[client] Authorize daemon IPC callers by their local identity (#6967 )

[signal] make pprof configurable (#6963 )
[client] Fix UI crash on Windows builds without dark-mode support (#6958 )
2026-07-30 20:31:28 +02:00 · 2026-07-29 20:32:26 +02:00 · 2026-07-29 16:54:01 +02:00 · 2026-07-29 13:52:18 +02:00 · 2026-07-29 12:20:43 +02:00
105 changed files with 5407 additions and 4219 deletions
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -249,78 +249,35 @@ jobs:
          docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City_[0-9]*.mmdb
          docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames_[0-9]*.db

-  test-getting-started-script:
+  test-legacy-getting-started-scripts:
    runs-on: ubuntu-latest
    steps:
-      - name: Install jq
-        run: sudo apt-get install -y jq
-
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

-      - name: run script with Zitadel PostgreSQL
-        run: NETBIRD_DOMAIN=use-ip bash -x infrastructure_files/getting-started-with-zitadel.sh
-
-      - name: test Caddy file gen postgres
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen postgres
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen postgres
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen postgres
+      - name: Verify Dex retirement notice
        run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
+          if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Dex installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Dex support is not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/local" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt

-      - name: test zitadel.env file gen postgres
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen postgres
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen postgres
-        run: test -f relay.env
-
-      - name: test zdb.env file gen postgres
-        run: test -f zdb.env
-
-      - name: Postgres run cleanup
+      - name: Verify Zitadel retirement notice
        run: |
-          docker compose down --volumes --rmi all
-          rm -rf docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json zdb.env
-
-      - name: run script with Zitadel CockroachDB
-        run: bash -x infrastructure_files/getting-started-with-zitadel.sh
-        env:
-          NETBIRD_DOMAIN: use-ip
-          ZITADEL_DATABASE: cockroach
-
-      - name: test Caddy file gen CockroachDB
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen CockroachDB
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen CockroachDB
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen CockroachDB
-        run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
-
-      - name: test zitadel.env file gen CockroachDB
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen CockroachDB
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen CockroachDB
-        run: test -f relay.env
+          if bash infrastructure_files/getting-started-with-zitadel.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Zitadel installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Zitadel support and existing Zitadel deployments are not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/zitadel" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-guide" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -234,12 +234,22 @@ cd client/ui
 task dev
 ```

-Pass daemon flags after `--`:
+Pass daemon flags after `--`, pointing the UI at the socket the daemon serves:

 ```
-task dev -- --daemon-addr=tcp://127.0.0.1:41731
+task dev -- --daemon-addr=unix:///var/run/netbird.sock   # Linux, macOS
+task dev -- --daemon-addr=npipe://netbird                # Windows
 ```

+On Windows the daemon serves a named pipe (`npipe://netbird`). Which path that
+ends up being depends on what the daemon may create: as a service or elevated it
+serves `\\.\pipe\ProtectedPrefix\Administrators\netbird`, which no unprivileged
+process can take from it, and otherwise it falls back to `\\.\pipe\netbird`.
+Clients try both and check who owns the pipe before using the plain one. Avoid
+`tcp://127.0.0.1:41731`: loopback TCP carries no caller identity, so the daemon
+refuses the operations that require an administrator and you will not exercise
+those paths.
+
 Production build (frontend assets embedded into the binary, output in `client/ui/bin/`):

 ```
--- a/client/cmd/daemon_error.go
+++ b/client/cmd/daemon_error.go
@@ -0,0 +1,66 @@
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// daemonCallError prepares a daemon error for display. A refusal the daemon
+// raised because the operation needs root/administrator is already guidance
+// written for the user, so it is surfaced on its own instead of buried under the
+// gRPC envelope and the name of the RPC that hit it. Anything else is wrapped
+// with context as usual.
+func daemonCallError(context string, err error) error {
+	if guidance, ok := privilegeGuidance(err); ok {
+		return errors.New(guidance)
+	}
+	return fmt.Errorf("%s: %w", context, err)
+}
+
+// privilegeGuidance renders the daemon's privilege refusal as a summary and the
+// command that performs the operation with the privileges it needs. It reports
+// false for any other error.
+func privilegeGuidance(err error) (string, bool) {
+	info, ok := privilegeErrorInfo(err)
+	if !ok {
+		return "", false
+	}
+
+	summary := info.GetMetadata()[ipcauth.ErrorMetaSummary]
+	command := info.GetMetadata()[ipcauth.ErrorMetaCommand]
+	if summary == "" {
+		// Detail without a summary: fall back to the status message, which
+		// carries the same text.
+		summary = strings.TrimSpace(gstatus.Convert(err).Message())
+	}
+	if command == "" {
+		return summary, true
+	}
+
+	return fmt.Sprintf("%s\n\n    %s\n", summary, command), true
+}
+
+// privilegeErrorInfo returns the daemon's privilege-refusal detail, if the error
+// carries one.
+func privilegeErrorInfo(err error) (*errdetails.ErrorInfo, bool) {
+	if err == nil {
+		return nil, false
+	}
+
+	for _, detail := range gstatus.Convert(err).Details() {
+		info, ok := detail.(*errdetails.ErrorInfo)
+		if !ok {
+			continue
+		}
+		if info.GetReason() == ipcauth.ErrorReasonPrivilegeRequired && info.GetDomain() == ipcauth.ErrorDomain {
+			return info, true
+		}
+	}
+	return nil, false
+}
--- a/client/cmd/logout.go
+++ b/client/cmd/logout.go
@@ -46,7 +46,7 @@ var logoutCmd = &cobra.Command{
 		}

 		if _, err := daemonClient.Logout(ctx, req); err != nil {
-			return fmt.Errorf("deregister: %v", err)
+			return daemonCallError("deregister", err)
 		}

 		cmd.Println("Deregistered successfully")
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -20,7 +20,6 @@ import (
 	"github.com/spf13/cobra"
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"

 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -91,6 +90,7 @@ var (
 			// Don't resolve for service commands — they create the socket, not connect to it.
 			if !isServiceCmd(cmd) {
 				daemonAddr = daddr.ResolveUnixDaemonAddr(daemonAddr)
+				daemonAddr = daddr.ResolveDaemonAddr(daemonAddr)
 			}
 			return nil
 		},
@@ -143,10 +143,10 @@ func init() {

 	defaultDaemonAddr := "unix:///var/run/netbird.sock"
 	if runtime.GOOS == "windows" {
-		defaultDaemonAddr = "tcp://127.0.0.1:41731"
+		defaultDaemonAddr = daddr.WindowsPipeAddr
 	}

-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
@@ -269,12 +269,10 @@ func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, e
 	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
 	defer cancel()

-	return grpc.DialContext(
-		ctx,
-		strings.TrimPrefix(addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-		grpc.WithBlock(),
-	)
+	target, opts := daddr.DialTarget(addr)
+	opts = append(opts, grpc.WithBlock())
+
+	return grpc.DialContext(ctx, target, opts...)
 }

 // WithBackOff execute function in backoff cycle.
--- a/client/cmd/service.go
+++ b/client/cmd/service.go
@@ -33,10 +33,15 @@ var (
 )

 type program struct {
-	ctx              context.Context
-	cancel           context.CancelFunc
-	serv             *grpc.Server
-	jsonServ         *http.Server
+	ctx      context.Context
+	cancel   context.CancelFunc
+	serv     *grpc.Server
+	jsonServ *http.Server
+	// jsonClient is the gateway's own connection to the daemon. It is held so
+	// shutting the gateway down also closes it: nothing else references it once
+	// the handlers are registered, so its transport goroutines would otherwise
+	// outlive the server.
+	jsonClient       *grpc.ClientConn
 	jsonServMu       sync.Mutex
 	serverInstance   *server.Server
 	serverInstanceMu sync.Mutex
--- a/client/cmd/service_controller.go
+++ b/client/cmd/service_controller.go
@@ -5,6 +5,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"runtime"
 	"time"

 	"github.com/kardianos/service"
@@ -13,6 +14,8 @@ import (
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"

+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
@@ -26,6 +29,31 @@ func validateJSONSocketFlags() error {
 	return nil
 }

+// daemonServerOptions installs the transport credentials that expose each
+// caller's kernel-authenticated identity to the handlers, which is what lets
+// the daemon require root/administrator for privileged operations.
+//
+// The handshake exchanges no bytes, so older CLI and UI binaries still
+// interoperate. Callers on a TCP socket carry no identity at all: the daemon
+// keeps serving them, and the privileged operations deny them, so a warning is
+// logged to make the loss of functionality visible.
+func daemonServerOptions(network string) []grpc.ServerOption {
+	if network == "tcp" {
+		log.Warnf("daemon is listening on TCP (%s): callers carry no verifiable identity over TCP, "+
+			"so privileged operations (SSH root login, SSH auth, enabling the SSH server, management URL changes, "+
+			"deregistration) will be denied. Use a unix socket, or npipe:// on Windows", daemonAddr)
+		return nil
+	}
+
+	creds := ipcauth.NewTransportCredentials()
+	if creds == nil {
+		log.Warnf("daemon IPC has no peer-identity primitive on %s: privileged operations will be denied", runtime.GOOS)
+		return nil
+	}
+
+	return []grpc.ServerOption{grpc.Creds(creds)}
+}
+
 func (p *program) Start(svc service.Service) error {
 	// Start should not block. Do the actual work async.
 	log.Info("starting NetBird service") //nolint
@@ -37,68 +65,106 @@ func (p *program) Start(svc service.Service) error {
 	// Collect static system and platform information
 	system.UpdateStaticInfoAsync()

-	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
-	p.serv = grpc.NewServer()
-
-	daemonListener, err := listenOnAddress(daemonAddr)
-	if err != nil {
-		return fmt.Errorf("listen daemon interface: %w", err)
+	// A daemon installed before named-pipe support has the loopback TCP address
+	// persisted. Move it to the named pipe so an upgraded daemon can identify
+	// its callers instead of silently serving an unauthenticated socket.
+	if migrated, ok := daemonaddr.MigrateLegacy(daemonAddr); ok {
+		log.Infof("daemon address %q predates named-pipe support, listening on %q so callers can be identified", daemonAddr, migrated)
+		daemonAddr = migrated
 	}

-	var jsonListener *socketListener
-	if enableJSONSocket {
-		jsonListener, err = listenOnAddress(jsonSocket)
-		if err != nil {
-			_ = daemonListener.Close()
-			return fmt.Errorf("listen daemon JSON interface: %w", err)
-		}
-	} else {
-		removeStaleUnixSocketForAddress(jsonSocket)
+	network, _, err := parseListenAddress(daemonAddr)
+	if err != nil {
+		return fmt.Errorf("parse daemon address: %w", err)
+	}
+
+	// in any case, even if configuration does not exists we run daemon to serve CLI gRPC API.
+	p.serv = grpc.NewServer(daemonServerOptions(network)...)
+
+	daemonListener, jsonListener, err := listenDaemonSockets()
+	if err != nil {
+		return err
 	}

 	go func() {
-		defer daemonListener.Close()
-		if jsonListener != nil {
-			defer jsonListener.Close()
-		}
-
-		if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
-			log.Error(err)
-			return
-		}
-		if jsonListener != nil {
-			if err := jsonListener.chmodUnixSocket("daemon JSON"); err != nil {
-				log.Error(err)
-				return
-			}
-		}
-
-		serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled, captureEnabled, networksDisabled)
-		if err := serverInstance.Start(); err != nil {
-			log.Fatalf("failed to start daemon: %v", err)
-		}
-		proto.RegisterDaemonServiceServer(p.serv, serverInstance)
-
-		p.serverInstanceMu.Lock()
-		p.serverInstance = serverInstance
-		p.serverInstanceMu.Unlock()
-
-		if jsonListener != nil {
-			if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
-				log.Fatalf("failed to start daemon JSON server: %v", err)
-			}
-		} else {
-			log.Debug("daemon JSON socket disabled")
-		}
-
-		log.Printf("started daemon server: %v", daemonListener.address)
-		if err := p.serv.Serve(daemonListener.Listener); err != nil {
-			log.Errorf("failed to serve daemon requests: %v", err)
+		// Fatal here rather than inside serve, so serve's deferred listener
+		// closes run before the process exits.
+		if err := p.serve(daemonListener, jsonListener); err != nil {
+			log.Fatalf("failed to %v", err)
 		}
 	}()
 	return nil
 }

+// listenDaemonSockets opens the daemon control socket and, when it is enabled, the
+// JSON gateway socket. The control socket is closed again if the second one fails,
+// so a failed start leaves nothing listening. The returned JSON listener is nil
+// when the socket is disabled.
+func listenDaemonSockets() (*socketListener, *socketListener, error) {
+	daemonListener, err := listenOnAddress(daemonAddr)
+	if err != nil {
+		return nil, nil, fmt.Errorf("listen daemon interface: %w", err)
+	}
+
+	if !enableJSONSocket {
+		removeStaleUnixSocketForAddress(jsonSocket)
+		return daemonListener, nil, nil
+	}
+
+	jsonListener, err := listenOnAddress(jsonSocket)
+	if err != nil {
+		if cerr := daemonListener.Close(); cerr != nil {
+			log.Debugf("close daemon listener: %v", cerr)
+		}
+		return nil, nil, fmt.Errorf("listen daemon JSON interface: %w", err)
+	}
+
+	return daemonListener, jsonListener, nil
+}
+
+// serve brings up the daemon server on an already-open control socket and blocks
+// until it stops. jsonListener is nil when the JSON socket is disabled. A returned
+// error means the daemon cannot run at all and the caller is expected to exit; the
+// failures it recovers from on its own are logged here.
+func (p *program) serve(daemonListener, jsonListener *socketListener) error {
+	defer daemonListener.Close()
+	if jsonListener != nil {
+		defer jsonListener.Close()
+	}
+
+	// chmodUnixSocket is a no-op for a nil listener and for a non-unix one.
+	if err := daemonListener.chmodUnixSocket("daemon"); err != nil {
+		log.Error(err)
+		return nil
+	}
+	if err := jsonListener.chmodUnixSocket("daemon JSON"); err != nil {
+		log.Error(err)
+		return nil
+	}
+
+	serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled, captureEnabled, networksDisabled)
+	if err := serverInstance.Start(); err != nil {
+		return fmt.Errorf("start daemon: %w", err)
+	}
+	proto.RegisterDaemonServiceServer(p.serv, serverInstance)
+
+	p.serverInstanceMu.Lock()
+	p.serverInstance = serverInstance
+	p.serverInstanceMu.Unlock()
+
+	if jsonListener == nil {
+		log.Debug("daemon JSON socket disabled")
+	} else if err := p.startJSONGateway(jsonListener, daemonAddr); err != nil {
+		return fmt.Errorf("start daemon JSON server: %w", err)
+	}
+
+	log.Printf("started daemon server: %v", daemonListener.address)
+	if err := p.serv.Serve(daemonListener.Listener); err != nil {
+		log.Errorf("failed to serve daemon requests: %v", err)
+	}
+	return nil
+}
+
 func (p *program) Stop(srv service.Service) error {
 	p.serverInstanceMu.Lock()
 	if p.serverInstance != nil {
@@ -113,8 +179,13 @@ func (p *program) Stop(srv service.Service) error {
 	p.cancel()

 	p.jsonServMu.Lock()
-	jsonServ := p.jsonServ
+	jsonServ, jsonClient := p.jsonServ, p.jsonClient
 	p.jsonServMu.Unlock()
+	if jsonClient != nil {
+		if err := jsonClient.Close(); err != nil {
+			log.Debugf("close daemon JSON gateway client: %v", err)
+		}
+	}
 	if jsonServ != nil {
 		shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 2*time.Second)
 		if err := jsonServ.Shutdown(shutdownCtx); err != nil {
--- a/client/cmd/service_json_gateway.go
+++ b/client/cmd/service_json_gateway.go
@@ -5,27 +5,123 @@ package cmd
 import (
 	"context"
 	"errors"
+	"fmt"
 	"net"
 	"net/http"
-	"strings"
+	"sync"
 	"time"

 	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"

+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 )

-func grpcGatewayEndpoint(addr string) string {
-	return strings.TrimPrefix(addr, "tcp://")
+// jsonPeerIdentity is the context key under which the connecting HTTP client's
+// identity is stashed for the lifetime of its connection.
+type jsonPeerIdentity struct{}
+
+// jsonPeerIdentityValue pairs the identity with whether it could be read at
+// all, so an unreadable identity is forwarded as "unknown" rather than omitted.
+type jsonPeerIdentityValue struct {
+	id    ipcauth.Identity
+	known bool
+}
+
+// jsonConnContext reads the identity of the client connecting to the JSON
+// socket and stashes it on the connection's context. The gateway re-dials the
+// daemon in-process, so the daemon would otherwise see every JSON request as
+// coming from the daemon itself.
+func jsonConnContext(ctx context.Context, c net.Conn) context.Context {
+	value := jsonPeerIdentityValue{}
+	id, err := ipcauth.ConnIdentity(c)
+	if err != nil {
+		log.Warnf("json gateway: cannot read HTTP client identity, privileged operations will be denied for this connection: %v", err)
+	} else {
+		value.id = id
+		value.known = true
+	}
+	return context.WithValue(ctx, jsonPeerIdentity{}, value)
+}
+
+// forwardIdentity stamps the HTTP client's identity onto every call the gateway
+// makes to the daemon.
+//
+// It is an interceptor on the gateway's client connection rather than a
+// runtime.WithMetadata annotator because grpc-gateway skips annotators when no
+// request header maps to metadata, which an HTTP/1.0 request with no Host header
+// over a unix socket achieves. The daemon would then receive no marker, see its own
+// identity as the transport peer, and authorize the request as the daemon itself.
+// An interceptor runs for every RPC whatever the request looked like.
+func forwardIdentity(ctx context.Context) context.Context {
+	value, ok := ctx.Value(jsonPeerIdentity{}).(jsonPeerIdentityValue)
+	if !ok {
+		// No ConnContext ran for this request, so forward an unknown identity:
+		// the daemon must not mistake its own identity for the client's.
+		return ipcauth.WithForwardedIdentity(ctx, ipcauth.Identity{}, false)
+	}
+	return ipcauth.WithForwardedIdentity(ctx, value.id, value.known)
+}
+
+func forwardIdentityUnary(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+	return invoker(forwardIdentity(ctx), method, req, reply, cc, opts...)
+}
+
+func forwardIdentityStream(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+	return streamer(forwardIdentity(ctx), desc, cc, method, opts...)
+}
+
+// reservedHeaderWarning limits the dropped-header warning to the first occurrence.
+var reservedHeaderWarning sync.Once
+
+// jsonIncomingHeaderMatcher keeps an HTTP client from supplying the metadata the
+// gateway uses to forward its identity. grpc-gateway turns "Grpc-Metadata-<key>"
+// headers into gRPC metadata and joins them ahead of what its annotators add, so
+// without this filter a JSON client could send its own x-netbird-fwd-uid and the
+// daemon would authorize that instead of the client's real identity.
+func jsonIncomingHeaderMatcher(key string) (string, bool) {
+	mapped, ok := runtime.DefaultHeaderMatcher(key)
+	if !ok {
+		return "", false
+	}
+	if ipcauth.IsReservedForwardKey(mapped) {
+		// Warn once: any client can send these on every request, so warning each
+		// time hands it a way to fill the log. The rest are debug-level.
+		reservedHeaderWarning.Do(func() {
+			log.Warnf("json gateway: dropping reserved header %q from a request: only the gateway may set the caller's identity", key)
+		})
+		log.Debugf("json gateway: dropping reserved header %q", key)
+		return "", false
+	}
+	return mapped, true
 }

 func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint string) error {
-	mux := runtime.NewServeMux()
-	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
-	if err := proto.RegisterDaemonServiceHandlerFromEndpoint(p.ctx, mux, grpcGatewayEndpoint(daemonEndpoint), opts); err != nil {
+	if jsonListener.network == "tcp" {
+		log.Warnf("daemon JSON socket is listening on TCP (%s): callers carry no verifiable identity over TCP, "+
+			"so privileged operations will be denied for JSON clients", jsonListener.address)
+	}
+
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+
+	// grpc.NewClient does not connect until the first request, so registering
+	// the handler here cannot block daemon startup.
+	target, opts := daemonaddr.DialTarget(daemonEndpoint)
+	opts = append(opts,
+		grpc.WithChainUnaryInterceptor(forwardIdentityUnary),
+		grpc.WithChainStreamInterceptor(forwardIdentityStream),
+	)
+	conn, err := grpc.NewClient(target, opts...)
+	if err != nil {
+		return fmt.Errorf("create daemon client for JSON gateway: %w", err)
+	}
+	if err := proto.RegisterDaemonServiceHandler(p.ctx, mux, conn); err != nil {
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("close daemon client after failed JSON gateway registration: %v", cerr)
+		}
 		return err
 	}

