diff --git a/actions/pbis.ts b/actions/pbis.ts
index 0f45dfc..d98b85b 100644
--- a/actions/pbis.ts
+++ b/actions/pbis.ts
@@ -7,13 +7,17 @@ import { z } from 'zod'
 import { prisma } from '@/lib/prisma'
 import { SessionData, sessionOptions } from '@/lib/session'
 import { getAccessibleProduct } from '@/lib/product-access'
+import { generateNextPbiCode, isValidCode, MAX_CODE_LENGTH, normalizeCode } from '@/lib/code'
 
 async function getSession() {
   return getIronSession<SessionData>(await cookies(), sessionOptions)
 }
 
+const codeField = z.string().max(MAX_CODE_LENGTH).optional()
+
 const createPbiSchema = z.object({
   productId: z.string(),
+  code: codeField,
   title: z.string().min(1, 'Titel is verplicht').max(200),
   description: z.string().max(2000).optional(),
   priority: z.coerce.number().int().min(1).max(4),
@@ -21,6 +25,7 @@ const createPbiSchema = z.object({
 
 const updatePbiSchema = z.object({
   id: z.string(),
+  code: codeField,
   title: z.string().min(1, 'Titel is verplicht').max(200),
   description: z.string().max(2000).optional(),
   priority: z.coerce.number().int().min(1).max(4),
@@ -33,6 +38,7 @@ export async function createPbiAction(_prevState: unknown, formData: FormData) {
 
   const parsed = createPbiSchema.safeParse({
     productId: formData.get('productId'),
+    code: (formData.get('code') as string) || undefined,
     title: formData.get('title'),
     description: formData.get('description') || undefined,
     priority: formData.get('priority'),
@@ -42,6 +48,17 @@ export async function createPbiAction(_prevState: unknown, formData: FormData) {
   const product = await getAccessibleProduct(parsed.data.productId, session.userId)
   if (!product) return { error: 'Product niet gevonden' }
 
+  let code = normalizeCode(parsed.data.code)
+  if (code !== null && !isValidCode(code)) {
+    return { error: { code: ['Code mag alleen letters, cijfers, punten, koppeltekens of underscores bevatten'] } }
+  }
+  if (code === null) {
+    code = await generateNextPbiCode(parsed.data.productId)
+  } else {
+    const dup = await prisma.pbi.findFirst({ where: { product_id: parsed.data.productId, code } })
+    if (dup) return { error: { code: ['Deze code is al in gebruik binnen dit product'] } }
+  }
+
   const last = await prisma.pbi.findFirst({
     where: { product_id: parsed.data.productId, priority: parsed.data.priority },
     orderBy: { sort_order: 'desc' },
@@ -51,6 +68,7 @@ export async function createPbiAction(_prevState: unknown, formData: FormData) {
   const pbi = await prisma.pbi.create({
     data: {
       product_id: parsed.data.productId,
+      code,
       title: parsed.data.title,
       description: parsed.data.description ?? null,
       priority: parsed.data.priority,
@@ -69,6 +87,7 @@ export async function updatePbiAction(_prevState: unknown, formData: FormData) {
 
   const parsed = updatePbiSchema.safeParse({
     id: formData.get('id'),
+    code: (formData.get('code') as string) || undefined,
     title: formData.get('title'),
     description: formData.get('description') || undefined,
     priority: formData.get('priority'),
@@ -83,9 +102,21 @@ export async function updatePbiAction(_prevState: unknown, formData: FormData) {
   const accessible = await getAccessibleProduct(pbi.product_id, session.userId)
   if (!accessible) return { error: 'PBI niet gevonden' }
 
+  const code = normalizeCode(parsed.data.code)
+  if (code !== null && !isValidCode(code)) {
+    return { error: { code: ['Code mag alleen letters, cijfers, punten, koppeltekens of underscores bevatten'] } }
+  }
+  if (code) {
+    const dup = await prisma.pbi.findFirst({
+      where: { product_id: pbi.product_id, code, NOT: { id: parsed.data.id } },
+    })
+    if (dup) return { error: { code: ['Deze code is al in gebruik binnen dit product'] } }
+  }
+
   await prisma.pbi.update({
     where: { id: parsed.data.id },
     data: {
+      code,
       title: parsed.data.title,
       description: parsed.data.description ?? null,
       priority: parsed.data.priority,
diff --git a/actions/products.ts b/actions/products.ts
index 960ed98..6eae56a 100644
--- a/actions/products.ts
+++ b/actions/products.ts
@@ -8,9 +8,14 @@ import { z } from 'zod'
 import { prisma } from '@/lib/prisma'
 import { SessionData, sessionOptions } from '@/lib/session'
 import { Role } from '@prisma/client'
+import { isValidCode, MAX_CODE_LENGTH, normalizeCode } from '@/lib/code'
 
