diff --git a/.coverage b/.coverage
index a77b9d1..f14a43d 100644
Binary files a/.coverage and b/.coverage differ
diff --git a/app/services/auth.py b/app/services/auth.py
index 6f0d287..c8d38e8 100644
--- a/app/services/auth.py
+++ b/app/services/auth.py
@@ -36,6 +36,7 @@
 # Signup responds identically whether or not the email is already registered,
 # so an attacker can't enumerate accounts through the signup endpoint.
 GENERIC_SIGNUP_MESSAGE = "Please check your email to activate your account."
+VERIFICATION_CODE_LENGTH = settings.VERIFICATION_CODE_LENGTH
 
 
 # --- Redis key builders (single source of truth for key formats) ------------
@@ -150,7 +151,7 @@ async def initiate_password_reset(
     if not user or await email_cooldown_active("reset", email):
         return {"detail": "Password Reset Code Sent"}
 
-    code = generate_random_code(6)
+    code = generate_random_code(VERIFICATION_CODE_LENGTH)
     await redis_manager.cache_json_item(
         reset_code_key(email), {"code": code}, ttl=60 * 30
     )
@@ -287,7 +288,7 @@ async def signup_user(
 
     user = await create_user(data, session)
 
-    code = generate_random_code(6)
+    code = generate_random_code(VERIFICATION_CODE_LENGTH)
     await redis_manager.cache_json_item(
         activation_code_key(data.email), {"code": code}, ttl=60 * 30
     )
@@ -310,7 +311,7 @@ async def resend_activation_code(
     if not user or await email_cooldown_active("activation", email):
         return {"detail": "Activation Code Sent"}
 
-    code = generate_random_code(6)
+    code = generate_random_code(VERIFICATION_CODE_LENGTH)
     await redis_manager.cache_json_item(
         activation_code_key(email), {"code": code}, ttl=60 * 30
     )
diff --git a/app/settings.py b/app/settings.py
index 83a8e54..5e1c218 100644
--- a/app/settings.py
+++ b/app/settings.py
@@ -14,6 +14,9 @@ class Settings(BaseSettings):
     JWT_SECRET: str = ""  # REQUIRED in production (DEBUG=False); see validator below
     JWT_ALGORITHM: str = "HS256"  # optional environement variable with default value
 
+    # ensures the length of the otp codes used across the app is consistent
+    VERIFICATION_CODE_LENGTH: int = 6
+
     REDIS_HOST: str = "localhost"
     REDIS_PORT: int = 6379