diff --git a/packages/server/src/time-slot/time-slot.controller.ts b/packages/server/src/time-slot/time-slot.controller.ts
index 2338ebb..da72f64 100644
--- a/packages/server/src/time-slot/time-slot.controller.ts
+++ b/packages/server/src/time-slot/time-slot.controller.ts
@@ -23,9 +23,14 @@ import { PublishDaySlotsDto } from './dto/publish-day-slots.dto'
 
 // ---------------------------------------------------------------------------
 // Member endpoints
+//
+// These endpoints are intentionally public — they power the "available
+// courses" list and slot detail view that unauthenticated visitors can
+// browse before deciding to log in. The service layer accepts an optional
+// `userId`; when absent, it omits per-user booking flags
+// (`isBookedByMe` / `myBookingId` / `myBookingStatus` are all false/null).
 // ---------------------------------------------------------------------------
 
-@UseGuards(JwtAuthGuard)
 @Controller('time-slot')
 export class TimeSlotController {
   constructor(private readonly timeSlotService: TimeSlotService) {}
@@ -33,7 +38,7 @@ export class TimeSlotController {
   @Get('available')
   getAvailableSlots(
     @Query() query: QuerySlotsDto,
-    @CurrentUser('sub') userId: string,
+    @CurrentUser('sub') userId?: string,
   ) {
     return this.timeSlotService.getAvailableSlots(query.date, userId)
   }
@@ -41,7 +46,7 @@ export class TimeSlotController {
   @Get(':id')
   getSlotById(
     @Param('id') id: string,
-    @CurrentUser('sub') userId: string,
+    @CurrentUser('sub') userId?: string,
   ) {
     return this.timeSlotService.getSlotById(id, userId)
   }