diff --git a/functions/submit_order/handler.py b/functions/submit_order/handler.py
index 2704122..d6c6276 100644
--- a/functions/submit_order/handler.py
+++ b/functions/submit_order/handler.py
@@ -65,6 +65,10 @@ def _get_discount_settings() -> tuple[Decimal, Decimal]:
     return _settings
 
 
+def _get_admin_emails() -> set[str]:
+    return {email.lower() for email in get_settings().get("admin_emails", [])}
+
+
 def _google_auth_configured() -> bool:
     return bool(os.environ.get("GOOGLE_CLIENT_ID_PARAM", ""))
 
@@ -147,6 +151,10 @@ def _verify_google_token(token: str) -> tuple[dict | None, str]:
         return None, "invalid"
 
 
+def _authentication_service_unavailable() -> dict:
+    return response(503, {"error": "Authentication service temporarily unavailable"})
+
+
 def _verify_admin(event) -> tuple[dict | None, dict | None]:
     """Verify Google auth and admin access. Returns (user_info, error_response)."""
     if not _google_auth_configured():
@@ -163,14 +171,11 @@ def _verify_admin(event) -> tuple[dict | None, dict | None]:
 
     user_info, status = _verify_google_token(token)
     if status == "unavailable":
-        return None, response(
-            503, {"error": "Authentication service temporarily unavailable"}
-        )
+        return None, _authentication_service_unavailable()
     if user_info is None:
         return None, response(403, {"error": "Invalid or unauthorized Google account"})
 
-    admin_emails = {e.lower() for e in get_settings().get("admin_emails", [])}
-    if user_info["email"].lower() not in admin_emails:
+    if user_info["email"].lower() not in _get_admin_emails():
         return None, response(403, {"error": "Admin access required"})
 
     return user_info, None
@@ -422,21 +427,15 @@ def handle_submit(event):
         client_id = _get_google_client_id()
     except Exception as exc:
         logger.error("SSM fetch failed for Google client ID: %s", exc)
-        return response(
-            503, {"error": "Authentication service temporarily unavailable"}
-        )
+        return _authentication_service_unavailable()
     if not client_id:
         logger.error("Google client ID is unavailable")
-        return response(
-            503, {"error": "Authentication service temporarily unavailable"}
-        )
+        return _authentication_service_unavailable()
     if not google_token:
         return response(403, {"error": "Google authentication is required"})
     user_info, verify_status = _verify_google_token(google_token)
     if verify_status == "unavailable":
-        return response(
-            503, {"error": "Authentication service temporarily unavailable"}
-        )
+        return _authentication_service_unavailable()
     if user_info is None:
         return response(403, {"error": "Invalid or unauthorized Google account"})
     name = user_info["name"]
@@ -453,8 +452,7 @@ def handle_submit(event):
 
     week = current_week()
     status = get_form_status(week)
-    admin_emails = {e.lower() for e in get_settings().get("admin_emails", [])}
-    is_admin_user = email.lower() in admin_emails
+    is_admin_user = email.lower() in _get_admin_emails()
     if status == "closed" and not is_admin_user:
         return response(410, {"error": "Orders are closed for this week"})
     if status == "not_found":
diff --git a/package-lock.json b/package-lock.json
index 42998f0..23f61ca 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,10 +8,10 @@
       "name": "meal-order-manager",
       "version": "1.0.0",
       "devDependencies": {
-        "@eslint/js": "^10.0.1",
-        "eslint": "^10.8.0",
-        "globals": "^17.8.0",
-        "prettier": "^3.9.6"
+        "@eslint/js": "10.0.1",
+        "eslint": "10.8.0",
+        "globals": "17.8.0",
+        "prettier": "3.9.6"
       }
     },
     "node_modules/@eslint-community/eslint-utils": {
diff --git a/package.json b/package.json
index 0f8e333..1fbe656 100644
--- a/package.json
+++ b/package.json
@@ -9,9 +9,9 @@
     "lint:templates": "eslint \"src/server/templates/*.js\""
   },
   "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "eslint": "^10.8.0",
-    "globals": "^17.8.0",
-    "prettier": "^3.9.6"
+    "@eslint/js": "10.0.1",
+    "eslint": "10.8.0",
+    "globals": "17.8.0",
+    "prettier": "3.9.6"
   }
 }
diff --git a/src/server/generate_form.py b/src/server/generate_form.py
index d74c283..26819d2 100644
--- a/src/server/generate_form.py
+++ b/src/server/generate_form.py
@@ -159,7 +159,7 @@ def main():
 
             ssm = boto3.client("ssm")
             resp = ssm.get_parameter(Name="/meal-order-manager/google-client-id")
-            google_client_id = resp["Parameter"]["Value"]
+            google_client_id = resp["Parameter"]["Value"].strip()
         except Exception as exc:
             parser.error(
                 "Google auth is required in cloud mode, but the Google client ID "