diff --git a/.env.example b/.env.example
index 7239bb1..e2e5280 100644
--- a/.env.example
+++ b/.env.example
@@ -31,15 +31,26 @@ AUTH_GOOGLE_SECRET=""
 # First admin user email (auto-granted ADMIN role on first login)
 INITIAL_ADMIN_EMAIL="admin@scoutlane.local"
 
+# Optional: restrict Google sign-in to one email domain (e.g. "yourcompany.com").
+# Leave empty to accept any Google account (they land as RECRUITER).
+AUTH_ALLOWED_EMAIL_DOMAIN=""
+
 # ── Application ──────────────────────────────────────────────────────────────
 # Public URL of the deployed app (used for emails, redirects, etc.)
 NEXT_PUBLIC_APP_URL="http://localhost:3000"
 
-# Resume parsing strategy. Defaults to "queue-and-inline".
-#  "queue-and-inline" — parse immediately during submission AND enqueue for redundancy (best dev UX)
+# Resume parsing strategy. Defaults to "queue" (async; applicant never waits).
+#  "queue"            — dispatch via the job runner below (recommended)
+#  "queue-and-inline" — dispatch AND parse immediately during submission (redundant)
 #  "inline"           — parse synchronously during submission (blocks the response)
-#  "queue"            — enqueue only; requires `pnpm worker:resume` running separately
-RESUME_PARSE_MODE="queue-and-inline"
+RESUME_PARSE_MODE="queue"
+
+# Background job runner for resume parsing + email delivery.
+#  "worker" — enqueue to pg-boss; requires `pnpm worker:resume` and `pnpm worker:emails`
+#             running on a long-lived host (Railway/Render/Fly). Default off Vercel.
+#  "inline" — run after the response in the same serverless invocation via next/server
+#             after(); no worker needed. Default on Vercel.
+JOB_RUNNER=""
 
 # ── File Storage (Google Cloud Storage) ──────────────────────────────────────
 # Create a service account at https://console.cloud.google.com/iam-admin/serviceaccounts
@@ -79,9 +90,10 @@ EMAIL_FROM="ScoutLane <onboarding@resend.dev>"
 # Get a key at https://openrouter.ai/keys
 OPENROUTER_API_KEY=""
 
-# Model identifier. `openrouter/auto` keeps parsing available if a provider model is removed.
-OPENROUTER_MODEL="openrouter/owl-alpha"
-OPENROUTER_FALLBACK_MODELS="openrouter/free,openrouter/auto"
+# Model identifier. Defaults to google/gemini-2.5-flash when unset.
+# `openrouter/auto` keeps parsing available if a provider model is removed.
+OPENROUTER_MODEL="google/gemini-2.5-flash"
+OPENROUTER_FALLBACK_MODELS="google/gemini-2.5-flash-lite,openrouter/auto"
 
 # Attribution headers (optional, but help with OpenRouter rate-limit visibility)
 OPENROUTER_APP_URL="http://localhost:3000"
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..fd6029f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,11 @@
+# Binary assets — never apply EOL conversion
+*.pdf binary
+*.docx binary
+*.doc binary
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.woff binary
+*.woff2 binary
diff --git a/docs/SETUP.md b/docs/SETUP.md
index 7dea3bc..e8c9efe 100644
--- a/docs/SETUP.md
+++ b/docs/SETUP.md
@@ -132,7 +132,15 @@ GOOGLE_CLIENT_ID="123456789012-abcdefg.apps.googleusercontent.com"
 GOOGLE_CLIENT_SECRET="GOCSPX-xxxxxxxxxxxxxxxxxxxxx"
 ```
 
-Either pair is accepted. If you set both, `AUTH_GOOGLE_ID` / `AUTH_GOOGLE_SECRET` takes priority.
+Either pair is accepted. If you set both, `AUTH_GOOGLE_ID` / `AUTH_GOOGLE_SECRET` takes priority. **Do not keep both pairs around** — a stale value in the losing convention is the classic cause of `invalid_client` after rotating credentials. The dev server logs a `[auth]` warning when both are set with different values.
+
+Optional: restrict who can sign in by email domain:
+
+```
+AUTH_ALLOWED_EMAIL_DOMAIN="yourcompany.com"
+```
+
+When set, Google sign-ins from any other domain are rejected. Leave unset to accept any Google account (they land as `RECRUITER`).
 
 ```
 AUTH_SECRET="<generate with: openssl rand -base64 32>"
@@ -157,6 +165,13 @@ pnpm dev
 
 If you see "Error 400: redirect_uri_mismatch" the URI you used does not match what is configured in Google Cloud — re-check `NEXT_PUBLIC_APP_URL` and the redirect URIs you saved.
 
+**Troubleshooting `invalid_client` / "OAuth client was not found":**
+
+1. Check the dev server log for the `[auth] Google OAuth using clientId prefix …` line — that prefix must match an OAuth client that still exists under **APIs & Services → Credentials** in the GCP project. If the client was deleted, create a new one (§2.3) and update the env vars.
+2. If the log warns that both `AUTH_GOOGLE_ID` and `GOOGLE_CLIENT_ID` are set with different values, delete the stale one — `AUTH_GOOGLE_ID` wins.
+3. Empty strings count as unset: `AUTH_GOOGLE_ID=""` silently falls back to `GOOGLE_CLIENT_ID`. Keep exactly one pair populated.
+4. On Vercel, set `AUTH_GOOGLE_ID`, `AUTH_GOOGLE_SECRET`, `AUTH_SECRET`, and `NEXT_PUBLIC_APP_URL` in the project's environment variables and redeploy — env edits do not apply to running deployments.
+
 ### 2.6 Disabling the dev provider in production
 
 The dev Credentials provider is only registered when `NODE_ENV === "development"` OR `AUTH_GOOGLE_ID` is empty. In production, **always** set a real `AUTH_GOOGLE_ID` so the dev provider is suppressed.
@@ -177,8 +192,8 @@ Resume parsing uses OpenRouter through the OpenAI-compatible SDK. If `OPENROUTER
 ```
 OPENROUTER_API_KEY="sk-or-v1-xxxxxxxxxxxxxxxxxxxx"
 # Optional. Defaults to the current free OpenRouter fallback used by ScoutLane.
-OPENROUTER_MODEL="openrouter/owl-alpha"
-OPENROUTER_FALLBACK_MODELS="openrouter/free,openrouter/auto"
+OPENROUTER_MODEL="google/gemini-2.5-flash"
+OPENROUTER_FALLBACK_MODELS="google/gemini-2.5-flash-lite,openrouter/auto"
 ```
 
 ### 3.3 What happens when parsing fails
@@ -187,32 +202,43 @@ The applicant row is updated with `parsingStatus="FAILED"` and the error message
 
 ---
 
-## 4. Background workers
+## 4. Background jobs
 
-ScoutLane runs two long-running worker processes off the web server. They cannot run on Vercel serverless — host them on Render, Railway, Fly, or any process supervisor with persistent execution.
+Resume parsing and email delivery go through a job dispatcher (`src/server/jobs/dispatch.ts`) with two execution modes, controlled by `JOB_RUNNER`:
+
+| Mode | How it runs | When |
+|---|---|---|
+| `inline` | After the HTTP response in the same serverless invocation, via `next/server` `after()`. No worker process needed. | **Default on Vercel.** |
+| `worker` | Enqueued to pg-boss; long-running workers process the queue. | **Default elsewhere.** Requires the workers below. |
+
+**Vercel deployments need no worker** — leave `JOB_RUNNER` unset and parsing + emails run inline after each response. Note the inline LLM call is bounded by the function's `maxDuration` (60s on the apply route); if it gets cut, the admin Retry button re-runs parsing.
+
+### Worker mode processes
 
 | Process | Command | Triggered by |
 |---|---|---|
-| Resume parser | `pnpm worker:resume` | New applications → `enqueueResumeParseJob` |
-| Email sender | `pnpm worker:emails` | New applications, admin sends, job alerts → `enqueueEmailJob` |
+| Resume parser | `pnpm worker:resume` | New applications → resume parse jobs |
+| Email sender | `pnpm worker:emails` | New applications → confirmation + admin notification jobs |
 
 Both workers share the same `DATABASE_URL` as the web app (pg-boss stores jobs in PostgreSQL). On startup they create their queues if missing and run forever.
 
-**Resume parsing mode:** `RESUME_PARSE_MODE` controls how resume parsing runs. The default is `"queue-and-inline"` — parsing happens immediately during submission AND gets enqueued for redundancy. In production with high traffic, switch to `"queue"` to avoid blocking application submissions, and run `pnpm worker:resume` on a persistent host.
+**Resume parsing mode:** `RESUME_PARSE_MODE` controls how parsing is triggered on submission. The default is `"queue"` — the applicant never waits; the dispatcher runs it via `JOB_RUNNER`. `"inline"` parses synchronously inside the request (local diagnostics), `"queue-and-inline"` does both.
 