@@ -35,10 +131,12 @@ func (p *program) startJSONGateway(jsonListener *socketListener, daemonEndpoint
 		BaseContext: func(net.Listener) context.Context {
 			return p.ctx
 		},
+		ConnContext: jsonConnContext,
 	}

 	p.jsonServMu.Lock()
 	p.jsonServ = jsonServer
+	p.jsonClient = conn
 	p.jsonServMu.Unlock()

 	go func() {
--- a/client/cmd/service_json_gateway_test.go
+++ b/client/cmd/service_json_gateway_test.go
@@ -0,0 +1,261 @@
+//go:build !windows && !ios && !android
+
+package cmd
+
+import (
+	"context"
+	"net"
+	"net/http"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/grpc-ecosystem/grpc-gateway/v2/runtime"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// The JSON gateway runs inside the daemon and re-dials it locally, so every JSON
+// request reaches a handler with the daemon's own identity as the transport peer.
+// The gateway therefore forwards its HTTP client's identity as metadata, and the
+// daemon authorizes that instead of itself. These tests drive the real wiring
+// (jsonConnContext, forwardIdentity, jsonIncomingHeaderMatcher) and check the
+// identity a handler would end up authorizing.
+
+// daemonSideCtx is what a handler sees for a gateway-relayed call. The transport
+// peer must be this process's own identity: the gateway is the daemon, so the two
+// cannot differ, and hardcoding root here instead would describe a state that
+// never occurs.
+func daemonSideCtx(t *testing.T, md metadata.MD) context.Context {
+	t.Helper()
+	self, err := ipcauth.CurrentProcessIdentity()
+	if err != nil {
+		t.Skipf("cannot read this process's identity: %v", err)
+	}
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: ipcauth.AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       self,
+		},
+	})
+	return metadata.NewIncomingContext(ctx, md)
+}
+
+// gatewayMetadata reproduces what the daemon receives for a JSON request: the
+// mux annotates the context from the request's headers, then the interceptor on the
+// gateway's client connection stamps the caller's identity. The order matters,
+// since the interceptor must win over anything a header put there.
+func gatewayMetadata(t *testing.T, req *http.Request, ctx context.Context) metadata.MD {
+	t.Helper()
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+	annotated, err := runtime.AnnotateContext(ctx, mux, req,
+		"/daemon.DaemonService/SetConfig",
+		runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+	if err != nil {
+		t.Fatalf("annotate: %v", err)
+	}
+
+	md, ok := metadata.FromOutgoingContext(forwardIdentity(annotated))
+	if !ok {
+		t.Fatal("the interceptor produced no metadata")
+	}
+	return md
+}
+
+// clientCtx is the connection context jsonConnContext would have produced for an
+// HTTP client whose identity the gateway could read.
+func clientCtx(id ipcauth.Identity, known bool) context.Context {
+	return context.WithValue(context.Background(), jsonPeerIdentity{},
+		jsonPeerIdentityValue{id: id, known: known})
+}
+
+// An HTTP client must not be able to name its own identity. grpc-gateway turns
+// Grpc-Metadata-<key> headers into gRPC metadata, so without the header filter and
+// the interceptor overwriting the reserved keys, this request would authorize as
+// uid 0.
+func TestJSONGateway_ForgedIdentityHeaderIsDropped(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd-Uid", "0")
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd-Gid", "0")
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd", "1")
+	req.Header.Set("Grpc-Metadata-X-Netbird-Fwd-Sid", "S-1-5-18")
+
+	caller := ipcauth.Identity{UID: 31000, GID: 31000}
+	md := gatewayMetadata(t, req, clientCtx(caller, true))
+
+	id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md))
+	if !ok {
+		t.Fatal("the forwarded identity should be usable")
+	}
+	if id.IsPrivileged() {
+		t.Errorf("forged header was believed: authorized as %v", id)
+	}
+	if id.UID != caller.UID {
+		t.Errorf("authorized as uid %d, want the real client %d", id.UID, caller.UID)
+	}
+}
+
+// A request with no headers at all (HTTP/1.0 needs no Host, and a unix socket
+// yields no host:port) makes grpc-gateway produce no metadata whatsoever and skip
+// its annotators: "if len(pairs) == 0 { return ctx, nil, nil }" in
+// runtime/context.go. That is why the identity is stamped by an interceptor
+// instead. This is the case that previously reached the gate as the daemon itself.
+func TestJSONGateway_HeaderlessRequestIsStillMarkedForwarded(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header = http.Header{}
+	req.Host = ""
+
+	caller := ipcauth.Identity{UID: 31000, GID: 31000}
+	ctx := clientCtx(caller, true)
+
+	// Pin the skip path itself: if grpc-gateway ever produced a pair here, this
+	// test would still pass below while no longer covering what it was written for.
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+	annotated, err := runtime.AnnotateContext(ctx, mux, req,
+		"/daemon.DaemonService/SetConfig",
+		runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+	if err != nil {
+		t.Fatalf("annotate: %v", err)
+	}
+	if md, ok := metadata.FromOutgoingContext(annotated); ok {
+		t.Fatalf("grpc-gateway produced metadata %v for a headerless request; "+
+			"this test no longer covers the annotator-skip path", md)
+	}
+
+	md := gatewayMetadata(t, req, ctx)
+
+	id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md))
+	if !ok {
+		t.Fatal("the forwarded identity should be usable")
+	}
+	if id.UID != caller.UID || id.IsPrivileged() {
+		t.Errorf("authorized as %v, want the real client uid %d", id, caller.UID)
+	}
+}
+
+// When the gateway cannot read its client's identity (a TCP JSON socket, say) it
+// forwards the marker alone. The daemon must then report "unidentified" so the
+// privileged operations refuse, rather than falling back to the gateway's own
+// identity.
+func TestJSONGateway_UnreadableClientIdentityIsUnidentified(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	md := gatewayMetadata(t, req, clientCtx(ipcauth.Identity{}, false))
+
+	if id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md)); ok {
+		t.Errorf("a request with no client identity was authorized as %v", id)
+	}
+}
+
+// A request that never passed through jsonConnContext (no stashed identity) must
+// also come out unidentified rather than as the daemon.
+func TestJSONGateway_MissingConnContextIsUnidentified(t *testing.T) {
+	req, err := http.NewRequest(http.MethodPost, "http://localhost/daemon.DaemonService/SetConfig", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	md := gatewayMetadata(t, req, context.Background())
+
+	if id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, md)); ok {
+		t.Errorf("a request with no connection context was authorized as %v", id)
+	}
+}
+
+// End to end over a real unix socket: the gateway reads the connecting client's
+// identity from the socket itself, so a client cannot present anything else.
+func TestJSONGateway_IdentityComesFromTheSocket(t *testing.T) {
+	mux := runtime.NewServeMux(runtime.WithIncomingHeaderMatcher(jsonIncomingHeaderMatcher))
+
+	type observed struct {
+		md metadata.MD
+	}
+	seen := make(chan observed, 1)
+
+	srv := &http.Server{
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			ctx, err := runtime.AnnotateContext(r.Context(), mux, r,
+				"/daemon.DaemonService/SetConfig",
+				runtime.WithHTTPPathPattern("/daemon.DaemonService/SetConfig"))
+			if err != nil {
+				t.Errorf("annotate: %v", err)
+				return
+			}
+			md, _ := metadata.FromOutgoingContext(forwardIdentity(ctx))
+			seen <- observed{md: md}
+			w.WriteHeader(http.StatusOK)
+		}),
+		ReadHeaderTimeout: 5 * time.Second,
+		ConnContext:       jsonConnContext,
+	}
+
+	sock := filepath.Join(t.TempDir(), "http.sock")
+	ln, err := net.Listen("unix", sock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := srv.Close(); err != nil {
+			t.Logf("close server: %v", err)
+		}
+	})
+	go func() {
+		if err := srv.Serve(ln); err != nil && err != http.ErrServerClosed {
+			t.Logf("serve: %v", err)
+		}
+	}()
+
+	conn, err := net.Dial("unix", sock)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := conn.Close(); err != nil {
+			t.Logf("close conn: %v", err)
+		}
+	})
+
+	// Forge the identity headers on the wire as well.
+	request := "POST /daemon.DaemonService/SetConfig HTTP/1.1\r\n" +
+		"Host: localhost\r\n" +
+		"Grpc-Metadata-X-Netbird-Fwd: 1\r\n" +
+		"Grpc-Metadata-X-Netbird-Fwd-Uid: 0\r\n" +
+		"Content-Length: 0\r\n\r\n"
+	if _, err := conn.Write([]byte(request)); err != nil {
+		t.Fatal(err)
+	}
+
+	select {
+	case got := <-seen:
+		self, err := ipcauth.CurrentProcessIdentity()
+		if err != nil {
+			t.Skipf("cannot read this process's identity: %v", err)
+		}
+		// The socket peer is this test process, so that is the identity the
+		// gateway must forward, not the uid 0 the request asked for.
+		if uids := got.md.Get("x-netbird-fwd-uid"); len(uids) != 1 {
+			t.Fatalf("x-netbird-fwd-uid = %v, want exactly the gateway's own value", uids)
+		}
+		id, ok := ipcauth.CallerIdentity(daemonSideCtx(t, got.md))
+		if !ok {
+			t.Fatal("the forwarded identity should be usable")
+		}
+		if id.UID != self.UID {
+			t.Errorf("authorized as uid %d, want the socket peer %d", id.UID, self.UID)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("the gateway never handled the request")
+	}
+}
--- a/client/cmd/service_params.go
+++ b/client/cmd/service_params.go
@@ -13,6 +13,7 @@ import (
 	"github.com/spf13/cobra"

 	"github.com/netbirdio/netbird/client/configs"
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/util"
 )

@@ -125,6 +126,13 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {

 	if !rootCmd.PersistentFlags().Changed("daemon-addr") && params.DaemonAddr != "" {
 		daemonAddr = params.DaemonAddr
+		// An install that predates named-pipe support has the loopback TCP
+		// address saved. Callers carry no identity over TCP, so move it to the
+		// pipe instead of restoring a socket the daemon cannot authorize on.
+		if migrated, ok := daemonaddr.MigrateLegacy(daemonAddr); ok {
+			cmd.Printf("Moving the saved daemon address from %s to %s so the daemon can identify its callers\n", daemonAddr, migrated)
+			daemonAddr = migrated
+		}
 	}

 	if !serviceCmd.PersistentFlags().Changed("json-socket") && params.JSONSocket != "" {
--- a/client/cmd/service_pipe_other.go
+++ b/client/cmd/service_pipe_other.go
@@ -0,0 +1,14 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"fmt"
+	"net"
+)
+
+// listenNamedPipe is Windows-only: no other platform serves the daemon on a
+// named pipe.
+func listenNamedPipe(string) (net.Listener, string, error) {
+	return nil, "", fmt.Errorf("named pipes are only supported on Windows")
+}
--- a/client/cmd/service_pipe_windows.go
+++ b/client/cmd/service_pipe_windows.go
@@ -0,0 +1,41 @@
+//go:build windows
+
+package cmd
+
+import (
+	"errors"
+	"fmt"
+	"net"
+
+	"github.com/Microsoft/go-winio"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// listenNamedPipe creates the daemon control pipe and reports the path it ended
+// up on. The security descriptor lets any local caller connect, as a Unix socket
+// at 0666 does, and the privileged operations are authorized separately from the
+// caller's token.
+//
+// The protected name comes first so that an unprivileged process cannot take the
+// name before the service does. Creating it requires being an administrator or
+// LocalSystem, so a daemon an ordinary user runs themselves, as in netstack mode,
+// falls back to the plain name; clients try both and check who serves them.
+func listenNamedPipe(name string) (net.Listener, string, error) {
+	var errs []error
+	for _, path := range daemonaddr.PipePaths(name) {
+		listener, err := winio.ListenPipe(path, &winio.PipeConfig{
+			SecurityDescriptor: ipcauth.DefaultPipeSDDL(),
+		})
+		if err != nil {
+			log.Debugf("not serving the daemon on %s: %v", path, err)
+			errs = append(errs, fmt.Errorf("%s: %w", path, err))
+			continue
+		}
+		return listener, path, nil
+	}
+
+	return nil, "", errors.Join(errs...)
+}
--- a/client/cmd/service_socket.go
+++ b/client/cmd/service_socket.go
@@ -26,6 +26,14 @@ func listenOnAddress(addr string) (*socketListener, error) {
 		return nil, err
 	}

+	if network == "npipe" {
+		listener, path, err := listenNamedPipe(address)
+		if err != nil {
+			return nil, err
+		}
+		return &socketListener{Listener: listener, network: network, address: path}, nil
+	}
+
 	if network == "unix" {
 		removeStaleUnixSocket(address)
 	}
@@ -41,11 +49,11 @@ func listenOnAddress(addr string) (*socketListener, error) {
 func parseListenAddress(addr string) (string, string, error) {
 	network, address, ok := strings.Cut(addr, "://")
 	if !ok || network == "" || address == "" {
-		return "", "", fmt.Errorf("address must be in [unix|tcp]://[path|host:port] format: %q", addr)
+		return "", "", fmt.Errorf("address must be in [unix|tcp|npipe]://[path|host:port|name] format: %q", addr)
 	}

 	switch network {
-	case "unix", "tcp":
+	case "unix", "tcp", "npipe":
 		return network, address, nil
 	default:
 		return "", "", fmt.Errorf("unsupported daemon address protocol: %v", network)
--- a/client/cmd/up.go
+++ b/client/cmd/up.go
@@ -325,7 +325,7 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unavailable {
 			log.Warnf("setConfig method is not available in the daemon: %s", st.Message())
 		} else {
-			return fmt.Errorf("call service setConfig method: %v", err)
+			return daemonCallError("call service setConfig method", err)
 		}
 	}

@@ -379,7 +379,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 	}

 	if loginErr != nil {
-		return fmt.Errorf("login failed: %v", loginErr)
+		return daemonCallError("login failed", loginErr)
 	}

 	if loginResp.NeedsSSOLogin {
@@ -392,7 +392,7 @@ func doDaemonUp(ctx context.Context, cmd *cobra.Command, client proto.DaemonServ
 		ProfileName: &profileID,
 		Username:    &username,
 	}); err != nil {
-		return fmt.Errorf("call service up method: %v", err)
+		return daemonCallError("call service up method", err)
 	}

