diff --git a/app/api/refer-community-project/route.ts b/app/api/refer-community-project/route.ts
index 0f42ef4..9d0cd41 100644
--- a/app/api/refer-community-project/route.ts
+++ b/app/api/refer-community-project/route.ts
@@ -73,6 +73,7 @@ export async function POST(request: NextRequest) {
         project_url: body.project_url || '',
         github_url: body.github_url || '',
         tags: Array.isArray(body.tags) ? body.tags : [],
+        language: typeof body.language === 'string' ? body.language : '',
         submitter_name: body.submitter_name,
         submitter_email: body.submitter_email,
         verification_code: body.verification_code || '',
diff --git a/app/api/refer-local-group/route.ts b/app/api/refer-local-group/route.ts
index ff7910e..bb04239 100644
--- a/app/api/refer-local-group/route.ts
+++ b/app/api/refer-local-group/route.ts
@@ -71,6 +71,7 @@ export async function POST(request: NextRequest) {
         location: body.location || '',
         url: body.url,
         description: body.description,
+        language: typeof body.language === 'string' ? body.language : '',
         submitter_name: body.submitter_name,
         submitter_email: body.submitter_email,
         verification_code: body.verification_code || '',
diff --git a/app/api/submit-project/route.ts b/app/api/submit-project/route.ts
index 6df34f8..7b05c72 100644
--- a/app/api/submit-project/route.ts
+++ b/app/api/submit-project/route.ts
@@ -73,6 +73,7 @@ export async function POST(request: NextRequest) {
         url: (body.url as string) || '',
         repo_urls: Array.isArray(body.repo_urls) ? body.repo_urls : [],
         tags: Array.isArray(body.tags) ? body.tags : [],
+        language: typeof body.language === 'string' ? body.language : '',
         submitter_name: body.submitter_name,
         submitter_email: body.submitter_email,
         verification_code: body.verification_code || '',
diff --git a/components/LanguageSwitcher.tsx b/components/LanguageSwitcher.tsx
index 36e47c0..5426a50 100644
--- a/components/LanguageSwitcher.tsx
+++ b/components/LanguageSwitcher.tsx
@@ -3,19 +3,11 @@
 import { useLocale } from 'next-intl'
 import { useRouter, usePathname } from '@/src/i18n/navigation'
 import { locales, type Locale } from '@/src/i18n/routing'
+import { localeLabels } from '@/src/i18n/locale-labels'
 import { GlobeAltIcon } from '@heroicons/react/24/outline'
 import { useState, useRef, useEffect, useTransition } from 'react'
 import clsx from 'clsx'
 
-const localeLabels: Record<Locale, string> = {
-  en: 'English',
-  it: 'Italiano',
-  es: 'Espanol',
-  fr: 'Francais',
-  pt: 'Portugues',
-  de: 'Deutsch',
-}
-
 export default function LanguageSwitcher() {
   const locale = useLocale()
   const router = useRouter()
diff --git a/components/sections/ReferCommunityProjectModal.tsx b/components/sections/ReferCommunityProjectModal.tsx
index 30492bf..5a174e7 100644
--- a/components/sections/ReferCommunityProjectModal.tsx
+++ b/components/sections/ReferCommunityProjectModal.tsx
@@ -1,7 +1,9 @@
 'use client'
 
 import { useState, useRef, useCallback } from 'react'
-import { useTranslations } from 'next-intl'
+import { useTranslations, useLocale } from 'next-intl'
+import { locales, type Locale } from '@/src/i18n/routing'
+import { localeLabels } from '@/src/i18n/locale-labels'
 
 interface ReferCommunityProjectModalProps {
   buttonLabel: string
@@ -11,6 +13,8 @@ type Status = 'idle' | 'sending_code' | 'awaiting_code' | 'submitting' | 'succes
 
