diff --git a/routes/web.php b/routes/web.php
index 4b9d38c21..f327b50b2 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -377,27 +377,12 @@ Route::post('2faVerify', function () {
 })->name('2faVerify')->middleware('2fa');
 
 Route::post('btcpay/webhook', function (Illuminate\Http\Request $request) {
-    $payload = json_decode($request->getContent(), true);
-    if (! empty($payload)) {
-        // We have received a payment for an invoice and user should be upgraded to a paid plan based on order
-        if ($payload['type'] === 'InvoiceReceivedPayment') {
-            preg_match('/(?P<role>\w+(\+\+)?)[ ](?P<addYears>\d+)/i', $payload['metadata']['itemDesc'], $matches);
-            $user = User::query()->where('email', '=', $payload['metadata']['buyerEmail'])->first();
-            if ($user) {
-                User::updateUserRole($user->id, $matches['role']);
-                User::updateUserRoleChangeDate($user->id, null, $matches['addYears']);
-                Log::info('User upgraded to '.$matches['role'].' for BTCPay webhook: '.$payload['metadata']['buyerEmail']);
-            } else {
-                Log::error('User not found for BTCPay webhook: '.$payload['metadata']['buyerEmail']);
-            }
-        }
-
-        return response('OK', 200);
-    }
-
-    return response('OK', 200);
-});
-Route::get('btcpay/webhook', function (Illuminate\Http\Request $request) {
+    $hashCheck = 'sha256='.hash_hmac('sha256', $request->getContent(), config('nntmux.btcpay_webhook_secret'));
+    if ($hashCheck !== $request->header('btcpay-sig')) {
+        Log::error('BTCPay webhook hash check failed: '.$request->header('btcpay-sig'));
+
+        return response('Not Found', 404);
+    }
     $payload = json_decode($request->getContent(), true);
     if (! empty($payload)) {
         // We have received a payment for an invoice and user should be upgraded to a paid plan based on order