diff --git a/app/admin/page.tsx b/app/admin/page.tsx
index e880311..b296f54 100644
--- a/app/admin/page.tsx
+++ b/app/admin/page.tsx
@@ -499,6 +499,13 @@ export default function AdminDashboard() {
 
   const handleSaveCard = async () => {
     if (!isEditing) return;
+
+    // External Link: URL obbligatorio (feedback immediato, ribadito anche lato server)
+    if (isEditing.cardType === 'EXTERNAL_LINK' && !isEditing.actionUrl?.trim()) {
+      showToast("L'URL è obbligatorio per le card External Link", 'error');
+      return;
+    }
+
     const generateSafeId = () => 'card-' + Date.now().toString(36) + Math.random().toString(36).substring(2);
     const newCard = { ...isEditing, id: isEditing.id || generateSafeId() } as Card;
 
@@ -997,7 +1004,7 @@ export default function AdminDashboard() {
                 {isEditing.cardType !== 'FULLSCREEN_LOCK' && (isEditing.cardType === 'EXTERNAL_LINK' ? (
                   <>
                     <div>
-                      <label className="block text-sm font-semibold text-gray-800 mb-1">URL</label>
+                      <label className="block text-sm font-semibold text-gray-800 mb-1">URL <span className="text-red-600">*</span></label>
                       <input
                         type="url"
                         maxLength={CARD_LIMITS.actionUrl}
diff --git a/lib/validation.ts b/lib/validation.ts
index 112adf5..6d7ff98 100644
--- a/lib/validation.ts
+++ b/lib/validation.ts
@@ -53,6 +53,11 @@ export function validateCard(card: Partial<Card>): ValidationResult {
     errors.push({ field: 'fullContent', message: 'Contenuto troppo lungo', limit: CARD_LIMITS.fullContent, actual: strLen(card.fullContent) });
   }
 
+  // Le card External Link richiedono obbligatoriamente l'URL.
+  if (card.cardType === 'EXTERNAL_LINK' && (typeof card.actionUrl !== 'string' || card.actionUrl.trim() === '')) {
+    errors.push({ field: 'actionUrl', message: "L'URL è obbligatorio per le card External Link" });
+  }
+
   if (card.actionUrl !== undefined && card.actionUrl !== '') {
     if (typeof card.actionUrl !== 'string') {
       errors.push({ field: 'actionUrl', message: 'Tipo non valido' });