 export default function ReferCommunityProjectModal({ buttonLabel }: ReferCommunityProjectModalProps) {
   const t = useTranslations('communityProjects')
+  const tc = useTranslations('common')
+  const currentLocale = useLocale() as Locale
   const dialogRef = useRef<HTMLDialogElement>(null)
   const openedAtRef = useRef<number>(0)
   const [formData, setFormData] = useState<{ fields: Record<string, string>; tags: string[] }>({ fields: {}, tags: [] })
@@ -50,6 +54,7 @@ export default function ReferCommunityProjectModal({ buttonLabel }: ReferCommuni
       description: data.get('description') as string,
       project_url: data.get('project_url') as string,
       github_url: data.get('github_url') as string,
+      language: data.get('language') as string,
       submitter_name: data.get('submitter_name') as string,
       submitter_email: data.get('submitter_email') as string,
       website: data.get('website') as string,
@@ -290,6 +295,25 @@ export default function ReferCommunityProjectModal({ buttonLabel }: ReferCommuni
                   />
                 </div>
 
+                <div>
+                  <label htmlFor="cp_language" className="block text-sm font-medium text-gray-700">
+                    {tc('submissionLanguage')} <span className="text-red-500">*</span>
+                  </label>
+                  <select
+                    id="cp_language"
+                    name="language"
+                    defaultValue={formData.fields.language || currentLocale}
+                    className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 text-sm focus:border-cdcf-gold focus:ring-1 focus:ring-cdcf-gold focus:outline-none"
+                  >
+                    {locales.map((loc) => (
+                      <option key={loc} value={loc}>
+                        {localeLabels[loc]}
+                      </option>
+                    ))}
+                  </select>
+                  <p className="mt-1 text-xs text-gray-500">{tc('submissionLanguageHint')}</p>
+                </div>
+
                 <div>
                   <label htmlFor="cp_project_name" className="block text-sm font-medium text-gray-700">
                     {t('fieldProjectName')} <span className="text-red-500">*</span>
diff --git a/components/sections/ReferLocalGroupModal.tsx b/components/sections/ReferLocalGroupModal.tsx
index 0355125..5d1e45b 100644
--- a/components/sections/ReferLocalGroupModal.tsx
+++ b/components/sections/ReferLocalGroupModal.tsx
@@ -1,7 +1,9 @@
 'use client'
 
 import { useState, useRef, useCallback } from 'react'
-import { useTranslations } from 'next-intl'
+import { useTranslations, useLocale } from 'next-intl'
+import { locales, type Locale } from '@/src/i18n/routing'
+import { localeLabels } from '@/src/i18n/locale-labels'
 
 interface ReferLocalGroupModalProps {
   buttonLabel: string
@@ -11,6 +13,8 @@ type Status = 'idle' | 'sending_code' | 'awaiting_code' | 'submitting' | 'succes
 
 export default function ReferLocalGroupModal({ buttonLabel }: ReferLocalGroupModalProps) {
   const t = useTranslations('community')
+  const tc = useTranslations('common')
+  const currentLocale = useLocale() as Locale
   const dialogRef = useRef<HTMLDialogElement>(null)
   const openedAtRef = useRef<number>(0)
   const [formData, setFormData] = useState<Record<string, string>>({})
@@ -45,6 +49,7 @@ export default function ReferLocalGroupModal({ buttonLabel }: ReferLocalGroupMod
       location: data.get('location') as string,
       url: data.get('url') as string,
       description: data.get('description') as string,
+      language: data.get('language') as string,
       submitter_name: data.get('submitter_name') as string,
       submitter_email: data.get('submitter_email') as string,
       website: data.get('website') as string,
@@ -57,6 +62,7 @@ export default function ReferLocalGroupModal({ buttonLabel }: ReferLocalGroupMod
       location: payload.location,
       url: payload.url,
       description: payload.description,
+      language: payload.language,
       submitter_name: payload.submitter_name,
       submitter_email: payload.submitter_email,
       website: payload.website,
@@ -285,6 +291,25 @@ export default function ReferLocalGroupModal({ buttonLabel }: ReferLocalGroupMod
                   />
                 </div>
 
