diff --git a/apps/server/src/routes/v1/notifications/schema.ts b/apps/server/src/routes/v1/notifications/schema.ts
index 5ade48ac3..3b4344586 100644
--- a/apps/server/src/routes/v1/notifications/schema.ts
+++ b/apps/server/src/routes/v1/notifications/schema.ts
@@ -5,6 +5,7 @@ export const ParamsSchema = z.object({
   id: z
     .string()
     .min(1)
+    .regex(/^\d+$/, "ID must be a numeric string")
     .openapi({
       param: {
         name: "id",