diff --git a/apps/web/app/api/teams/[team]/upgrade/route.ts b/apps/web/app/api/teams/[team]/upgrade/route.ts
index b5182c51f6abe3..3b1c86dc884915 100644
--- a/apps/web/app/api/teams/[team]/upgrade/route.ts
+++ b/apps/web/app/api/teams/[team]/upgrade/route.ts
@@ -45,6 +45,12 @@ async function getHandler(req: NextRequest, { params }: { params: Promise<Params
       throw new HttpError({ statusCode: 402, message: "Payment required" });
     }
 
+    // Not all sessions carry "teamId": API v2 uses "pendingPaymentTeamId" and legacy sessions predate it.
+    const sessionTeamId = checkoutSession.metadata?.teamId;
+    if (sessionTeamId && Number(sessionTeamId) !== id) {
+      throw new HttpError({ statusCode: 400, message: "Checkout session does not match team" });
+    }
+
     let team = await prisma.team.findFirst({
       where: { metadata: { path: ["paymentId"], equals: checkoutSession.id } },
     });