+                <div>
+                  <label htmlFor="lg_language" className="block text-sm font-medium text-gray-700">
+                    {tc('submissionLanguage')} <span className="text-red-500">*</span>
+                  </label>
+                  <select
+                    id="lg_language"
+                    name="language"
+                    defaultValue={formData.language || currentLocale}
+                    className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 text-sm focus:border-cdcf-gold focus:ring-1 focus:ring-cdcf-gold focus:outline-none"
+                  >
+                    {locales.map((loc) => (
+                      <option key={loc} value={loc}>
+                        {localeLabels[loc]}
+                      </option>
+                    ))}
+                  </select>
+                  <p className="mt-1 text-xs text-gray-500">{tc('submissionLanguageHint')}</p>
+                </div>
+
                 <div>
                   <label htmlFor="group_name" className="block text-sm font-medium text-gray-700">
                     {t('fieldGroupName')} <span className="text-red-500">*</span>
diff --git a/components/sections/SubmitProjectModal.tsx b/components/sections/SubmitProjectModal.tsx
index a3a23fe..fea4b7d 100644
--- a/components/sections/SubmitProjectModal.tsx
+++ b/components/sections/SubmitProjectModal.tsx
@@ -1,7 +1,9 @@
 'use client'
 
 import { useState, useRef, useCallback } from 'react'
-import { useTranslations } from 'next-intl'
+import { useTranslations, useLocale } from 'next-intl'
+import { locales, type Locale } from '@/src/i18n/routing'
+import { localeLabels } from '@/src/i18n/locale-labels'
 
 interface SubmitProjectModalProps {
   buttonLabel: string
@@ -11,6 +13,8 @@ type Status = 'idle' | 'sending_code' | 'awaiting_code' | 'submitting' | 'succes
 
 export default function SubmitProjectModal({ buttonLabel }: SubmitProjectModalProps) {
   const t = useTranslations('projects')
+  const tc = useTranslations('common')
+  const currentLocale = useLocale() as Locale
   const dialogRef = useRef<HTMLDialogElement>(null)
   const openedAtRef = useRef<number>(0)
   const [formData, setFormData] = useState<{ fields: Record<string, string>; repoUrls: string[]; tags: string[] }>({
@@ -67,6 +71,7 @@ export default function SubmitProjectModal({ buttonLabel }: SubmitProjectModalPr
       category: data.get('category') as string,
       description: data.get('description') as string,
       url: data.get('url') as string,
+      language: data.get('language') as string,
       submitter_name: data.get('submitter_name') as string,
       submitter_email: data.get('submitter_email') as string,
       website: data.get('website') as string,
@@ -308,6 +313,25 @@ export default function SubmitProjectModal({ buttonLabel }: SubmitProjectModalPr
                   />
                 </div>
 