 ### 4.1 Local dev
 
-With the default `RESUME_PARSE_MODE=queue-and-inline`, you only need the email worker for local dev:
+Simplest local setup — no workers at all:
 
 ```
+JOB_RUNNER=inline
 pnpm dev
-pnpm worker:emails
 ```
 
-If you switch to `RESUME_PARSE_MODE=queue`, also start the resume worker:
+Or keep `JOB_RUNNER=worker` (the non-Vercel default) and run both workers:
 
 ```
+pnpm dev
 pnpm worker:resume
+pnpm worker:emails
 ```
 
 ### 4.2 Hosted (recommended on Render)
diff --git a/next.config.ts b/next.config.ts
index a60cb78..32c85e5 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -6,7 +6,14 @@ const nextConfig: NextConfig = {
       bodySizeLimit: "10mb",
     },
   },
-  serverExternalPackages: ["@prisma/client", "pg", "@google-cloud/storage", "pdf-parse"],
+  serverExternalPackages: [
+    "@prisma/client",
+    "pg",
+    "@google-cloud/storage",
+    "pdf-parse",
+    "pdfjs-dist",
+    "@napi-rs/canvas",
+  ],
   async headers() {
     return [
       {
diff --git a/src/app/(admin)/admin/jobs/[id]/applicants/[applicantId]/page.tsx b/src/app/(admin)/admin/jobs/[id]/applicants/[applicantId]/page.tsx
index e3176df..e5e857f 100644
--- a/src/app/(admin)/admin/jobs/[id]/applicants/[applicantId]/page.tsx
+++ b/src/app/(admin)/admin/jobs/[id]/applicants/[applicantId]/page.tsx
@@ -13,7 +13,7 @@ import { ApplicantResumeDataEditor } from "./_components/ApplicantResumeDataEdit
 import { ApplicantCustomFields, type ConfiguredCustomField } from "./_components/ApplicantCustomFields";
 import { DeleteApplicantButton } from "./_components/DeleteApplicantButton";
 import { InterviewDatePicker } from "@/components/applicants/InterviewDatePicker";
-import { canEmbedResume } from "@/lib/resume/preview";
+import { getResumePreviewKind } from "@/lib/resume/preview";
 
 function matchBadgeColor(score: number | null): string {
   if (score === null) return "bg-slate-100 text-slate-500";
@@ -132,7 +132,8 @@ export default async function ApplicantDetailPage({ params }: ApplicantDetailPag
 
   // Decide inline preview by the stored MIME type (resume URLs frequently lack
   // a usable extension), falling back to the URL extension for externally
-  // hosted files. PDFs/text embed; Word documents are download-only.
+  // hosted files. PDFs/text embed natively; Word documents render through the
+  // sanitized HTML preview route.
   const resumeObjectName = applicant.resumeUrl
     ? getResumeObjectName(applicant.resumeUrl)
     : null;
@@ -142,14 +143,19 @@ export default async function ApplicantDetailPage({ params }: ApplicantDetailPag
         select: { contentType: true },
       })
     : null;
+  const resumePreviewKind = applicant.resumeUrl
+    ? getResumePreviewKind({
+        contentType: resumeFile?.contentType,
+        pathname: getResumePathname(applicant.resumeUrl),
+      })
+    : "none";
   const resumeEmbedSrc =
-    applicant.resumeUrl &&
-    canEmbedResume({
-      contentType: resumeFile?.contentType,
-      pathname: getResumePathname(applicant.resumeUrl),
-    })
+    resumePreviewKind === "native"
       ? applicant.resumeUrl
-      : null;
+      : resumePreviewKind === "docx-html" && resumeObjectName
+        ? `/api/resumes/preview/${resumeObjectName}`
+        : null;
+  const resumeEmbedSandbox = resumePreviewKind === "docx-html" ? "" : undefined;
 
   const confidenceColors: Record<string, string> = {
     high: "bg-emerald-100 text-emerald-700",
@@ -295,6 +301,7 @@ export default async function ApplicantDetailPage({ params }: ApplicantDetailPag
                 <iframe
                   title={`${applicant.name} resume`}
                   src={resumeEmbedSrc}
+                  sandbox={resumeEmbedSandbox}
                   className="h-[720px] w-full bg-white"
                 />
               </div>
diff --git a/src/app/(public)/careers/[slug]/page.tsx b/src/app/(public)/careers/[slug]/page.tsx
index 8622318..286b5e8 100644
--- a/src/app/(public)/careers/[slug]/page.tsx
+++ b/src/app/(public)/careers/[slug]/page.tsx
@@ -9,6 +9,10 @@ import type { Metadata } from "next";
 import Link from "next/link";
 import { MapPin, Briefcase, DollarSign, ArrowLeft, Building, LogIn } from "lucide-react";
 
+// Inline job runner work (resume parse + email sends via after()) can outlive
+// the default serverless duration; give the apply action room to finish.
+export const maxDuration = 60;
+
 interface Props {
   params: Promise<{ slug: string }>;
 }
diff --git a/src/app/api/admin/jobs/parse-retry/[applicantId]/route.ts b/src/app/api/admin/jobs/parse-retry/[applicantId]/route.ts
index 5ff6434..dcb8577 100644
--- a/src/app/api/admin/jobs/parse-retry/[applicantId]/route.ts
+++ b/src/app/api/admin/jobs/parse-retry/[applicantId]/route.ts
@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/db/prisma";
 import { auth } from "@/lib/auth/auth";
 import { parseApplicantResumeFromUrl } from "@/lib/resume/parseApplicantResume";
-import { enqueueResumeParseJob } from "@/server/queues/resume";
+import { dispatchResumeParse } from "@/server/jobs/dispatch";
 
 export const runtime = "nodejs";
 export const maxDuration = 60;
@@ -47,7 +47,7 @@ export async function POST(
       return NextResponse.json({ success: true, status: "COMPLETED" });
     }
 
-    await enqueueResumeParseJob({ applicantId, resumeUrl: applicant.resumeUrl });
+    await dispatchResumeParse({ applicantId, resumeUrl: applicant.resumeUrl });
     return NextResponse.json({ success: true, status: "PENDING" });
   } catch (error) {
     console.error("[parse-retry] parse failed:", error);
diff --git a/src/app/api/resumes/[...objectName]/route.ts b/src/app/api/resumes/[...objectName]/route.ts
index fb919a6..1cbe5cb 100644
--- a/src/app/api/resumes/[...objectName]/route.ts
+++ b/src/app/api/resumes/[...objectName]/route.ts
@@ -1,65 +1,48 @@
-import { readFile, stat } from "node:fs/promises";
-import path from "node:path";
 import { NextRequest, NextResponse } from "next/server";
-import { prisma } from "@/lib/db/prisma";
-import { LOCAL_RESUME_STORAGE_DIR } from "@/lib/storage/upload";
+import { canEmbedResume } from "@/lib/resume/preview";
+import { buildContentDisposition, readResumeObject } from "@/lib/resume/storage-read";
 
 export const dynamic = "force-dynamic";
 
-const CONTENT_TYPES: Record<string, string> = {
-  ".doc": "application/msword",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".pdf": "application/pdf",
-  ".csv": "text/csv; charset=utf-8",
-};
-
-function resolveLocalResumePath(parts: string[]): string | null {
-  const root = path.resolve(LOCAL_RESUME_STORAGE_DIR);
-  const filePath = path.resolve(root, ...parts);
-  return filePath === root || !filePath.startsWith(`${root}${path.sep}`) ? null : filePath;
-}
-
 export async function GET(
-  _request: NextRequest,
+  request: NextRequest,
   { params }: { params: Promise<{ objectName: string[] }> },
 ) {
   const { objectName } = await params;
   const storedObjectName = objectName.join("/");
-  const filePath = resolveLocalResumePath(objectName);
-
-  if (!filePath) {
-    return NextResponse.json({ error: "Invalid resume path" }, { status: 400 });
-  }
 
+  let resume;
   try {
-    const [file, info] = await Promise.all([readFile(filePath), stat(filePath)]);
-    const ext = path.extname(filePath).toLowerCase();
-
-    return new NextResponse(file, {
-      headers: {
-        "Cache-Control": "private, max-age=0, no-cache",
-        "Content-Length": String(info.size),
-        "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
-        "X-Content-Type-Options": "nosniff",
-      },
-    });
+    resume = await readResumeObject(storedObjectName);
   } catch {
-    const stored = await prisma.resumeFile.findUnique({
-      where: { objectName: storedObjectName },
-      select: { contentType: true, data: true, size: true },
-    });
-
-    if (!stored) {
-      return NextResponse.json({ error: "Resume not found" }, { status: 404 });
-    }
+    return NextResponse.json({ error: "Invalid resume path" }, { status: 400 });
+  }
 
