diff --git a/packages/auth/package.json b/packages/auth/package.json
index 03dad97..78cbfb4 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -6,7 +6,8 @@
   "exports": {
     ".": "./src/index.ts",
     "./cms": "./src/integrations/cms/index.ts",
-    "./api": "./src/integrations/api/router.ts"
+    "./api": "./src/integrations/api/router.ts",
+    "./di/bind-production": "./src/di/bind-production.ts"
   },
   "scripts": {
     "build": "tsc --noEmit",
diff --git a/packages/auth/src/di/bind-production.ts b/packages/auth/src/di/bind-production.ts
new file mode 100644
index 0000000..3c4904d
--- /dev/null
+++ b/packages/auth/src/di/bind-production.ts
@@ -0,0 +1,12 @@
+import type { SanitizedConfig as _SanitizedConfig } from "payload";
+
+// Auth currently uses Mock repositories even in production: see Plan 3
+// decisions. This helper exists for API symmetry with other features and
+// for forward-compatibility if a Payload-backed users repo is added later.
+//
+// Until then it's a no-op that intentionally accepts (and ignores) the
+// SanitizedConfig argument so app-boot code can call it uniformly.
+export function bindProductionAuth(_config: _SanitizedConfig): void {
+  // Default mock bindings from `module.ts` already loaded by container.ts;
+  // nothing to swap.
+}