+                <div>
+                  <label htmlFor="sp_language" className="block text-sm font-medium text-gray-700">
+                    {tc('submissionLanguage')} <span className="text-red-500">*</span>
+                  </label>
+                  <select
+                    id="sp_language"
+                    name="language"
+                    defaultValue={formData.fields.language || currentLocale}
+                    className="mt-1 block w-full rounded-md border border-gray-300 px-3 py-2 text-sm focus:border-cdcf-gold focus:ring-1 focus:ring-cdcf-gold focus:outline-none"
+                  >
+                    {locales.map((loc) => (
+                      <option key={loc} value={loc}>
+                        {localeLabels[loc]}
+                      </option>
+                    ))}
+                  </select>
+                  <p className="mt-1 text-xs text-gray-500">{tc('submissionLanguageHint')}</p>
+                </div>
+
                 <div>
                   <label htmlFor="project_name" className="block text-sm font-medium text-gray-700">
                     {t('fieldProjectName')} <span className="text-red-500">*</span>
diff --git a/messages/de.json b/messages/de.json
index a18a75a..91feccb 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -74,7 +74,9 @@
     "error": "Etwas ist schiefgelaufen",
     "notFound": "Seite nicht gefunden",
     "search": "Suchen",
-    "language": "Sprache"
+    "language": "Sprache",
+    "submissionLanguage": "Inhaltssprache",
+    "submissionLanguageHint": "Verfassen Sie Ihre Einreichung in einer der 6 unterst\u00fctzten Sprachen. Wir \u00fcbersetzen sie automatisch in die anderen 5."
   },
   "hero": {
     "defaultTagline": "Catholic Digital Commons Foundation",
diff --git a/messages/en.json b/messages/en.json
index 6c0ede0..73e272a 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -74,7 +74,9 @@
     "error": "Something went wrong",
     "notFound": "Page not found",
     "search": "Search",
-    "language": "Language"
+    "language": "Language",
+    "submissionLanguage": "Content language",
+    "submissionLanguageHint": "Write your submission in any of the 6 supported languages. We'll auto-translate to the other 5."
   },
   "hero": {
     "defaultTagline": "Catholic Digital Commons Foundation",
diff --git a/messages/es.json b/messages/es.json
index c5fec17..cefc86b 100644
--- a/messages/es.json
+++ b/messages/es.json
@@ -74,7 +74,9 @@
     "error": "Algo salió mal",
     "notFound": "Página no encontrada",
     "search": "Buscar",
-    "language": "Idioma"
+    "language": "Idioma",
+    "submissionLanguage": "Idioma del contenido",
+    "submissionLanguageHint": "Escribe tu propuesta en cualquiera de los 6 idiomas admitidos. La traduciremos autom\u00e1ticamente a los otros 5."
   },
   "hero": {
     "defaultTagline": "Catholic Digital Commons Foundation",
diff --git a/messages/fr.json b/messages/fr.json
index d4ef87c..1844c20 100644
--- a/messages/fr.json
+++ b/messages/fr.json
@@ -74,7 +74,9 @@
     "error": "Une erreur est survenue",
     "notFound": "Page introuvable",
     "search": "Rechercher",
-    "language": "Langue"
+    "language": "Langue",
+    "submissionLanguage": "Langue du contenu",
+    "submissionLanguageHint": "R\u00e9digez votre soumission dans l'une des 6 langues prises en charge. Nous la traduirons automatiquement vers les 5 autres."
   },
   "hero": {
     "defaultTagline": "Catholic Digital Commons Foundation",
diff --git a/messages/it.json b/messages/it.json
index 8bafabd..dc38f6f 100644
--- a/messages/it.json
+++ b/messages/it.json
@@ -74,7 +74,9 @@
     "error": "Qualcosa è andato storto",
     "notFound": "Pagina non trovata",
     "search": "Cerca",
-    "language": "Lingua"
+    "language": "Lingua",
+    "submissionLanguage": "Lingua del contenuto",
+    "submissionLanguageHint": "Scrivi la tua candidatura in una qualsiasi delle 6 lingue supportate. La tradurremo automaticamente nelle altre 5."