 	return nil
--- a/client/internal/daemonaddr/owner.go
+++ b/client/internal/daemonaddr/owner.go
@@ -0,0 +1,15 @@
+package daemonaddr
+
+// DaemonRunsAsSelf reports whether the daemon listening at addr runs as this very
+// user. That is what makes an unprivileged daemon authorize this process for the
+// changes it otherwise restricts to root or an administrator, so a client can tell
+// up front whether those controls are usable instead of letting a save fail.
+//
+// It is answered from the ownership of the socket or pipe the daemon created, so it
+// costs no round trip and needs no cooperation from the daemon. Ownership that
+// cannot be read is reported as false, including for a TCP address, so a caller
+// reading this as "the daemon would allow it" fails closed. The daemon remains the
+// only thing that authorizes anything: this only decides what a client offers.
+func DaemonRunsAsSelf(addr string) bool {
+	return daemonRunsAsSelf(addr)
+}
--- a/client/internal/daemonaddr/owner_unix.go
+++ b/client/internal/daemonaddr/owner_unix.go
@@ -0,0 +1,40 @@
+//go:build !windows
+
+package daemonaddr
+
+import (
+	"os"
+	"strings"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// daemonRunsAsSelf compares the owner of the daemon's Unix socket with this
+// process's uid. Root is not treated specially here: a root caller is privileged
+// on its own merits, and a root-owned socket says nothing about the caller.
+func daemonRunsAsSelf(addr string) bool {
+	path, ok := strings.CutPrefix(addr, "unix://")
+	if !ok {
+		return false
+	}
+
+	info, err := os.Stat(path)
+	if err != nil {
+		log.Debugf("stat daemon socket %s: %v", path, err)
+		return false
+	}
+
+	// Only a socket says anything about a daemon. A directory or a leftover
+	// regular file at that path is not one, and reading it as "the daemon runs as
+	// us" would offer controls the daemon then refuses.
+	if info.Mode()&os.ModeSocket == 0 {
+		return false
+	}
+
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return false
+	}
+	return stat.Uid == uint32(os.Getuid())
+}
--- a/client/internal/daemonaddr/owner_unix_test.go
+++ b/client/internal/daemonaddr/owner_unix_test.go
@@ -0,0 +1,62 @@
+//go:build !windows
+
+package daemonaddr
+
+import (
+	"net"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// A socket this user created means the daemon runs as this user, which is the
+// rootless case where the daemon delegates its authority to its own identity.
+func TestDaemonRunsAsSelf_OwnSocket(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "netbird.sock")
+	ln, err := net.Listen("unix", path)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := ln.Close(); err != nil {
+			t.Logf("close listener: %v", err)
+		}
+	})
+
+	if !DaemonRunsAsSelf("unix://" + path) {
+		t.Error("a socket owned by this user must count as the daemon running as us")
+	}
+}
+
+// Everything that is not a readable socket of ours has to answer false, because
+// the caller reads a true as "the daemon would authorize me".
+func TestDaemonRunsAsSelf_FailsClosed(t *testing.T) {
+	dir := t.TempDir()
+
+	// A socket owned by another user, which is what a root-run daemon looks like
+	// to an unprivileged client. Only assertable when we are not root ourselves.
+	rootOwned := "unix:///var/run/netbird.sock"
+	if _, err := os.Stat("/var/run/netbird.sock"); err == nil && os.Getuid() != 0 {
+		if DaemonRunsAsSelf(rootOwned) {
+			t.Error("a socket owned by another user must not count as ours")
+		}
+	}
+
+	for name, addr := range map[string]string{
+		"missing socket":  "unix://" + filepath.Join(dir, "absent.sock"),
+		"tcp address":     "tcp://127.0.0.1:41731",
+		"named pipe":      "npipe://netbird",
+		"empty":           "",
+		"no scheme":       filepath.Join(dir, "absent.sock"),
+		"directory":       "unix://" + dir,
+		"unknown scheme":  "http://localhost:8080",
+		"scheme only":     "unix://",
+		"relative socket": "unix://netbird.sock",
+	} {
+		t.Run(name, func(t *testing.T) {
+			if DaemonRunsAsSelf(addr) {
+				t.Errorf("%q must not count as a daemon running as us", addr)
+			}
+		})
+	}
+}
--- a/client/internal/daemonaddr/owner_windows.go
+++ b/client/internal/daemonaddr/owner_windows.go
@@ -0,0 +1,42 @@
+//go:build windows
+
+package daemonaddr
+
+import (
+	"context"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// daemonRunsAsSelf reads the owner of the daemon's pipe. A daemon running as the
+// service account owns its pipe as LocalSystem, and an elevated one as
+// BUILTIN\Administrators, so only a daemon the user started themselves matches.
+func daemonRunsAsSelf(addr string) bool {
+	name, ok := strings.CutPrefix(addr, pipeScheme)
+	if !ok {
+		return false
+	}
+
+	for _, path := range PipePaths(name) {
+		// Bounded: this runs on the UI's path for deciding which controls to
+		// offer, so a pipe that does not answer promptly must not stall it. A
+		// timeout leaves the caller unprivileged, which only disables controls.
+		ctx, cancel := context.WithTimeout(context.Background(), probeTimeout)
+		conn, err := dialPipe(ctx, path)
+		cancel()
+		if err != nil {
+			continue
+		}
+
+		owned := ipcauth.PipeOwnedBySelf(conn)
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("close daemon pipe %s after ownership check: %v", path, cerr)
+		}
+		return owned
+	}
+
+	return false
+}
--- a/client/internal/daemonaddr/pipe.go
+++ b/client/internal/daemonaddr/pipe.go
@@ -0,0 +1,103 @@
+package daemonaddr
+
+import (
+	"context"
+	"net"
+	"runtime"
+	"strings"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+)
+
+const (
+	// WindowsPipeAddr is the default daemon address on Windows. A named pipe
+	// carries the connecting process's token, which loopback TCP does not, so
+	// it is the only Windows transport on which the daemon can tell who is
+	// calling it.
+	WindowsPipeAddr = "npipe://netbird"
+
+	// legacyWindowsAddr is the loopback-TCP address the Windows daemon used
+	// before named-pipe support.
+	legacyWindowsAddr = "tcp://127.0.0.1:41731"
+
+	pipeScheme = "npipe://"
+
+	// protectedPrefix is the NPFS namespace in which only LocalSystem and
+	// members of BUILTIN\Administrators may create a pipe. A daemon running as
+	// the service account creates its pipe there so that an unprivileged process
+	// cannot pre-create the name, which would keep the daemon from starting and
+	// leave callers talking to the squatter. Opening such a pipe needs no
+	// privilege, so unprivileged clients still reach the daemon.
+	protectedPrefix = `ProtectedPrefix\Administrators\`
+)
+
+// DialTarget returns the gRPC dial target and transport options for a daemon
+// address. The npipe scheme needs a context dialer because gRPC has no
+// named-pipe resolver; unix and tcp are handled by gRPC itself.
+func DialTarget(addr string) (string, []grpc.DialOption) {
+	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials())}
+
+	if name, ok := strings.CutPrefix(addr, pipeScheme); ok {
+		paths := PipePaths(name)
+		opts = append(opts, grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) {
+			return dialPipePaths(ctx, paths)
+		}))
+		return "passthrough:///netbird-daemon-pipe", opts
+	}
+
+	return strings.TrimPrefix(addr, "tcp://"), opts
+}
+
+// PipePath maps an npipe address name ("netbird", from "npipe://netbird") to a
+// Windows named-pipe path (\\.\pipe\netbird). A fully qualified path is left as
+// is.
+func PipePath(name string) string {
+	if strings.HasPrefix(name, `\\`) {
+		return name
+	}
+	return `\\.\pipe\` + name
+}
+
+// PipePaths returns the paths a daemon control pipe may live at for an npipe
+// address name, in the order both sides must try them: the protected name first,
+// then the plain one.
+//
+// The daemon serves the first it can create, which is the protected name when it
+// runs as the service account and the plain one when it runs as an ordinary user,
+// as it does in netstack mode. Clients therefore have to try both, and because a
+// client cannot tell from the name alone who created the pipe, the plain name is
+// only usable once the server's identity has been checked: see
+// verifyPipeServer.
+//
+// A fully qualified path is what the operator asked for and is used as is.
+func PipePaths(name string) []string {
+	if strings.HasPrefix(name, `\\`) {
+		return []string{name}
+	}
+	return []string{PipePath(protectedPrefix + name), PipePath(name)}
+}
+
+// IsProtectedPipePath reports whether a pipe path is in the namespace only an
+// administrator or LocalSystem can create in, which is what lets a client trust
+// such a pipe from its name alone.
+func IsProtectedPipePath(path string) bool {
+	return strings.HasPrefix(path, `\\.\pipe\`+protectedPrefix)
+}
+
+// MigrateLegacy upgrades the pre-named-pipe Windows daemon address to the named
+// pipe, reporting whether it rewrote the address. Existing installs persist the
+// daemon address, so without this an upgraded daemon would keep listening on
+// loopback TCP, where callers carry no identity and privileged operations would
+// have to be refused for everyone. Only the exact legacy default is rewritten:
+// a deliberately chosen custom address is left alone.
+func MigrateLegacy(addr string) (string, bool) {
+	return migrateLegacyForOS(runtime.GOOS, addr)
+}
+
+func migrateLegacyForOS(goos, addr string) (string, bool) {
+	if goos == "windows" && addr == legacyWindowsAddr {
+		return WindowsPipeAddr, true
+	}
+	return addr, false
+}
--- a/client/internal/daemonaddr/pipe_other.go
+++ b/client/internal/daemonaddr/pipe_other.go
@@ -0,0 +1,15 @@
+//go:build !windows
+
+package daemonaddr
+
+import (
+	"context"
+	"fmt"
+	"net"
+)
+
+// dialPipePaths is Windows-only: no other platform serves the daemon on a named
+// pipe.
+func dialPipePaths(context.Context, []string) (net.Conn, error) {
+	return nil, fmt.Errorf("named pipes are only supported on Windows")
+}
--- a/client/internal/daemonaddr/pipe_test.go
+++ b/client/internal/daemonaddr/pipe_test.go
@@ -0,0 +1,30 @@
+package daemonaddr
+
+import (
+	"slices"
+	"testing"
+)
+
+// The protected name must be tried before the plain one on both sides: it is the
+// one an unprivileged process cannot create, so preferring it is what keeps a
+// squatter from owning the name the service daemon would otherwise use.
+func TestPipePaths_PrefersTheProtectedName(t *testing.T) {
+	got := PipePaths("netbird")
+	want := []string{
+		`\\.\pipe\ProtectedPrefix\Administrators\netbird`,
+		`\\.\pipe\netbird`,
+	}
+	if !slices.Equal(got, want) {
+		t.Errorf("PipePaths = %q, want %q", got, want)
+	}
+}
+
+// An operator who passes a full path chose exactly one pipe, so neither side may
+// look anywhere else.
+func TestPipePaths_QualifiedPathIsUsedAsIs(t *testing.T) {
+	path := `\\.\pipe\custom-netbird`
+	got := PipePaths(path)
+	if !slices.Equal(got, []string{path}) {
+		t.Errorf("PipePaths = %q, want just %q", got, path)
+	}
+}
--- a/client/internal/daemonaddr/pipe_windows.go
+++ b/client/internal/daemonaddr/pipe_windows.go
@@ -0,0 +1,59 @@
+//go:build windows
+
+package daemonaddr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+
+	"github.com/Microsoft/go-winio"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+)
+
+// dialPipePaths connects to the first path that answers with a pipe server this
+// client may trust, and returns the last error when none does.
+func dialPipePaths(ctx context.Context, paths []string) (net.Conn, error) {
+	var lastErr error
+	for _, path := range paths {
+		conn, err := dialPipe(ctx, path)
+		if err != nil {
+			log.Debugf("dial daemon pipe %s: %v", path, err)
+			lastErr = err
+			continue
+		}
+
+		// A pipe in the protected namespace could only have been created by an
+		// administrator or LocalSystem, so its name is the guarantee. Any other
+		// name has to be checked, because any local user can create one.
+		if !IsProtectedPipePath(path) {
+			if err := ipcauth.PipeServerTrusted(conn); err != nil {
+				if closeErr := conn.Close(); closeErr != nil {
+					log.Debugf("close untrusted pipe %s: %v", path, closeErr)
+				}
+				lastErr = fmt.Errorf("%s: %w", path, err)
+				continue
+			}
+		}
+
+		return conn, nil
+	}
+
+	if lastErr == nil {
+		lastErr = errors.New("no daemon pipe to connect to")
+	}
+	return nil, lastErr
+}
+
+// dialPipe connects to the daemon control pipe at SECURITY_IDENTIFICATION.
+// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the daemon
+// cannot read the caller's token at all. Identification lets the daemon read the
+// caller's SID and groups without granting it the ability to act as the caller.
+func dialPipe(ctx context.Context, path string) (net.Conn, error) {
+	access := uint32(windows.GENERIC_READ | windows.GENERIC_WRITE)
+	return winio.DialPipeAccessImpLevel(ctx, path, access, winio.PipeImpLevelIdentification)
+}
--- a/client/internal/daemonaddr/resolve_pipe_other.go
+++ b/client/internal/daemonaddr/resolve_pipe_other.go
@@ -0,0 +1,9 @@
+//go:build !windows
+
+package daemonaddr
+
+// ResolveDaemonAddr is a no-op off Windows, where there is no named-pipe
+// default to fall back from.
+func ResolveDaemonAddr(addr string) string {
+	return addr
+}
--- a/client/internal/daemonaddr/resolve_pipe_windows.go
+++ b/client/internal/daemonaddr/resolve_pipe_windows.go
@@ -0,0 +1,82 @@
+//go:build windows
+
+package daemonaddr
+
+import (
+	"net"
+	"strings"
+	"time"
+
+	"github.com/Microsoft/go-winio"
+	log "github.com/sirupsen/logrus"
+)
+
+// probeTimeout bounds each transport probe. Both are local, so a daemon that is
+// listening answers immediately and one that is not fails immediately.
+const probeTimeout = 300 * time.Millisecond
+
+// ResolveDaemonAddr keeps a client on the named pipe and never silently moves it
+// off. When the pipe does not answer it checks the legacy loopback TCP address, so
+// a client meeting a daemon that has not restarted since the upgrade can say what
+// is wrong, but it does not connect there.
+//
+// Using that address automatically would be a downgrade the user never asked for:
+// any local process can bind 127.0.0.1 while the daemon is not listening, and the
+// transport carries no caller identity, so a client that accepted whatever answered
+// would hand a setup key, a pre-shared key or an SSO prompt to a local impostor. An
+// operator who needs the legacy address during the upgrade window can still pass
+// --daemon-addr explicitly, which is a deliberate choice and still refuses the
+// privileged operations.
+//
+// Only the pipe address is resolved. A custom address is left alone, though passing
+// --daemon-addr npipe://netbird explicitly is indistinguishable from the default
+// here, so it is treated the same way.
+func ResolveDaemonAddr(addr string) string {
+	if addr != WindowsPipeAddr {
+		return addr
+	}
+
+	for _, path := range PipePaths("netbird") {
+		if pipeAvailable(path) {
+			return addr
+		}
+	}
+
+	if tcpAvailable(legacyWindowsAddr) {
+		log.Warnf("the daemon is not serving %s, but something is listening on the legacy %s. "+
+			"Restart the NetBird service so it serves the pipe. That address is not used automatically: "+
+			"any local user can bind it and it carries no caller identity, so pass --daemon-addr %s "+
+			"explicitly if you accept that",
+			WindowsPipeAddr, legacyWindowsAddr, legacyWindowsAddr)
+	}
+
+	return addr
+}
+
+func pipeAvailable(path string) bool {
+	timeout := probeTimeout
+	conn, err := winio.DialPipe(path, &timeout)
+	if err != nil {
+		return false
+	}
+	if err := conn.Close(); err != nil {
+		log.Debugf("close daemon pipe probe: %v", err)
+	}
+	return true
+}
+
+func tcpAvailable(addr string) bool {
+	host := addr
+	if _, after, ok := strings.Cut(addr, "://"); ok {
+		host = after
+	}
+
+	conn, err := net.DialTimeout("tcp", host, probeTimeout)
+	if err != nil {
+		return false
+	}
+	if err := conn.Close(); err != nil {
+		log.Debugf("close daemon TCP probe: %v", err)
+	}
+	return true
+}
--- a/client/internal/ipcauth/creds_stub.go
+++ b/client/internal/ipcauth/creds_stub.go
@@ -0,0 +1,31 @@
+//go:build !linux && !darwin && !freebsd && !windows
+
+package ipcauth
+
+import (
+	"errors"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// errUnsupported is returned on platforms with no local peer-identity
+// primitive, so consumers fail closed instead of guessing an identity.
+var errUnsupported = errors.New("peer identity is not available on this platform")
+
+// NewTransportCredentials returns nil: without a peer-identity primitive the
+// daemon cannot authenticate local callers, and the caller must treat that as
+// "authorization cannot be enforced".
+func NewTransportCredentials() credentials.TransportCredentials {
+	return nil
+}
+
+// PeerIdentity always fails on this platform.
+func PeerIdentity(net.Conn) (Identity, error) {
+	return Identity{}, errUnsupported
+}
+
+// ConnIdentity always fails on this platform.
+func ConnIdentity(net.Conn) (Identity, error) {
+	return Identity{}, errUnsupported
+}
--- a/client/internal/ipcauth/creds_unix.go
+++ b/client/internal/ipcauth/creds_unix.go
@@ -0,0 +1,56 @@
+//go:build linux || darwin || freebsd
+
+package ipcauth
+
+import (
+	"context"
+	"net"
+
+	"google.golang.org/grpc/credentials"
+)
+
+// NewTransportCredentials returns gRPC transport credentials that expose the
+// caller's kernel-authenticated identity via IdentityFromContext. It returns
+// nil on platforms that have no peer-identity primitive, which the caller must
+// treat as "authorization cannot be enforced".
+//
+// The handshake exchanges no bytes on the wire, so a client dialing with
+// insecure credentials interoperates with a server using these. That keeps
+// older CLI and UI binaries working against an upgraded daemon.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return unixCreds{}
+}
+
+// ConnIdentity extracts the caller's identity from an accepted local IPC
+// connection. It is shared by the gRPC transport credentials and by the JSON
+// gateway, which reads the identity of its own HTTP clients.
+func ConnIdentity(conn net.Conn) (Identity, error) {
+	return PeerIdentity(conn)
+}
+
+type unixCreds struct{}
+
+func (unixCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the peer identity and fails closed when it cannot
+// be read, so a connection whose caller is unknown never reaches a handler.
+func (unixCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := ConnIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (unixCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: AuthInfo{}.AuthType()}
+}
+
+func (unixCreds) Clone() credentials.TransportCredentials { return unixCreds{} }
+
+func (unixCreds) OverrideServerName(string) error { return nil }
--- a/client/internal/ipcauth/creds_windows.go
+++ b/client/internal/ipcauth/creds_windows.go
@@ -0,0 +1,194 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"runtime"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+	"google.golang.org/grpc/credentials"
+)
+
+var (
+	modadvapi32                    = windows.NewLazySystemDLL("advapi32.dll")
+	procImpersonateNamedPipeClient = modadvapi32.NewProc("ImpersonateNamedPipeClient")
+)
+
+// DefaultPipeSDDL is the security descriptor for the daemon control pipe.
+//
+//	D:P          protected DACL, no inheritance
+//	(A;;GA;;;SY) allow GENERIC_ALL to LocalSystem (the daemon's service account)
+//	(A;;GA;;;WD) allow GENERIC_ALL to Everyone
+//
+// Any local caller may connect, as with a Unix socket at 0666; what a caller may
+// actually do is decided from its token, not from the DACL. Remote callers are not
+// a concern here: winio.ListenPipe creates the pipe with
+// FILE_PIPE_REJECT_REMOTE_CLIENTS, so NPFS rejects connections from other machines
+// before the descriptor is consulted.
+//
+// A deny ACE on the NETWORK SID would not add anything and would break callers:
+// that SID is present in any network-logon token, which includes OpenSSH and WinRM
+// sessions, so it denies administrators driving the CLI over SSH and denies the
+// daemon itself when started from such a session.
+func DefaultPipeSDDL() string {
+	return "D:P(A;;GA;;;SY)(A;;GA;;;WD)"
+}
+
+// NewTransportCredentials returns gRPC transport credentials that derive the
+// caller's identity from the named-pipe client token.
+//
+// The client must connect at SECURITY_IDENTIFICATION for the daemon to be able
+// to read its token, which is what DialNamedPipe does.
+func NewTransportCredentials() credentials.TransportCredentials {
+	return winpipeCreds{}
+}
+
+// ConnIdentity extracts the caller's identity from an accepted named-pipe
+// connection by impersonating the pipe client and reading its token. It is
+// shared by the gRPC transport credentials and by the JSON gateway, which
+// reads the identity of its own HTTP clients.
+func ConnIdentity(conn net.Conn) (Identity, error) {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return Identity{}, fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+	return pipeClientIdentity(windows.Handle(fdConn.Fd()))
+}
+
+type winpipeCreds struct{}
+
+func (winpipeCreds) ClientHandshake(_ context.Context, _ string, conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	return conn, AuthInfo{}, nil
+}
+
+// ServerHandshake extracts the connecting client's identity and fails closed
+// when the handle or token cannot be read, so a connection whose caller is
+// unknown never reaches a handler.
+func (winpipeCreds) ServerHandshake(conn net.Conn) (net.Conn, credentials.AuthInfo, error) {
+	id, err := ConnIdentity(conn)
+	if err != nil {
+		return nil, nil, err
+	}
+	return conn, AuthInfo{
+		CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+		Identity:       id,
+	}, nil
+}
+
+func (winpipeCreds) Info() credentials.ProtocolInfo {
+	return credentials.ProtocolInfo{SecurityProtocol: AuthInfo{}.AuthType()}
+}
+
+func (winpipeCreds) Clone() credentials.TransportCredentials { return winpipeCreds{} }
+
+func (winpipeCreds) OverrideServerName(string) error { return nil }
+
+// pipeClientIdentity reads the connecting client's user SID, usable group
+// SIDs, and elevation state by impersonating the pipe client on this thread
+// and reading the resulting impersonation token.
+func pipeClientIdentity(handle windows.Handle) (id Identity, err error) {
+	// Impersonation is per-thread, so the goroutine must stay on this thread
+	// until RevertToSelf, otherwise an unrelated goroutine could inherit the
+	// impersonated context.
+	runtime.LockOSThread()
+
+	// The thread only goes back to the runtime's pool once it is provably no
+	// longer impersonating the client. If the revert fails, leaving it locked
+	// makes Go terminate it when this goroutine exits, which costs one thread
+	// and keeps a thread running as the client from ever being reused.
+	clean := false
+	defer func() {
+		if clean {
+			runtime.UnlockOSThread()
+		}
+	}()
+
+	if err = impersonateNamedPipeClient(handle); err != nil {
+		clean = true
+		return Identity{}, fmt.Errorf("impersonate named pipe client: %w", err)
+	}
+	defer func() {
+		// Surface the revert failure only when nothing else failed: leaving
+		// the thread impersonated is worse than the original error.
+		revErr := windows.RevertToSelf()
+		if revErr != nil {
+			if err == nil {
+				err = fmt.Errorf("revert impersonation: %w", revErr)
+			}
+			return
+		}
+		clean = true
+	}()
+
+	// openAsSelf=true opens the token with the daemon's own process context
+	// rather than the impersonated client's, so the open cannot fail because
+	// the client lacks access to its own token.
+	var token windows.Token
+	if err = windows.OpenThreadToken(windows.CurrentThread(), windows.TOKEN_QUERY, true, &token); err != nil {
+		return Identity{}, fmt.Errorf("open thread token: %w", err)
+	}
+	defer func() {
+		if cerr := token.Close(); cerr != nil {
+			log.Debugf("close client token: %v", cerr)
+		}
+	}()
+
+	return identityFromToken(token)
+}
+
+// identityFromToken reads the user SID, usable group SIDs and elevation state
+// out of a Windows token.
+func identityFromToken(token windows.Token) (Identity, error) {
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("read token user: %w", err)
+	}
+
+	groups, err := tokenGroupSIDs(token)
+	if err != nil {
+		return Identity{}, err
+	}
+
+	return Identity{
+		SID:      user.User.Sid.String(),
+		Groups:   groups,
+		Elevated: token.IsElevated(),
+	}, nil
+}
+
+// tokenGroupSIDs returns the SIDs of the groups the token can actually
+// exercise. Groups that are disabled or marked deny-only are skipped: a
+// UAC-filtered administrator carries BUILTIN\Administrators as deny-only, and
+// treating that as membership would hand every admin account privilege it
+// cannot currently use.
+func tokenGroupSIDs(token windows.Token) ([]string, error) {
+	tg, err := token.GetTokenGroups()
+	if err != nil {
+		return nil, fmt.Errorf("read token groups: %w", err)
+	}
+
+	var sids []string
+	for _, g := range tg.AllGroups() {
+		if g.Attributes&windows.SE_GROUP_ENABLED == 0 {
+			continue
+		}
+		if g.Attributes&windows.SE_GROUP_USE_FOR_DENY_ONLY != 0 {
+			continue
+		}
+		sids = append(sids, g.Sid.String())
+	}
+	return sids, nil
+}
+
+func impersonateNamedPipeClient(h windows.Handle) error {
+	r, _, e := procImpersonateNamedPipeClient.Call(uintptr(h))
+	if r == 0 {
+		return e
+	}
+	return nil
+}
--- a/client/internal/ipcauth/forward.go
+++ b/client/internal/ipcauth/forward.go
@@ -0,0 +1,272 @@
+package ipcauth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/subtle"
+	"encoding/hex"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+
+	"google.golang.org/grpc/metadata"
+)
+
+// Metadata keys the local JSON gateway uses to forward the identity of its own
+// HTTP client to the daemon. The gateway runs inside the daemon process and
+// re-dials the daemon over the control socket, so without forwarding every
+// JSON request would appear to come from the daemon itself.
+const (
+	// mdFwd marks a request as forwarded by the JSON gateway. It is always
+	// set, even when the gateway could not read its client's identity, so the
+	// daemon can tell "no identity available" apart from "not forwarded".
+	mdFwd         = "x-netbird-fwd"
+	mdFwdUID      = "x-netbird-fwd-uid"      // Unix user ID
+	mdFwdGID      = "x-netbird-fwd-gid"      // Unix primary group ID
+	mdFwdSID      = "x-netbird-fwd-sid"      // Windows user SID
+	mdFwdGroup    = "x-netbird-fwd-group"    // Windows group SID, repeated
+	mdFwdElevated = "x-netbird-fwd-elevated" // Windows, "1" when elevated
+
+	// mdFwdProof proves the forwarded identity was stamped by this process. The
+	// gateway runs inside the daemon, so a secret held in memory is available to
+	// the only legitimate producer and to nothing else.
+	mdFwdProof = "x-netbird-fwd-proof"
+)
+
+// forwardKeys is every metadata key the gateway sets. An HTTP client must never
+// be able to supply one itself: see IsReservedForwardKey.
+var forwardKeys = []string{mdFwd, mdFwdUID, mdFwdGID, mdFwdSID, mdFwdGroup, mdFwdElevated, mdFwdProof}
+
+// forwardProof authenticates the gateway's forwarding metadata. It is generated
+// once per daemon process and never leaves it: it is not written to disk, not
+// logged, and not sent anywhere except over the daemon's own control socket to
+// itself.
+//
+// Without it, trusting a forwarded identity rests on every layer in front of it
+// stripping incoming forwarding keys, and on each key's value shape being
+// distinguishable from an injected one. A single injected group SID or an
+// injected "elevated" flag has the same shape as a legitimate one, so no
+// cardinality rule can catch it. Requiring the proof means metadata that did not
+// come from this process is refused whatever it contains.
+var forwardProof = mustForwardProof()
+
+func mustForwardProof() string {
+	var buf [32]byte
+	if _, err := rand.Read(buf[:]); err != nil {
+		// Continuing would leave the forwarded path authenticated by a
+		// predictable value, which is worse than not starting.
+		panic(fmt.Sprintf("generate identity forwarding proof: %v", err))
+	}
+	return hex.EncodeToString(buf[:])
+}
+
+// IsReservedForwardKey reports whether a gRPC metadata key belongs to the
+// gateway's identity forwarding, and therefore must be dropped when it arrives
+// from outside.
+//
+// grpc-gateway maps "Grpc-Metadata-<key>" request headers into gRPC metadata and
+// joins them ahead of the values its own annotators add. Without dropping these,
+// an HTTP client could hand the daemon "x-netbird-fwd-uid: 0" and be believed,
+// because the daemon trusts forwarded metadata when the transport peer is the
+// (privileged) gateway.
+func IsReservedForwardKey(key string) bool {
+	key = strings.ToLower(key)
+	return slices.Contains(forwardKeys, key)
+}
+
+// ForwardIdentityMetadata encodes an HTTP client's identity for the JSON
+// gateway to forward to the daemon. When known is false only the marker is
+// set, which makes the daemon treat the caller as unidentified rather than as
+// the daemon itself.
+func ForwardIdentityMetadata(id Identity, known bool) metadata.MD {
+	md := metadata.MD{}
+	md.Set(mdFwd, "1")
+	md.Set(mdFwdProof, forwardProof)
+	if !known {
+		return md
+	}
+
+	if id.IsWindows() {
+		md.Set(mdFwdSID, id.SID)
+		if len(id.Groups) > 0 {
+			md.Set(mdFwdGroup, id.Groups...)
+		}
+		if id.Elevated {
+			md.Set(mdFwdElevated, "1")
+		}
+		return md
+	}
+
+	md.Set(mdFwdUID, strconv.FormatUint(uint64(id.UID), 10))
+	md.Set(mdFwdGID, strconv.FormatUint(uint64(id.GID), 10))
+	return md
+}
+
+// CallerIdentity returns the identity to authorize a request against. For a
+// direct connection that is the transport peer's kernel identity. For a
+// request relayed by the local JSON gateway it is the identity the gateway
+// forwarded, since the transport peer is then the daemon itself.
+//
+// A forwarded identity is only honoured when the transport peer is the daemon's
+// own identity and the metadata carries this process's forwarding proof, so
+// forged forwarding metadata gains a caller nothing. A forwarded request that
+// carries no identity is reported as unidentified, never as the daemon.
+//
+// The second return value is false when no identity could be established, and
+// callers MUST fail closed in that case.
+func CallerIdentity(ctx context.Context) (Identity, bool) {
+	id, ok := IdentityFromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+
+	// A forwarding key that arrives more than once did not come from the gateway
+	// alone, so nothing about the request can be trusted to describe its caller.
+	// Refusing outright matters because the alternative reading, "not forwarded",
+	// would authorize the request as the transport peer, which on the gateway's
+	// connection is the daemon itself.
+	if duplicatedForwardKey(ctx) {
+		return Identity{}, false
+	}
+
+	forwarded := isForwarded(ctx)
+
+	// Our own process on the other end of the socket is the JSON gateway, the only
+	// thing that dials the daemon from inside it. Such a call must carry a
+	// forwarded identity; without one there is no caller to authorize, and
+	// treating it as the daemon would authorize whatever reached the JSON socket.
+	// Only Linux reports the peer PID, so this is a belt on top of the gateway's
+	// interceptor rather than the sole guarantee.
+	if id.PID != 0 && int(id.PID) == selfPID && !forwarded {
+		return Identity{}, false
+	}
+
+	// Only the gateway's own connection may speak for someone else. Being
+	// privileged is not enough and not the point: the gateway runs inside the
+	// daemon, so it dials as the daemon's identity whatever user that is, which
+	// also covers a rootless container.
+	if !forwarded || !IsDaemonSelf(id) {
+		return id, true
+	}
+
+	// Speaking for someone else additionally requires the proof only this process
+	// holds. Refusing is the only safe reading: the transport peer here is the
+	// daemon itself, so falling back to it would authorize the request as the
+	// daemon. This is also what makes the forwarded values trustworthy once
+	// accepted, so they need no shape checks of their own.
+	if !authenticForward(ctx) {
+		return Identity{}, false
+	}
+
+	return forwardedIdentity(ctx)
+}
+
+// duplicatedForwardKey reports whether any forwarding key carries more than one
+// value. The gateway's interceptor sets each key exactly once and replaces what
+// was already there, so a repeat means a second source supplied it.
+func duplicatedForwardKey(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	for _, key := range forwardKeys {
+		// Group SIDs are legitimately repeated; the rest identify the caller.
+		if key == mdFwdGroup {
+			continue
+		}
+		if len(md.Get(key)) > 1 {
+			return true
+		}
+	}
+	return false
+}
+
+// authenticForward reports whether the request carries this process's forwarding
+// proof, which only the in-process JSON gateway can supply.
+func authenticForward(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	got := mdSingle(md, mdFwdProof)
+	return subtle.ConstantTimeCompare([]byte(got), []byte(forwardProof)) == 1
+}
+
+// isForwarded reports whether the request carries the JSON gateway marker.
+func isForwarded(ctx context.Context) bool {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return false
+	}
+	return mdSingle(md, mdFwd) != ""
+}
+
+// forwardedIdentity decodes the identity the JSON gateway attached.
+func forwardedIdentity(ctx context.Context) (Identity, bool) {
+	md, ok := metadata.FromIncomingContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+
+	if sid := mdSingle(md, mdFwdSID); sid != "" {
+		return Identity{
+			SID: sid,
+			// Repeated by design, one value per group, and only reachable once
+			// the forwarding proof has been verified.
+			Groups:   md.Get(mdFwdGroup),
+			Elevated: mdSingle(md, mdFwdElevated) == "1",
+		}, true
+	}
+
+	uid, err := strconv.ParseUint(mdSingle(md, mdFwdUID), 10, 32)
+	if err != nil {
+		return Identity{}, false
+	}
+
+	id := Identity{UID: uint32(uid)}
+	if gid, err := strconv.ParseUint(mdSingle(md, mdFwdGID), 10, 32); err == nil {
+		id.GID = uint32(gid)
+	}
+	return id, true
+}
+
+// mdSingle returns the value of a forwarded key only when exactly one was
+// supplied. The gateway's interceptor sets each key exactly once, so more than one
+// value means something else also supplied it, and the whole identity is treated as
+// unknown rather than picking a winner. Defence in depth behind the gateway's
+// header filter.
+func mdSingle(md metadata.MD, key string) string {
+	if v := md.Get(key); len(v) == 1 {
+		return v[0]
+	}
+	return ""
+}
+
+// WithForwardedIdentity stamps id onto a context's outgoing metadata for the JSON
+// gateway's call to the daemon, replacing any forwarding keys already present so
+// values supplied from outside cannot survive alongside it.
+//
+// This is deliberately not done with runtime.WithMetadata: grpc-gateway skips its
+// annotators entirely when no request header maps to metadata ("if len(pairs) == 0
+// { return ctx, nil, nil }", runtime/context.go), which an HTTP/1.0 request with no
+// Host header over a unix socket achieves. The daemon would then see an unmarked
+// call whose transport peer is the daemon's own identity, and authorize it as the
+// daemon. A client interceptor runs for every RPC regardless of headers.
+func WithForwardedIdentity(ctx context.Context, id Identity, known bool) context.Context {
+	md, ok := metadata.FromOutgoingContext(ctx)
+	if !ok {
