diff --git a/src/routes/faqRouter.js b/src/routes/faqRouter.js
index 3c5c509c4..0374cb84a 100644
--- a/src/routes/faqRouter.js
+++ b/src/routes/faqRouter.js
@@ -51,7 +51,10 @@ const checkFaqPermission = (requiredPermission) => (req, res, next) => {
 
 // Define routes with verifyToken and checkFaqPermission
 router.get('/faqs/search', verifyToken, faqController.searchFAQs);
-router.get('/faqs', verifyToken, faqController.getAllFAQs);
+// Public: the job listing page at /collaboration is reachable without signing in,
+// and its FAQ section reads from here. getAllFAQs does not use req.user.
+// Every other FAQ route below stays behind verifyToken.
+router.get('/faqs', faqController.getAllFAQs);
 router.post('/faqs', verifyToken, checkFaqPermission('manageFAQs'), faqController.createFAQ);
 router.put('/faqs/:id', verifyToken, checkFaqPermission('manageFAQs'), faqController.updateFAQ);
 router.delete('/faqs/:id', verifyToken, checkFaqPermission('manageFAQs'), faqController.deleteFAQ);
diff --git a/src/startup/middleware.js b/src/startup/middleware.js
index 565b99673..72a8439ed 100644
--- a/src/startup/middleware.js
+++ b/src/startup/middleware.js
@@ -91,6 +91,14 @@ module.exports = function (app) {
       return;
     }
 
+    // Public FAQ list: the job listing page at /collaboration is reachable without
+    // signing in, and its FAQ section reads from here. Matched exactly so the
+    // search, history and unanswered FAQ routes stay behind authentication.
+    if (req.path === '/api/faqs' && req.method === 'GET') {
+      next();
+      return;
+    }
+
     if (req.originalUrl.startsWith('/api/bluesky')) {
       next();
       return;