-    return new NextResponse(Buffer.from(stored.data), {
-      headers: {
-        "Cache-Control": "private, max-age=0, no-cache",
-        "Content-Length": String(stored.size),
-        "Content-Type": stored.contentType,
-        "X-Content-Type-Options": "nosniff",
+  if (!resume) {
+    return NextResponse.json(
+      {
+        error:
+          "Resume file not found. It may have been uploaded in a different environment or before durable storage was enabled.",
       },
-    });
+      { status: 404 },
+    );
   }
+
+  // request.nextUrl is absent when invoked with a plain Request (e.g. tests).
+  const requestUrl = request.nextUrl ?? new URL(request.url);
+  const forceDownload = requestUrl.searchParams.get("download") === "1";
+  const disposition =
+    !forceDownload && canEmbedResume({ contentType: resume.contentType })
+      ? "inline"
+      : "attachment";
+
+  return new NextResponse(new Uint8Array(resume.buffer), {
+    headers: {
+      "Cache-Control": "private, max-age=0, no-cache",
+      "Content-Disposition": buildContentDisposition(disposition, resume.filename),
+      "Content-Length": String(resume.size),
+      "Content-Type": resume.contentType,
+      "X-Content-Type-Options": "nosniff",
+    },
+  });
 }
diff --git a/src/app/api/resumes/preview/[...objectName]/route.ts b/src/app/api/resumes/preview/[...objectName]/route.ts
new file mode 100644
index 0000000..5465853
--- /dev/null
+++ b/src/app/api/resumes/preview/[...objectName]/route.ts
@@ -0,0 +1,77 @@
+import { NextRequest, NextResponse } from "next/server";
+import { prisma } from "@/lib/db/prisma";
+import { auth } from "@/lib/auth/auth";
+import { convertDocxToSafeHtml } from "@/lib/resume/docx-preview";
+import { readResumeObject } from "@/lib/resume/storage-read";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+const DOCX_CONTENT_TYPE =
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+
+/**
+ * Renders a stored DOCX resume as sanitized HTML for the admin inline preview.
+ * The middleware matcher excludes /api/resumes, so authentication is enforced
+ * here: a signed-in user with an organization is required.
+ */
+export async function GET(
+  _request: NextRequest,
+  { params }: { params: Promise<{ objectName: string[] }> },
+) {
+  const session = await auth();
+  if (!session?.user?.email) {
+    return NextResponse.json({ error: "Not authenticated" }, { status: 401 });
+  }
+
+  const user = await prisma.user.findUnique({
+    where: { email: session.user.email },
+    select: { organizationId: true },
+  });
+  if (!user?.organizationId) {
+    return NextResponse.json({ error: "Not authorized" }, { status: 403 });
+  }
+
+  const { objectName } = await params;
+  const storedObjectName = objectName.join("/");
+
+  let resume;
+  try {
+    resume = await readResumeObject(storedObjectName);
+  } catch {
+    return NextResponse.json({ error: "Invalid resume path" }, { status: 400 });
+  }
+
+  if (!resume) {
+    return NextResponse.json({ error: "Resume file not found." }, { status: 404 });
+  }
+
+  const baseContentType = resume.contentType.split(";")[0]?.trim().toLowerCase();
+  const isDocx =
+    baseContentType === DOCX_CONTENT_TYPE || /\.docx$/i.test(resume.filename);
+  if (!isDocx) {
+    return NextResponse.json(
+      { error: "Preview is only available for .docx resumes." },
+      { status: 415 },
+    );
+  }
+
+  try {
+    const html = await convertDocxToSafeHtml(resume.buffer);
+    return new NextResponse(html, {
+      headers: {
+        "Cache-Control": "private, max-age=0, no-cache",
+        "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'",
+        "Content-Type": "text/html; charset=utf-8",
+        "X-Content-Type-Options": "nosniff",
+        "X-Frame-Options": "SAMEORIGIN",
+      },
+    });
+  } catch (error) {
+    console.error("[resume-preview] docx conversion failed:", error);
+    return NextResponse.json(
+      { error: "Could not generate a preview for this document." },
+      { status: 500 },
+    );
+  }
+}
diff --git a/src/lib/auth/auth.config.ts b/src/lib/auth/auth.config.ts
index 5a85270..17274ad 100644
--- a/src/lib/auth/auth.config.ts
+++ b/src/lib/auth/auth.config.ts
@@ -47,6 +47,27 @@ export function logGoogleAuthDiagnostics(): void {
   if (process.env.NODE_ENV !== "development") return;
   const { clientId, clientSecret, idSource, secretSource } = resolveGoogleCredentials();
   if (!clientId && !clientSecret) return; // dev-login-only setup; nothing to report
+
+  // A stale value in the losing convention is a classic source of
+  // invalid_client: the dev edits one var while the other (older) one wins
+  // in a different environment. Never log the values themselves.
+  const authId = process.env.AUTH_GOOGLE_ID?.trim();
+  const legacyId = process.env.GOOGLE_CLIENT_ID?.trim();
+  if (authId && legacyId && authId !== legacyId) {
+    console.warn(
+      "[auth] Both AUTH_GOOGLE_ID and GOOGLE_CLIENT_ID are set with different values; " +
+        "AUTH_GOOGLE_ID wins. Remove the stale variable to avoid invalid_client surprises.",
+    );
+  }
+  const authSecret = process.env.AUTH_GOOGLE_SECRET?.trim();
+  const legacySecret = process.env.GOOGLE_CLIENT_SECRET?.trim();
+  if (authSecret && legacySecret && authSecret !== legacySecret) {
+    console.warn(
+      "[auth] Both AUTH_GOOGLE_SECRET and GOOGLE_CLIENT_SECRET are set with different values; " +
+        "AUTH_GOOGLE_SECRET wins. Remove the stale variable.",
+    );
+  }
+
   const idPrefix = clientId ? `${clientId.split("-")[0]}…(${clientId.length} chars)` : "(empty)";
   if (!clientId || !clientSecret) {
     console.warn(
diff --git a/src/lib/auth/sign-in.test.ts b/src/lib/auth/sign-in.test.ts
index 499e83b..cb50700 100644
--- a/src/lib/auth/sign-in.test.ts
+++ b/src/lib/auth/sign-in.test.ts
@@ -1,14 +1,15 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
-const { userUpsert, orgFindFirst, orgCreate } = vi.hoisted(() => ({
+const { userUpsert, userFindUnique, orgFindFirst, orgCreate } = vi.hoisted(() => ({
   userUpsert: vi.fn(),
+  userFindUnique: vi.fn(),
   orgFindFirst: vi.fn(),
   orgCreate: vi.fn(),
 }));
 
 vi.mock("@/lib/db/prisma", () => ({
   prisma: {
-    user: { upsert: userUpsert },
+    user: { upsert: userUpsert, findUnique: userFindUnique },
     organization: { findFirst: orgFindFirst, create: orgCreate },
   },
 }));
@@ -17,10 +18,13 @@ import { handleSignIn } from "./sign-in";
 
 beforeEach(() => {
   userUpsert.mockReset();
+  userFindUnique.mockReset();
   orgFindFirst.mockReset();
   orgCreate.mockReset();
   orgFindFirst.mockResolvedValue({ id: "org-1" });
+  userFindUnique.mockResolvedValue(null);
   userUpsert.mockResolvedValue({ id: "u1", email: "dev@scoutlane.local", role: "ADMIN" });
+  delete process.env.AUTH_ALLOWED_EMAIL_DOMAIN;
 });
 
 describe("handleSignIn — dev provider", () => {
@@ -78,11 +82,80 @@ describe("handleSignIn — Google provider", () => {
         user: { email: "boss@scoutlane.com", name: "Boss" },
         account: { provider: "google" },
       });
-      expect(userUpsert).toHaveBeenCalledWith(
-        expect.objectContaining({ where: { email: "boss@scoutlane.com" } }),
-      );
+      const arg = userUpsert.mock.calls[0][0];
+      expect(arg.where).toEqual({ email: "boss@scoutlane.com" });
+      expect(arg.create).toEqual(expect.objectContaining({ role: "ADMIN" }));
+      expect(arg.update).toEqual(expect.objectContaining({ role: "ADMIN" }));
     } finally {
       delete process.env.INITIAL_ADMIN_EMAIL;
     }
   });
+
+  it("upserts a regular Google user as RECRUITER with an organization attached", async () => {
+    const ok = await handleSignIn({
+      user: { email: "Jane@Example.com", name: "Jane" },
+      account: { provider: "google" },
+    });
+
+    expect(ok).toBe(true);
+    const arg = userUpsert.mock.calls[0][0];
+    expect(arg.where).toEqual({ email: "jane@example.com" });
+    expect(arg.create).toEqual(
+      expect.objectContaining({ role: "RECRUITER", organizationId: "org-1" }),
+    );
+    expect(arg.update).not.toHaveProperty("role");
+  });
+
+  it("never reassigns an existing organization membership", async () => {
+    userFindUnique.mockResolvedValue({ organizationId: "org-existing" });
+
+    await handleSignIn({
+      user: { email: "jane@example.com" },
+      account: { provider: "google" },
+    });
+
+    const arg = userUpsert.mock.calls[0][0];
+    expect(arg.update).not.toHaveProperty("organizationId");
+    expect(orgFindFirst).not.toHaveBeenCalled();
+  });
+
+  it("attaches an organization to a user that has none", async () => {
+    userFindUnique.mockResolvedValue({ organizationId: null });
+
+    await handleSignIn({
+      user: { email: "jane@example.com" },
+      account: { provider: "google" },
+    });
+
+    const arg = userUpsert.mock.calls[0][0];
+    expect(arg.update).toEqual(expect.objectContaining({ organizationId: "org-1" }));
+  });
+
+  it("does not block sign-in when the DB is unavailable", async () => {
+    userFindUnique.mockRejectedValue(new Error("db down"));
+
+    const ok = await handleSignIn({
+      user: { email: "jane@example.com" },
+      account: { provider: "google" },
+    });
+
+    expect(ok).toBe(true);
+  });
+
+  it("rejects emails outside AUTH_ALLOWED_EMAIL_DOMAIN when set", async () => {
+    process.env.AUTH_ALLOWED_EMAIL_DOMAIN = "scoutlane.com";
+
+    const rejected = await handleSignIn({
+      user: { email: "stranger@gmail.com" },
+      account: { provider: "google" },
+    });
+    const allowed = await handleSignIn({
+      user: { email: "jane@scoutlane.com" },
+      account: { provider: "google" },
+    });
+
+    expect(rejected).toBe(false);
+    expect(allowed).toBe(true);
+    expect(userUpsert).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/src/lib/auth/sign-in.ts b/src/lib/auth/sign-in.ts
index a5e2132..53cbbd8 100644
--- a/src/lib/auth/sign-in.ts
+++ b/src/lib/auth/sign-in.ts
@@ -24,13 +24,21 @@ async function resolveOrganizationId(): Promise<string | null> {
   return created.id;
 }
 
+function getAllowedEmailDomain(): string | undefined {
+  return process.env.AUTH_ALLOWED_EMAIL_DOMAIN?.toLowerCase().trim().replace(/^@/, "") || undefined;
+}
+
 /**
  * NextAuth `signIn` callback logic, extracted for unit testing.
  *
  * - Dev Credentials provider: upsert an ADMIN `User` row (and an org) so admin
  *   Server Actions that look up the user by email always succeed locally. A DB
  *   failure here must never block dev sign-in.
- * - Google provider: promote `INITIAL_ADMIN_EMAIL` to ADMIN on first login.
+ * - Google provider: optionally gate by `AUTH_ALLOWED_EMAIL_DOMAIN`, promote
+ *   `INITIAL_ADMIN_EMAIL` to ADMIN, and upsert every signed-in user with an
+ *   organization attached (the Prisma adapter creates users without one, which
+ *   breaks org-scoped routes). Existing roles and org memberships are never
+ *   downgraded or reassigned.
  */
 export async function handleSignIn({ user, account }: SignInParams): Promise<boolean> {
   const email = user.email?.toLowerCase().trim();
@@ -58,22 +66,41 @@ export async function handleSignIn({ user, account }: SignInParams): Promise<boo
 
   if (!email) return false;
 