 const productSchema = z.object({
   name: z.string().min(1, 'Naam is verplicht').max(100, 'Naam mag maximaal 100 tekens bevatten'),
+  code: z
+    .string()
+    .max(MAX_CODE_LENGTH, `Code mag maximaal ${MAX_CODE_LENGTH} tekens bevatten`)
+    .optional(),
   description: z.string().max(1000, 'Beschrijving mag maximaal 1000 tekens bevatten').optional(),
   repo_url: z
     .string()
@@ -34,6 +39,7 @@ export async function createProductAction(_prevState: unknown, formData: FormDat
 
   const parsed = productSchema.safeParse({
     name: formData.get('name'),
+    code: (formData.get('code') as string) || undefined,
     description: formData.get('description') || undefined,
     repo_url: formData.get('repo_url') || undefined,
     definition_of_done: formData.get('definition_of_done'),
@@ -43,15 +49,26 @@ export async function createProductAction(_prevState: unknown, formData: FormDat
     return { error: parsed.error.flatten().fieldErrors }
   }
 
+  const code = normalizeCode(parsed.data.code)
+  if (code !== null && !isValidCode(code)) {
+    return { error: { code: ['Code mag alleen letters, cijfers, punten, koppeltekens of underscores bevatten'] } }
+  }
+
   const existing = await prisma.product.findFirst({
     where: { user_id: session.userId, name: parsed.data.name },
   })
   if (existing) return { error: { name: ['Een product met deze naam bestaat al'] } }
 
+  if (code) {
+    const dup = await prisma.product.findFirst({ where: { user_id: session.userId, code } })
+    if (dup) return { error: { code: ['Deze code is al in gebruik'] } }
+  }
+
   const product = await prisma.product.create({
     data: {
       user_id: session.userId,
       name: parsed.data.name,
+      code,
       description: parsed.data.description ?? null,
       repo_url: parsed.data.repo_url || null,
       definition_of_done: parsed.data.definition_of_done,
@@ -71,6 +88,7 @@ export async function updateProductAction(_prevState: unknown, formData: FormDat
 
   const parsed = productSchema.safeParse({
     name: formData.get('name'),
+    code: (formData.get('code') as string) || undefined,
     description: formData.get('description') || undefined,
     repo_url: formData.get('repo_url') || undefined,
     definition_of_done: formData.get('definition_of_done'),
@@ -80,6 +98,11 @@ export async function updateProductAction(_prevState: unknown, formData: FormDat
     return { error: parsed.error.flatten().fieldErrors }
   }
 
+  const code = normalizeCode(parsed.data.code)
+  if (code !== null && !isValidCode(code)) {
+    return { error: { code: ['Code mag alleen letters, cijfers, punten, koppeltekens of underscores bevatten'] } }
+  }
+
   // Verify ownership
   const product = await prisma.product.findFirst({
     where: { id, user_id: session.userId },
@@ -92,10 +115,18 @@ export async function updateProductAction(_prevState: unknown, formData: FormDat
   })
   if (duplicate) return { error: { name: ['Een product met deze naam bestaat al'] } }
 
+  if (code) {
+    const dupCode = await prisma.product.findFirst({
+      where: { user_id: session.userId, code, NOT: { id } },
+    })
+    if (dupCode) return { error: { code: ['Deze code is al in gebruik'] } }
+  }
+
   await prisma.product.update({
     where: { id },
     data: {
       name: parsed.data.name,
+      code,
       description: parsed.data.description ?? null,
       repo_url: parsed.data.repo_url || null,
       definition_of_done: parsed.data.definition_of_done,
diff --git a/actions/stories.ts b/actions/stories.ts
index 29119ae..35acb1b 100644
--- a/actions/stories.ts
+++ b/actions/stories.ts
@@ -8,6 +8,7 @@ import { prisma } from '@/lib/prisma'
 import { SessionData, sessionOptions } from '@/lib/session'
 import { getAccessibleProduct, productAccessFilter } from '@/lib/product-access'
 import { requireProductWriter } from '@/lib/auth'
+import { generateNextStoryCode, isValidCode, MAX_CODE_LENGTH, normalizeCode } from '@/lib/code'
 
 async function getSession() {
   return getIronSession<SessionData>(await cookies(), sessionOptions)
@@ -24,9 +25,12 @@ function hasDuplicateIds(ids: string[]) {
   return new Set(ids).size !== ids.length
 }
 
