diff --git a/src/app/(app)/orders/page.tsx b/src/app/(app)/orders/page.tsx
index 65c9aec..c93cd8a 100644
--- a/src/app/(app)/orders/page.tsx
+++ b/src/app/(app)/orders/page.tsx
@@ -104,12 +104,16 @@ function OrdersReviewModalMount({
     (async () => {
       try {
         const { getOrder, getOrderItems } = await import("@/lib/pb-helpers");
-        const { getAdminPocketBase } = await import("@/lib/server/pocketbase-admin");
-        const adminPb = await getAdminPocketBase();
+        // Use the BROWSER PB instance (not the admin one) — admin PB
+        // requires server-only env vars and would break in the browser
+        // bundle. The user's session PB already has read access to
+        // customers + quote_attachments, so we don't need privileges.
+        const { getPocketBase } = await import("@/lib/pocketbase");
+        const pb = getPocketBase();
         const [order, items, customersResult] = await Promise.all([
           getOrder(orderId),
           getOrderItems(orderId),
-          adminPb.collection("customers").getFullList({
+          pb.collection("customers").getFullList({
             sort: "-created",
             expand: "company",
           }),
@@ -125,7 +129,7 @@ function OrdersReviewModalMount({
           | undefined;
 
         const attachments = quote
-          ? await adminPb
+          ? await pb
               .collection("quote_attachments")
               .getFullList({
                 filter: `quote = "${quote.id}"`,