+  const allowedDomain = getAllowedEmailDomain();
+  if (allowedDomain && !email.endsWith(`@${allowedDomain}`)) {
+    return false;
+  }
+
   const initialAdminEmail = getInitialAdminEmail();
-  if (initialAdminEmail && email === initialAdminEmail) {
-    try {
-      await prisma.user.upsert({
-        where: { email },
-        create: {
-          email,
-          name: user.name ?? null,
-          image: user.image ?? null,
-          role: "ADMIN",
-        },
-        update: { role: "ADMIN" },
-      });
-    } catch {
-      return true;
-    }
+  const isInitialAdmin = Boolean(initialAdminEmail && email === initialAdminEmail);
+
+  try {
+    const existing = await prisma.user.findUnique({
+      where: { email },
+      select: { organizationId: true },
+    });
+    const organizationId = existing?.organizationId ?? (await resolveOrganizationId());
+
+    await prisma.user.upsert({
+      where: { email },
+      create: {
+        email,
+        name: user.name ?? null,
+        image: user.image ?? null,
+        role: isInitialAdmin ? "ADMIN" : "RECRUITER",
+        ...(organizationId ? { organizationId } : {}),
+      },
+      update: {
+        // Never downgrade an existing role; only the initial admin is promoted.
+        ...(isInitialAdmin ? { role: "ADMIN" as const } : {}),
+        // Attach an org only when the user has none; never reassign membership.
+        ...(existing && !existing.organizationId && organizationId ? { organizationId } : {}),
+      },
+    });
+  } catch {
+    // A transient DB error must not block OAuth sign-in; the JWT callback
+    // falls back to the default RECRUITER role.
+    return true;
   }
   return true;
 }
diff --git a/src/lib/llm/openrouter.test.ts b/src/lib/llm/openrouter.test.ts
index 541cb57..d03f76c 100644
--- a/src/lib/llm/openrouter.test.ts
+++ b/src/lib/llm/openrouter.test.ts
@@ -22,10 +22,10 @@ afterEach(() => {
 });
 
 describe("OpenRouter model selection", () => {
-  it("uses a current free OpenRouter model as the default model", () => {
+  it("uses Gemini 2.5 Flash as the default model", () => {
     delete process.env.OPENROUTER_MODEL;
 
-    expect(getOpenRouterModel()).toBe("openrouter/owl-alpha");
+    expect(getOpenRouterModel()).toBe("google/gemini-2.5-flash");
   });
 
   it("deduplicates configured models and keeps built-in fallbacks", () => {
@@ -36,8 +36,8 @@ describe("OpenRouter model selection", () => {
       "model-a",
       "model-b",
       "openrouter/auto",
-      "openrouter/owl-alpha",
-      "openrouter/free",
+      "google/gemini-2.5-flash",
+      "google/gemini-2.5-flash-lite",
     ]);
   });
 });
diff --git a/src/lib/llm/openrouter.ts b/src/lib/llm/openrouter.ts
index 03856e0..7b7ec32 100644
--- a/src/lib/llm/openrouter.ts
+++ b/src/lib/llm/openrouter.ts
@@ -4,8 +4,8 @@ let cached: OpenAI | null | undefined;
 
 type ChatMessage = OpenAI.Chat.Completions.ChatCompletionMessageParam;
 
-const DEFAULT_OPENROUTER_MODEL = "openrouter/owl-alpha";
-const BUILT_IN_FALLBACK_MODELS = ["openrouter/free", "openrouter/auto"];
+const DEFAULT_OPENROUTER_MODEL = "google/gemini-2.5-flash";
+const BUILT_IN_FALLBACK_MODELS = ["google/gemini-2.5-flash-lite", "openrouter/auto"];
 const DEFAULT_OPENROUTER_TIMEOUT_MS = 20_000;
 
 export function getOpenRouterClient(): OpenAI | null {
diff --git a/src/lib/llm/resume.ts b/src/lib/llm/resume.ts
index 0776f6f..034e6a9 100644
--- a/src/lib/llm/resume.ts
+++ b/src/lib/llm/resume.ts
@@ -67,6 +67,9 @@ For confidence: use "high" when the field is clearly stated in the resume,
 If a field is null, set its confidence to "low".
 
 Only use information present in the resume. Use null or empty arrays when missing.
+Output exactly the listed keys and no others.
+Lowercase the email. graduationYear must be a 4-digit year string when known.
+Deduplicate skills and use canonical names (e.g. "TypeScript", not "typescript" or "TS").
 
 Resume:
 `;
diff --git a/src/lib/resume/__fixtures__/sample-resume.docx b/src/lib/resume/__fixtures__/sample-resume.docx
new file mode 100644
index 0000000..3aa36af
Binary files /dev/null and b/src/lib/resume/__fixtures__/sample-resume.docx differ
diff --git a/src/lib/resume/__fixtures__/sample-resume.pdf b/src/lib/resume/__fixtures__/sample-resume.pdf
new file mode 100644
index 0000000..cbccaad
Binary files /dev/null and b/src/lib/resume/__fixtures__/sample-resume.pdf differ
diff --git a/src/lib/resume/docx-preview.test.ts b/src/lib/resume/docx-preview.test.ts
new file mode 100644
index 0000000..01e7270
--- /dev/null
+++ b/src/lib/resume/docx-preview.test.ts
@@ -0,0 +1,45 @@
+// @vitest-environment node
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it, vi } from "vitest";
+
+import { convertDocxToSafeHtml } from "./docx-preview";
+
+const FIXTURE_DOCX = join(__dirname, "__fixtures__", "sample-resume.docx");
+
+describe("convertDocxToSafeHtml", () => {
+  it("converts the committed DOCX fixture to an HTML document", async () => {
+    const html = await convertDocxToSafeHtml(readFileSync(FIXTURE_DOCX));
+
+    expect(html).toContain("<!DOCTYPE html>");
+    expect(html).toContain("SCOUTLANE DOCX FIXTURE");
+    expect(html).toContain("Skills: TypeScript, SQL, Python");
+  });
+
+  it("strips scripts, event handlers, and javascript: links", async () => {
+    vi.doMock("mammoth", () => ({
+      default: {
+        convertToHtml: vi.fn().mockResolvedValue({
+          value:
+            '<p onclick="alert(1)">hi</p><script>alert(2)</script>' +
+            '<a href="javascript:alert(3)">bad</a><a href="https://example.com">ok</a>' +
+            '<img src="x" onerror="alert(4)" />',
+        }),
+      },
+    }));
+    vi.resetModules();
+    const { convertDocxToSafeHtml: convert } = await import("./docx-preview");
+
+    const html = await convert(Buffer.from("ignored"));
+
+    expect(html).not.toContain("<script");
+    expect(html).not.toContain("onclick");
+    expect(html).not.toContain("javascript:");
+    expect(html).not.toContain("<img");
+    expect(html).toContain('href="https://example.com"');
+    expect(html).toContain('rel="noreferrer"');
+
+    vi.doUnmock("mammoth");
+    vi.resetModules();
+  });
+});
diff --git a/src/lib/resume/docx-preview.ts b/src/lib/resume/docx-preview.ts
new file mode 100644
index 0000000..be1336d
--- /dev/null
+++ b/src/lib/resume/docx-preview.ts
@@ -0,0 +1,80 @@
+import mammoth from "mammoth";
+import sanitizeHtml from "sanitize-html";
+
+const ALLOWED_TAGS = [
+  "p",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "ul",
+  "ol",
+  "li",
+  "table",
+  "thead",
+  "tbody",
+  "tr",
+  "td",
+  "th",
+  "strong",
+  "em",
+  "b",
+  "i",
+  "u",
+  "s",
+  "br",
+  "a",
+  "blockquote",
+];
+
+const BASE_STYLES = `
+  body {
+    font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif;
+    font-size: 14px;
+    line-height: 1.6;
+    color: #0f172a;
+    max-width: 48rem;
+    margin: 0 auto;
+    padding: 2rem 1.5rem;
+    background: #ffffff;
+  }
+  h1, h2, h3, h4, h5, h6 { line-height: 1.3; margin: 1.2em 0 0.4em; }
+  table { border-collapse: collapse; width: 100%; }
+  td, th { border: 1px solid #e2e8f0; padding: 0.35rem 0.5rem; text-align: left; }
+  a { color: #4338ca; }
+`;
+
+/**
+ * Converts DOCX bytes to a self-contained, sanitized HTML document suitable
+ * for rendering inside a sandboxed iframe. Scripts, event handlers, images,
+ * and non-https/mailto links are stripped.
+ */
+export async function convertDocxToSafeHtml(buffer: Buffer): Promise<string> {
+  const result = await mammoth.convertToHtml({ buffer });
+
+  const safeBody = sanitizeHtml(result.value ?? "", {
+    allowedTags: ALLOWED_TAGS,
+    allowedAttributes: {
+      a: ["href", "rel", "target"],
+      td: ["colspan", "rowspan"],
+      th: ["colspan", "rowspan"],
+    },
+    allowedSchemes: ["https", "mailto"],
+    transformTags: {
+      a: sanitizeHtml.simpleTransform("a", { rel: "noreferrer", target: "_blank" }),
+    },
+    disallowedTagsMode: "discard",
+  });
+
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<style>${BASE_STYLES}</style>
+</head>
+<body>${safeBody}</body>
+</html>`;
+}
diff --git a/src/lib/resume/extractText.test.ts b/src/lib/resume/extractText.test.ts
index 3db579c..d9539d9 100644
--- a/src/lib/resume/extractText.test.ts
+++ b/src/lib/resume/extractText.test.ts
@@ -5,11 +5,20 @@ import { describe, expect, it } from "vitest";
 
 import { extractTextFromResumeBuffer } from "./extractText";
 