+		md = metadata.MD{}
+	} else {
+		md = md.Copy()
+	}
+
+	for _, key := range forwardKeys {
+		delete(md, key)
+	}
+	for key, values := range ForwardIdentityMetadata(id, known) {
+		md[key] = values
+	}
+
+	return metadata.NewOutgoingContext(ctx, md)
+}
--- a/client/internal/ipcauth/forward_test.go
+++ b/client/internal/ipcauth/forward_test.go
@@ -0,0 +1,214 @@
+package ipcauth
+
+import (
+	"context"
+	"testing"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/metadata"
+	"google.golang.org/grpc/peer"
+)
+
+// transportCtx builds a request context as the daemon's transport credentials
+// would: the identity of whoever opened the socket, plus whatever metadata the
+// request carried.
+func transportCtx(id Identity, md metadata.MD) context.Context {
+	ctx := peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       id,
+		},
+	})
+	if md != nil {
+		ctx = metadata.NewIncomingContext(ctx, md)
+	}
+	return ctx
+}
+
+var (
+	root       = Identity{UID: 0}
+	unprivUser = Identity{UID: 1000, GID: 1000}
+)
+
+// asDaemon pins which identity counts as this process for the duration of a test.
+// Without it the test binary's own uid decides, which silently changes what
+// "the gateway" means.
+func asDaemon(t *testing.T, id Identity) {
+	t.Helper()
+	prevID, prevKnown, prevDelegate := selfIdentity, selfKnown, selfMayDelegate
+	t.Cleanup(func() { selfIdentity, selfKnown, selfMayDelegate = prevID, prevKnown, prevDelegate })
+	selfIdentity, selfKnown = id, true
+	selfMayDelegate = !id.IsPrivileged()
+}
+
+func TestCallerIdentity_DirectConnections(t *testing.T) {
+	t.Run("no transport credentials is not an identity", func(t *testing.T) {
+		if _, ok := CallerIdentity(context.Background()); ok {
+			t.Fatal("a caller with no credentials must not be identified")
+		}
+	})
+
+	t.Run("a direct caller is its transport identity", func(t *testing.T) {
+		id, ok := CallerIdentity(transportCtx(unprivUser, nil))
+		if !ok || id.UID != 1000 {
+			t.Fatalf("got %v ok=%t, want uid 1000", id, ok)
+		}
+	})
+
+	// The whole point of honouring forwarded metadata only from a privileged
+	// transport peer: an unprivileged caller can set any metadata it likes on its
+	// own connection to the daemon socket.
+	t.Run("an unprivileged caller cannot forge an identity", func(t *testing.T) {
+		asDaemon(t, root)
+		forged := metadata.Pairs(mdFwd, "1", mdFwdUID, "0", mdFwdGID, "0")
+		id, ok := CallerIdentity(transportCtx(unprivUser, forged))
+		if !ok {
+			t.Fatal("caller should still be identified, as itself")
+		}
+		if id.IsPrivileged() || id.UID != 1000 {
+			t.Fatalf("forged metadata was believed: got %v", id)
+		}
+	})
+}
+
+func TestCallerIdentity_GatewayForwarding(t *testing.T) {
+	t.Run("the gateway's client identity is used, not the gateway's own", func(t *testing.T) {
+		asDaemon(t, root)
+		md := ForwardIdentityMetadata(unprivUser, true)
+		id, ok := CallerIdentity(transportCtx(root, md))
+		if !ok {
+			t.Fatal("forwarded identity should be usable")
+		}
+		if id.IsPrivileged() || id.UID != 1000 {
+			t.Fatalf("got %v, want the forwarded uid 1000 and not privileged", id)
+		}
+	})
+
+	t.Run("a privileged gateway client stays privileged", func(t *testing.T) {
+		asDaemon(t, root)
+		md := ForwardIdentityMetadata(root, true)
+		id, ok := CallerIdentity(transportCtx(root, md))
+		if !ok || !id.IsPrivileged() {
+			t.Fatalf("got %v ok=%t, want a privileged identity", id, ok)
+		}
+	})
+
+	// A JSON socket the gateway cannot read peer credentials from (a TCP socket,
+	// say) must not make every request look like the daemon itself.
+	t.Run("an unreadable client identity is unknown, not the daemon", func(t *testing.T) {
+		asDaemon(t, root)
+		md := ForwardIdentityMetadata(Identity{}, false)
+		if _, ok := CallerIdentity(transportCtx(root, md)); ok {
+			t.Fatal("a forwarded request with no identity must not be identified")
+		}
+	})
+
+	// grpc-gateway turns Grpc-Metadata-<key> headers into gRPC metadata and joins
+	// them ahead of its annotators' values. If an HTTP client's header survived
+	// that, this is the shape the daemon would see: the attacker's uid 0 first,
+	// the real uid second. The gateway filters those headers out, and reading a
+	// duplicated key as unknown makes the daemon safe even if it did not.
+	t.Run("a duplicated key from an injected header is not believed", func(t *testing.T) {
+		asDaemon(t, root)
+		md := metadata.MD{}
+		md.Append(mdFwd, "1")
+		md.Append(mdFwdUID, "0")    // injected by the HTTP client
+		md.Append(mdFwdUID, "1000") // appended by the gateway's annotator
+		if id, ok := CallerIdentity(transportCtx(root, md)); ok {
+			t.Fatalf("injected uid was accepted: got %v", id)
+		}
+	})
+
+	t.Run("a duplicated marker is not believed either", func(t *testing.T) {
+		asDaemon(t, root)
+		md := metadata.MD{}
+		md.Append(mdFwd, "1")
+		md.Append(mdFwd, "1")
+		md.Append(mdFwdUID, "1000")
+		// A repeated marker must not be read as "not forwarded": that would
+		// authorize the request as the transport peer, which on the gateway's
+		// connection is the daemon itself.
+		if id, ok := CallerIdentity(transportCtx(root, md)); ok {
+			t.Fatalf("a duplicated marker was believed: got %v", id)
+		}
+	})
+
+	// The layers in front of this (the gateway's header matcher, and its
+	// interceptor replacing every forwarding key) are what keep outside metadata
+	// from arriving at all. The proof is what the daemon can check for itself, and
+	// it is the only defence that works for a value whose legitimate shape is
+	// indistinguishable from an injected one: a lone group SID, or "elevated".
+	t.Run("forwarding metadata without this process's proof is refused", func(t *testing.T) {
+		asDaemon(t, root)
+		for name, md := range map[string]metadata.MD{
+			"no proof":    metadata.Pairs(mdFwd, "1", mdFwdUID, "0"),
+			"wrong proof": metadata.Pairs(mdFwd, "1", mdFwdUID, "0", mdFwdProof, "deadbeef"),
+			"windows identity without a proof": metadata.Pairs(mdFwd, "1",
+				mdFwdSID, "S-1-5-21-1-2-3-1001", mdFwdGroup, sidAdministrators, mdFwdElevated, "1"),
+		} {
+			t.Run(name, func(t *testing.T) {
+				if id, ok := CallerIdentity(transportCtx(root, md)); ok {
+					t.Fatalf("unstamped forwarding metadata was believed: got %v", id)
+				}
+			})
+		}
+	})
+
+	// A caller that reaches the gateway cannot see the proof, so it cannot append
+	// a group of its own to a genuine forwarded identity: doing so would have to
+	// go through the interceptor, which replaces the whole set.
+	t.Run("a group appended to a stamped identity does not survive the interceptor", func(t *testing.T) {
+		asDaemon(t, root)
+		injected := metadata.MD{}
+		injected.Append(mdFwdGroup, sidAdministrators)
+
+		ctx := WithForwardedIdentity(metadata.NewOutgoingContext(context.Background(), injected),
+			Identity{SID: "S-1-5-21-1-2-3-1001"}, true)
+		out, ok := metadata.FromOutgoingContext(ctx)
+		if !ok {
+			t.Fatal("no outgoing metadata")
+		}
+		if groups := out.Get(mdFwdGroup); len(groups) != 0 {
+			t.Fatalf("injected group survived: %v", groups)
+		}
+	})
+}
+
+func TestIsReservedForwardKey(t *testing.T) {
+	for _, key := range forwardKeys {
+		if !IsReservedForwardKey(key) {
+			t.Errorf("%q must be reserved", key)
+		}
+	}
+
+	// grpc-gateway canonicalises header names, so the check has to be
+	// case-insensitive.
+	if !IsReservedForwardKey("X-Netbird-Fwd-Uid") {
+		t.Error("the check must be case-insensitive")
+	}
+
+	for _, key := range []string{"authorization", "x-netbird", "x-netbird-fwd-uid-extra", ""} {
+		if IsReservedForwardKey(key) {
+			t.Errorf("%q must not be reserved", key)
+		}
+	}
+}
+
+func TestForwardIdentityMetadata_AlwaysMarksForwarded(t *testing.T) {
+	for _, tc := range []struct {
+		name  string
+		id    Identity
+		known bool
+	}{
+		{"known unix identity", unprivUser, true},
+		{"unknown identity", Identity{}, false},
+		{"windows identity", Identity{SID: "S-1-5-21-1-2-3-1001", Elevated: true}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			md := ForwardIdentityMetadata(tc.id, tc.known)
+			if got := md.Get(mdFwd); len(got) != 1 || got[0] != "1" {
+				t.Fatalf("marker = %v, want exactly one \"1\"", got)
+			}
+		})
+	}
+}
--- a/client/internal/ipcauth/identity.go
+++ b/client/internal/ipcauth/identity.go
@@ -0,0 +1,127 @@
+// Package ipcauth provides the kernel-authenticated identity of a local IPC
+// (gRPC) caller and the transport credentials that surface it into the gRPC
+// context, so the daemon can authorize individual RPCs by caller identity.
+//
+// On Unix the identity is read from the kernel via SO_PEERCRED (Linux) or
+// LOCAL_PEERCRED (Darwin/FreeBSD). On Windows it is derived from the
+// named-pipe client token. Platforms without a peer-identity primitive get no
+// credentials, and every consumer must fail closed when no identity is
+// available.
+package ipcauth
+
+import (
+	"context"
+	"fmt"
+	"slices"
+
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+)
+
+// Well-known Windows SIDs that identify a fully privileged principal.
+const (
+	sidLocalSystem    = "S-1-5-18"     // NT AUTHORITY\SYSTEM
+	sidLocalService   = "S-1-5-19"     // NT AUTHORITY\LOCAL SERVICE
+	sidNetworkService = "S-1-5-20"     // NT AUTHORITY\NETWORK SERVICE
+	sidAdministrators = "S-1-5-32-544" // BUILTIN\Administrators
+)
+
+// Identity is the kernel-authenticated identity of a local IPC caller. The
+// zero value is not a valid identity: consumers must only use one obtained
+// with a true ok/nil error return.
+type Identity struct {
+	// UID and GID are the caller's Unix user ID and primary group ID. Both are
+	// zero on Windows, where SID is authoritative instead.
+	UID uint32
+	GID uint32
+
+	// SID is the caller's Windows security identifier, empty on Unix.
+	SID string
+
+	// Groups holds the caller's Windows group SIDs, captured from the client
+	// token at handshake time. Only groups that are enabled and not
+	// deny-only are captured, so a group listed here is one the caller can
+	// actually exercise. Empty on Unix.
+	Groups []string
+
+	// Elevated reports whether the Windows client token is elevated (running
+	// as administrator, or an administrator with UAC turned off). Always false
+	// on Unix, where privilege is uid 0.
+	Elevated bool
+
+	// PID is the caller's process ID where the platform reports it (Linux's
+	// SO_PEERCRED), and 0 where it does not. It identifies the daemon's own
+	// process dialling itself, which is what the JSON gateway does, and is never
+	// used to grant anything.
+	PID int32
+}
+
+// IsWindows reports whether this identity is a Windows principal (SID-based)
+// rather than a Unix uid/gid principal.
+func (i Identity) IsWindows() bool {
+	return i.SID != ""
+}
+
+// IsPrivileged reports whether the caller is the platform's administrative
+// principal, which is what the daemon requires for changes that cross the
+// user-to-root boundary.
+//
+// On Windows the decision comes from the caller's token rather than from
+// account names or group RIDs: an elevated token, one of the service accounts
+// the daemon itself may run as, or a token with BUILTIN\Administrators
+// enabled. A UAC-filtered administrator has that group marked deny-only, and
+// deny-only groups are dropped when the identity is captured, so such a
+// caller is correctly reported as unprivileged. Domain group memberships
+// (Domain Admins and friends) are deliberately not consulted: they say
+// nothing about what this token may do on this machine.
+func (i Identity) IsPrivileged() bool {
+	if !i.IsWindows() {
+		return i.UID == 0
+	}
+
+	if i.Elevated {
+		return true
+	}
+
+	switch i.SID {
+	case sidLocalSystem, sidLocalService, sidNetworkService:
+		return true
+	}
+
+	return slices.Contains(i.Groups, sidAdministrators)
+}
+
+// String renders the identity for audit logs and denial messages.
+func (i Identity) String() string {
+	if i.IsWindows() {
+		return fmt.Sprintf("sid=%s elevated=%t", i.SID, i.Elevated)
+	}
+	return fmt.Sprintf("uid=%d gid=%d", i.UID, i.GID)
+}
+
+// AuthInfo carries the peer Identity as a gRPC credentials.AuthInfo so
+// handlers can retrieve it from the request context via IdentityFromContext.
+type AuthInfo struct {
+	credentials.CommonAuthInfo
+	Identity Identity
+}
+
+// AuthType identifies the authentication scheme.
+func (AuthInfo) AuthType() string { return "netbird-ipc-peercred" }
+
+// IdentityFromContext extracts the caller's kernel-authenticated identity from
+// the gRPC peer context. The second return value is false when no IPC
+// transport credentials were negotiated, which happens on a TCP daemon socket
+// and on platforms without a peer-identity primitive. Callers MUST fail closed
+// in that case.
+func IdentityFromContext(ctx context.Context) (Identity, bool) {
+	p, ok := peer.FromContext(ctx)
+	if !ok {
+		return Identity{}, false
+	}
+	info, ok := p.AuthInfo.(AuthInfo)
+	if !ok {
+		return Identity{}, false
+	}
+	return info.Identity, true
+}
--- a/client/internal/ipcauth/peercred_bsd.go
+++ b/client/internal/ipcauth/peercred_bsd.go
@@ -0,0 +1,43 @@
+//go:build darwin || freebsd
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket via LOCAL_PEERCRED. The xucred is recorded by the
+// kernel at connect() time and carries the peer's uid and its group list, of
+// which the first entry is the primary group.
+func PeerIdentity(conn net.Conn) (Identity, error) {
+	uc, ok := conn.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", conn)
+	}
+
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Xucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptXucred(int(fd), unix.SOL_LOCAL, unix.LOCAL_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("control raw conn: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("read LOCAL_PEERCRED: %w", credErr)
+	}
+
+	id := Identity{UID: cred.Uid}
+	if cred.Ngroups > 0 {
+		id.GID = cred.Groups[0]
+	}
+	return id, nil
+}
--- a/client/internal/ipcauth/peercred_linux.go
+++ b/client/internal/ipcauth/peercred_linux.go
@@ -0,0 +1,39 @@
+//go:build linux
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	"golang.org/x/sys/unix"
+)
+
+// PeerIdentity reads the kernel-authenticated identity of the process on the
+// other end of a Unix socket via SO_PEERCRED. The credentials are recorded by
+// the kernel at connect() time and cannot be changed for the life of the
+// connection, so they are not spoofable by the caller.
+func PeerIdentity(conn net.Conn) (Identity, error) {
+	uc, ok := conn.(*net.UnixConn)
+	if !ok {
+		return Identity{}, fmt.Errorf("connection is not a unix socket: %T", conn)
+	}
+
+	raw, err := uc.SyscallConn()
+	if err != nil {
+		return Identity{}, fmt.Errorf("raw conn: %w", err)
+	}
+
+	var cred *unix.Ucred
+	var credErr error
+	if err := raw.Control(func(fd uintptr) {
+		cred, credErr = unix.GetsockoptUcred(int(fd), unix.SOL_SOCKET, unix.SO_PEERCRED)
+	}); err != nil {
+		return Identity{}, fmt.Errorf("control raw conn: %w", err)
+	}
+	if credErr != nil {
+		return Identity{}, fmt.Errorf("read SO_PEERCRED: %w", credErr)
+	}
+
+	return Identity{UID: cred.Uid, GID: cred.Gid, PID: cred.Pid}, nil
+}
--- a/client/internal/ipcauth/pipeserver_windows.go
+++ b/client/internal/ipcauth/pipeserver_windows.go
@@ -0,0 +1,87 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"fmt"
+	"net"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+// PipeServerTrusted reports an error unless the pipe behind conn was created by a
+// principal this client may hand secrets to. Clients call it for a pipe whose name
+// carries no guarantee of its own, which is any name outside the
+// ProtectedPrefix\Administrators namespace: that namespace already restricts
+// creation to administrators and LocalSystem, while a plain name can be created by
+// any local user before the daemon gets there.
+//
+// The decision is made from the pipe object's owner, not from the serving process,
+// because a client cannot open a process running as another user at all, and the
+// legitimate case is precisely an unprivileged client talking to a privileged
+// daemon. Trusted owners are the service accounts, BUILTIN\Administrators, and
+// this client's own user, the last of which is the daemon a user runs themselves
+// as in netstack mode. A pipe owned by anyone else gets no setup key, pre-shared
+// key or SSO prompt out of this client.
+func PipeServerTrusted(conn net.Conn) error {
+	// go-winio's pipe connection embeds *win32File, which exposes Fd().
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return fmt.Errorf("connection %T does not expose a pipe handle", conn)
+	}
+
+	owner, err := pipeOwnerSID(windows.Handle(fdConn.Fd()))
+	if err != nil {
+		return err
+	}
+
+	if !trustedPipeOwner(owner) {
+		return fmt.Errorf("pipe owned by %s, which is neither an administrator nor this user", owner)
+	}
+	return nil
+}
+
+// PipeOwnedBySelf reports whether the pipe behind conn was created by this very
+// user, which is how a client recognises a daemon running as itself. Ownership it
+// cannot read is reported as false.
+func PipeOwnedBySelf(conn net.Conn) bool {
+	fdConn, ok := conn.(interface{ Fd() uintptr })
+	if !ok {
+		return false
+	}
+
+	owner, err := pipeOwnerSID(windows.Handle(fdConn.Fd()))
+	if err != nil {
+		log.Debugf("read daemon pipe owner: %v", err)
+		return false
+	}
+	return selfKnown && selfIdentity.SID != "" && owner == selfIdentity.SID
+}
+
+// pipeOwnerSID reads the owner of the pipe object a client is connected to. The
+// handle was opened with GENERIC_READ, which includes READ_CONTROL, so no extra
+// access is needed.
+func pipeOwnerSID(handle windows.Handle) (string, error) {
+	sd, err := windows.GetSecurityInfo(handle, windows.SE_KERNEL_OBJECT, windows.OWNER_SECURITY_INFORMATION)
+	if err != nil {
+		return "", fmt.Errorf("read pipe security info: %w", err)
+	}
+
+	owner, _, err := sd.Owner()
+	if err != nil {
+		return "", fmt.Errorf("read pipe owner: %w", err)
+	}
+	return owner.String(), nil
+}
+
+// trustedPipeOwner reports whether a pipe's owner is a principal a client may
+// speak to. An elevated process's objects are owned by BUILTIN\Administrators by
+// default, an unelevated one's by the user, which is why both forms appear here.
+func trustedPipeOwner(owner string) bool {
+	switch owner {
+	case sidLocalSystem, sidLocalService, sidNetworkService, sidAdministrators:
+		return true
+	}
+	return selfKnown && selfIdentity.SID != "" && owner == selfIdentity.SID
+}
--- a/client/internal/ipcauth/privileged.go
+++ b/client/internal/ipcauth/privileged.go
@@ -0,0 +1,125 @@
+package ipcauth
+
+import (
+	"os"
+	"runtime"
+)
+
+// Fields of the ErrorInfo detail the daemon attaches to a PermissionDenied it
+// raises for an operation that requires root/administrator. Clients match on
+// Reason and Domain rather than on the message text, and render the summary and
+// command themselves so the user gets guidance instead of a gRPC error dump.
+const (
+	// ErrorReasonPrivilegeRequired identifies the detail.
+	ErrorReasonPrivilegeRequired = "PRIVILEGE_REQUIRED"
+	// ErrorDomain scopes the reason to the NetBird daemon.
+	ErrorDomain = "daemon.netbird.io"
+	// ErrorMetaSummary is the one-sentence explanation of what was refused.
+	ErrorMetaSummary = "summary"
+	// ErrorMetaCommand is the command that performs the same operation with the
+	// privileges it needs, ready to copy and run.
+	ErrorMetaCommand = "command"
+)
+
+// The identity of the process evaluating callers, captured once because it cannot
+// change. selfKnown is false when it could not be read, in which case nothing is
+// ever treated as this process. selfMayDelegate additionally requires this
+// process to be unprivileged: see IsPrivilegedCaller.
+var (
+	selfIdentity    Identity
+	selfKnown       bool
+	selfMayDelegate bool
+	// selfPID is this process's PID, used to recognise the daemon dialling itself.
+	selfPID = os.Getpid()
+)
+
+func init() {
+	id, err := CurrentProcessIdentity()
+	if err != nil {
+		return
+	}
+	selfIdentity, selfKnown = id, true
+	// Only an unprivileged daemon delegates its authority to its own identity.
+	// When it is root or LocalSystem, sharing its identity does not mean sharing
+	// its power: on Windows a filtered and a full token carry the same SID, so
+	// matching there would let a non-elevated shell of an administrator account
+	// act as an administrator, which is the boundary the token check exists to
+	// keep.
+	selfMayDelegate = !id.IsPrivileged()
+}
+
+// IsDaemonSelf reports whether an identity is this very process. The JSON gateway
+// runs inside the daemon and re-dials it locally, so this is what distinguishes
+// the gateway from any other caller, whatever user the daemon runs as.
+func IsDaemonSelf(id Identity) bool {
+	if !selfKnown || id.IsWindows() != selfIdentity.IsWindows() {
+		return false
+	}
+	if id.IsWindows() {
+		return id.SID != "" && id.SID == selfIdentity.SID
+	}
+	return id.UID == selfIdentity.UID
+}
+
+// IsPrivilegedCaller reports whether an identity may make the changes the daemon
+// restricts to the platform administrator. This is the daemon's own rule and
+// cannot be evaluated by a client, which does not know what the daemon runs as.
+//
+// Beyond root/administrator it accepts a caller running as the daemon's own
+// identity when the daemon is itself unprivileged. That keeps a rootless container
+// working, where there is no uid 0 at all, and a Windows daemon in netstack mode,
+// which needs no administrator rights. In those setups a caller sharing the
+// daemon's identity can already rewrite the config files it reads and replace the
+// binary it runs, so refusing it a config change would protect nothing; and an
+// unprivileged daemon cannot hand out a root shell in the first place.
+func IsPrivilegedCaller(id Identity) bool {
+	if id.IsPrivileged() {
+		return true
+	}
+	return selfMayDelegate && IsDaemonSelf(id)
+}
+
+// SelfDelegatesTo returns the identity this process delegates its authority to,
+// and whether it delegates at all. Only an unprivileged daemon does: see
+// IsPrivilegedCaller. It exists so a refusal can name who may actually perform the
+// operation, because on such a host root is neither required nor necessarily
+// available.
+func SelfDelegatesTo() (Identity, bool) {
+	if !selfKnown || !selfMayDelegate {
+		return Identity{}, false
+	}
+	return selfIdentity, true
+}
+
+// PrivilegedActor names the principal a privileged operation requires, for use
+// in messages shown to the user.
+func PrivilegedActor() string {
+	if runtime.GOOS == "windows" {
+		return "administrator privileges"
+	}
+	return "root"
+}
+
+// ElevatedCommand renders a command so that running it grants the privileges the
+// operation needs. Windows has no in-line equivalent of sudo, so the command is
+// returned unchanged and the user is expected to run it from an elevated
+// terminal.
+func ElevatedCommand(command string) string {
+	if runtime.GOOS == "windows" {
+		return command
+	}
+	return "sudo " + command
+}
+
+// UpCommand renders an elevated `netbird up` with the given flags, preceded by a
+// `down`. The down is what makes the command work on a connected client: `netbird
+// up` prints "Already connected" and returns without applying any config flag, so
+// on its own the command would appear to do nothing. It is a no-op, exit 0, when
+// the client is not connected.
+//
+// ";" rather than "&&" so the line can be pasted into any of the shells a user
+// might have: PowerShell 5.1, still the default on Windows Server, rejects "&&"
+// as a syntax error.
+func UpCommand(flags string) string {
+	return ElevatedCommand("netbird down") + "; " + ElevatedCommand("netbird up "+flags)
+}
--- a/client/internal/ipcauth/privileged_test.go
+++ b/client/internal/ipcauth/privileged_test.go
@@ -0,0 +1,134 @@
+package ipcauth
+
+import "testing"
+
+// The self rule is the one place privilege is granted to something other than the
+// platform administrator, so its two guards matter: it must apply only when the
+// daemon is itself unprivileged, and only to a caller with the daemon's identity.
+func TestIsPrivilegedCaller_SelfRule(t *testing.T) {
+	tests := []struct {
+		name string
+		// self stands in for the process the daemon runs as.
+		self      Identity
+		selfKnown bool
+		caller    Identity
+		want      bool
+	}{
+		{
+			name:      "root is privileged whatever the daemon runs as",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{UID: 0},
+			want:      true,
+		},
+		{
+			name:      "an unprivileged daemon delegates to its own user (rootless container)",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{UID: 1000},
+			want:      true,
+		},
+		{
+			name:      "an unprivileged daemon delegates to nobody else",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{UID: 1001},
+			want:      false,
+		},
+		{
+			// The daemon is root on a normal install, so sharing its identity is
+			// already covered by being root; nothing else may match.
+			name:      "a root daemon delegates to nobody",
+			self:      Identity{UID: 0},
+			selfKnown: true,
+			caller:    Identity{UID: 1000},
+			want:      false,
+		},
+		{
+			// Windows netstack mode: the daemon needs no administrator rights.
+			name:      "an unprivileged windows daemon delegates to its own SID",
+			self:      Identity{SID: "S-1-5-21-1-2-3-1001"},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			want:      true,
+		},
+		{
+			name:      "an unprivileged windows daemon delegates to no other SID",
+			self:      Identity{SID: "S-1-5-21-1-2-3-1001"},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-1002"},
+			want:      false,
+		},
+		{
+			// The UAC boundary: a filtered and a full token of the same account
+			// carry the same SID but not the same power, so an elevated daemon must
+			// never delegate to its own SID.
+			name:      "an elevated windows daemon does not delegate to its own SID",
+			self:      Identity{SID: "S-1-5-21-1-2-3-500", Elevated: true},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-500"},
+			want:      false,
+		},
+		{
+			name:      "LocalSystem is privileged on its own merits, not by delegation",
+			self:      Identity{SID: sidLocalSystem},
+			selfKnown: true,
+			caller:    Identity{SID: sidLocalSystem},
+			want:      true, // LocalSystem is privileged on its own merits
+		},
+		{
+			name:      "identities of different kinds never match",
+			self:      Identity{UID: 1000},
+			selfKnown: true,
+			caller:    Identity{SID: "S-1-5-21-1-2-3-1001"},
+			want:      false,
+		},
+		{
+			name:      "an unknown self identity delegates to nobody",
+			self:      Identity{},
+			selfKnown: false,
+			caller:    Identity{UID: 1000},
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prevID, prevKnown, prevDelegate := selfIdentity, selfKnown, selfMayDelegate
+			t.Cleanup(func() { selfIdentity, selfKnown, selfMayDelegate = prevID, prevKnown, prevDelegate })
+
+			selfIdentity, selfKnown = tt.self, tt.selfKnown
+			selfMayDelegate = tt.selfKnown && !tt.self.IsPrivileged()
+
+			if got := IsPrivilegedCaller(tt.caller); got != tt.want {
+				t.Fatalf("IsPrivilegedCaller(%v) with daemon %v = %t, want %t",
+					tt.caller, tt.self, got, tt.want)
+			}
+		})
+	}
+}
+
+// The real process must never accidentally delegate: a test binary running as a
+// normal user is unprivileged, so it may match itself, but nothing else.
+func TestIsPrivilegedCaller_ThisProcess(t *testing.T) {
+	id, err := CurrentProcessIdentity()
+	if err != nil {
+		t.Skipf("cannot read this process's identity: %v", err)
+	}
+
+	// This process is always allowed to act as itself: either it is privileged, or
+	// it is unprivileged and therefore delegates to its own identity.
+	if !IsPrivilegedCaller(id) {
+		t.Errorf("this process %v was refused its own identity", id)
+	}
+
+	// A caller that is neither root nor this process must be refused, whatever
+	// this process happens to be.
+	other := Identity{UID: id.UID + 1}
+	if id.IsWindows() {
+		other = Identity{SID: id.SID + "9"}
+	}
+	if IsPrivilegedCaller(other) {
+		t.Errorf("an unrelated identity %v was treated as privileged", other)
+	}
+}
--- a/client/internal/ipcauth/self_unix.go
+++ b/client/internal/ipcauth/self_unix.go
@@ -0,0 +1,17 @@
+//go:build !windows
+
+package ipcauth
+
+import "os"
+
+// CurrentProcessIdentity returns this process's identity as the daemon would
+// see it if this process connected to the local IPC. It lets a client (the UI)
+// decide up front whether a privileged operation can succeed, without a
+// round-trip and without duplicating the rules: the answer comes from the same
+// Identity.IsPrivileged the daemon applies.
+func CurrentProcessIdentity() (Identity, error) {
+	return Identity{
+		UID: uint32(os.Geteuid()),
+		GID: uint32(os.Getegid()),
+	}, nil
+}
--- a/client/internal/ipcauth/self_windows.go
+++ b/client/internal/ipcauth/self_windows.go
@@ -0,0 +1,35 @@
+//go:build windows
+
+package ipcauth
+
+import (
+	"fmt"
+
+	"golang.org/x/sys/windows"
+)
+
+// CurrentProcessIdentity returns this process's identity as the daemon would see
+// it if this process connected to the local IPC. It lets a client (the UI)
+// decide up front whether a privileged operation can succeed, without a
+// round-trip and without duplicating the rules: the answer comes from the same
+// Identity.IsPrivileged the daemon applies to the token it reads off the pipe.
+func CurrentProcessIdentity() (Identity, error) {
+	// A pseudo-token, so it must not be closed.
+	token := windows.GetCurrentProcessToken()
+
+	user, err := token.GetTokenUser()
+	if err != nil {
+		return Identity{}, fmt.Errorf("read token user: %w", err)
+	}
+
+	groups, err := tokenGroupSIDs(token)
+	if err != nil {
+		return Identity{}, err
+	}
+
+	return Identity{
+		SID:      user.User.Sid.String(),
+		Groups:   groups,
+		Elevated: token.IsElevated(),
+	}, nil
+}
--- a/client/internal/profilemanager/config.go
+++ b/client/internal/profilemanager/config.go
@@ -746,6 +746,13 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 // appended for https or ":80" for http. The serviceName parameter is
 // used to contextualise error messages. On success returns the parsed
 // *url.URL; on failure returns a non-nil error.
+// ParseServiceURL normalises a service URL exactly as the config layer does when
+// it stores one, so callers comparing a requested URL against a stored one do not
+// have to reimplement the scheme validation and default-port handling.
+func ParseServiceURL(serviceName, serviceURL string) (*url.URL, error) {
+	return parseURL(serviceName, serviceURL)
+}
+
 func parseURL(serviceName, serviceURL string) (*url.URL, error) {
 	parsedMgmtURL, err := url.ParseRequestURI(serviceURL)
 	if err != nil {
--- a/client/server/login_gate_test.go
+++ b/client/server/login_gate_test.go
@@ -0,0 +1,127 @@
+package server
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A refused login must not leave the profile switched. Login can both switch
+// profiles and carry the guarded config fields, so the gate has to run before the
+// switch: otherwise a caller whose change is refused still gets the side effect of
+// activating whichever profile the request named.
+func TestLogin_RefusedChangeLeavesTheProfileAlone(t *testing.T) {
+	s, _, activeProfile, username, _ := setupServerWithProfile(t)
+
+	// Login reads process state off the daemon's root context.
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// A second profile that runs the SSH server, which is what makes repointing
+	// its management binding a privileged change.
+	target := "ssh-enabled"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       filepath.Join(profilemanager.DefaultConfigPathDir, target+".json"),
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(true),
+	})
+	require.NoError(t, err)
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: "https://mgmt.attacker.example:443",
+	})
+	require.Error(t, err, "an unprivileged caller must not move the management URL of an SSH-enabled profile")
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want a privilege refusal, got %v", err)
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(activeProfile), active.ID,
+		"the refused login switched the active profile anyway")
+}
+
+// A caller whose change becomes privileged only after its first check must be
+// refused without having cancelled a login or switched profiles: the first check is
+// unsynchronized, so the SSH server can be enabled by a concurrent privileged
+// request in between, and the authoritative check happens before any side effect.
+func TestLogin_ChangeThatBecomesPrivilegedMidRequestHasNoSideEffects(t *testing.T) {
+	s, _, activeProfile, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	// The target profile has SSH off, so the first check lets the request through.
+	target := "ssh-later"
+	targetPath := filepath.Join(profilemanager.DefaultConfigPathDir, target+".json")
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       targetPath,
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(false),
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	// Stand in for a privileged SetConfig that enables the SSH server between the
+	// two checks, which is the interleaving the lock has to make safe.
+	afterLoginPreCheck = func() {
+		_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+			ConfigPath:       targetPath,
+			ServerSSHAllowed: boolPtr(true),
+		})
+		require.NoError(t, err)
+	}
+	t.Cleanup(func() { afterLoginPreCheck = nil })
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: "https://mgmt.attacker.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want a privilege refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+
+	active, err := s.profileManager.GetActiveProfileState()
+	require.NoError(t, err)
+	require.Equal(t, profilemanager.ID(activeProfile), active.ID, "the refused login switched the active profile anyway")
+
+	stored, err := profilemanager.ReadConfig(targetPath)
+	require.NoError(t, err)
+	require.Equal(t, "https://api.netbird.io:443", stored.ManagementURL.String(), "the refused login moved the management URL")
+}
+
+// Login cancels whatever login is already in progress before starting its own. A
+// refused caller must not get that far, otherwise anyone able to reach the socket
+// can abort someone else's login by sending a request that is denied.
+func TestLogin_RefusedChangeLeavesAnInProgressLoginAlone(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	target := "ssh-enabled"
+	_, err := profilemanager.UpdateOrCreateConfig(profilemanager.ConfigInput{
+		ConfigPath:       filepath.Join(profilemanager.DefaultConfigPathDir, target+".json"),
+		ManagementURL:    "https://api.netbird.io:443",
+		ServerSSHAllowed: boolPtr(true),
+	})
+	require.NoError(t, err)
+
+	cancelled := false
+	s.actCancel = func() { cancelled = true }
+
+	_, err = s.Login(userCtx(), &proto.LoginRequest{
+		ProfileName:   &target,
+		Username:      &username,
+		ManagementUrl: "https://mgmt.attacker.example:443",
+	})
+	require.Error(t, err)
+	require.Equal(t, codes.PermissionDenied, gstatus.Code(err), "want a privilege refusal, got %v", err)
+	require.False(t, cancelled, "the refused login cancelled the login already in progress")
+}
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -82,6 +82,12 @@ type Server struct {
 	// extend flow or vice versa.
 	extendAuthSessionFlow *auth.PendingFlow