   },
   "hero": {
     "defaultTagline": "Catholic Digital Commons Foundation",
diff --git a/messages/pt.json b/messages/pt.json
index 21eb897..4391e79 100644
--- a/messages/pt.json
+++ b/messages/pt.json
@@ -74,7 +74,9 @@
     "error": "Algo deu errado",
     "notFound": "Página não encontrada",
     "search": "Pesquisar",
-    "language": "Idioma"
+    "language": "Idioma",
+    "submissionLanguage": "Idioma do conte\u00fado",
+    "submissionLanguageHint": "Escreva sua submiss\u00e3o em qualquer um dos 6 idiomas suportados. Traduziremos automaticamente para os outros 5."
   },
   "hero": {
     "defaultTagline": "Catholic Digital Commons Foundation",
diff --git a/src/i18n/locale-labels.ts b/src/i18n/locale-labels.ts
new file mode 100644
index 0000000..b372265
--- /dev/null
+++ b/src/i18n/locale-labels.ts
@@ -0,0 +1,10 @@
+import type { Locale } from './routing'
+
+export const localeLabels: Record<Locale, string> = {
+  en: 'English',
+  it: 'Italiano',
+  es: 'Español',
+  fr: 'Français',
+  pt: 'Português',
+  de: 'Deutsch',
+}
diff --git a/wordpress/themes/cdcf-headless/functions.php b/wordpress/themes/cdcf-headless/functions.php
index da3bc4a..65d2def 100644
--- a/wordpress/themes/cdcf-headless/functions.php
+++ b/wordpress/themes/cdcf-headless/functions.php
@@ -816,6 +816,7 @@
             'description'       => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_textarea_field'],
             'url'               => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'esc_url_raw'],
             'location'          => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'default' => ''],
+            'language'          => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'default' => ''],
             'submitter_name'    => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
             'submitter_email'   => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_email'],
             'verification_code' => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
@@ -871,6 +872,7 @@
             'project_url'       => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'esc_url_raw', 'default' => ''],
             'github_url'        => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'esc_url_raw', 'default' => ''],
             'tags'              => ['required' => false, 'type' => 'array',  'default' => []],
+            'language'          => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'default' => ''],
             'submitter_name'    => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
             'submitter_email'   => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_email'],
             'verification_code' => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
@@ -924,6 +926,7 @@
             'url'               => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'esc_url_raw', 'default' => ''],
             'repo_urls'         => ['required' => false, 'type' => 'array',  'default' => []],
             'tags'              => ['required' => false, 'type' => 'array',  'default' => []],
+            'language'          => ['required' => false, 'type' => 'string', 'sanitize_callback' => 'sanitize_text_field', 'default' => ''],
             'submitter_name'    => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
             'submitter_email'   => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_email'],
             'verification_code' => ['required' => true,  'type' => 'string', 'sanitize_callback' => 'sanitize_text_field'],
diff --git a/wordpress/themes/cdcf-headless/includes/handlers/refer-community-project.php b/wordpress/themes/cdcf-headless/includes/handlers/refer-community-project.php
index 0b8dba1..112a191 100644
--- a/wordpress/themes/cdcf-headless/includes/handlers/refer-community-project.php
+++ b/wordpress/themes/cdcf-headless/includes/handlers/refer-community-project.php
@@ -16,6 +16,13 @@
 }
 