+const FIXTURE_PDF = join(__dirname, "__fixtures__", "sample-resume.pdf");
 const SAMPLE_PDF = join(process.cwd(), "docs", "samples of resumes", "sanaa_syed_resume.pdf");
 
 describe("extractTextFromResumeBuffer", () => {
+  it("extracts text from the committed PDF fixture", async () => {
+    const fixture = readFileSync(FIXTURE_PDF);
+
+    await expect(extractTextFromResumeBuffer(fixture, "resume.pdf")).resolves.toContain(
+      "SCOUTLANE FIXTURE RESUME",
+    );
+  });
+
   it.skipIf(!existsSync(SAMPLE_PDF))(
-    "extracts text through the Node pdf-parse build",
+    "extracts text from a real local sample resume",
     async () => {
       const sample = readFileSync(SAMPLE_PDF);
 
diff --git a/src/lib/resume/extractText.ts b/src/lib/resume/extractText.ts
index 98ae197..935a111 100644
--- a/src/lib/resume/extractText.ts
+++ b/src/lib/resume/extractText.ts
@@ -1,18 +1,26 @@
-import { createRequire } from "node:module";
 import mammoth from "mammoth";
 
-const require = createRequire(import.meta.url);
+type PdfParseCtor = new (input: { data: Uint8Array }) => {
+  getText: () => Promise<{ text?: string }>;
+  destroy?: () => Promise<void> | void;
+};
 
 type PdfParseModule = {
-  default?: (data: Buffer) => Promise<{ text?: string }>;
-  PDFParse?: {
-    new (input: { data: Uint8Array }): {
-      getText: () => Promise<{ text?: string }>;
-      destroy?: () => Promise<void> | void;
-    };
-  };
+  default?: ((data: Buffer) => Promise<{ text?: string }>) | { PDFParse?: PdfParseCtor };
+  PDFParse?: PdfParseCtor;
 };
 
+// pdf-parse is listed in next.config.ts `serverExternalPackages`, so both
+// webpack and Turbopack leave this dynamic import external and Node resolves
+// the real package at runtime. (A createRequire(import.meta.url) + require()
+// combo broke under the Next bundler — see commit history.)
+let pdfParsePromise: Promise<PdfParseModule> | null = null;
+
+function loadPdfParse(): Promise<PdfParseModule> {
+  pdfParsePromise ??= import("pdf-parse") as Promise<PdfParseModule>;
+  return pdfParsePromise;
+}
+
 function extension(filename: string): string {
   const base = filename.split(/[/\\]/).pop() ?? filename;
   const i = base.lastIndexOf(".");
@@ -35,15 +43,15 @@ export async function extractTextFromResumeBuffer(buffer: Buffer, filename: stri
   }
 
   if (ext === "pdf") {
-    const mod = require("pdf-parse") as PdfParseModule;
-    const legacyParse = mod.default;
+    const mod = await loadPdfParse();
 
-    if (typeof legacyParse === "function") {
-      const parsed = await legacyParse(buffer);
+    if (typeof mod.default === "function") {
+      const parsed = await mod.default(buffer);
       return (parsed.text ?? "").trim();
     }
 
-    const PDFParse = mod.PDFParse;
+    const PDFParse =
+      mod.PDFParse ?? (typeof mod.default === "object" ? mod.default?.PDFParse : undefined);
     if (!PDFParse) {
       throw new Error("PDF parser is unavailable.");
     }
diff --git a/src/lib/resume/parseApplicantResume.ts b/src/lib/resume/parseApplicantResume.ts
index c6dcf86..74240e1 100644
--- a/src/lib/resume/parseApplicantResume.ts
+++ b/src/lib/resume/parseApplicantResume.ts
@@ -1,11 +1,9 @@
-import { readFile } from "node:fs/promises";
-import path from "node:path";
 import type { Prisma } from "@/generated/prisma/client";
 import { prisma } from "@/lib/db/prisma";
 import { extractTextFromResumeBuffer } from "@/lib/resume/extractText";
+import { readResumeObject } from "@/lib/resume/storage-read";
 import { parseResumeFromText, type ParsedResume } from "@/lib/llm/resume";
 import { scoreApplicantInline } from "@/lib/match/scoreApplicant";
-import { LOCAL_RESUME_STORAGE_DIR } from "@/lib/storage/upload";
 
 const MAX_PARSING_ERROR_LENGTH = 240;
 const PARSING_SECRET_PATTERNS: ReadonlyArray<RegExp> = [
@@ -109,36 +107,17 @@ function getResumeObjectName(resumeUrl: string): string | null {
     : null;
 }
 
-function resolveLocalResumePath(objectName: string): string | null {
-  const root = path.resolve(LOCAL_RESUME_STORAGE_DIR);
-  const filePath = path.resolve(root, ...objectName.split("/"));
-  return filePath === root || !filePath.startsWith(`${root}${path.sep}`) ? null : filePath;
-}
-
 async function readStoredResume(
   resumeUrl: string,
 ): Promise<{ buffer: Buffer; filename: string } | null> {
   const objectName = getResumeObjectName(resumeUrl);
   if (!objectName) return null;
 
-  const filePath = resolveLocalResumePath(objectName);
-  if (!filePath) {
-    throw new Error("Invalid resume path.");
-  }
-
-  const filename = objectName.split("/").pop() || "resume.pdf";
-  try {
-    return { buffer: await readFile(filePath), filename };
-  } catch {
-    const stored = await prisma.resumeFile.findUnique({
-      where: { objectName },
-      select: { data: true },
-    });
-    if (!stored) {
-      throw new Error("Could not load stored resume.");
-    }
-    return { buffer: Buffer.from(stored.data), filename };
+  const stored = await readResumeObject(objectName);
+  if (!stored) {
+    throw new Error("Could not load stored resume.");
   }
+  return { buffer: stored.buffer, filename: stored.filename };
 }
 
 export async function parseApplicantResumeFromBuffer(
diff --git a/src/lib/resume/preview.test.ts b/src/lib/resume/preview.test.ts
index 6bb8e28..eeb6c84 100644
--- a/src/lib/resume/preview.test.ts
+++ b/src/lib/resume/preview.test.ts
@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { canEmbedResume } from "@/lib/resume/preview";
+import { canEmbedResume, getResumePreviewKind } from "@/lib/resume/preview";
 
 describe("canEmbedResume", () => {
   it("embeds PDFs by content type even when the URL has no extension", () => {
@@ -39,3 +39,32 @@ describe("canEmbedResume", () => {
     expect(canEmbedResume({ contentType: "", pathname: "/files/resume" })).toBe(false);
   });
 });
+
+describe("getResumePreviewKind", () => {
+  const DOCX_MIME =
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+
+  it("returns native for embeddable content types", () => {
+    expect(getResumePreviewKind({ contentType: "application/pdf" })).toBe("native");
+    expect(getResumePreviewKind({ contentType: "text/plain" })).toBe("native");
+  });
+
+  it("returns docx-html for docx by content type", () => {
+    expect(getResumePreviewKind({ contentType: DOCX_MIME })).toBe("docx-html");
+    expect(getResumePreviewKind({ contentType: `${DOCX_MIME}; charset=binary` })).toBe(
+      "docx-html",
+    );
+  });
+
+  it("returns docx-html for .docx extension when content type is unknown", () => {
+    expect(
+      getResumePreviewKind({ contentType: null, pathname: "/files/resume.docx" }),
+    ).toBe("docx-html");
+  });
+
+  it("returns none for legacy .doc and unknown formats", () => {
+    expect(getResumePreviewKind({ contentType: "application/msword" })).toBe("none");
+    expect(getResumePreviewKind({ contentType: "", pathname: "/files/resume" })).toBe("none");
+    expect(getResumePreviewKind({})).toBe("none");
+  });
+});
diff --git a/src/lib/resume/preview.ts b/src/lib/resume/preview.ts
index b2c8122..3af7614 100644
--- a/src/lib/resume/preview.ts
+++ b/src/lib/resume/preview.ts
@@ -19,6 +19,36 @@ const EMBEDDABLE_CONTENT_TYPES: ReadonlySet<string> = new Set([
 
 const EMBEDDABLE_EXTENSIONS = /\.(pdf|csv|txt)$/i;
 
