diff --git a/client/server/mdm.go b/client/server/mdm.go
index df4b80690..68464b763 100644
--- a/client/server/mdm.go
+++ b/client/server/mdm.go
@@ -14,10 +14,10 @@ import (
 // active MDM policy. Tests override this to inject a fake policy.
 var loadMDMPolicy = mdm.LoadPolicy
 
-// requestedManagedKeys returns the names of MDM-managed keys whose
+// requestedMDMManagedKeys returns the names of MDM-managed keys whose
 // corresponding field is set in the SetConfigRequest. Only keys with an
 // MDM mapping are considered; other fields are ignored.
-func requestedManagedKeys(msg *proto.SetConfigRequest) []string {
+func requestedMDMManagedKeys(msg *proto.SetConfigRequest) []string {
 	if msg == nil {
 		return nil
 	}
@@ -52,12 +52,12 @@ func requestedManagedKeys(msg *proto.SetConfigRequest) []string {
 	return keys
 }
 
-// rejectManagedFieldConflicts returns a FailedPrecondition gRPC error with a
-// ManagedFieldsViolation detail when any of the requested keys is MDM-
-// enforced, and nil otherwise. The whole request is rejected on any
-// conflict; non-conflicting fields in the same request are not applied
-// either (no partial apply).
-func rejectManagedFieldConflicts(policy *mdm.Policy, requested []string) error {
+// rejectMDMManagedFieldConflicts returns a FailedPrecondition gRPC error
+// with an MDMManagedFieldsViolation detail when any of the requested keys
+// is MDM-enforced, and nil otherwise. The whole request is rejected on
+// any conflict; non-conflicting fields in the same request are not
+// applied either (no partial apply).
+func rejectMDMManagedFieldConflicts(policy *mdm.Policy, requested []string) error {
 	if policy.IsEmpty() || len(requested) == 0 {
 		return nil
 	}
@@ -74,7 +74,7 @@ func rejectManagedFieldConflicts(policy *mdm.Policy, requested []string) error {
 		codes.FailedPrecondition,
 		fmt.Sprintf("fields managed by MDM cannot be modified: %v", conflicts),
 	)
-	detailed, err := st.WithDetails(&proto.ManagedFieldsViolation{Fields: conflicts})
+	detailed, err := st.WithDetails(&proto.MDMManagedFieldsViolation{Fields: conflicts})
 	if err != nil {
 		// Detail attachment is best-effort; fall back to the plain status
 		// so the caller still gets a usable FailedPrecondition.
diff --git a/client/server/server.go b/client/server/server.go
index 1a44cf21b..41052eadc 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -309,10 +309,10 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	}
 
 	// MDM gate: refuse the whole request if any of its fields is enforced
-	// by the active MDM policy. The error carries a ManagedFieldsViolation
-	// detail listing the offending key names. Non-conflicting fields in
-	// the same request are not applied either.
-	if err := rejectManagedFieldConflicts(loadMDMPolicy(), requestedManagedKeys(msg)); err != nil {
+	// by the active MDM policy. The error carries an MDMManagedFields-
+	// Violation detail listing the offending key names. Non-conflicting
+	// fields in the same request are not applied either.
+	if err := rejectMDMManagedFieldConflicts(loadMDMPolicy(), requestedMDMManagedKeys(msg)); err != nil {
 		return nil, err
 	}
 
@@ -1556,7 +1556,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		EnableSSHRemotePortForwarding: enableSSHRemotePortForwarding,
 		DisableSSHAuth:                disableSSHAuth,
 		SshJWTCacheTTL:                sshJWTCacheTTL,
-		ManagedFields:                 cfg.Policy().ManagedKeys(),
+		MDMManagedFields:              cfg.Policy().ManagedKeys(),
 	}, nil
 }
 
diff --git a/client/server/setconfig_mdm_test.go b/client/server/setconfig_mdm_test.go
index f19ef0ad4..53232c70d 100644
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -71,20 +71,20 @@ func setupServerWithProfile(t *testing.T) (s *Server, ctx context.Context, profN
 	return s, ctx, profName, currUser.Username, cfgPath
 }
 
-// extractViolation pulls the ManagedFieldsViolation detail from a
+// extractViolation pulls the MDMManagedFieldsViolation detail from a
 // FailedPrecondition error. Fails the test if absent or malformed.
-func extractViolation(t *testing.T, err error) *proto.ManagedFieldsViolation {
+func extractViolation(t *testing.T, err error) *proto.MDMManagedFieldsViolation {
 	t.Helper()
 	require.Error(t, err)
 	st, ok := gstatus.FromError(err)
 	require.True(t, ok, "error must be a gRPC status: %v", err)
 	require.Equal(t, codes.FailedPrecondition, st.Code(), "expected FailedPrecondition, got %s", st.Code())
 	for _, d := range st.Details() {
-		if v, ok := d.(*proto.ManagedFieldsViolation); ok {
+		if v, ok := d.(*proto.MDMManagedFieldsViolation); ok {
 			return v
 		}
 	}
-	t.Fatalf("ManagedFieldsViolation detail not found on status; details: %v", st.Details())
+	t.Fatalf("MDMManagedFieldsViolation detail not found on status; details: %v", st.Details())
 	return nil
 }