diff --git a/site/src/components/intake/steps/ReviewStep.astro b/site/src/components/intake/steps/ReviewStep.astro
index 8832fcb..f535bdd 100644
--- a/site/src/components/intake/steps/ReviewStep.astro
+++ b/site/src/components/intake/steps/ReviewStep.astro
@@ -108,10 +108,12 @@ const vertical = slugVertical(service_slug);
       orderNumber = created.order_number;
       (window as any).PWIntake.set({ ...state, order_number: orderNumber });
     }
-    // Step 2: validate
+    // Step 2: validate. The API requires an application/json Content-Type even
+    // for an empty body — without it the request 415s and validation silently
+    // fails, stranding the user on the review step (no advance to payment).
     const vResp = await fetch(
       `/api/v1/compliance-orders/${orderNumber}/validate`,
-      { method: "POST" },
+      { method: "POST", headers: { "Content-Type": "application/json" }, body: "{}" },
     );
     const data = await vResp.json();
     return {