+const DOCX_CONTENT_TYPES: ReadonlySet<string> = new Set([
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+]);
+
+const DOCX_EXTENSION = /\.docx$/i;
+
+export type ResumePreviewKind = "native" | "docx-html" | "none";
+
+/**
+ * Decides how the admin UI previews a resume: `native` renders the original
+ * file in an iframe (PDF/text), `docx-html` renders the server-converted HTML
+ * preview route, `none` falls back to download-only.
+ */
+export function getResumePreviewKind(input: {
+  contentType?: string | null;
+  pathname?: string | null;
+}): ResumePreviewKind {
+  if (canEmbedResume(input)) {
+    return "native";
+  }
+  const contentType = input.contentType?.split(";")[0]?.trim().toLowerCase();
+  if (contentType && DOCX_CONTENT_TYPES.has(contentType)) {
+    return "docx-html";
+  }
+  if (!contentType && input.pathname && DOCX_EXTENSION.test(input.pathname)) {
+    return "docx-html";
+  }
+  return "none";
+}
+
 export function canEmbedResume(input: {
   contentType?: string | null;
   pathname?: string | null;
diff --git a/src/lib/resume/storage-read.test.ts b/src/lib/resume/storage-read.test.ts
new file mode 100644
index 0000000..bb0f880
--- /dev/null
+++ b/src/lib/resume/storage-read.test.ts
@@ -0,0 +1,93 @@
+// @vitest-environment node
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { readFileMock, findUniqueMock } = vi.hoisted(() => ({
+  readFileMock: vi.fn(),
+  findUniqueMock: vi.fn(),
+}));
+
+vi.mock("node:fs/promises", () => ({
+  readFile: readFileMock,
+}));
+
+vi.mock("@/lib/db/prisma", () => ({
+  prisma: { resumeFile: { findUnique: findUniqueMock } },
+}));
+
+import {
+  buildContentDisposition,
+  readResumeObject,
+  resolveLocalResumePath,
+} from "./storage-read";
+
+beforeEach(() => {
+  readFileMock.mockReset();
+  findUniqueMock.mockReset();
+});
+
+describe("readResumeObject", () => {
+  it("returns the local file when it exists on disk", async () => {
+    readFileMock.mockResolvedValue(Buffer.from("local pdf bytes"));
+
+    const result = await readResumeObject("resumes/2026-06/jane-abc.pdf");
+
+    expect(result).not.toBeNull();
+    expect(result!.buffer.toString()).toBe("local pdf bytes");
+    expect(result!.contentType).toBe("application/pdf");
+    expect(result!.filename).toBe("jane-abc.pdf");
+    expect(findUniqueMock).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the database when the local file is missing", async () => {
+    readFileMock.mockRejectedValue(new Error("ENOENT"));
+    findUniqueMock.mockResolvedValue({
+      contentType: "application/pdf",
+      data: Uint8Array.from(Buffer.from("db pdf bytes")),
+      filename: "jane-original.pdf",
+      size: 12,
+    });
+
+    const result = await readResumeObject("resumes/2026-06/jane-abc.pdf");
+
+    expect(result).not.toBeNull();
+    expect(result!.buffer.toString()).toBe("db pdf bytes");
+    expect(result!.filename).toBe("jane-original.pdf");
+    expect(findUniqueMock).toHaveBeenCalledWith({
+      where: { objectName: "resumes/2026-06/jane-abc.pdf" },
+      select: { contentType: true, data: true, filename: true, size: true },
+    });
+  });
+
+  it("returns null when the object exists nowhere", async () => {
+    readFileMock.mockRejectedValue(new Error("ENOENT"));
+    findUniqueMock.mockResolvedValue(null);
+
+    await expect(readResumeObject("resumes/2026-06/missing.pdf")).resolves.toBeNull();
+  });
+
+  it("rejects path traversal", async () => {
+    await expect(readResumeObject("../../etc/passwd")).rejects.toThrow("Invalid resume path.");
+    expect(readFileMock).not.toHaveBeenCalled();
+  });
+});
+
+describe("resolveLocalResumePath", () => {
+  it("returns null for traversal and the bare root", () => {
+    expect(resolveLocalResumePath("..")).toBeNull();
+    expect(resolveLocalResumePath("")).toBeNull();
+  });
+});
+
+describe("buildContentDisposition", () => {
+  it("emits inline with quoted and RFC 5987 filenames", () => {
+    expect(buildContentDisposition("inline", "resume.pdf")).toBe(
+      `inline; filename="resume.pdf"; filename*=UTF-8''resume.pdf`,
+    );
+  });
+
+  it("sanitizes non-ascii filenames in the quoted fallback", () => {
+    const value = buildContentDisposition("attachment", "résumé.pdf");
+    expect(value.startsWith(`attachment; filename="r_sum_.pdf"`)).toBe(true);
+    expect(value).toContain("filename*=UTF-8''r%C3%A9sum%C3%A9.pdf");
+  });
+});
diff --git a/src/lib/resume/storage-read.ts b/src/lib/resume/storage-read.ts
new file mode 100644
index 0000000..98cae09
--- /dev/null
+++ b/src/lib/resume/storage-read.ts
@@ -0,0 +1,87 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { prisma } from "@/lib/db/prisma";
+import { LOCAL_RESUME_STORAGE_DIR } from "@/lib/storage/upload";
+
+const EXTENSION_CONTENT_TYPES: Record<string, string> = {
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".pdf": "application/pdf",
+  ".csv": "text/csv; charset=utf-8",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+export interface StoredResume {
+  buffer: Buffer;
+  contentType: string;
+  filename: string;
+  size: number;
+}
+
+/**
+ * Resolves a stored object name to an absolute path inside the local resume
+ * directory, rejecting path-traversal attempts. Returns null when the
+ * resolved path would escape the storage root.
+ */
+export function resolveLocalResumePath(objectName: string): string | null {
+  const root = path.resolve(LOCAL_RESUME_STORAGE_DIR);
+  const filePath = path.resolve(root, ...objectName.split("/"));
+  return filePath === root || !filePath.startsWith(`${root}${path.sep}`) ? null : filePath;
+}
+
+function inferContentTypeFromName(name: string): string {
+  const ext = path.extname(name).toLowerCase();
+  return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
+}
+
+/**
+ * Loads a stored resume by object name: local disk first (dev), then the
+ * database-backed ResumeFile table (Vercel/production). Returns null when the
+ * object cannot be found in either backend. Throws on path-traversal input.
+ */
+export async function readResumeObject(objectName: string): Promise<StoredResume | null> {
+  const filePath = resolveLocalResumePath(objectName);
+  if (!filePath) {
+    throw new Error("Invalid resume path.");
+  }
+
+  const fallbackFilename = objectName.split("/").pop() || "resume.pdf";
+
+  try {
+    const buffer = await readFile(filePath);
+    return {
+      buffer,
+      contentType: inferContentTypeFromName(filePath),
+      filename: fallbackFilename,
+      size: buffer.byteLength,
+    };
+  } catch {
+    const stored = await prisma.resumeFile.findUnique({
+      where: { objectName },
+      select: { contentType: true, data: true, filename: true, size: true },
+    });
+
+    if (!stored) {
+      return null;
+    }
+
+    return {
+      buffer: Buffer.from(stored.data),
+      contentType: stored.contentType || inferContentTypeFromName(stored.filename),
+      filename: stored.filename || fallbackFilename,
+      size: stored.size,
+    };
+  }
+}
+
+/**
+ * Builds a Content-Disposition header value with an RFC 5987-encoded filename
+ * so non-ASCII applicant filenames survive the round trip.
+ */
+export function buildContentDisposition(kind: "inline" | "attachment", filename: string): string {
+  const fallback = filename.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_");
+  const encoded = encodeURIComponent(filename).replace(/['()*]/g, (c) =>
+    `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+  return `${kind}; filename="${fallback}"; filename*=UTF-8''${encoded}`;
+}
diff --git a/src/server/jobs/dispatch.test.ts b/src/server/jobs/dispatch.test.ts
new file mode 100644
index 0000000..7378bf3
--- /dev/null
+++ b/src/server/jobs/dispatch.test.ts
@@ -0,0 +1,169 @@
+// @vitest-environment node
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const {
+  enqueueResumeParseJobMock,
+  enqueueEmailJobMock,
+  enqueueAdminNotificationEmailsMock,
+  dispatchEmailJobMock,
+  parseFromBufferMock,
+  parseFromUrlMock,
+} = vi.hoisted(() => ({
+  enqueueResumeParseJobMock: vi.fn(),
+  enqueueEmailJobMock: vi.fn(),
+  enqueueAdminNotificationEmailsMock: vi.fn(),
+  dispatchEmailJobMock: vi.fn(),
+  parseFromBufferMock: vi.fn(),
+  parseFromUrlMock: vi.fn(),
+}));
+
+vi.mock("next/server", () => ({
+  after: vi.fn((cb: () => Promise<void>) => void cb()),
+}));
+
+vi.mock("@/server/queues/resume", () => ({
+  enqueueResumeParseJob: enqueueResumeParseJobMock,
+}));
+
+vi.mock("@/server/queues/emails", () => ({
+  enqueueEmailJob: enqueueEmailJobMock,
+  enqueueAdminNotificationEmails: enqueueAdminNotificationEmailsMock,
+}));
+
+vi.mock("@/server/services/emails/dispatch-email-job", () => ({
+  dispatchEmailJob: dispatchEmailJobMock,
+}));
+
+vi.mock("@/lib/resume/parseApplicantResume", () => ({
+  parseApplicantResumeFromBuffer: parseFromBufferMock,
+  parseApplicantResumeFromUrl: parseFromUrlMock,
+}));
+
+import {
+  dispatchAdminNotificationEmails,
+  dispatchEmail,
+  dispatchResumeParse,
+} from "./dispatch";
+import type { EmailJob } from "@/server/queues/emails";
+
+const originalJobRunner = process.env.JOB_RUNNER;
+
+const confirmationJob: EmailJob = {
+  kind: "applicant-confirmation",
+  payload: { to: "jane@example.com", applicantName: "Jane", jobTitle: "Engineer" },
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  dispatchEmailJobMock.mockResolvedValue({ ok: true, skipped: false });
+  parseFromBufferMock.mockResolvedValue(undefined);
+  parseFromUrlMock.mockResolvedValue(undefined);
+  enqueueResumeParseJobMock.mockResolvedValue("job-1");
+  enqueueEmailJobMock.mockResolvedValue("job-2");
+  enqueueAdminNotificationEmailsMock.mockResolvedValue({ enqueued: ["a@x.com"], failed: [] });
+});
+
+afterEach(() => {
+  if (originalJobRunner === undefined) delete process.env.JOB_RUNNER;
+  else process.env.JOB_RUNNER = originalJobRunner;
+});
+
+async function flushInlineTasks(): Promise<void> {
+  await new Promise((resolve) => setImmediate(resolve));
+}
+
+describe("dispatchResumeParse", () => {
+  it("enqueues to pg-boss in worker mode", async () => {
+    process.env.JOB_RUNNER = "worker";
+
+    await dispatchResumeParse({ applicantId: "a1", resumeUrl: "/api/resumes/r.pdf" });
+
+    expect(enqueueResumeParseJobMock).toHaveBeenCalledWith({
+      applicantId: "a1",
+      resumeUrl: "/api/resumes/r.pdf",
+    });
+    expect(parseFromBufferMock).not.toHaveBeenCalled();
+    expect(parseFromUrlMock).not.toHaveBeenCalled();
+  });
+
+  it("parses from the buffer inline when provided", async () => {
+    process.env.JOB_RUNNER = "inline";
+    const buffer = Buffer.from("pdf");
+
+    await dispatchResumeParse({
+      applicantId: "a1",
+      resumeUrl: "/api/resumes/r.pdf",
+      buffer,
+      filename: "r.pdf",
+    });
+    await flushInlineTasks();
+
+    expect(parseFromBufferMock).toHaveBeenCalledWith("a1", buffer, "r.pdf");
+    expect(enqueueResumeParseJobMock).not.toHaveBeenCalled();
+  });
+
+  it("parses from the URL inline when no buffer is provided", async () => {
+    process.env.JOB_RUNNER = "inline";
+
+    await dispatchResumeParse({ applicantId: "a1", resumeUrl: "/api/resumes/r.pdf" });
+    await flushInlineTasks();
+
+    expect(parseFromUrlMock).toHaveBeenCalledWith("a1", "/api/resumes/r.pdf");
+  });
+});
+
+describe("dispatchEmail", () => {
+  it("enqueues in worker mode", async () => {