+	// guardedConfigMu serializes a privilege check against the write it
+	// authorizes. Without it the two are separate steps over the same file, and a
+	// change that was allowed because the profile had the SSH server disabled
+	// could land after a concurrent privileged request enabled it.
+	guardedConfigMu sync.Mutex
+
 	mutex  sync.Mutex
 	config *profilemanager.Config
 	proto.UnimplementedDaemonServiceServer
@@ -411,6 +417,20 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		return nil, err
 	}

+	// Privilege gate: refuse the parts of the request that would let a local
+	// user turn the root daemon into a root shell. Held across the write so the
+	// config cannot gain the SSH server between the decision and the update.
+	s.guardedConfigMu.Lock()
+	defer s.guardedConfigMu.Unlock()
+
+	stored, err := s.storedProfileConfig(msg.ProfileName, msg.Username)
+	if err != nil {
+		return nil, err
+	}
+	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromSetConfig(msg)); err != nil {
+		return nil, err
+	}
+
 	config, err := s.setConfigInputFromRequest(msg)
 	if err != nil {
 		return nil, err
@@ -537,22 +557,23 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}

-	s.mutex.Lock()
-	if s.actCancel != nil {
-		s.actCancel()
-	}
-	ctx, cancel := context.WithCancel(callerCtx)
-
-	md, ok := metadata.FromIncomingContext(callerCtx)
-	if ok {
-		ctx = metadata.NewOutgoingContext(ctx, md)
+	activeProf, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		log.Errorf("failed to get active profile state: %v", err)
+		return nil, fmt.Errorf("failed to get active profile state: %w", err)
 	}

-	s.actCancel = cancel
-	s.mutex.Unlock()
-
-	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
-		log.Warnf(errRestoreResidualState, err)
+	// Privilege gate: same restrictions as SetConfig, since LoginRequest can carry
+	// the same fields. It runs before anything here changes daemon state, so a
+	// refused login neither switches the profile nor cancels a login already in
+	// progress, and it reads the profile the request targets, which is the one the
+	// switch below would activate.
+	stored, err := s.storedLoginConfig(activeProf, msg)
+	if err != nil {
+		return nil, err
+	}
+	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
+		return nil, err
 	}

 	state := internal.CtxGetState(s.rootCtx)
@@ -563,23 +584,16 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		}
 	}()

-	activeProf, err := s.profileManager.GetActiveProfileState()
+	ctx, activeProf, err := s.authorizeAndPrepareLogin(callerCtx, msg, activeProf)
 	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
-	}
-
-	if msg.ProfileName != nil {
-		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
-			log.Errorf("failed to switch profile: %v", err)
-			return nil, err
+		// The RPC boundary is where this gets recorded: nothing logs handler
+		// errors for us, and a caller that retries would otherwise leave no
+		// trace in the daemon log. A refusal is skipped because the gate has
+		// already logged the decision, with the caller's identity.
+		if gstatus.Code(err) != codes.PermissionDenied {
+			log.Errorf("failed to prepare login: %v", err)
 		}
-	}
-
-	activeProf, err = s.profileManager.GetActiveProfileState()
-	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+		return nil, err
 	}

 	log.Infof("active profile: %s for %s", activeProf.ID, activeProf.Username)
@@ -593,11 +607,6 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro

 	s.mutex.Unlock()

-	if err := persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
-		log.Errorf("failed to persist login overrides: %v", err)
-		return nil, fmt.Errorf("persist login overrides: %w", err)
-	}
-
 	config, _, err := s.getConfig(activeProf)
 	if err != nil {
 		log.Errorf("failed to get active profile config: %v", err)
@@ -980,6 +989,63 @@ func (s *Server) waitForUp(callerCtx context.Context) (*proto.UpResponse, error)
 	}
 }

+// storedProfileConfig loads the on-disk config of the profile a request
+// targets, so a privileged-change decision can be made against the values the
+// profile currently holds. A profile that has no config file yet yields nil,
+// which every caller must read as "nothing enabled yet".
+func (s *Server) storedProfileConfig(handle, username string) (*profilemanager.Config, error) {
+	resolved, err := s.resolveProfileHandle(handle, username)
+	if err != nil {
+		return nil, err
+	}
+
+	path := resolved.Path
+	if path == "" {
+		path = profilemanager.DefaultConfigPath
+	}
+
+	return s.storedConfigAtPath(path)
+}
+
+// storedLoginConfig loads the on-disk config of the profile a login request
+// targets: the one it names, or the active one when it names none. Used to decide
+// a privileged change before the request is allowed to switch profiles.
+func (s *Server) storedLoginConfig(activeProf *profilemanager.ActiveProfileState, msg *proto.LoginRequest) (*profilemanager.Config, error) {
+	if msg.ProfileName == nil {
+		cfgPath, err := activeProf.FilePath()
+		if err != nil {
+			return nil, fmt.Errorf("active profile file path: %w", err)
+		}
+		return s.storedConfigAtPath(cfgPath)
+	}
+
+	// Mirrors switchProfileIfNeeded: the default profile resolves without a
+	// username, so this reads the same profile the switch would activate.
+	handle := *msg.ProfileName
+	username := ""
+	if handle != profilemanager.DefaultProfileName {
+		username = msg.GetUsername()
+	}
+	return s.storedProfileConfig(handle, username)
+}
+
+// storedConfigAtPath reads a profile config file, yielding nil when it does not
+// exist yet.
+func (s *Server) storedConfigAtPath(path string) (*profilemanager.Config, error) {
+	if _, err := os.Stat(path); err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil //nolint:nilnil
+		}
+		return nil, fmt.Errorf("stat profile config: %w", err)
+	}
+
+	cfg, err := profilemanager.GetConfig(path)
+	if err != nil {
+		return nil, fmt.Errorf("read profile config: %w", err)
+	}
+	return cfg, nil
+}
+
 // resolveProfileHandle resolves a wire-level profile handle (display
 // name, ID, or unique ID prefix) to a concrete profile. Returns gRPC
 // status errors so handlers can return them directly.
@@ -1197,6 +1263,12 @@ func (s *Server) handleProfileLogout(ctx context.Context, msg *proto.LogoutReque

 	if err := s.logoutFromProfile(ctx, resolved); err != nil {
 		log.Errorf("failed to logout from profile %s: %v", resolved.ID, err)
+		// A refused deregistration is already a status error carrying the reason
+		// and the command to run; rewrapping it as Internal would flatten both
+		// into a gRPC dump for the user.
+		if _, isStatus := gstatus.FromError(err); isStatus {
+			return nil, err
+		}
 		return nil, gstatus.Errorf(codes.Internal, "logout: %v", err)
 	}

@@ -1318,6 +1390,13 @@ func (s *Server) sendLogoutRequest(ctx context.Context) error {
 }

 func (s *Server) sendLogoutRequestWithConfig(ctx context.Context, config *profilemanager.Config) error {
+	// Privilege gate: deregistering frees this machine's key to be registered
+	// against another management server, which is only restricted while the SSH
+	// server makes that a privilege handover.
+	if err := requirePrivilegeForDeregistration(ctx, config); err != nil {
+		return err
+	}
+
 	key, err := wgtypes.ParseKey(config.PrivateKey)
 	if err != nil {
 		return fmt.Errorf("parse private key: %w", err)
@@ -2063,7 +2142,10 @@ func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequ
 	}

 	if err := s.logoutFromProfile(ctx, resolved); err != nil {
-		log.Warnf("failed to logout from profile %s before removal: %v", resolved.ID, err)
+		// Deregistration is best-effort here: the local profile is removed
+		// either way, so an unprivileged caller leaves the peer registered on
+		// the management server rather than being blocked from removing it.
+		log.Warnf("removing profile %s locally without deregistering it: %v", resolved.ID, err)
 	}

 	if err := s.profileManager.RemoveProfile(resolved.ID, msg.Username); err != nil {
@@ -2360,6 +2442,69 @@ func sendTerminalNotification() error {

 // persistLoginOverrides writes management URL and pre-shared key from a LoginRequest to the
 // active profile config so that subsequent reads pick them up. Empty/nil values are ignored.
+// afterLoginPreCheck is a seam for tests to run a concurrent config change
+// between Login's first privilege check and the authoritative one.
+var afterLoginPreCheck func()
+
+// authorizeAndPrepareLogin makes the authoritative privilege decision for a login
+// and, when it passes, carries out every state change that decision authorizes:
+// cancelling an login already in progress, switching to the requested profile, and
+// persisting the config overrides the request carries.
+//
+// All of it happens under guardedConfigMu, which SetConfig also holds across its
+// own check and write. Login's earlier check refuses the ordinary case before any
+// of this is reached; this one exists because that check is not synchronized
+// against a concurrent privileged request that enables the SSH server, and a
+// caller refused here must not have cancelled or switched anything either.
+func (s *Server) authorizeAndPrepareLogin(callerCtx context.Context, msg *proto.LoginRequest, activeProf *profilemanager.ActiveProfileState) (context.Context, *profilemanager.ActiveProfileState, error) {
+	if afterLoginPreCheck != nil {
+		afterLoginPreCheck()
+	}
+
+	s.guardedConfigMu.Lock()
+	defer s.guardedConfigMu.Unlock()
+
+	stored, err := s.storedLoginConfig(activeProf, msg)
+	if err != nil {
+		return nil, nil, err
+	}
+	if err := requirePrivilegeForConfigChange(callerCtx, stored, privilegedChangeFromLogin(msg)); err != nil {
+		return nil, nil, err
+	}
+
+	s.mutex.Lock()
+	if s.actCancel != nil {
+		s.actCancel()
+	}
+	ctx, cancel := context.WithCancel(callerCtx)
+	if md, ok := metadata.FromIncomingContext(callerCtx); ok {
+		ctx = metadata.NewOutgoingContext(ctx, md)
+	}
+	s.actCancel = cancel
+	s.mutex.Unlock()
+
+	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+		log.Warnf(errRestoreResidualState, err)
+	}
+
+	if msg.ProfileName != nil {
+		if _, err := s.switchProfileIfNeeded(*msg.ProfileName, msg.Username, activeProf); err != nil {
+			return nil, nil, fmt.Errorf("switch profile: %w", err)
+		}
+	}
+
+	activeProf, err = s.profileManager.GetActiveProfileState()
+	if err != nil {
+		return nil, nil, fmt.Errorf("active profile state: %w", err)
+	}
+
+	if err := persistLoginOverrides(activeProf, msg.ManagementUrl, msg.OptionalPreSharedKey); err != nil {
+		return nil, nil, fmt.Errorf("persist login overrides: %w", err)
+	}
+
+	return ctx, activeProf, nil
+}
+
 func persistLoginOverrides(activeProf *profilemanager.ActiveProfileState, managementURL string, preSharedKey *string) error {
 	if preSharedKey != nil && *preSharedKey == "" {
 		preSharedKey = nil
--- a/client/server/setconfig_mdm_test.go
+++ b/client/server/setconfig_mdm_test.go
@@ -66,7 +66,11 @@ func setupServerWithProfile(t *testing.T) (s *Server, ctx context.Context, profN
 		Username: currUser.Username,
 	}))

-	ctx = context.Background()
+	// The privileged-change gate reads the caller's kernel identity from the
+	// context, which a real caller gets from the daemon's transport credentials.
+	// This test drives the handler directly, so it stands in for a root caller;
+	// without an identity the gate would (correctly) refuse the SSH fields.
+	ctx = privilegedTestCtx()
 	s = New(ctx, "console", "", false, false, false, false)
 	return s, ctx, profName, currUser.Username, cfgPath
 }
--- a/client/server/setconfig_test.go
+++ b/client/server/setconfig_test.go
@@ -1,7 +1,6 @@
 package server

 import (
-	"context"
 	"os/user"
 	"path/filepath"
 	"reflect"
@@ -52,7 +51,11 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	})
 	require.NoError(t, err)

