diff --git a/internal/service/push_sender.go b/internal/service/push_sender.go
index aef35f1..0d99eb6 100644
--- a/internal/service/push_sender.go
+++ b/internal/service/push_sender.go
@@ -45,6 +45,15 @@ func NewPushSender(repo *repository.PushRepo, publicKey, privateKey, subject str
 	if publicKey == "" || privateKey == "" || repo == nil {
 		return nil
 	}
+	// webpush-go prepends "mailto:" to any non-https subscriber, so a subject
+	// already in "mailto:foo@bar" form would become "mailto:mailto:foo@bar" —
+	// a malformed VAPID `sub` that Apple rejects with BadJwtToken (FCM is
+	// lenient). Hand the library a bare address (or an https: URL) so it adds
+	// exactly one prefix.
+	subject = strings.TrimSpace(subject)
+	if !strings.HasPrefix(subject, "https:") {
+		subject = strings.TrimPrefix(subject, "mailto:")
+	}
 	return &PushSender{repo: repo, pub: publicKey, priv: privateKey, subject: subject, logger: logger}
 }