+    process.env.JOB_RUNNER = "worker";
+
+    await dispatchEmail(confirmationJob);
+
+    expect(enqueueEmailJobMock).toHaveBeenCalledWith(confirmationJob);
+    expect(dispatchEmailJobMock).not.toHaveBeenCalled();
+  });
+
+  it("sends inline in inline mode", async () => {
+    process.env.JOB_RUNNER = "inline";
+
+    await dispatchEmail(confirmationJob);
+    await flushInlineTasks();
+
+    expect(dispatchEmailJobMock).toHaveBeenCalledWith(confirmationJob);
+    expect(enqueueEmailJobMock).not.toHaveBeenCalled();
+  });
+});
+
+describe("dispatchAdminNotificationEmails", () => {
+  const input = {
+    adminEmails: ["a@x.com", "b@x.com"],
+    jobTitle: "Engineer",
+    applicantName: "Jane",
+    applicantEmail: "jane@example.com",
+    jobUrl: "https://app/admin/jobs/1",
+  };
+
+  it("delegates to the queue fan-out in worker mode", async () => {
+    process.env.JOB_RUNNER = "worker";
+
+    const result = await dispatchAdminNotificationEmails(input);
+
+    expect(enqueueAdminNotificationEmailsMock).toHaveBeenCalledWith(input);
+    expect(result).toEqual({ enqueued: ["a@x.com"], failed: [] });
+  });
+
+  it("sends one inline email per admin in inline mode", async () => {
+    process.env.JOB_RUNNER = "inline";
+
+    const result = await dispatchAdminNotificationEmails(input);
+    await flushInlineTasks();
+
+    expect(dispatchEmailJobMock).toHaveBeenCalledTimes(2);
+    expect(dispatchEmailJobMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        kind: "admin-new-application",
+        payload: expect.objectContaining({ to: "a@x.com" }),
+      }),
+    );
+    expect(result).toEqual({ enqueued: ["a@x.com", "b@x.com"], failed: [] });
+  });
+});
diff --git a/src/server/jobs/dispatch.ts b/src/server/jobs/dispatch.ts
new file mode 100644
index 0000000..13ac1a2
--- /dev/null
+++ b/src/server/jobs/dispatch.ts
@@ -0,0 +1,103 @@
+import {
+  parseApplicantResumeFromBuffer,
+  parseApplicantResumeFromUrl,
+} from "@/lib/resume/parseApplicantResume";
+import {
+  enqueueAdminNotificationEmails,
+  enqueueEmailJob,
+  type AdminFanOutResult,
+  type AdminNotificationFanOutInput,
+  type EmailJob,
+} from "@/server/queues/emails";
+import { enqueueResumeParseJob } from "@/server/queues/resume";
+import { dispatchEmailJob } from "@/server/services/emails/dispatch-email-job";
+import { getJobRunnerMode, runAfterResponse } from "./runner";
+
+/**
+ * Dispatches a resume parse: enqueued to pg-boss in `worker` mode, executed
+ * after the response in `inline` mode (preferring the in-memory buffer when
+ * the caller still has it, avoiding a re-download).
+ */
+export async function dispatchResumeParse(input: {
+  applicantId: string;
+  resumeUrl: string;
+  buffer?: Buffer;
+  filename?: string;
+}): Promise<void> {
+  if (getJobRunnerMode() === "worker") {
+    await enqueueResumeParseJob({
+      applicantId: input.applicantId,
+      resumeUrl: input.resumeUrl,
+    });
+    return;
+  }
+
+  const { applicantId, resumeUrl, buffer, filename } = input;
+  runAfterResponse("resume-parse", async () => {
+    if (buffer && filename) {
+      await parseApplicantResumeFromBuffer(applicantId, buffer, filename);
+      return;
+    }
+    await parseApplicantResumeFromUrl(applicantId, resumeUrl);
+  });
+}
+
+/**
+ * Dispatches a single email job: enqueued in `worker` mode, sent after the
+ * response in `inline` mode. Inline send results are logged to EmailLog by
+ * the send functions themselves.
+ */
+export async function dispatchEmail(job: EmailJob): Promise<void> {
+  if (getJobRunnerMode() === "worker") {
+    await enqueueEmailJob(job);
+    return;
+  }
+
+  runAfterResponse(`email-${job.kind}`, async () => {
+    const result = await dispatchEmailJob(job);
+    if (result.skipped) {
+      console.warn(`[jobs:email] skipped ${job.kind} for ${job.payload.to}`);
+    } else if (!result.ok) {
+      console.error(`[jobs:email] ${job.kind} failed for ${job.payload.to}: ${result.error}`);
+    }
+  });
+}
+
+/**
+ * Fans out admin "new application" notifications. In `worker` mode the queue
+ * reports per-recipient enqueue failures; in `inline` mode delivery happens
+ * post-response, so there is nothing to report yet (send failures land in
+ * EmailLog). Inline sends run sequentially inside a single after() task —
+ * parallel sends trip Resend's requests-per-second limit.
+ */
+export async function dispatchAdminNotificationEmails(
+  input: AdminNotificationFanOutInput,
+): Promise<AdminFanOutResult> {
+  if (getJobRunnerMode() === "worker") {
+    return enqueueAdminNotificationEmails(input);
+  }
+
+  const jobs: EmailJob[] = input.adminEmails.map((to) => ({
+    kind: "admin-new-application",
+    payload: {
+      to,
+      jobTitle: input.jobTitle,
+      applicantName: input.applicantName,
+      applicantEmail: input.applicantEmail,
+      jobUrl: input.jobUrl,
+    },
+  }));
+
+  runAfterResponse("email-admin-fan-out", async () => {
+    for (const job of jobs) {
+      const result = await dispatchEmailJob(job);
+      if (result.skipped) {
+        console.warn(`[jobs:email] skipped ${job.kind} for ${job.payload.to}`);
+      } else if (!result.ok) {
+        console.error(`[jobs:email] ${job.kind} failed for ${job.payload.to}: ${result.error}`);
+      }
+    }
+  });
+
+  return { enqueued: [...input.adminEmails], failed: [] };
+}
diff --git a/src/server/jobs/runner.test.ts b/src/server/jobs/runner.test.ts
new file mode 100644
index 0000000..aae2514
--- /dev/null
+++ b/src/server/jobs/runner.test.ts
@@ -0,0 +1,80 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const { afterMock } = vi.hoisted(() => ({ afterMock: vi.fn() }));
+
+vi.mock("next/server", () => ({ after: afterMock }));
+
+import { getJobRunnerMode, runAfterResponse } from "./runner";
+
+const originalJobRunner = process.env.JOB_RUNNER;
+const originalVercel = process.env.VERCEL;
+
+afterEach(() => {
+  if (originalJobRunner === undefined) delete process.env.JOB_RUNNER;
+  else process.env.JOB_RUNNER = originalJobRunner;
+  if (originalVercel === undefined) delete process.env.VERCEL;
+  else process.env.VERCEL = originalVercel;
+  afterMock.mockReset();
+});
+
+describe("getJobRunnerMode", () => {
+  it("honors JOB_RUNNER over the environment default", () => {
+    process.env.JOB_RUNNER = "inline";
+    delete process.env.VERCEL;
+    expect(getJobRunnerMode()).toBe("inline");
+
+    process.env.JOB_RUNNER = "worker";
+    process.env.VERCEL = "1";
+    expect(getJobRunnerMode()).toBe("worker");
+  });
+
+  it("defaults to inline on Vercel and worker elsewhere", () => {
+    delete process.env.JOB_RUNNER;
+    process.env.VERCEL = "1";
+    expect(getJobRunnerMode()).toBe("inline");
+
+    delete process.env.VERCEL;
+    expect(getJobRunnerMode()).toBe("worker");
+  });
+
+  it("ignores unknown JOB_RUNNER values", () => {
+    process.env.JOB_RUNNER = "banana";
+    delete process.env.VERCEL;
+    expect(getJobRunnerMode()).toBe("worker");
+  });
+});
+
+describe("runAfterResponse", () => {
+  it("schedules the task via after()", () => {
+    const task = vi.fn().mockResolvedValue(undefined);
+    runAfterResponse("test", task);
+    expect(afterMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("falls back to direct execution when after() throws", async () => {
+    afterMock.mockImplementation(() => {
+      throw new Error("not in a request scope");
+    });
+    const task = vi.fn().mockResolvedValue(undefined);
+
+    runAfterResponse("test", task);
+
+    expect(task).toHaveBeenCalledTimes(1);
+  });
+
+  it("swallows and logs task rejections", async () => {
+    const consoleError = vi.spyOn(console, "error").mockImplementation(() => {});
+    afterMock.mockImplementation((cb: () => Promise<void>) => void cb());
+    const task = vi.fn().mockRejectedValue(new Error("boom"));
+
+    runAfterResponse("test", task);
+    await new Promise((resolve) => setImmediate(resolve));
+
+    expect(consoleError).toHaveBeenCalledWith(
+      "[jobs:test] inline task failed:",
+      expect.any(Error),
+    );
+    consoleError.mockRestore();
+  });
+});
diff --git a/src/server/jobs/runner.ts b/src/server/jobs/runner.ts
new file mode 100644
index 0000000..557f378
--- /dev/null
+++ b/src/server/jobs/runner.ts
@@ -0,0 +1,41 @@
+import { after } from "next/server";
+
+export type JobRunnerMode = "worker" | "inline";
+
+/**
+ * Decides how background jobs (resume parsing, email delivery) execute.
+ *
+ * - `worker`: jobs are enqueued to pg-boss and a long-running worker
+ *   (`pnpm worker:resume` / `pnpm worker:emails`) processes them.
+ * - `inline`: jobs run in the same serverless invocation after the response
+ *   is sent (via Next's `after()`), so no worker process is required.
+ *
+ * `JOB_RUNNER` env wins when set; otherwise Vercel deployments default to
+ * `inline` (serverless functions cannot host pg-boss workers) and everything
+ * else defaults to `worker`.
+ */
+export function getJobRunnerMode(): JobRunnerMode {
+  const raw = process.env.JOB_RUNNER?.toLowerCase();
+  if (raw === "worker" || raw === "inline") {
+    return raw;
+  }
+  return process.env.VERCEL ? "inline" : "worker";
+}
+
+/**
+ * Schedules a task to run after the current response is flushed. Falls back
+ * to fire-and-forget execution outside a request context (e.g. tests,
+ * scripts) where `after()` throws.
+ */
+export function runAfterResponse(label: string, task: () => Promise<void>): void {
+  const run = () =>
+    task().catch((error) => {
+      console.error(`[jobs:${label}] inline task failed:`, error);
+    });
+
+  try {
+    after(run);
+  } catch {
+    void run();
+  }
+}
diff --git a/src/server/services/emails/dispatch-email-job.ts b/src/server/services/emails/dispatch-email-job.ts
new file mode 100644
index 0000000..e7eabb0
--- /dev/null
+++ b/src/server/services/emails/dispatch-email-job.ts
@@ -0,0 +1,33 @@
+import {
+  sendAdminNewApplicationEmail,
+  sendApplicationConfirmationEmail,
+  sendCustomEmail,
+  sendJobAlertConfirmation,
+  sendNewJobNotification,
+  type EmailSendResult,
+} from "@/lib/email/send";
+import type { EmailJob } from "@/server/queues/emails";
+
+/**
+ * Routes an EmailJob to its send function. Shared by the pg-boss worker and
+ * the inline job runner so both paths behave identically.
+ */
+export async function dispatchEmailJob(job: EmailJob): Promise<EmailSendResult> {
+  switch (job.kind) {
+    case "admin-new-application":
+      return sendAdminNewApplicationEmail(job.payload);
+    case "applicant-confirmation":
+      return sendApplicationConfirmationEmail(job.payload);
+    case "custom":
+      return sendCustomEmail(job.payload);
+    case "job-alert-confirmation":
+      return sendJobAlertConfirmation(job.payload.to, job.payload.token);
+    case "new-job-notification":
+      return sendNewJobNotification(
+        job.payload.to,
+        job.payload.jobTitle,
+        job.payload.jobUrl,
+        job.payload.token,
+      );
+  }
+}
diff --git a/src/server/services/submit-job-application-impl.test.ts b/src/server/services/submit-job-application-impl.test.ts
index fddf362..42cc171 100644
--- a/src/server/services/submit-job-application-impl.test.ts
+++ b/src/server/services/submit-job-application-impl.test.ts
@@ -56,13 +56,12 @@ vi.mock("@/lib/resume/parseApplicantResume", () => ({
   parseApplicantResumeFromBuffer: parseApplicantResumeFromBufferMock,
 }));
 
