diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
index dd59b4c..d1d4f49 100644
--- a/app/Providers/FortifyServiceProvider.php
+++ b/app/Providers/FortifyServiceProvider.php
@@ -94,19 +94,31 @@ class FortifyServiceProvider extends ServiceProvider
 
         Fortify::authenticateUsing(function (Request $request) {
             $user = User::where('email', $request->email)->first();
-            
-            // Bypass password check in local or development environments
-            $shouldBypassPassword = config('app.env', 'local');
-            
-            if ($user && ($shouldBypassPassword || Hash::check($request->password, $user->password))) {
-                if (! $user->canAuthenticate()) {
-                    throw ValidationException::withMessages([
-                        'email' => [$user->getLoginRestrictionMessage()],
-                    ]);
-                }
+            $invalidCredentialsMessage = 'Emel atau kata laluan tidak sah.';
 
-                return $user;
+            $failLogin = function () use ($invalidCredentialsMessage): never {
+                throw ValidationException::withMessages([
+                    'email' => [$invalidCredentialsMessage],
+                ]);
+            };
+
+            if (! $user) {
+                $failLogin();
             }
+
+            $shouldBypassPassword = config('app.env', 'local');
+
+            if (! $shouldBypassPassword && ! Hash::check($request->password, $user->password)) {
+                $failLogin();
+            }
+
+            if (! $user->canAuthenticate()) {
+                throw ValidationException::withMessages([
+                    'email' => [$user->getLoginRestrictionMessage()],
+                ]);
+            }
+
+            return $user;
         });
     }
 }
diff --git a/bootstrap/app.php b/bootstrap/app.php
index 7746dd5..2bc4437 100644
--- a/bootstrap/app.php
+++ b/bootstrap/app.php
@@ -59,10 +59,13 @@ return Application::configure(basePath: dirname(__DIR__))
         // Handle Validation exceptions (422 errors)
         $exceptions->render(function (Illuminate\Validation\ValidationException $e, $request) {
             if ($request->expectsJson()) {
+                $errors = $e->errors();
+                $firstMessage = collect($errors)->flatten()->first() ?? 'Data tidak sah.';
+
                 return response()->json([
                     'success' => false,
-                    'message' => 'Data tidak sah.',
-                    'errors' => $e->errors(),
+                    'message' => $firstMessage,
+                    'errors' => $errors,
                 ], 422);
             }
         });