+const codeField = z.string().max(MAX_CODE_LENGTH).optional()
+
 const createStorySchema = z.object({
   pbiId: z.string(),
   productId: z.string(),
+  code: codeField,
   title: z.string().min(1, 'Titel is verplicht').max(200),
   description: z.string().max(2000).optional(),
   acceptance_criteria: z.string().max(2000).optional(),
@@ -35,6 +39,7 @@ const createStorySchema = z.object({
 
 const updateStorySchema = z.object({
   id: z.string(),
+  code: codeField,
   title: z.string().min(1, 'Titel is verplicht').max(200),
   description: z.string().max(2000).optional(),
   acceptance_criteria: z.string().max(2000).optional(),
@@ -49,6 +54,7 @@ export async function createStoryAction(_prevState: unknown, formData: FormData)
   const parsed = createStorySchema.safeParse({
     pbiId: formData.get('pbiId'),
     productId: formData.get('productId'),
+    code: (formData.get('code') as string) || undefined,
     title: formData.get('title'),
     description: formData.get('description') || undefined,
     acceptance_criteria: formData.get('acceptance_criteria') || undefined,
@@ -61,6 +67,17 @@ export async function createStoryAction(_prevState: unknown, formData: FormData)
   })
   if (!pbi) return { error: 'PBI niet gevonden' }
 
+  let code = normalizeCode(parsed.data.code)
+  if (code !== null && !isValidCode(code)) {
+    return { error: { code: ['Code mag alleen letters, cijfers, punten, koppeltekens of underscores bevatten'] } }
+  }
+  if (code === null) {
+    code = await generateNextStoryCode(pbi.product_id)
+  } else {
+    const dup = await prisma.story.findFirst({ where: { product_id: pbi.product_id, code } })
+    if (dup) return { error: { code: ['Deze code is al in gebruik binnen dit product'] } }
+  }
+
   const last = await prisma.story.findFirst({
     where: { pbi_id: parsed.data.pbiId, priority: parsed.data.priority },
     orderBy: { sort_order: 'desc' },
@@ -71,6 +88,7 @@ export async function createStoryAction(_prevState: unknown, formData: FormData)
     data: {
       pbi_id: parsed.data.pbiId,
       product_id: pbi.product_id,
+      code,
       title: parsed.data.title,
       description: parsed.data.description ?? null,
       acceptance_criteria: parsed.data.acceptance_criteria ?? null,
@@ -91,6 +109,7 @@ export async function updateStoryAction(_prevState: unknown, formData: FormData)
 
   const parsed = updateStorySchema.safeParse({
     id: formData.get('id'),
+    code: (formData.get('code') as string) || undefined,
     title: formData.get('title'),
     description: formData.get('description') || undefined,
     acceptance_criteria: formData.get('acceptance_criteria') || undefined,
@@ -101,9 +120,21 @@ export async function updateStoryAction(_prevState: unknown, formData: FormData)
   const story = await verifyStoryAccess(parsed.data.id, session.userId)
   if (!story) return { error: 'Story niet gevonden' }
 
+  const code = normalizeCode(parsed.data.code)
+  if (code !== null && !isValidCode(code)) {
+    return { error: { code: ['Code mag alleen letters, cijfers, punten, koppeltekens of underscores bevatten'] } }
+  }
+  if (code) {
+    const dup = await prisma.story.findFirst({
+      where: { product_id: story.product_id, code, NOT: { id: parsed.data.id } },
+    })
+    if (dup) return { error: { code: ['Deze code is al in gebruik binnen dit product'] } }
+  }
+
   await prisma.story.update({
     where: { id: parsed.data.id },
     data: {
+      code,
       title: parsed.data.title,
       description: parsed.data.description ?? null,
       acceptance_criteria: parsed.data.acceptance_criteria ?? null,