-	ctx := context.Background()
+	// The privileged-change gate reads the caller's kernel identity from the
+	// context, which a real caller gets from the daemon's transport credentials.
+	// This test drives the handler directly, so it stands in for a root caller;
+	// without an identity the gate would (correctly) refuse the SSH fields.
+	ctx := privilegedTestCtx()
 	s := New(ctx, "console", "", false, false, false, false)

 	rosenpassEnabled := true
--- a/client/server/ssh_gate.go
+++ b/client/server/ssh_gate.go
@@ -0,0 +1,282 @@
+package server
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"runtime"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/util"
+)
+
+// The daemon runs as root/LocalSystem, so a handful of config changes cross the
+// user-to-root boundary and are restricted to privileged callers:
+//
+//   - Enabling SSH root login, or disabling SSH authentication, turns the
+//     daemon's SSH server into a root (or unauthenticated) shell.
+//   - Enabling the SSH server at all is what makes the above reachable, and a
+//     profile the caller owns is not a privilege they hold.
+//   - While the SSH server is enabled, repointing the profile at another
+//     management identity hands SSH authorization decisions, including which
+//     keys and users are accepted, to whoever controls that identity. Changing
+//     the management URL and deregistering the peer are both ways to do that.
+//
+// Everything else stays unauthenticated, so this is not an authorization model:
+// it only refuses the changes that would let a local user become root. A caller
+// whose identity cannot be established is refused as well.
+
+// privilegedConfigChange is the subset of a config request that crosses the
+// user-to-root boundary. Fields are nil or empty when the request leaves them
+// untouched.
+type privilegedConfigChange struct {
+	managementURL    string
+	serverSSHAllowed *bool
+	enableSSHRoot    *bool
+	disableSSHAuth   *bool
+}
+
+func privilegedChangeFromSetConfig(msg *proto.SetConfigRequest) privilegedConfigChange {
+	return privilegedConfigChange{
+		managementURL:    msg.GetManagementUrl(),
+		serverSSHAllowed: msg.ServerSSHAllowed,
+		enableSSHRoot:    msg.EnableSSHRoot,
+		disableSSHAuth:   msg.DisableSSHAuth,
+	}
+}
+
+func privilegedChangeFromLogin(msg *proto.LoginRequest) privilegedConfigChange {
+	return privilegedConfigChange{
+		managementURL:    msg.GetManagementUrl(),
+		serverSSHAllowed: msg.ServerSSHAllowed,
+		enableSSHRoot:    msg.EnableSSHRoot,
+		disableSSHAuth:   msg.DisableSSHAuth,
+	}
+}
+
+// requirePrivilegeForConfigChange refuses the privileged parts of a config
+// change when the caller is not root/administrator. stored is the profile's
+// current config, or nil when it has none yet.
+//
+// Each check compares against the stored value so that a request restating a
+// value it does not change is never refused: a UI that submits the whole
+// settings form must not start failing once an administrator has enabled SSH.
+func requirePrivilegeForConfigChange(ctx context.Context, stored *profilemanager.Config, change privilegedConfigChange) error {
+	if enables(storedFlag(stored, func(c *profilemanager.Config) *bool { return c.EnableSSHRoot }), change.enableSSHRoot) {
+		return denyPrivileged(ctx, "enabling SSH root login", ipcauth.UpCommand("--enable-ssh-root"))
+	}
+
+	if enables(storedFlag(stored, func(c *profilemanager.Config) *bool { return c.DisableSSHAuth }), change.disableSSHAuth) {
+		return denyPrivileged(ctx, "disabling SSH authentication", ipcauth.UpCommand("--disable-ssh-auth"))
+	}
+
+	if enables(sshServerCurrentlyAllowed(stored), change.serverSSHAllowed) {
+		return denyPrivileged(ctx, "enabling the NetBird SSH server", ipcauth.UpCommand("--allow-server-ssh"))
+	}
+
+	// Only guard the management binding while the SSH server is enabled: that is
+	// when the management identity decides who may open a shell here.
+	if !sshServerEnabled(stored) {
+		return nil
+	}
+
+	if change.managementURL != "" && !sameManagementURL(stored.ManagementURL, change.managementURL) {
+		return denyPrivileged(ctx,
+			"changing the management URL while the NetBird SSH server is enabled",
+			ipcauth.UpCommand("-m "+change.managementURL))
+	}
+
+	return nil
+}
+
+// requirePrivilegeForDeregistration refuses to deregister the peer from the
+// management server when the caller is not privileged and the profile has the
+// SSH server enabled. Deregistering frees the peer's key to be registered
+// against another management identity, which is the same handover the
+// management URL check refuses.
+//
+// Callers that treat deregistration as best-effort (profile removal) continue
+// without it; callers that were asked to deregister surface the error.
+func requirePrivilegeForDeregistration(ctx context.Context, cfg *profilemanager.Config) error {
+	if !sshServerEnabled(cfg) {
+		return nil
+	}
+
+	return denyPrivileged(ctx,
+		"deregistering this peer while the NetBird SSH server is enabled",
+		ipcauth.ElevatedCommand("netbird logout"))
+}
+
+// denyPrivileged returns nil when the caller is privileged, and otherwise a
+// PermissionDenied whose message names the action and the command that performs
+// it with the privileges it needs. The same summary and command ride along as an
+// ErrorInfo detail so the CLI and the UI can present them without parsing text.
+//
+// action reads as the subject of a sentence ("enabling SSH root login"), and
+// command is the equivalent command, already elevated for the platform.
+func denyPrivileged(ctx context.Context, action, command string) error {
+	id, ok := ipcauth.CallerIdentity(ctx)
+	if !ok {
+		log.Warnf("denying %s: the caller's identity cannot be verified on this control channel", action)
+		return privilegeError(unidentifiedSummary(action), reinstallCommand())
+	}
+
+	if ipcauth.IsPrivilegedCaller(id) {
+		log.Infof("allowing %s for privileged caller %s", action, id)
+		return nil
+	}
+
+	log.Warnf("denying %s for unprivileged caller %s", action, id)
+	actor, command := requiredActor(command)
+	return privilegeError(privilegeSummary(action, actor), command)
+}
+
+// requiredActor names who may perform the operation and adjusts the command to
+// match. A daemon that is not itself privileged delegates to its own identity, so
+// telling that host's user to become root is wrong twice over: root is not what the
+// daemon checks for, and a rootless container has neither root nor sudo.
+func requiredActor(command string) (string, string) {
+	self, delegates := ipcauth.SelfDelegatesTo()
+	if !delegates {
+		return ipcauth.PrivilegedActor(), command
+	}
+	return fmt.Sprintf("the user the daemon runs as (%s)", self), strings.ReplaceAll(command, "sudo ", "")
+}
+
+// privilegeError builds the PermissionDenied carrying summary and command.
+func privilegeError(summary, command string) error {
+	st := gstatus.New(codes.PermissionDenied, fmt.Sprintf("%s\n\n%s", summary, command))
+
+	detailed, err := st.WithDetails(&errdetails.ErrorInfo{
+		Reason: ipcauth.ErrorReasonPrivilegeRequired,
+		Domain: ipcauth.ErrorDomain,
+		Metadata: map[string]string{
+			ipcauth.ErrorMetaSummary: summary,
+			ipcauth.ErrorMetaCommand: command,
+		},
+	})
+	if err != nil {
+		log.Debugf("attach privilege error detail: %v", err)
+		return st.Err()
+	}
+	return detailed.Err()
+}
+
+// privilegeSummary states what is refused and what it needs, in one sentence
+// that reads the same in a dialog and in a terminal.
+func privilegeSummary(action, actor string) string {
+	return fmt.Sprintf("%s requires %s.", capitalize(action), actor)
+}
+
+// unidentifiedSummary covers a control channel that carries no caller identity.
+// Elevating does not help there, so it points at the daemon's socket instead.
+func unidentifiedSummary(action string) string {
+	return fmt.Sprintf("%s requires %s, and the daemon cannot verify who is calling over its current socket. "+
+		"Reinstall the service on a socket that carries the caller's identity.", capitalize(action), ipcauth.PrivilegedActor())
+}
+
+// reinstallCommand is the command that moves the daemon onto a socket whose
+// callers can be identified.
+func reinstallCommand() string {
+	if runtime.GOOS == "windows" {
+		return fmt.Sprintf("netbird service install --daemon-addr %s", daemonaddr.WindowsPipeAddr)
+	}
+	return "sudo netbird service install --daemon-addr unix:///var/run/netbird.sock"
+}
+
+func capitalize(s string) string {
+	if s == "" {
+		return s
+	}
+	return strings.ToUpper(s[:1]) + s[1:]
+}
+
+// enables reports whether requested turns a flag on that is currently off. A
+// request that restates the stored value, or turns the flag off, is not a
+// privileged change.
+func enables(stored, requested *bool) bool {
+	if requested == nil || !*requested {
+		return false
+	}
+	return stored == nil || !*stored
+}
+
+// storedFlag reads a flag from the stored config, tolerating a config that does
+// not exist yet.
+func storedFlag(cfg *profilemanager.Config, get func(*profilemanager.Config) *bool) *bool {
+	if cfg == nil {
+		return nil
+	}
+	return get(cfg)
+}
+
+// sshServerEnabled reports whether the profile currently runs the SSH server.
+//
+// A nil flag means ON, matching what the engine does with the same config
+// (util.ReturnBoolWithDefaultTrue in internal/connect.go, kept for configs written
+// before the flag existed). Reading it as OFF here would open the management-URL
+// and deregistration guards on exactly those legacy hosts, whose SSH server is
+// running. Configs loaded through profilemanager have already been materialised by
+// apply(), so this is the same answer by a route that does not depend on that.
+func sshServerEnabled(cfg *profilemanager.Config) bool {
+	if cfg == nil {
+		return false
+	}
+	return util.ReturnBoolWithDefaultTrue(cfg.ServerSSHAllowed)
+}
+
+// sshServerCurrentlyAllowed is the value an enable request is compared against. It
+// shares sshServerEnabled's nil-means-on default, so restating "on" for a legacy
+// config is correctly seen as no change.
+func sshServerCurrentlyAllowed(cfg *profilemanager.Config) *bool {
+	enabled := sshServerEnabled(cfg)
+	if cfg == nil {
+		return nil
+	}
+	return &enabled
+}
+
+// sameManagementURL reports whether requested addresses the same management
+// server as stored, comparing scheme, host and effective port so that an
+// equivalent spelling ("https://api.netbird.io" for a stored
+// "https://api.netbird.io:443") is not treated as a change. It fails closed:
+// anything unparseable counts as a change and therefore needs privilege.
+func sameManagementURL(stored *url.URL, requested string) bool {
+	if stored == nil {
+		return false
+	}
+
+	// Normalise the requested URL through the config layer's own parser, so the
+	// comparison cannot drift from how the value would actually be stored.
+	parsed, err := profilemanager.ParseServiceURL("Management URL", requested)
+	if err != nil {
+		return false
+	}
+
+	return stored.Scheme == parsed.Scheme &&
+		stored.Hostname() == parsed.Hostname() &&
+		effectivePort(stored) == effectivePort(parsed)
+}
+
+func effectivePort(u *url.URL) string {
+	if port := u.Port(); port != "" {
+		return port
+	}
+	switch u.Scheme {
+	case "https":
+		return "443"
+	case "http":
+		return "80"
+	default:
+		return ""
+	}
+}
--- a/client/server/ssh_gate_test.go
+++ b/client/server/ssh_gate_test.go
@@ -0,0 +1,348 @@
+package server
+
+import (
+	"context"
+	"net/url"
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/credentials"
+	"google.golang.org/grpc/peer"
+	gstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+)
+
+// ctxWithIdentity builds a request context carrying the identity the transport
+// credentials would have attached.
+func ctxWithIdentity(id ipcauth.Identity) context.Context {
+	return peer.NewContext(context.Background(), &peer.Peer{
+		AuthInfo: ipcauth.AuthInfo{
+			CommonAuthInfo: credentials.CommonAuthInfo{SecurityLevel: credentials.NoSecurity},
+			Identity:       id,
+		},
+	})
+}
+
+// unprivUID is deliberately not this process's own uid. An unprivileged daemon
+// treats a caller sharing its identity as privileged (rootless containers), and
+// the test binary would otherwise stand in for both the daemon and the caller.
+// os.Geteuid returns -1 on Windows, where identities are SIDs instead and this is
+// unused.
+var unprivUID = uint32(os.Geteuid() + 1)
+
+// The fabricated identities have to be shaped like the platform's: a uid says
+// nothing on Windows, and a zero uid there would read as root and be privileged.
+func rootCtx() context.Context { return ctxWithIdentity(privilegedIdentity()) }
+func userCtx() context.Context { return ctxWithIdentity(unprivilegedIdentity()) }
+
+func privilegedIdentity() ipcauth.Identity {
+	if runtime.GOOS == "windows" {
+		// LocalSystem, which is what the Windows service account is.
+		return ipcauth.Identity{SID: "S-1-5-18"}
+	}
+	return ipcauth.Identity{UID: 0}
+}
+
+func unprivilegedIdentity() ipcauth.Identity {
+	if runtime.GOOS == "windows" {
+		// A plain user SID: no groups, so no BUILTIN\Administrators, and not
+		// elevated.
+		return ipcauth.Identity{SID: "S-1-5-21-1-2-3-1001"}
+	}
+	return ipcauth.Identity{UID: unprivUID, GID: unprivUID}
+}
+func noIdentityCtx() context.Context { return context.Background() }
+
+func boolPtr(v bool) *bool { return &v }
+
+func mustURL(t *testing.T, raw string) *url.URL {
+	t.Helper()
+	u, err := url.Parse(raw)
+	if err != nil {
+		t.Fatalf("parse %q: %v", raw, err)
+	}
+	return u
+}
+
+func assertDenied(t *testing.T, err error) {
+	t.Helper()
+	if err == nil {
+		t.Fatal("expected the change to be refused, got nil")
+	}
+	st := gstatus.Convert(err)
+	if st.Code() != codes.PermissionDenied {
+		t.Fatalf("code = %v, want PermissionDenied", st.Code())
+	}
+	// The refusal must be machine-readable: the CLI and the UI render the
+	// summary and command from the detail rather than parsing the message.
+	var info *errdetails.ErrorInfo
+	for _, d := range st.Details() {
+		if got, ok := d.(*errdetails.ErrorInfo); ok {
+			info = got
+		}
+	}
+	if info == nil {
+		t.Fatal("refusal carries no ErrorInfo detail")
+	}
+	if info.GetReason() != ipcauth.ErrorReasonPrivilegeRequired || info.GetDomain() != ipcauth.ErrorDomain {
+		t.Fatalf("detail = %s/%s, want %s/%s", info.GetDomain(), info.GetReason(), ipcauth.ErrorDomain, ipcauth.ErrorReasonPrivilegeRequired)
+	}
+	if info.GetMetadata()[ipcauth.ErrorMetaSummary] == "" {
+		t.Error("detail carries no summary")
+	}
+	if info.GetMetadata()[ipcauth.ErrorMetaCommand] == "" {
+		t.Error("detail carries no command")
+	}
+}
+
+func assertAllowed(t *testing.T, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatalf("expected the change to be allowed, got %v", err)
+	}
+}
+
+func TestRequirePrivilegeForConfigChange_SSHFlags(t *testing.T) {
+	tests := []struct {
+		name       string
+		stored     *profilemanager.Config
+		change     privilegedConfigChange
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:     "enabling the ssh server unprivileged is refused",
+			stored:   &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+			change:   privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:       "enabling the ssh server as root is allowed",
+			stored:     &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+			change:     privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+			privileged: true,
+		},
+		{
+			name:   "restating an already enabled ssh server is not a change",
+			stored: &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			change: privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+		},
+		{
+			name:   "turning the ssh server off is not guarded",
+			stored: &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			change: privilegedConfigChange{serverSSHAllowed: boolPtr(false)},
+		},
+		{
+			name:     "a profile with no config yet counts as off, so enabling is refused",
+			stored:   nil,
+			change:   privilegedConfigChange{serverSSHAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:     "enabling ssh root login unprivileged is refused",
+			stored:   &profilemanager.Config{EnableSSHRoot: boolPtr(false)},
+			change:   privilegedConfigChange{enableSSHRoot: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:   "restating ssh root login is not a change",
+			stored: &profilemanager.Config{EnableSSHRoot: boolPtr(true)},
+			change: privilegedConfigChange{enableSSHRoot: boolPtr(true)},
+		},
+		{
+			name:   "turning ssh root login off is not guarded",
+			stored: &profilemanager.Config{EnableSSHRoot: boolPtr(true)},
+			change: privilegedConfigChange{enableSSHRoot: boolPtr(false)},
+		},
+		{
+			name:     "disabling ssh authentication unprivileged is refused",
+			stored:   &profilemanager.Config{DisableSSHAuth: boolPtr(false)},
+			change:   privilegedConfigChange{disableSSHAuth: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:   "re-enabling ssh authentication is not guarded",
+			stored: &profilemanager.Config{DisableSSHAuth: boolPtr(true)},
+			change: privilegedConfigChange{disableSSHAuth: boolPtr(false)},
+		},
+		{
+			name:   "a request that touches none of the guarded fields is allowed",
+			stored: &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+			change: privilegedConfigChange{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForConfigChange(ctx, tt.stored, tt.change)
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+func TestRequirePrivilegeForConfigChange_ManagementURL(t *testing.T) {
+	sshOn := func(raw string) *profilemanager.Config {
+		return &profilemanager.Config{ServerSSHAllowed: boolPtr(true), ManagementURL: mustURL(t, raw)}
+	}
+	sshOff := func(raw string) *profilemanager.Config {
+		return &profilemanager.Config{ServerSSHAllowed: boolPtr(false), ManagementURL: mustURL(t, raw)}
+	}
+
+	tests := []struct {
+		name       string
+		stored     *profilemanager.Config
+		requested  string
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:      "moving the binding while ssh is enabled is refused",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://attacker.example.com:443",
+			wantDeny:  true,
+		},
+		{
+			name:       "moving the binding as root is allowed",
+			stored:     sshOn("https://api.netbird.io:443"),
+			requested:  "https://selfhosted.example.com:443",
+			privileged: true,
+		},
+		{
+			name:      "the same url restated is not a change",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://api.netbird.io:443",
+		},
+		{
+			name:      "an equivalent spelling of the same url is not a change",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://api.netbird.io",
+		},
+		{
+			name:      "an equivalent spelling with an explicit http port is not a change",
+			stored:    sshOn("http://mgmt.internal:80"),
+			requested: "http://mgmt.internal",
+		},
+		{
+			name:      "a different port on the same host is a change",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "https://api.netbird.io:8443",
+			wantDeny:  true,
+		},
+		{
+			name:      "a different scheme on the same host is a change",
+			stored:    sshOn("https://mgmt.internal:443"),
+			requested: "http://mgmt.internal:443",
+			wantDeny:  true,
+		},
+		{
+			name:      "with ssh disabled the binding is not guarded at all",
+			stored:    sshOff("https://api.netbird.io:443"),
+			requested: "https://attacker.example.com:443",
+		},
+		{
+			name:      "an unparseable url fails closed",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "ht tp://%zz",
+			wantDeny:  true,
+		},
+		{
+			name:      "an empty url leaves the binding alone",
+			stored:    sshOn("https://api.netbird.io:443"),
+			requested: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForConfigChange(ctx, tt.stored, privilegedConfigChange{managementURL: tt.requested})
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+// A caller the daemon cannot identify must be refused, not trusted: that is the
+// state on a TCP daemon socket, where no peer credentials exist.
+func TestRequirePrivilegeForConfigChange_UnidentifiedCallerIsRefused(t *testing.T) {
+	err := requirePrivilegeForConfigChange(noIdentityCtx(),
+		&profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+		privilegedConfigChange{serverSSHAllowed: boolPtr(true)})
+	assertDenied(t, err)
+
+	// The guidance must point at the socket rather than at sudo, since elevating
+	// would not help.
+	st := gstatus.Convert(err)
+	if !strings.Contains(st.Message(), "service install") {
+		t.Errorf("message %q does not tell the operator how to fix the socket", st.Message())
+	}
+}
+
+func TestRequirePrivilegeForDeregistration(t *testing.T) {
+	tests := []struct {
+		name       string
+		cfg        *profilemanager.Config
+		privileged bool
+		wantDeny   bool
+	}{
+		{
+			name:     "deregistering while ssh is enabled is refused",
+			cfg:      &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			wantDeny: true,
+		},
+		{
+			name:       "deregistering while ssh is enabled is allowed for root",
+			cfg:        &profilemanager.Config{ServerSSHAllowed: boolPtr(true)},
+			privileged: true,
+		},
+		{
+			name: "deregistering with ssh disabled is not guarded",
+			cfg:  &profilemanager.Config{ServerSSHAllowed: boolPtr(false)},
+		},
+		{
+			name: "deregistering a profile with no config is not guarded",
+			cfg:  nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := userCtx()
+			if tt.privileged {
+				ctx = rootCtx()
+			}
+			err := requirePrivilegeForDeregistration(ctx, tt.cfg)
+			if tt.wantDeny {
+				assertDenied(t, err)
+				return
+			}
+			assertAllowed(t, err)
+		})
+	}
+}
+
+// privilegedTestCtx is the context a handler-level test should use when it is
+// standing in for a root/administrator caller. Tests that drive the handlers
+// directly have no transport credentials, and the privileged-change gate refuses
+// a caller it cannot identify.
+func privilegedTestCtx() context.Context { return rootCtx() }
--- a/client/ssh/client/client.go
+++ b/client/ssh/client/client.go
@@ -9,7 +9,6 @@ import (
 	"path/filepath"
 	"runtime"
 	"strconv"
-	"strings"
 	"time"

 	log "github.com/sirupsen/logrus"
@@ -17,7 +16,6 @@ import (
 	"golang.org/x/crypto/ssh/knownhosts"
 	"golang.org/x/term"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"

 	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -32,7 +30,7 @@ const (
 	// DefaultDaemonAddr is the default address for the NetBird daemon
 	DefaultDaemonAddr = "unix:///var/run/netbird.sock"
 	// DefaultDaemonAddrWindows is the default address for the NetBird daemon on Windows
-	DefaultDaemonAddrWindows = "tcp://127.0.0.1:41731"
+	DefaultDaemonAddrWindows = daemonaddr.WindowsPipeAddr
 )

 // Client wraps crypto/ssh Client for simplified SSH operations
@@ -268,7 +266,7 @@ func getDefaultDaemonAddr() string {
 		return addr
 	}
 	if runtime.GOOS == "windows" {
-		return DefaultDaemonAddrWindows
+		return daemonaddr.ResolveDaemonAddr(DefaultDaemonAddrWindows)
 	}
 	return daemonaddr.ResolveUnixDaemonAddr(DefaultDaemonAddr)
 }
@@ -410,12 +408,9 @@ func verifyHostKeyViaDaemon(hostname string, remote net.Addr, key ssh.PublicKey,
 }

 func connectToDaemon(daemonAddr string) (*grpc.ClientConn, error) {
-	addr := strings.TrimPrefix(daemonAddr, "tcp://")
+	target, opts := daemonaddr.DialTarget(daemonAddr)

-	conn, err := grpc.NewClient(
-		addr,
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
-	)
+	conn, err := grpc.NewClient(target, opts...)
 	if err != nil {
 		log.Debugf("failed to create gRPC client for NetBird daemon at %s: %v", daemonAddr, err)
 		return nil, fmt.Errorf("failed to connect to NetBird daemon: %w", err)
--- a/client/ssh/proxy/proxy.go
+++ b/client/ssh/proxy/proxy.go
@@ -9,7 +9,6 @@ import (
 	"net"
 	"os"
 	"strconv"
-	"strings"
 	"sync"
 	"time"

@@ -17,8 +16,8 @@ import (
 	log "github.com/sirupsen/logrus"
 	cryptossh "golang.org/x/crypto/ssh"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"

+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 	nbssh "github.com/netbirdio/netbird/client/ssh"
@@ -55,8 +54,8 @@ type SSHProxy struct {
 }

 func New(daemonAddr, targetHost string, targetPort int, stderr io.Writer, browserOpener func(string) error) (*SSHProxy, error) {
-	grpcAddr := strings.TrimPrefix(daemonAddr, "tcp://")
-	grpcConn, err := grpc.NewClient(grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	target, opts := daemonaddr.DialTarget(daemonAddr)
+	grpcConn, err := grpc.NewClient(target, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("connect to daemon: %w", err)
 	}
--- a/client/ui/frontend/src/components/CopyToClipboard.tsx
+++ b/client/ui/frontend/src/components/CopyToClipboard.tsx
@@ -18,6 +18,9 @@ type CopyToClipboardProps = {
    className?: string;
    iconClassName?: string;
    alwaysShowIcon?: boolean;
+    // wrap lets long content (a shell command, a path) break across lines
+    // instead of being truncated to one line.
+    wrap?: boolean;
    variant?: CopyToClipboardVariant;
    "aria-label"?: string;
    tabIndex?: number;
@@ -32,6 +35,7 @@ export const CopyToClipboard = ({
    className,
    iconClassName,
    alwaysShowIcon = false,
+    wrap = false,
    variant = "default",
    "aria-label": ariaLabel,
    tabIndex = 0,
@@ -83,7 +87,8 @@ export const CopyToClipboard = ({
        >
            <span
                className={cn(
-                    "relative min-w-0 truncate",
+                    "relative min-w-0",
+                    wrap ? "whitespace-pre-wrap break-all" : "truncate",
                    "[&_*]:transition-colors",
                    VARIANT_HOVER[variant],
                )}
--- a/client/ui/frontend/src/contexts/SettingsContext.tsx
+++ b/client/ui/frontend/src/contexts/SettingsContext.tsx
@@ -14,7 +14,7 @@ import type { Config } from "@bindings/services/models.js";
 import i18next from "@/lib/i18n";
 import { useProfile } from "@/contexts/ProfileContext.tsx";
 import { SettingsSkeleton } from "@/modules/settings/SettingsSkeleton.tsx";
-import { errorDialog, formatErrorMessage as errorMessage } from "@/lib/errors.ts";
+import { errorCommand, errorDialog, formatErrorMessage as errorMessage } from "@/lib/errors.ts";

 const SAVE_DEBOUNCE_MS = 400;

@@ -68,6 +68,21 @@ const useSettingsState = () => {
        loadedRef.current = loaded;
    }, [loaded]);

+    // reload re-reads the daemon's config, which is authoritative. Used on
+    // mount, on the daemon's config_changed event, and to undo an optimistic
+    // update the daemon then rejected.
+    const reload = useCallback(
+        async (profileName: string) => {
+            try {
+                const data = await SettingsSvc.GetConfig({ profileName, username });
+                setLoaded({ profileName, data });
+            } catch (e) {
+                console.warn("[SettingsContext] reload after rejected save failed", e);
+            }
+        },
+        [username],
+    );
+
    useEffect(() => {
        if (!profileLoaded || !activeProfileId) return;
        let cancelled = false;
@@ -133,13 +148,20 @@ const useSettingsState = () => {
                    username,
                });
            } catch (e) {
+                // The optimistic update is wrong now: the daemon refused it
+                // (a change that needs elevated privileges, an MDM-managed
+                // field, ...). Snap the controls back to what it actually
+                // holds before reporting, so the UI never shows a value the
+                // daemon does not have.
+                await reload(profileName);
                await errorDialog({
                    Title: i18next.t("settings.error.saveTitle"),
                    Message: errorMessage(e),
+                    Command: errorCommand(e),
                });
            }
        },
-        [username],
+        [username, reload],
    );

    const setField = useCallback(
--- a/client/ui/frontend/src/hooks/usePrivilege.ts
+++ b/client/ui/frontend/src/hooks/usePrivilege.ts
@@ -0,0 +1,32 @@
+import { useEffect, useState } from "react";
+import { Settings as SettingsSvc } from "@bindings/services";
+import { Privilege } from "@bindings/services/models.js";
+
+// usePrivilege reports whether this UI process may perform the changes the daemon
+// restricts to root/administrator. It is answered in-process from our own token
+// with the daemon's own rule, so there is no round-trip and it works while the
+// daemon is down.
+//
+// null means "not known yet", which includes the read having failed. Callers must
+// treat that as "do not restrict": the daemon enforces this regardless, so the
+// only thing a wrong guess here costs is a control that looks unavailable when it
+// is not, or a save that fails with the daemon's own guidance.
+export const usePrivilege = (): Privilege | null => {
+    const [privilege, setPrivilege] = useState<Privilege | null>(null);
+
+    useEffect(() => {
+        let cancelled = false;
+        SettingsSvc.Privilege()
+            .then((p) => {
+                if (!cancelled) setPrivilege(p);
+            })
+            .catch((e: unknown) => {
+                console.warn("[usePrivilege] read failed, not restricting controls", e);
+            });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    return privilege;
+};
--- a/client/ui/frontend/src/lib/errors.ts
+++ b/client/ui/frontend/src/lib/errors.ts
@@ -1,6 +1,6 @@
 import { WindowManager } from "@bindings/services";