 function cdcf_rest_refer_community_project(WP_REST_Request $request) {
+    // Resolve + validate the submission content language up front so we
+    // refuse tampered values before any side effects.
+    $language = cdcf_validate_submission_language($request['language']);
+    if (is_wp_error($language)) {
+        return $language;
+    }
+
     // Rate limiting via transients: 3 submissions per hour per IP (defense-in-depth).
     $ip = sanitize_text_field($_SERVER['REMOTE_ADDR'] ?? 'unknown');
     $transient_key = 'cdcf_refer_cp_' . md5($ip);
@@ -86,9 +93,11 @@ function cdcf_rest_refer_community_project(WP_REST_Request $request) {
         return new WP_Error('insert_failed', 'Failed to create referral.', ['status' => 500]);
     }
 
-    // Assign English language so Polylang can link translations later.
+    // Tag the post with its submission content language so Polylang
+    // can link translations later. Defaults to 'en' for legacy callers
+    // that don't send the field; see cdcf_validate_submission_language.
     if (function_exists('pll_set_post_language')) {
-        pll_set_post_language($post_id, 'en');
+        pll_set_post_language($post_id, $language);
     }
 
     // Set ACF fields if ACF is active.
diff --git a/wordpress/themes/cdcf-headless/includes/handlers/refer-local-group.php b/wordpress/themes/cdcf-headless/includes/handlers/refer-local-group.php
index 9334000..89e7f1d 100644
--- a/wordpress/themes/cdcf-headless/includes/handlers/refer-local-group.php
+++ b/wordpress/themes/cdcf-headless/includes/handlers/refer-local-group.php
@@ -16,6 +16,13 @@
 }
 
 function cdcf_rest_refer_local_group(WP_REST_Request $request) {
+    // Resolve + validate the submission content language up front so we
+    // refuse tampered values before any side effects.
+    $language = cdcf_validate_submission_language($request['language']);
+    if (is_wp_error($language)) {
+        return $language;
+    }
+
     // Rate limiting via transients: 3 submissions per hour per IP (defense-in-depth).
     $ip = sanitize_text_field($_SERVER['REMOTE_ADDR'] ?? 'unknown');
     $transient_key = 'cdcf_refer_' . md5($ip);
@@ -85,9 +92,11 @@ function cdcf_rest_refer_local_group(WP_REST_Request $request) {
         return new WP_Error('insert_failed', 'Failed to create referral.', ['status' => 500]);
     }
 
-    // Assign English language so Polylang can link translations later.
+    // Tag the post with its submission content language so Polylang
+    // can link translations later. Defaults to 'en' for legacy callers
+    // that don't send the field; see cdcf_validate_submission_language.
     if (function_exists('pll_set_post_language')) {
-        pll_set_post_language($post_id, 'en');
+        pll_set_post_language($post_id, $language);
     }
 
     // Set ACF fields if ACF is active.
diff --git a/wordpress/themes/cdcf-headless/includes/handlers/submit-project.php b/wordpress/themes/cdcf-headless/includes/handlers/submit-project.php
index 1a150e8..0a55c87 100644
--- a/wordpress/themes/cdcf-headless/includes/handlers/submit-project.php
+++ b/wordpress/themes/cdcf-headless/includes/handlers/submit-project.php
@@ -18,6 +18,13 @@
 }
 
 function cdcf_rest_submit_project(WP_REST_Request $request) {
+    // Resolve + validate the submission content language up front so we
+    // refuse tampered values before any side effects.
+    $language = cdcf_validate_submission_language($request['language']);
+    if (is_wp_error($language)) {
+        return $language;
+    }
+
     // Rate limiting via transients: 3 submissions per hour per IP (defense-in-depth).
     $ip = sanitize_text_field($_SERVER['REMOTE_ADDR'] ?? 'unknown');
     $transient_key = 'cdcf_projsub_' . md5($ip);
@@ -88,9 +95,11 @@ function cdcf_rest_submit_project(WP_REST_Request $request) {
         return new WP_Error('insert_failed', 'Failed to create project submission.', ['status' => 500]);
     }
 
-    // Assign English language so Polylang can link translations later.
+    // Tag the post with its submission content language so Polylang
+    // can link translations later. Defaults to 'en' for legacy callers
+    // that don't send the field; see cdcf_validate_submission_language.
     if (function_exists('pll_set_post_language')) {
-        pll_set_post_language($post_id, 'en');
+        pll_set_post_language($post_id, $language);
     }
 
     // Sanitise repo URLs.
diff --git a/wordpress/themes/cdcf-headless/includes/security.php b/wordpress/themes/cdcf-headless/includes/security.php
index 4386b4d..4259bc6 100644
--- a/wordpress/themes/cdcf-headless/includes/security.php
+++ b/wordpress/themes/cdcf-headless/includes/security.php
@@ -110,3 +110,35 @@ function cdcf_is_spam_content(string $text): bool {
 
