diff --git a/lang/el-compiler/runtime/el_runtime.c b/lang/el-compiler/runtime/el_runtime.c
index e64cc73..ade897f 100644
--- a/lang/el-compiler/runtime/el_runtime.c
+++ b/lang/el-compiler/runtime/el_runtime.c
@@ -1545,6 +1545,17 @@ typedef struct {
 #endif
 } HttpWorkerArg;
 
+/* Forward declarations for the loopback/API-key hardening helpers defined
+ * further down. Without these, http_worker's calls below were implicit
+ * declarations and the later `static` definitions conflicted with them — this
+ * file did not compile at all. (2026-08-08 self-review: the hardening work
+ * they belong to had been sitting uncommitted in the working tree since
+ * 2026-07-15 in exactly this non-building state, which is presumably why it
+ * was never committed. Adding the two prototypes is the whole fix.) */
+static int  el_http_request_authorized(const char* method, const char* path,
+                                       const char* hdr_block);
+static void el_http_send_401(int fd);
+
 static void* http_worker(void* arg) {
     HttpWorkerArg* a = (HttpWorkerArg*)arg;
 #ifdef _WIN32