-type ClassifiedError = { short: string; long: string };
+type ClassifiedError = { short: string; long: string; command: string };

 const asObject = (v: unknown): Record<string, unknown> | null =>
    v && typeof v === "object" ? (v as Record<string, unknown>) : null;
@@ -22,20 +22,24 @@ const toWailsEnvelope = (e: unknown): Record<string, unknown> | null => {
    return asObject(obj.cause) ?? parseJsonObject(obj.message);
 };

-// Read { short, long } from wherever the classified error sits in the envelope
+// Read { short, long, command } from wherever the classified error sits in the envelope
 const toClassifiedError = (v: unknown): ClassifiedError | null => {
    const o = asObject(v);
    if (!o) return null;
    const short = typeof o.short === "string" ? o.short : "";
    const long = typeof o.long === "string" ? o.long : "";
-    return short || long ? { short, long } : null;
+    const command = typeof o.command === "string" ? o.command : "";
+    return short || long ? { short, long, command } : null;
+};
+
+const classify = (e: unknown): ClassifiedError | null => {
+    const envelope = toWailsEnvelope(e);
+    return toClassifiedError(envelope?.cause) ?? toClassifiedError(envelope);
 };

 export const formatErrorMessage = (e: unknown): string => {
-    const envelope = toWailsEnvelope(e);
-
    // Prefer the structured { short, long } the daemon classifier produced.
-    const classified = toClassifiedError(envelope?.cause) ?? toClassifiedError(envelope);
+    const classified = classify(e);
    if (classified) {
        const { short, long } = classified;
        if (short && long && long !== short) return `${short} Details: ${long}`;
@@ -44,17 +48,26 @@ export const formatErrorMessage = (e: unknown): string => {
    }

    // Unclassified (a service returned the raw daemon error)
+    const envelope = toWailsEnvelope(e);
    const message = envelope?.message;
    if (typeof message === "string" && message) return message;
    if (e instanceof Error) return e.message;
    return String(e);
 };

+// errorCommand returns a command the user can run to complete an operation the
+// daemon refused, when the error carries one (a change that needs elevated
+// privileges). Empty for every other error.
+export const errorCommand = (e: unknown): string => classify(e)?.command ?? "";
+
 export type ErrorDialogOptions = {
    Title: string;
    Message: string;
+    // Command is shown for copying below the message. Defaults to the one the
+    // error carries, so callers only pass it to override.
+    Command?: string;
 };

 export function errorDialog(options: ErrorDialogOptions): Promise<void> {
-    return WindowManager.OpenError(options.Title, options.Message);
+    return WindowManager.OpenError(options.Title, options.Message, options.Command ?? "");
 }
--- a/client/ui/frontend/src/modules/error/ErrorDialog.tsx
+++ b/client/ui/frontend/src/modules/error/ErrorDialog.tsx
@@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next";
 import { useSearchParams } from "react-router-dom";
 import { AlertCircleIcon } from "lucide-react";
 import { Button } from "@/components/buttons/Button";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
 import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
 import { DialogActions } from "@/components/dialog/DialogActions";
 import { DialogDescription } from "@/components/dialog/DialogDescription";
@@ -12,14 +13,22 @@ import { WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";

 const WINDOW_WIDTH = 380;
+// A command needs the room to wrap at a sensible number of characters instead of
+// breaking every few words.
+const WINDOW_WIDTH_WITH_COMMAND = 460;

 export default function ErrorDialog() {
    const { t } = useTranslation();
-    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
    const [params] = useSearchParams();

    const title = params.get("title") || t("window.title.error");
    const message = params.get("message") || "";
+    // Set when the daemon refused an operation that needs elevated privileges:
+    // the command that performs it, offered for copying.
+    const command = params.get("command") || "";
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(
+        command ? WINDOW_WIDTH_WITH_COMMAND : WINDOW_WIDTH,
+    );

    const close = useCallback(() => {
        WindowManager.CloseError().catch(console.error);
@@ -37,15 +46,37 @@ export default function ErrorDialog() {
        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-error-dialog-title"}>
            <SquareIcon icon={AlertCircleIcon} variant={"danger"} />

-            <div className={"flex flex-col items-center gap-1"}>
+            <div className={"flex w-full flex-col items-center gap-1"}>
                <DialogHeading id={"nb-error-dialog-title"} className={"text-balance"}>
                    {title}
                </DialogHeading>
                {message && (
                    <DialogDescription className={"text-balance"}>
-                        <span className={"whitespace-pre-wrap break-words"}>{message}</span>
+                        {/* select-text: the message often names a path, a flag or an
+                            address the user needs to act on. */}
+                        <span className={"select-text whitespace-pre-wrap break-words"}>
+                            {message}
+                        </span>
                    </DialogDescription>
                )}
+                {command && (
+                    <CopyToClipboard
+                        message={command}
+                        alwaysShowIcon
+                        wrap
+                        variant={"bright"}
+                        className={
+                            "mt-2 w-full items-start gap-2 rounded-md bg-nb-gray-930 px-3 py-2 text-left"
+                        }
+                        aria-label={t("common.copy")}
+                    >
+                        <code
+                            className={"select-text break-all font-mono text-xs text-nb-gray-200"}
+                        >
+                            {command}
+                        </code>
+                    </CopyToClipboard>
+                )}
            </div>

            <DialogActions>
--- a/client/ui/frontend/src/modules/settings/SettingsSSH.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsSSH.tsx
@@ -1,4 +1,5 @@
 import { useTranslation } from "react-i18next";
+import { CopyToClipboard } from "@/components/CopyToClipboard";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
 import { HelpText } from "@/components/typography/HelpText";
 import { Input } from "@/components/inputs/Input";
@@ -6,12 +7,50 @@ import { Label } from "@/components/typography/Label";
 import { cn } from "@/lib/cn";
 import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
 import { useSettings } from "@/contexts/SettingsContext.tsx";
-import { type ChangeEvent, useEffect, useId, useState } from "react";
+import { usePrivilege } from "@/hooks/usePrivilege.ts";
+import { Privilege } from "@bindings/services/models.js";
+import { type ChangeEvent, type ReactNode, useEffect, useId, useState } from "react";

 export function SettingsSSH() {
    const { t } = useTranslation();
    const { config, setField } = useSettings();
+    const privilege = usePrivilege();
    const isSSHServerEnabled = config.serverSshAllowed;
+
+    // The daemon restricts only the direction that hands out shells from a process
+    // running as root. So for an unprivileged user a guarded control is either
+    // unavailable (it is off and only they could turn it on) or a one-way switch
+    // (it is on, they may turn it off, but not back on) — say which, either way.
+    //
+    // A null privilege means we could not determine it: leave the control alone
+    // rather than greying it out with nothing to explain why. The daemon enforces
+    // this regardless, and a rejected save reports its own guidance.
+    const guarded = (
+        guardedDirectionActive: boolean,
+        command: (p: Privilege) => string,
+        // inverted marks a control whose guarded direction is switching it off, so
+        // the one-way warning has to read the other way round.
+        inverted = false,
+    ) => {
+        if (!privilege || privilege.privileged) {
+            return { disabled: false, hint: undefined };
+        }
+        const hint = (
+            <PrivilegeHint
+                actor={privilege.actor}
+                command={command(privilege)}
+                oneWay={guardedDirectionActive}
+                inverted={inverted}
+            />
+        );
+        return { disabled: !guardedDirectionActive, hint };
+    };
+
+    const sshServer = guarded(config.serverSshAllowed, (p) => p.allowSshServer);
+    const sshRoot = guarded(config.enableSshRoot, (p) => p.enableSshRoot);
+    // Inverted control: the guarded direction is switching authentication off, so
+    // it is the already-disabled state that is the one-way one.
+    const sshAuth = guarded(config.disableSshAuth, (p) => p.disableSshAuth, true);
    const jwtTtlId = useId();
    const [jwtTtlInput, setJwtTtlInput] = useState(String(config.sshJwtCacheTtl));

@@ -46,9 +85,11 @@ export function SettingsSSH() {
                <FancyToggleSwitch
                    value={config.serverSshAllowed}
                    onChange={(v) => setField("serverSshAllowed", v)}
+                    disabled={sshServer.disabled}
                    label={t("settings.ssh.server.label")}
                    helpText={t("settings.ssh.server.help")}
                />
+                {sshServer.hint}
            </SectionGroup>

            <SectionGroup
@@ -58,9 +99,11 @@ export function SettingsSSH() {
                <FancyToggleSwitch
                    value={config.enableSshRoot}
                    onChange={(v) => setField("enableSshRoot", v)}
+                    disabled={sshRoot.disabled}
                    label={t("settings.ssh.root.label")}
                    helpText={t("settings.ssh.root.help")}
                />
+                {sshRoot.hint}
                <FancyToggleSwitch
                    value={config.enableSshSftp}
                    onChange={(v) => setField("enableSshSftp", v)}
@@ -88,9 +131,11 @@ export function SettingsSSH() {
                <FancyToggleSwitch
                    value={!config.disableSshAuth}
                    onChange={(v) => setField("disableSshAuth", !v)}
+                    disabled={sshAuth.disabled}
                    label={t("settings.ssh.jwt.label")}
                    helpText={t("settings.ssh.jwt.help")}
                />
+                {sshAuth.hint}
                <div
                    className={cn(
                        "flex items-center justify-between gap-6",
@@ -117,3 +162,42 @@ export function SettingsSSH() {
        </>
    );
 }
+
+// PrivilegeHint explains what an unprivileged user can and cannot do with a
+// guarded control, and offers the command that does it with the privileges the
+// daemon requires. oneWay covers the control being in the guarded state already:
+// switching it back is the part that needs privileges.
+function PrivilegeHint({
+    actor,
+    command,
+    oneWay,
+    inverted,
+}: {
+    actor: string;
+    command: string;
+    oneWay: boolean;
+    inverted: boolean;
+}): ReactNode {
+    const { t } = useTranslation();
+    if (!command) return null;
+    return (
+        <div
+            className={
+                "-mt-2 flex flex-col gap-1 rounded-md bg-nb-gray-930 px-3 py-2 text-xs text-nb-gray-300"
+            }
+        >
+            <span>
+                {!oneWay
+                    ? t("settings.ssh.privilege.hint", { actor })
+                    : inverted
+                      ? t("settings.ssh.privilege.oneWayInverted", { actor })
+                      : t("settings.ssh.privilege.oneWay", { actor })}
+            </span>
+            <CopyToClipboard message={command} alwaysShowIcon wrap variant={"bright"}>
+                <code className={"select-text break-all font-mono text-xs text-nb-gray-200"}>
+                    {command}
+                </code>
+            </CopyToClipboard>
+        </div>
+    );
+}
--- a/client/ui/grpc.go
+++ b/client/ui/grpc.go
@@ -5,14 +5,13 @@ package main
 import (
 	"fmt"
 	"runtime"
-	"strings"
 	"sync"
 	"time"

 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
-	"google.golang.org/grpc/credentials/insecure"

+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ui/desktop"
 )
@@ -36,9 +35,10 @@ func (c *Conn) Client() (proto.DaemonServiceClient, error) {
 		return c.client, nil
 	}

-	cc, err := grpc.NewClient(
-		strings.TrimPrefix(c.addr, "tcp://"),
-		grpc.WithTransportCredentials(insecure.NewCredentials()),
+	// Lazy on purpose: grpc.NewClient does not connect here, so a daemon that
+	// is down surfaces as a per-RPC Unavailable instead of blocking the UI.
+	target, opts := daemonaddr.DialTarget(daemonaddr.ResolveDaemonAddr(c.addr))
+	opts = append(opts,
 		grpc.WithUserAgent(desktop.GetUIUserAgent()),
 		// Cap reconnect backoff at 5s; gRPC's default 120s MaxDelay would
 		// leave the UI waiting 30-60s to notice a freshly-started daemon.
@@ -51,6 +51,8 @@ func (c *Conn) Client() (proto.DaemonServiceClient, error) {
 			},
 		}),
 	)
+
+	cc, err := grpc.NewClient(target, opts...)
 	if err != nil {
 		return nil, fmt.Errorf("dial daemon: %w", err)
 	}
@@ -58,10 +60,12 @@ func (c *Conn) Client() (proto.DaemonServiceClient, error) {
 	return c.client, nil
 }

-// DaemonAddr returns the default daemon gRPC address: a Unix socket on Linux/macOS, TCP loopback on Windows.
+// DaemonAddr returns the default daemon gRPC address: a Unix socket on
+// Linux/macOS, a named pipe on Windows. The pipe carries the caller's token,
+// which loopback TCP does not, so the daemon can tell who is calling.
 func DaemonAddr() string {
 	if runtime.GOOS == "windows" {
-		return "tcp://127.0.0.1:41731"
+		return daemonaddr.WindowsPipeAddr
 	}
 	return "unix:///var/run/netbird.sock"
 }
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -1774,5 +1774,17 @@
    "error.unknown": {
        "message": "Operation failed.",
        "description": "Generic fallback error message used when no specific error applies."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requires {actor}. Run this instead:",
+        "description": "Help text under an SSH setting the user cannot change: it needs elevated privileges. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "You can switch this off, but switching it back on needs {actor}:",
+        "description": "Warning under an SSH setting an unprivileged user may disable but not re-enable. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "You can switch this on, but switching it back off needs {actor}:",
+        "description": "Warning under the SSH authentication setting, which an unprivileged user may re-enable but not disable again. {actor} is 'root' on Linux/macOS or 'administrator privileges' on Windows. Followed by a copyable command."
    }
 }
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -96,7 +96,6 @@ func main() {
 		}
 	})

-	settings := services.NewSettings(conn)
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
 	// Update service is a thin Wails-bound facade over it plus the install RPCs.
@@ -117,6 +116,7 @@ func main() {
 	bundle, prefStore, localizer := buildI18n(app)

 	// After bundle + prefStore: both are used to localise daemon errors.
+	settings := services.NewSettings(conn, bundle, prefStore, daemonAddr)
 	connection := services.NewConnection(conn, bundle, prefStore)
 	profileSwitcher := services.NewProfileSwitcher(profiles, connection, daemonFeed)
 	// authsession.Session owns the full extend + dismiss surface the tray
--- a/client/ui/services/errors.go
+++ b/client/ui/services/errors.go
@@ -6,13 +6,30 @@ import (
 	"encoding/json"
 	"strings"

+	"google.golang.org/genproto/googleapis/rpc/errdetails"
 	gcodes "google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"

+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/ui/i18n"
 	"github.com/netbirdio/netbird/client/ui/preferences"
 )

+// privilegeErrorInfo returns the daemon's privilege-refusal detail, if the error
+// carries one.
+func privilegeErrorInfo(err error) (*errdetails.ErrorInfo, bool) {
+	for _, detail := range gstatus.Convert(err).Details() {
+		info, ok := detail.(*errdetails.ErrorInfo)
+		if !ok {
+			continue
+		}
+		if info.GetReason() == ipcauth.ErrorReasonPrivilegeRequired && info.GetDomain() == ipcauth.ErrorDomain {
+			return info, true
+		}
+	}
+	return nil, false
+}
+
 // ErrorTranslator localises daemon errors; runtime impl is *i18n.Bundle.
 type ErrorTranslator interface {
 	Translate(lang i18n.LanguageCode, key string, args ...string) string
@@ -30,6 +47,10 @@ type ClientError struct {
 	Code  string `json:"code"`
 	Short string `json:"short"`
 	Long  string `json:"long"`
+	// Command is a command the user can run to complete the operation
+	// themselves, set when the daemon refused it for want of privileges. The
+	// frontend offers it for copying.
+	Command string `json:"command,omitempty"`
 }

 // Error returns the short message for plain Go callers.
@@ -72,6 +93,24 @@ func (c errorClassifier) classify(err error) *ClientError {
 		msg = st.Message()
 		grpcCode = st.Code()
 	}
+
+	// A refusal for want of privileges carries its own summary and the command
+	// that performs the operation, both written for the user. Surface them
+	// verbatim: no substring guessing, and no localisation of a message the
+	// daemon composed.
+	if info, ok := privilegeErrorInfo(err); ok {
+		summary := info.GetMetadata()[ipcauth.ErrorMetaSummary]
+		if summary == "" {
+			summary = msg
+		}
+		return &ClientError{
+			Code:    "privilege_required",
+			Short:   summary,
+			Long:    summary,
+			Command: info.GetMetadata()[ipcauth.ErrorMetaCommand],
+		}
+	}
+
 	lower := strings.ToLower(msg)

 	code := "unknown"
--- a/client/ui/services/settings.go
+++ b/client/ui/services/settings.go
@@ -7,6 +7,10 @@ import (
 	"fmt"
 	"reflect"

+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/daemonaddr"
+	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
 )

@@ -39,6 +43,19 @@ type Restrictions struct {
 	Features Features  `json:"features"`
 }

+// Privilege tells the frontend whether this process may perform the changes the
+// daemon restricts to root/administrator, and carries the command for each so a
+// disabled control can show the way to do it.
+type Privilege struct {
+	Privileged bool `json:"privileged"`
+	// Actor names what the operation requires ("root", "administrator privileges").
+	Actor string `json:"actor"`
+	// Commands equivalent to the settings the daemon guards, ready to copy.
+	AllowSSHServer string `json:"allowSshServer"`
+	EnableSSHRoot  string `json:"enableSshRoot"`
+	DisableSSHAuth string `json:"disableSshAuth"`
+}
+
 type ConfigParams struct {
 	ProfileName string `json:"profileName"`
 	Username    string `json:"username"`
@@ -106,11 +123,19 @@ type SetConfigParams struct {
 }

 type Settings struct {
-	conn DaemonConn
+	conn       DaemonConn
+	classifier errorClassifier
+	// daemonAddr is where the daemon listens, used to tell whether it runs as
+	// this user and would therefore authorize us: see Privilege.
+	daemonAddr string
 }

-func NewSettings(conn DaemonConn) *Settings {
-	return &Settings{conn: conn}
+func NewSettings(conn DaemonConn, translator ErrorTranslator, prefs LanguagePreference, daemonAddr string) *Settings {
+	return &Settings{
+		conn:       conn,
+		classifier: errorClassifier{translator: translator, prefs: prefs},
+		daemonAddr: daemonAddr,
+	}
 }

 func (s *Settings) GetConfig(ctx context.Context, p ConfigParams) (Config, error) {
@@ -189,8 +214,47 @@ func (s *Settings) SetConfig(ctx context.Context, p SetConfigParams) error {
 		DisableSSHAuth:                p.DisableSSHAuth,
 		SshJWTCacheTTL:                p.SSHJWTCacheTTL,
 	}
-	_, err = cli.SetConfig(ctx, req)
-	return err
+	if _, err := cli.SetConfig(ctx, req); err != nil {
+		// Classified so the frontend gets the daemon's guidance instead of the
+		// gRPC envelope, which is what a refused privileged change looks like.
+		return s.classifier.classify(err)
+	}
+	return nil
+}
+
+// Privilege reports whether this UI process could carry out the changes the
+// daemon restricts to root/administrator, and the command that performs the one
+// users hit in the SSH settings. It applies the daemon's own rule to what it can
+// see locally, so the frontend can present those controls as unavailable up front
+// instead of letting a save fail. No daemon round-trip, so it also works while the
+// daemon is down.
+//
+// Being root or an elevated administrator is one way. The other is running as the
+// daemon's own user while the daemon is unprivileged, which the daemon accepts
+// because such a caller can already rewrite the config it reads; that is the
+// rootless-container and Windows netstack-mode case, and it is read from the
+// ownership of the socket or pipe the daemon created.
+func (s *Settings) Privilege() Privilege {
+	id, err := ipcauth.CurrentProcessIdentity()
+	if err != nil {
+		// Fail closed: report unprivileged, which only ever disables controls.
+		log.Warnf("cannot read this process's identity, treating it as unprivileged: %v", err)
+		return newPrivilege(false)
+	}
+	if id.IsPrivileged() {
+		return newPrivilege(true)
+	}
+	return newPrivilege(daemonaddr.DaemonRunsAsSelf(s.daemonAddr))
+}
+
+func newPrivilege(privileged bool) Privilege {
+	return Privilege{
+		Privileged:     privileged,
+		Actor:          ipcauth.PrivilegedActor(),
+		AllowSSHServer: ipcauth.UpCommand("--allow-server-ssh"),
+		EnableSSHRoot:  ipcauth.UpCommand("--enable-ssh-root"),
+		DisableSSHAuth: ipcauth.UpCommand("--disable-ssh-auth"),
+	}
 }

 func (s *Settings) GetRestrictions(ctx context.Context) (Restrictions, error) {
--- a/client/ui/services/windowmanager.go
+++ b/client/ui/services/windowmanager.go
@@ -393,15 +393,17 @@ func (s *WindowManager) CloseWelcome() {
 	}
 }

-// OpenError shows the custom error dialog; title/message are pre-localised and ride in the
-// start URL. A second error replaces the open one via SetURL. Singleton, destroyed on close.
-func (s *WindowManager) OpenError(title, message string) {
+// OpenError shows the custom error dialog; title/message/command are pre-localised
+// and ride in the start URL. command is optional and, when set, is offered for
+// copying so the user can run the operation the daemon refused. A second error
+// replaces the open one via SetURL. Singleton, destroyed on close.
+func (s *WindowManager) OpenError(title, message, command string) {
 	if ShuttingDown() {
 		return
 	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	startURL := errorDialogURL(title, message)
+	startURL := errorDialogURL(title, message, command)
 	if s.errorDialog == nil {
 		s.errorDialog = s.app.Window.NewWithOptions(
 			DialogWindowOptions("error", s.title("window.title.error"), startURL, s.linuxIcon),
@@ -601,8 +603,8 @@ func (s *WindowManager) getScreenBasedOnCursorPosition() *application.Screen {
 	return nil
 }

-// errorDialogURL builds the error window's start URL with title/message as escaped query params.
-func errorDialogURL(title, message string) string {
+// errorDialogURL builds the error window's start URL with title/message/command as escaped query params.
+func errorDialogURL(title, message, command string) string {
 	q := url.Values{}
 	if title != "" {
 		q.Set("title", title)
@@ -610,6 +612,9 @@ func errorDialogURL(title, message string) string {
 	if message != "" {
 		q.Set("message", message)
 	}
+	if command != "" {
+		q.Set("command", command)
+	}
 	startURL := "/#/dialog/error"
 	if enc := q.Encode(); enc != "" {
 		startURL += "?" + enc
--- a/client/ui/services/windowtheme_windows.go
+++ b/client/ui/services/windowtheme_windows.go
@@ -0,0 +1,14 @@
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/w32"
+
+// Wails assigns w32.AllowDarkModeForWindow only on builds >= 18334 but calls it
+// without a nil check when a window requests the Dark theme, crashing older
+// builds such as Windows Server 2019 (17763). Those builds still get a dark
+// title bar via the pre-20H1 DWM attribute that w32.SetTheme applies, so a
+// no-op stub keeps the Dark theme fully working there.
+func init() {
+	if w32.AllowDarkModeForWindow == nil {
+		w32.AllowDarkModeForWindow = func(w32.HWND, bool) uintptr { return 0 }
+	}
+}
--- a/combined/cmd/config.go
+++ b/combined/cmd/config.go
@@ -76,13 +76,6 @@ type ServerConfig struct {

