
--- a/backend/src/config/env.js
+++ b/backend/src/config/env.js
@@ -7,6 +7,7 @@ const REQUIRED = [
   'JWT_SECRET',
   'API_KEY_PEPPER',
   'PLATFORM_SECRET_KEY',
+  'ARBITRATOR_SECRET_KEY',
   'STELLAR_NETWORK',
   'STELLAR_HORIZON_URL',
   'WALLET_ENCRYPTION_KEY',
@@ -51,6 +52,13 @@ function validateEnv() {
     );
   }
 
+  const arbitratorKey = process.env.ARBITRATOR_SECRET_KEY;
+  if (!/^S[A-Z2-7]{55}$/.test(arbitratorKey)) {
+    errors.push(
+      'ARBITRATOR_SECRET_KEY must be a valid Stellar secret seed (56 characters, starting with S)'
+    );
+  }
+
   const portRaw = process.env.PORT;
   if (portRaw && portRaw.length > 0) {
     const portNum = Number(portRaw);
diff --git a/backend/src/routes/campaignComments.js b/backend/src/routes/campaignComments.js
index 10aad129..85955921 100644
--- a/backend/src/routes/campaignComments.js
+++ b/backend/src/routes/campaignComments.js
@@ -4,6 +4,7 @@ const { requireAuth, authenticate } = require("../middleware/auth");
 const asyncHandler = require("../utils/asyncHandler");
 const logger = require("../config/logger");
 const rateLimit = require("express-rate-limit");
+const { ipKeyGenerator } = rateLimit;
 const { createNotification } = require("../services/notifications");
 const { sendCampaignCommentEmail, sendCommentReplyEmail } = require("../services/emailService");
 
@@ -39,7 +40,7 @@ const commentRateLimiter = rateLimit({
   max: 5,
   standardHeaders: true,
   legacyHeaders: false,
-  keyGenerator: (req) => req.user?.userId || req.ip,
+  keyGenerator: (req) => req.user?.userId || ipKeyGenerator(req.ip),
   message: { error: "Rate limit exceeded. You can post up to 5 comments per minute." },
 });