diff --git a/patbond-auth/src/test/java/com/patbond/patbond/auth/controller/AuthControllerTest.java b/patbond-auth/src/test/java/com/patbond/patbond/auth/controller/AuthControllerTest.java
index 128d5ef..a6b14aa 100644
--- a/patbond-auth/src/test/java/com/patbond/patbond/auth/controller/AuthControllerTest.java
+++ b/patbond-auth/src/test/java/com/patbond/patbond/auth/controller/AuthControllerTest.java
@@ -110,7 +110,10 @@ class AuthControllerTest {
                 // Frozen contract: exactly these six fields, nothing else.
                 .andExpect(jsonPath("$.data.username").doesNotExist())
                 .andExpect(jsonPath("$.data.nickname").doesNotExist())
-                .andExpect(jsonPath("$.data.expiresAt").doesNotExist());
+                .andExpect(jsonPath("$.data.expiresAt").doesNotExist())
+                // Envelope is exactly {code, message, data}: the derived
+                // isSuccess() getter must not leak onto the wire.
+                .andExpect(jsonPath("$.success").doesNotExist());
     }
 
     @Test
diff --git a/patbond-common/pom.xml b/patbond-common/pom.xml
index 4941a2e..407afc7 100644
--- a/patbond-common/pom.xml
+++ b/patbond-common/pom.xml
@@ -25,6 +25,12 @@
             <groupId>jakarta.validation</groupId>
             <artifactId>jakarta.validation-api</artifactId>
         </dependency>
+        <!-- Annotations only (no databind): keeps the wire shape of the shared
+             envelope under the contract module's control. -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
diff --git a/patbond-common/src/main/java/com/patbond/patbond/common/response/ApiResponse.java b/patbond-common/src/main/java/com/patbond/patbond/common/response/ApiResponse.java
index 21dd907..1460166 100644
--- a/patbond-common/src/main/java/com/patbond/patbond/common/response/ApiResponse.java
+++ b/patbond-common/src/main/java/com/patbond/patbond/common/response/ApiResponse.java
@@ -1,5 +1,7 @@
 package com.patbond.patbond.common.response;
 
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
 public class ApiResponse<T> {
 
     private Integer code;
@@ -23,6 +25,11 @@ public class ApiResponse<T> {
         return new ApiResponse<>(code, message, null);
     }
 
+    /**
+     * Derived convenience only — not part of the frozen wire contract
+     * {@code {code, message, data}}, hence never serialized.
+     */
+    @JsonIgnore
     public boolean isSuccess() {
         return Integer.valueOf(0).equals(code);
     }