diff --git a/_template-minimal/index.html b/_template-minimal/index.html
index dd82aee1..9344666b 100644
--- a/_template-minimal/index.html
+++ b/_template-minimal/index.html
@@ -26,9 +26,9 @@
     <title>APP_NAME</title>
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600&display=swap" rel="stylesheet">
+    <link href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600&display=swap" rel="stylesheet">
     <link rel="stylesheet" href="https://posimai-ui.vercel.app/v1/base.css">
-    <script src="https://unpkg.com/lucide@0.344.0/dist/umd/lucide.min.js"></script>
+    <script src="https://unpkg.com/lucide@0.344.0/dist/umd/lucide.min.js" integrity="sha384-tTkFttkBclaU1cloKwOi9xk3pbao3VZxTjLNBt8iFABWDBQibbAbWpVmO28zMuxq" crossorigin="anonymous"></script>
 
     <style>
         /* ── APP-SPECIFIC STYLES: ここにアプリ固有のスタイルを追加 ── */
diff --git a/_template/index.html b/_template/index.html
index 611cfa8a..f9e23292 100644
--- a/_template/index.html
+++ b/_template/index.html
@@ -35,12 +35,12 @@
         document.documentElement.lang = loc;
         document.documentElement.setAttribute('data-locale', loc);
 
-        // Magic Link
+        // JWT token handoff (cross-domain login from posimai-dashboard)
         var p = new URLSearchParams(location.search);
-        var k = p.get('init_key');
-        if (k) {
-            localStorage.setItem('posimai_api_key', k);
-            p.delete('init_key');
+        var tk = p.get('token');
+        if (tk) {
+            localStorage.setItem('posimai_token', tk);
+            p.delete('token');
             var u = location.pathname + (p.toString() ? '?' + p.toString() : '') + location.hash;
             history.replaceState({}, '', u);
         }
@@ -66,10 +66,10 @@
     <!-- ② フォント（@import より高速） -->
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600&display=swap" rel="stylesheet">
+    <link href="https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600&display=swap" rel="stylesheet">
 
     <!-- Lucide Icons — これ以外のアイコンライブラリ使用禁止 -->
-    <script src="https://unpkg.com/lucide@0.344.0/dist/umd/lucide.min.js"></script>
+    <script src="https://unpkg.com/lucide@0.344.0/dist/umd/lucide.min.js" integrity="sha384-tTkFttkBclaU1cloKwOi9xk3pbao3VZxTjLNBt8iFABWDBQibbAbWpVmO28zMuxq" crossorigin="anonymous"></script>
 
     <style>
         *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
@@ -131,7 +131,7 @@
         }
 
         body {
-            font-family: 'Inter', -apple-system, sans-serif;
+            font-family: 'Geist', system-ui, sans-serif;
             background: var(--bg);
             color: var(--text);
             font-size: 14px;