     return $score >= 5;
 }
+
+/**
+ * Resolve + validate the submission content language for a public
+ * submission form. Public submission forms (project, community_project,
+ * local_group) now expose a language selector defaulting to the page's
+ * current locale; this helper normalizes the request param to a
+ * configured Polylang locale.
+ *
+ * Empty / unset / null → default 'en' (legacy contract, plus the
+ * back-compat path for any caller that doesn't yet send the field).
+ * Any other value MUST be a key of CDCF_LOCALE_NAMES — otherwise we
+ * return WP_Error so the handler can refuse a tampered request rather
+ * than land a post in an unconfigured language. CDCF_LOCALE_NAMES is
+ * defined in functions.php (en/it/es/fr/pt/de).
+ *
+ * @return string|WP_Error Validated locale slug on success.
+ */
+function cdcf_validate_submission_language($value) {
+    $lang = is_string($value) ? trim($value) : '';
+    if ($lang === '') {
+        return 'en';
+    }
+    $allowed = defined('CDCF_LOCALE_NAMES') ? array_keys(CDCF_LOCALE_NAMES) : ['en'];
+    if (!in_array($lang, $allowed, true)) {
+        return new WP_Error(
+            'invalid_language',
+            'Submission language must be one of the configured site locales.',
+            ['status' => 400]
+        );
+    }
+    return $lang;
+}
diff --git a/wordpress/themes/cdcf-headless/tests/SubmissionHandlerTestBase.php b/wordpress/themes/cdcf-headless/tests/SubmissionHandlerTestBase.php
index 5618837..933c4fb 100644
--- a/wordpress/themes/cdcf-headless/tests/SubmissionHandlerTestBase.php
+++ b/wordpress/themes/cdcf-headless/tests/SubmissionHandlerTestBase.php
@@ -315,4 +315,72 @@ function (string $key) use (&$deleted): bool {
             $deleted
         );
     }
+
+    // ─── Submission language (CDCF_LOCALE_NAMES) ───────────────────
+
+    public function test_uses_submission_language_from_request_when_provided(): void
+    {
+        // The public submission form now exposes a content-language
+        // selector defaulting to the page's current locale, so that a
+        // Spanish submission lands as a Spanish post and the
+        // translation pipeline auto-creates EN/IT/FR/PT/DE siblings
+        // (rather than starting as English and getting manually
+        // re-tagged after the fact — the 2026-06-16 Enciclopedia
+        // Católica regression that exposed three independent
+        // hardcoded-EN bugs in the publish pipeline).
+        $this->stubCommonFunctions();
+        $langCalls = [];
+        Functions\when('pll_set_post_language')->alias(
+            function (int $post_id, string $lang) use (&$langCalls): bool {
+                $langCalls[] = [$post_id, $lang];
+                return true;
+            }
+        );
+        $this->allowAllFunctionsToExist();
+
+        $this->invokeHandler($this->makeRequest(['language' => 'es']));
+
+        $this->assertSame(
+            [[800, 'es']],
+            $langCalls,
+            'A Spanish submission must call pll_set_post_language with "es" for the newly inserted post — not the legacy hardcoded "en".'
+        );
+    }
+
+    public function test_defaults_to_english_when_no_submission_language_provided(): void
+    {
+        // Back-compat: callers that don't supply a language (the
+        // legacy contract) keep landing as English. The empty default
+        // from the args block resolves to 'en' here.
+        $this->stubCommonFunctions();
+        $langCalls = [];
+        Functions\when('pll_set_post_language')->alias(
+            function (int $post_id, string $lang) use (&$langCalls): bool {
+                $langCalls[] = [$post_id, $lang];
+                return true;
+            }
+        );
+        $this->allowAllFunctionsToExist();
+
+        $this->invokeHandler($this->makeRequest(['language' => '']));
+
+        $this->assertSame([[800, 'en']], $langCalls);
+    }
+
+    public function test_rejects_unsupported_submission_language_with_400(): void
+    {
+        // Defense in depth: the args block sanitizes the field, but
+        // validation against the CDCF_LOCALE_NAMES allowlist lives in
+        // the handler so a tampered request can't land posts in an
+        // unconfigured Polylang language.
+        $this->stubCommonFunctions();
+        Functions\expect('wp_insert_post')->never();
+        $this->allowAllFunctionsToExist();
+
+        $response = $this->invokeHandler($this->makeRequest(['language' => 'zh']));
+
+        $this->assertInstanceOf(WP_Error::class, $response);
+        $this->assertSame('invalid_language', $response->get_error_code());
+        $this->assertSame(400, $response->get_error_data()['status']);
+    }
 }