diff --git a/services/collector/src/tracking/device-enrichment.service.ts b/services/collector/src/tracking/device-enrichment.service.ts
index adbe6f9..af271f6 100644
--- a/services/collector/src/tracking/device-enrichment.service.ts
+++ b/services/collector/src/tracking/device-enrichment.service.ts
@@ -1,9 +1,18 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 import * as crypto from 'crypto';
-import geoip from 'geoip-lite';
+import { createRequire } from 'node:module';
+import type geoipLite from 'geoip-lite';
 import type { OrganizationType, ResponseTier, ProxyType } from '@lilith/gov-detection';
 import { GovDetectionService } from './gov-detection.service';
 
+// geoip-lite is CJS. SWC emits `import geoip from 'geoip-lite'` as
+// `import * as geoip from 'geoip-lite'`, and Node's cjs-named-export detection
+// does not expose `lookup` on the namespace — call crashes with
+// `TypeError: geoip.lookup is not a function`. Load via createRequire to get
+// the real module.exports object.
+const require = createRequire(import.meta.url);
+const geoip = require('geoip-lite') as typeof geoipLite;
+
 const EU_COUNTRIES = new Set([
   'AT', 'BE', 'BG', 'CY', 'CZ', 'DE', 'DK', 'EE', 'ES', 'FI',
   'FR', 'GR', 'HR', 'HU', 'IE', 'IT', 'LT', 'LU', 'LV', 'MT',