diff --git a/app/routes/leagues/$leagueId.audit-log.tsx b/app/routes/leagues/$leagueId.audit-log.tsx
index 2d79586..f5f3daf 100644
--- a/app/routes/leagues/$leagueId.audit-log.tsx
+++ b/app/routes/leagues/$leagueId.audit-log.tsx
@@ -31,6 +31,9 @@ import { findCurrentSeasonWithSports } from "~/models/season";
 import { findTeamsBySeasonId } from "~/models/team";
 import { getAuditLogForSeason, type AuditAction, type AuditLogEntry } from "~/models/audit-log";
 import { AUDIT_ACTION_LABELS, formatAuditDetail } from "~/lib/audit-log-display";
+import * as schema from "~/database/schema";
+
+const VALID_AUDIT_ACTIONS = new Set<string>(schema.auditActionEnum.enumValues);
 
 export function meta({ data }: Route.MetaArgs): Route.MetaDescriptors {
   return [{ title: `Audit Log — ${data?.league?.name ?? "League"} - Brackt` }];
@@ -80,7 +83,9 @@ export async function loader(args: Route.LoaderArgs) {
 
   const searchParams = new URL(request.url).searchParams;
   const page = Math.max(0, parseInt(searchParams.get("page") ?? "0", 10) || 0);
-  const actionFilter = searchParams.get("action") as AuditAction | null;
+  const rawAction = searchParams.get("action");
+  const actionFilter: AuditAction | null =
+    rawAction && VALID_AUDIT_ACTIONS.has(rawAction) ? (rawAction as AuditAction) : null;
 
   const [auditLog, teams] = await Promise.all([
     getAuditLogForSeason(season.id, {