-vi.mock("@/server/queues/emails", () => ({
-  enqueueAdminNotificationEmails: enqueueAdminNotificationEmailsMock,
-  enqueueEmailJob: enqueueEmailJobMock,
-}));
-
-vi.mock("@/server/queues/resume", () => ({
-  enqueueResumeParseJob: enqueueResumeParseJobMock,
+// The impl now routes background work through the job dispatcher, which
+// either enqueues to pg-boss (worker mode) or runs inline via after().
+vi.mock("@/server/jobs/dispatch", () => ({
+  dispatchAdminNotificationEmails: enqueueAdminNotificationEmailsMock,
+  dispatchEmail: enqueueEmailJobMock,
+  dispatchResumeParse: enqueueResumeParseJobMock,
 }));
 
 vi.mock("next/cache", () => ({
diff --git a/src/server/services/submit-job-application-impl.ts b/src/server/services/submit-job-application-impl.ts
index 90e35bd..11b7880 100644
--- a/src/server/services/submit-job-application-impl.ts
+++ b/src/server/services/submit-job-application-impl.ts
@@ -4,8 +4,11 @@ import { prisma } from "@/lib/db/prisma";
 import { canAcceptApplications } from "@/lib/jobs/status";
 import { parseApplicantResumeFromBuffer } from "@/lib/resume/parseApplicantResume";
 import { uploadFileBuffer } from "@/lib/storage/upload";
-import { enqueueAdminNotificationEmails, enqueueEmailJob } from "@/server/queues/emails";
-import { enqueueResumeParseJob } from "@/server/queues/resume";
+import {
+  dispatchAdminNotificationEmails,
+  dispatchEmail,
+  dispatchResumeParse,
+} from "@/server/jobs/dispatch";
 import {
   DUPLICATE_APPLICATION_MESSAGE,
   type ApplicationActionResult,
@@ -175,9 +178,11 @@ export async function submitJobApplicationImpl(
 
   try {
     if (resumeProcessingMode === "queue" || resumeProcessingMode === "queue-and-inline") {
-      await enqueueResumeParseJob({
+      await dispatchResumeParse({
         applicantId: applicant.id,
         resumeUrl: upload.url,
+        buffer: resumeBuffer,
+        filename: resumeFilename,
       });
     }
 
@@ -196,7 +201,7 @@ export async function submitJobApplicationImpl(
   }
 
   try {
-    await enqueueEmailJob({
+    await dispatchEmail({
       kind: "applicant-confirmation",
       payload: { to: email, applicantName, jobTitle: job.title },
     });
@@ -224,7 +229,7 @@ export async function submitJobApplicationImpl(
     const appUrl = (process.env.NEXT_PUBLIC_APP_URL ?? "http://localhost:3000").replace(/\/$/, "");
     const dashboardUrl = `${appUrl}/admin/jobs/${job.id}/applicants/${applicant.id}`;
     try {
-      const fanOut = await enqueueAdminNotificationEmails({
+      const fanOut = await dispatchAdminNotificationEmails({
         adminEmails,
         jobTitle: job.title,
         applicantName,
diff --git a/src/server/workers/emails.ts b/src/server/workers/emails.ts
index 9183c60..b814bcf 100644
--- a/src/server/workers/emails.ts
+++ b/src/server/workers/emails.ts
@@ -1,35 +1,8 @@
 import "dotenv/config";
 
 import type { Job } from "pg-boss";
-import {
-  sendAdminNewApplicationEmail,
-  sendApplicationConfirmationEmail,
-  sendCustomEmail,
-  sendJobAlertConfirmation,
-  sendNewJobNotification,
-  type EmailSendResult,
-} from "@/lib/email/send";
 import { EMAIL_SEND_QUEUE, getEmailQueue, type EmailJob } from "@/server/queues/emails";
-
-async function dispatch(job: EmailJob): Promise<EmailSendResult> {
-  switch (job.kind) {
-    case "admin-new-application":
-      return sendAdminNewApplicationEmail(job.payload);
-    case "applicant-confirmation":
-      return sendApplicationConfirmationEmail(job.payload);
-    case "custom":
-      return sendCustomEmail(job.payload);
-    case "job-alert-confirmation":
-      return sendJobAlertConfirmation(job.payload.to, job.payload.token);
-    case "new-job-notification":
-      return sendNewJobNotification(
-        job.payload.to,
-        job.payload.jobTitle,
-        job.payload.jobUrl,
-        job.payload.token,
-      );
-  }
-}
+import { dispatchEmailJob } from "@/server/services/emails/dispatch-email-job";
 
 async function main() {
   const boss = await getEmailQueue();
@@ -40,7 +13,7 @@ async function main() {
     async (jobs: Job<EmailJob>[]) => {
       const [job] = jobs;
       if (!job) return;
-      const result = await dispatch(job.data);
+      const result = await dispatchEmailJob(job.data);
       if (result.skipped) {
         console.warn(`[email-worker] skipped ${job.data.kind} for ${job.data.payload.to}`);
         return;