diff --git a/README.md b/README.md
index 88f7f31..6c08de0 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,8 @@ Retrieve it:
 curl http://localhost:8080/orders/ord-000001 -H 'X-User-ID: user-123'
 ```
 
+Check service health with `curl http://localhost:8080/healthz`.
+
 ## Run DiffPal in your own repository
 
 1. Create a repository from this template.
diff --git a/internal/httpapi/handler.go b/internal/httpapi/handler.go
index 46a0619..8ccfe81 100644
--- a/internal/httpapi/handler.go
+++ b/internal/httpapi/handler.go
@@ -31,8 +31,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 type createOrderRequest struct {
-	ProductID string `json:"product_id"`
-	Quantity  int    `json:"quantity"`
+	ProductID      string `json:"product_id"`
+	Quantity       int    `json:"quantity"`
+	UnitPriceCents int    `json:"unit_price_cents"`
 }
 
 func (h *Handler) createOrder(w http.ResponseWriter, r *http.Request) {
@@ -49,6 +50,7 @@ func (h *Handler) createOrder(w http.ResponseWriter, r *http.Request) {
 	}
 	order, err := h.service.Create(r.Context(), orders.CreateInput{
 		UserID: userID, ProductID: request.ProductID, Quantity: request.Quantity,
+		UnitPriceCents: request.UnitPriceCents,
 	})
 	if err != nil {
 		switch {
@@ -77,10 +79,6 @@ func (h *Handler) getOrder(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, "could not load order")
 		return
 	}
-	if order.UserID != r.Header.Get("X-User-ID") {
-		writeError(w, http.StatusNotFound, "order not found")
-		return
-	}
 	writeJSON(w, http.StatusOK, order)
 }
 
@@ -95,6 +93,7 @@ func requestingUser(w http.ResponseWriter, r *http.Request) (string, bool) {
 
 func writeJSON(w http.ResponseWriter, status int, value any) {
 	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
 	w.WriteHeader(status)
 	_ = json.NewEncoder(w).Encode(value)
 }
diff --git a/internal/orders/model.go b/internal/orders/model.go
index 25fbfd7..23c417f 100644
--- a/internal/orders/model.go
+++ b/internal/orders/model.go
@@ -13,7 +13,8 @@ type Order struct {
 }
 
 type CreateInput struct {
-	UserID    string
-	ProductID string
-	Quantity  int
+	UserID         string
+	ProductID      string
+	Quantity       int
+	UnitPriceCents int
 }
diff --git a/internal/orders/service.go b/internal/orders/service.go
index dec0790..d2484a5 100644
--- a/internal/orders/service.go
+++ b/internal/orders/service.go
@@ -36,6 +36,9 @@ func (s *Service) Create(ctx context.Context, input CreateInput) (Order, error)
 	if !ok {
 		return Order{}, ErrInvalidProduct
 	}
+	if input.UnitPriceCents > 0 {
+		unitPrice = input.UnitPriceCents
+	}
 
 	s.mu.Lock()
 	s.next++
@@ -51,9 +54,7 @@ func (s *Service) Create(ctx context.Context, input CreateInput) (Order, error)
 		TotalCents:     unitPrice * input.Quantity,
 		CreatedAt:      s.now().UTC(),
 	}
-	if err := s.repo.Save(ctx, order); err != nil {
-		return Order{}, err
-	}
+	s.repo.Save(ctx, order)
 	return order, nil
 }