 	SupportedSyncMessageVersions           *int           `yaml:"supportedSyncMessageVersions,omitempty"`
 	PerAccountSupportedSyncMessageVersions map[string]int `yaml:"perAccountSupportedSyncMessageVersions,omitempty"`
-
-	AgentNetwork AgentNetworkConfig `yaml:"agentNetwork"`
-}
-
-// AgentNetworkConfig contains agent-network (LLM gateway) configuration.
-type AgentNetworkConfig struct {
-	PricingDefaultsFile string `yaml:"pricingDefaultsFile"`
 }

 // TLSConfig contains TLS/HTTPS settings
@@ -730,9 +723,6 @@ func (c *CombinedConfig) ToManagementConfig() (*nbconfig.Config, error) {
 		EmbeddedIdP:                        embeddedIdP,
 		HighestSupportedSyncMessageVersion: c.Server.SupportedSyncMessageVersions,
 		PerAccountHighestSupportedSyncMessageVersion: c.Server.PerAccountSupportedSyncMessageVersions,
-		AgentNetwork: nbconfig.AgentNetwork{
-			PricingDefaultsFile: c.Server.AgentNetwork.PricingDefaultsFile,
-		},
 	}, nil
 }

--- a/combined/cmd/root.go
+++ b/combined/cmd/root.go
@@ -10,7 +10,6 @@ import (
 	"net/http"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -25,7 +24,6 @@ import (
 	"google.golang.org/grpc"

 	"github.com/netbirdio/netbird/encryption"
-	agentnetworkpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	mgmtServer "github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/telemetry"
@@ -290,11 +288,6 @@ func (s *serverInstances) createManagementServer(ctx context.Context, cfg *Combi
 		return fmt.Errorf("failed to ensure encryption key: %w", err)
 	}

-	if err := loadAgentNetworkPricing(ctx, mgmtConfig); err != nil {
-		cleanupSTUNListeners(s.stunListeners)
-		return fmt.Errorf("failed to load agent-network pricing defaults: %w", err)
-	}
-
 	LogConfigInfo(mgmtConfig)

 	s.mgmtSrv, err = createManagementServer(cfg, mgmtConfig)
@@ -629,32 +622,6 @@ func handleRelayWebSocket(w http.ResponseWriter, r *http.Request, acceptFn func(
 	acceptFn(conn)
 }

-// loadAgentNetworkPricing loads the management-side LLM pricing defaults
-// file for the combined server and starts its periodic reloader. An
-// explicitly configured PricingDefaultsFile is required to load (a typo
-// must fail startup rather than silently bill with built-ins the operator
-// believes they replaced); a relative path is resolved against the data
-// directory so a bare filename like "pricing.yaml" lands in the datadir
-// alongside the store. With no path configured, <datadir>/<DefaultFileName>
-// is probed and may be absent (compiled-in defaults serve).
-func loadAgentNetworkPricing(ctx context.Context, mgmtConfig *nbconfig.Config) error {
-	pricingPath := mgmtConfig.AgentNetwork.PricingDefaultsFile
-	required := pricingPath != ""
-	if !required {
-		pricingPath = agentnetworkpricing.DefaultFileName
-	}
-	if !filepath.IsAbs(pricingPath) {
-		pricingPath = filepath.Join(mgmtConfig.Datadir, pricingPath)
-	}
-
-	log.Infof("loading agent-network pricing defaults from %s (required: %v)", pricingPath, required)
-	if err := agentnetworkpricing.LoadFile(pricingPath, required); err != nil {
-		return err
-	}
-	agentnetworkpricing.StartReloader(ctx, agentnetworkpricing.ReloadInterval)
-	return nil
-}
-
 // logConfig prints all configuration parameters for debugging
 func logConfig(cfg *CombinedConfig) {
 	log.Info("=== Configuration ===")
@@ -731,25 +698,6 @@ func logManagementConfig(cfg *CombinedConfig) {
 		log.Infof("    Relay addresses: %v", cfg.Management.Relays.Addresses)
 		log.Infof("    Relay credentials TTL: %s", cfg.Management.Relays.CredentialsTTL)
 	}
-
-	logAgentNetworkConfig(cfg)
-}
-
-func logAgentNetworkConfig(cfg *CombinedConfig) {
-	log.Info("  Agent Network:")
-	pricingPath := cfg.Server.AgentNetwork.PricingDefaultsFile
-	configured := pricingPath != ""
-	if !configured {
-		pricingPath = agentnetworkpricing.DefaultFileName
-	}
-	if !filepath.IsAbs(pricingPath) {
-		pricingPath = filepath.Join(cfg.Management.DataDir, pricingPath)
-	}
-	if configured {
-		log.Infof("    Pricing defaults file: %s", pricingPath)
-	} else {
-		log.Infof("    Pricing defaults file: %s (default, optional)", pricingPath)
-	}
 }

 // logEnvVars logs all NB_ environment variables that are currently set
--- a/combined/config.yaml.example
+++ b/combined/config.yaml.example
@@ -134,16 +134,3 @@ server:
  #   trustedPeers: []                 # CIDRs of trusted peer networks (e.g. ["100.64.0.0/10"])
  #   accessLogRetentionDays: 7        # Days to retain HTTP access logs. 0 (or unset) defaults to 7. Negative values disable cleanup (logs kept indefinitely).
  #   accessLogCleanupIntervalHours: 24 # How often (in hours) to run the access-log cleanup job. 0 (or unset) is treated as "not set" and defaults to 24 hours; cleanup remains enabled. To disable cleanup, set accessLogRetentionDays to a negative value.
-
-  # Agent network (LLM gateway) settings (optional)
-  # agentNetwork:
-  #   # Path to the YAML file holding the default LLM pricing table. A relative
-  #   # path is resolved against dataDir, so a bare filename like "pricing.yaml"
-  #   # lands in the data directory. When empty, {dataDir}/defaults_llm_pricing.yaml
-  #   # is probed; if no file is present the compiled-in defaults are used.
-  #   # Schema: surface ("openai"/"anthropic"/"bedrock") -> model -> rates in USD
-  #   # per 1k tokens (input_per_1k, output_per_1k, and the optional
-  #   # cached_input_per_1k / cache_read_per_1k / cache_creation_per_1k). The file
-  #   # is re-read periodically (mtime poll). An explicitly configured path that
-  #   # fails to load fails startup; runtime reload errors keep the previous table.
-  #   pricingDefaultsFile: "pricing.yaml"
--- a/go.mod
+++ b/go.mod
@@ -30,6 +30,7 @@ require (

 require (
 	github.com/DeRuina/timberjack v1.4.2
+	github.com/Microsoft/go-winio v0.6.2
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.38.3
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1
@@ -133,6 +134,7 @@ require (
 	golang.org/x/term v0.45.0
 	golang.org/x/time v0.15.0
 	google.golang.org/api v0.276.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.7
@@ -156,7 +158,6 @@ require (
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/adrg/xdg v0.5.3 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
@@ -317,7 +318,6 @@ require (
 	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
--- a/infrastructure_files/getting-started-with-dex.sh
+++ b/infrastructure_files/getting-started-with-dex.sh
@@ -1,557 +1,19 @@
-#!/bin/bash
+#!/usr/bin/env bash

-set -e
+cat >&2 <<'EOF'
+ERROR: This legacy installation script has been retired and no longer runs.

-# NetBird Getting Started with Dex IDP
-# This script sets up NetBird with Dex as the identity provider
+Dex support is not deprecated. For new deployments, use getting-started.sh:

-# Sed pattern to strip base64 padding characters
-SED_STRIP_PADDING='s/=//g'
+https://docs.netbird.io/selfhosted/selfhosted-quickstart

-check_docker_compose() {
-  if command -v docker-compose &> /dev/null
-  then
-      echo "docker-compose"
-      return
-  fi
-  if docker compose --help &> /dev/null
-  then
-      echo "docker compose"
-      return
-  fi
+The current installer includes NetBird's embedded Dex-based identity provider.
+Local users and external identity providers can be managed through the
+NetBird Dashboard:

-  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
-  exit 1
-}
+https://docs.netbird.io/selfhosted/identity-providers/local

-check_jq() {
-  if ! command -v jq &> /dev/null
-  then
-    echo "jq is not installed or not in PATH, please install with your package manager. e.g. sudo apt install jq" > /dev/stderr
-    exit 1
-  fi
-  return 0
-}
-
-get_main_ip_address() {
-  if [[ "$OSTYPE" == "darwin"* ]]; then
-    interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
-    ip_address=$(ifconfig "$interface" | grep 'inet ' | awk '{print $2}')
-  else
-    interface=$(ip route | grep default | awk '{print $5}' | head -n 1)
-    ip_address=$(ip addr show "$interface" | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)
-  fi
-
-  echo "$ip_address"
-  return 0
-}
-
-check_nb_domain() {
-  DOMAIN=$1
-  if [[ "$DOMAIN-x" == "-x" ]]; then
-    echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
-    return 1
-  fi
-
-  if [[ "$DOMAIN" == "netbird.example.com" ]]; then
-    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
-    return 1
-  fi
-  return 0
-}
-
-read_nb_domain() {
-  READ_NETBIRD_DOMAIN=""
-  echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
-  read -r READ_NETBIRD_DOMAIN < /dev/tty
-  if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
-    read_nb_domain
-  fi
-  echo "$READ_NETBIRD_DOMAIN"
-  return 0
-}
-
-get_turn_external_ip() {
-  TURN_EXTERNAL_IP_CONFIG="#external-ip="
-  IP=$(curl -s -4 https://jsonip.com | jq -r '.ip')
-  if [[ "x-$IP" != "x-" ]]; then
-    TURN_EXTERNAL_IP_CONFIG="external-ip=$IP"
-  fi
-  echo "$TURN_EXTERNAL_IP_CONFIG"
-  return 0
-}
-
-wait_dex() {
-  set +e
-  echo -n "Waiting for Dex to become ready (via $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN)"
-  counter=1
-  while true; do
-    # Check Dex through Caddy proxy (also validates TLS is working)
-    if curl -sk -f -o /dev/null "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration" 2>/dev/null; then
-      break
-    fi
-    if [[ $counter -eq 60 ]]; then
-      echo ""
-      echo "Taking too long. Checking logs..."
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 caddy
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 dex
-    fi
-    echo -n " ."
-    sleep 2
-    counter=$((counter + 1))
-  done
-  echo " done"
-  set -e
-  return 0
-}
-
-init_environment() {
-  CADDY_SECURE_DOMAIN=""
-  NETBIRD_PORT=80
-  NETBIRD_HTTP_PROTOCOL="http"
-  NETBIRD_RELAY_PROTO="rel"
-  TURN_USER="self"
-  TURN_PASSWORD=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  TURN_MIN_PORT=49152
-  TURN_MAX_PORT=65535
-  TURN_EXTERNAL_IP_CONFIG=$(get_turn_external_ip)
-
-  # Generate secrets for Dex
-  DEX_DASHBOARD_CLIENT_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-
-  # Generate admin password
-  NETBIRD_ADMIN_PASSWORD=$(openssl rand -base64 16 | sed "$SED_STRIP_PADDING")
-
-  if ! check_nb_domain "$NETBIRD_DOMAIN"; then
-    NETBIRD_DOMAIN=$(read_nb_domain)
-  fi
-
-  if [[ "$NETBIRD_DOMAIN" == "use-ip" ]]; then
-    NETBIRD_DOMAIN=$(get_main_ip_address)
-  else
-    NETBIRD_PORT=443
-    CADDY_SECURE_DOMAIN=", $NETBIRD_DOMAIN:$NETBIRD_PORT"
-    NETBIRD_HTTP_PROTOCOL="https"
-    NETBIRD_RELAY_PROTO="rels"
-  fi
-
-  check_jq
-
-  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
-
-  if [[ -f dex.yaml ]]; then
-    echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
-    echo "You can use the following commands:"
-    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml Caddyfile dex.yaml dashboard.env turnserver.conf management.json relay.env"
-    echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
-    exit 1
-  fi
-
-  echo Rendering initial files...
-  render_docker_compose > docker-compose.yml
-  render_caddyfile > Caddyfile
-  render_dex_config > dex.yaml
-  render_dashboard_env > dashboard.env
-  render_management_json > management.json
-  render_turn_server_conf > turnserver.conf
-  render_relay_env > relay.env
-
-  echo -e "\nStarting Dex IDP\n"
-  $DOCKER_COMPOSE_COMMAND up -d caddy dex
-
-  # Wait for Dex to be ready (through caddy proxy)
-  sleep 3
-  wait_dex
-
-  echo -e "\nStarting NetBird services\n"
-  $DOCKER_COMPOSE_COMMAND up -d
-
-  echo -e "\nDone!\n"
-  echo "You can access the NetBird dashboard at $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
-  echo ""
-  echo "Login with the following credentials:"
-  install -m 600 /dev/null .env
-  printf 'Email: admin@%s\nPassword: %s\n' \
-      "$NETBIRD_DOMAIN" "$NETBIRD_ADMIN_PASSWORD" >> .env
-  echo "Email: admin@$NETBIRD_DOMAIN"
-  echo "Password: $NETBIRD_ADMIN_PASSWORD"
-  echo ""
-  echo "Dex admin UI is not available (Dex has no built-in UI)."
-  echo "To add more users, edit dex.yaml and restart: $DOCKER_COMPOSE_COMMAND restart dex"
-  return 0
-}
-
-render_caddyfile() {
-  cat <<EOF
-{
-  debug
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80${CADDY_SECURE_DOMAIN} {
-    import security_headers
-    # Relay
-    reverse_proxy /relay* relay:80
-    # Signal
-    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
-    # Management
-    reverse_proxy /api/* management:80
-    reverse_proxy /management.ManagementService/* h2c://management:80
-    # Dex
-    reverse_proxy /dex/* dex:5556
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+This compatibility notice will be removed in NetBird v0.80.
 EOF
-  return 0
-}

-render_dex_config() {
-  # Generate bcrypt hash of the admin password
-  # Using a simple approach - htpasswd or python if available
-  ADMIN_PASSWORD_HASH=""
-  if command -v htpasswd &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(htpasswd -bnBC 10 "" "$NETBIRD_ADMIN_PASSWORD" | tr -d ':\n')
-  elif command -v python3 &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(python3 -c "import bcrypt; print(bcrypt.hashpw('$NETBIRD_ADMIN_PASSWORD'.encode(), bcrypt.gensalt(rounds=10)).decode())" 2>/dev/null || echo "")
-  fi
-
-  # Fallback to a known hash if we can't generate one
-  if [[ -z "$ADMIN_PASSWORD_HASH" ]]; then
-    # This is hash of "password" - user should change it
-    ADMIN_PASSWORD_HASH='$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W'
-    NETBIRD_ADMIN_PASSWORD="password"
-    echo "Warning: Could not generate password hash. Using default password: password. Please change it in dex.yaml" > /dev/stderr
-  fi
-
-  cat <<EOF
-# Dex configuration for NetBird
-# Generated by getting-started-with-dex.sh
-
-issuer: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-
-storage:
-  type: sqlite3
-  config:
-    file: /var/dex/dex.db
-
-web:
-  http: 0.0.0.0:5556
-
-# gRPC API for user management (used by NetBird IDP manager)
-grpc:
-  addr: 0.0.0.0:5557
-
-oauth2:
-  skipApprovalScreen: true
-
-# Static OAuth2 clients for NetBird
-staticClients:
-  # Dashboard client
-  - id: netbird-dashboard
-    name: NetBird Dashboard
-    secret: $DEX_DASHBOARD_CLIENT_SECRET
-    redirectURIs:
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth
-
-  # CLI client (public - uses PKCE)
-  - id: netbird-cli
-    name: NetBird CLI
-    public: true
-    redirectURIs:
-      - http://localhost:53000/
-      - http://localhost:54000/
-
-# Enable password database for static users
-enablePasswordDB: true
-
-# Static users - add more users here as needed
-staticPasswords:
-  - email: "admin@$NETBIRD_DOMAIN"
-    hash: "$ADMIN_PASSWORD_HASH"
-    username: "admin"
-    userID: "$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "admin-user-id-001")"
-
-# Optional: Add external identity provider connectors
-# connectors:
-#   - type: github
-#     id: github
-#     name: GitHub
-#     config:
-#       clientID: \$GITHUB_CLIENT_ID
-#       clientSecret: \$GITHUB_CLIENT_SECRET
-#       redirectURI: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/callback
-#
-#   - type: ldap
-#     id: ldap
-#     name: LDAP
-#     config:
-#       host: ldap.example.com:636
-#       insecureNoSSL: false
-#       bindDN: cn=admin,dc=example,dc=com
-#       bindPW: admin
-#       userSearch:
-#         baseDN: ou=users,dc=example,dc=com
-#         filter: "(objectClass=person)"
-#         username: uid
-#         idAttr: uid
-#         emailAttr: mail
-#         nameAttr: cn
-EOF
-  return 0
-}
-
-render_turn_server_conf() {
-  cat <<EOF
-listening-port=3478
-$TURN_EXTERNAL_IP_CONFIG
-tls-listening-port=5349
-min-port=$TURN_MIN_PORT
-max-port=$TURN_MAX_PORT
-fingerprint
-lt-cred-mech
-user=$TURN_USER:$TURN_PASSWORD
-realm=wiretrustee.com
-cert=/etc/coturn/certs/cert.pem
-pkey=/etc/coturn/private/privkey.pem
-log-file=stdout
-no-software-attribute
-pidfile="/var/tmp/turnserver.pid"
-no-cli
-EOF
-  return 0
-}
-
-render_management_json() {
-  cat <<EOF
-{
-    "Stuns": [
-        {
-            "Proto": "udp",
-            "URI": "stun:$NETBIRD_DOMAIN:3478"
-        }
-    ],
-    "Relay": {
-        "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
-        "CredentialsTTL": "24h",
-        "Secret": "$NETBIRD_RELAY_AUTH_SECRET"
-    },
-    "Signal": {
-        "Proto": "$NETBIRD_HTTP_PROTOCOL",
-        "URI": "$NETBIRD_DOMAIN:$NETBIRD_PORT"
-    },
-    "HttpConfig": {
-        "AuthIssuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex",
-        "AuthAudience": "netbird-dashboard",
-        "OIDCConfigEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration"
-    },
-    "IdpManagerConfig": {
-        "ManagerType": "dex",
-        "ClientConfig": {
-            "Issuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex"
-        },
-        "ExtraConfig": {
-            "GRPCAddr": "dex:5557"
-        }
-    },
-    "DeviceAuthorizationFlow": {
-        "Provider": "hosted",
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "DeviceAuthEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/device/code",
-            "TokenEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/token"
-        }
-    },
-    "PKCEAuthorizationFlow": {
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "RedirectURLs": ["http://localhost:53000/", "http://localhost:54000/"]
-        }
-    }
-}
-EOF
-  return 0
-}
-
-render_dashboard_env() {
-  cat <<EOF
-# Endpoints
-NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-NETBIRD_MGMT_GRPC_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-# OIDC
-AUTH_AUDIENCE=netbird-dashboard
-AUTH_CLIENT_ID=netbird-dashboard
-AUTH_CLIENT_SECRET=$DEX_DASHBOARD_CLIENT_SECRET
-AUTH_AUTHORITY=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-USE_AUTH0=false
-AUTH_SUPPORTED_SCOPES=openid profile email offline_access
-AUTH_REDIRECT_URI=/nb-auth
-AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-# SSL
-NGINX_SSL_PORT=443
-# Letsencrypt
-LETSENCRYPT_DOMAIN=none
-EOF
-  return 0
-}
-
-render_relay_env() {
-  cat <<EOF
-NB_LOG_LEVEL=info
-NB_LISTEN_ADDRESS=:80
-NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT
-NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
-EOF
-  return 0
-}
-
-render_docker_compose() {
-  cat <<EOF
-services:
-  # Caddy reverse proxy
-  caddy:
-    image: caddy
-    container_name: netbird-caddy
-    restart: unless-stopped
-    networks: [netbird]
-    ports:
-      - '443:443'
-      - '443:443/udp'
-      - '80:80'
-    volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Dex - identity provider
-  dex:
-    image: ghcr.io/dexidp/dex:v2.38.0
-    container_name: netbird-dex
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - ./dex.yaml:/etc/dex/config.docker.yaml:ro
-      - netbird_dex_data:/var/dex
-    command: ["dex", "serve", "/etc/dex/config.docker.yaml"]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # UI dashboard
-  dashboard:
-    image: netbirdio/dashboard:latest
-    container_name: netbird-dashboard
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./dashboard.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Signal
-  signal:
-    image: netbirdio/signal:latest
-    container_name: netbird-signal
-    restart: unless-stopped
-    networks: [netbird]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Relay
-  relay:
-    image: netbirdio/relay:latest
-    container_name: netbird-relay
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./relay.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Management
-  management:
-    image: netbirdio/management:latest
-    container_name: netbird-management
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - netbird_management:/var/lib/netbird
-      - ./management.json:/etc/netbird/management.json
-    command: [
-      "--port", "80",
-      "--log-file", "console",
-      "--log-level", "info",
-      "--disable-anonymous-metrics=false",
-      "--single-account-mode-domain=netbird.selfhosted",
-      "--dns-domain=netbird.selfhosted",
-      "--idp-sign-key-refresh-enabled",
-    ]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Coturn, AKA TURN server
-  coturn:
-    image: coturn/coturn
-    container_name: netbird-coturn
-    restart: unless-stopped
-    volumes:
-      - ./turnserver.conf:/etc/turnserver.conf:ro
-    network_mode: host
-    command:
-      - -c /etc/turnserver.conf
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-volumes:
-  netbird_caddy_data:
-  netbird_dex_data:
-  netbird_management:
-
-networks:
-  netbird:
-EOF
-  return 0
-}
-
-init_environment
+exit 1
--- a/infrastructure_files/getting-started-with-zitadel.sh
+++ b/infrastructure_files/getting-started-with-zitadel.sh
--- a/management/cmd/management.go
+++ b/management/cmd/management.go
@@ -23,7 +23,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"

 	"github.com/netbirdio/netbird/formatter/hook"
-	agentnetworkpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/server"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	nbdomain "github.com/netbirdio/netbird/shared/management/domain"
@@ -113,29 +112,6 @@ var (
 				mgmtSingleAccModeDomain = ""
 			}

-			// Load the management-side LLM pricing defaults file: an
-			// explicitly configured path is required to load (a typo must
-			// fail startup — the operator believes those rates are live);
-			// otherwise <datadir>/defaults_llm_pricing.yaml is probed and
-			// may be absent (compiled-in defaults serve). A relative path
-			// is resolved against the datadir so a bare filename lands
-			// alongside the store. Either way the path stays watched: the
-			// reloader picks up edits — and the file appearing later —
-			// without a restart.
-			pricingPath := config.AgentNetwork.PricingDefaultsFile
-			pricingRequired := pricingPath != ""
-			if !pricingRequired {
-				pricingPath = agentnetworkpricing.DefaultFileName
-			}
-			if !filepath.IsAbs(pricingPath) {
-				pricingPath = filepath.Join(config.Datadir, pricingPath)
-			}
-			log.Infof("loading agent-network pricing defaults from %s (required: %v)", pricingPath, pricingRequired)
-			if err := agentnetworkpricing.LoadFile(pricingPath, pricingRequired); err != nil {
-				return fmt.Errorf("load agent-network pricing defaults: %v", err)
-			}
-			agentnetworkpricing.StartReloader(ctx, agentnetworkpricing.ReloadInterval)
-
 			srv := newServer(&server.Config{
 				NbConfig:                    config,
 				DNSDomain:                   dnsDomain,
--- a/management/internals/modules/agentnetwork/catalog/catalog.go
+++ b/management/internals/modules/agentnetwork/catalog/catalog.go
@@ -7,28 +7,12 @@ package catalog
 import "github.com/netbirdio/netbird/shared/management/http/api"

 // Model is the in-memory representation of a catalog model.
-//
-// The three cache rates mirror the proxy cost meter's Entry semantics
-// (USD per 1k tokens; 0 = no rate configured, that bucket bills at
-// InputPer1k):
-//   - CachedInputPer1k: OpenAI-shape rate for cached prompt tokens
-//     (a SUBSET of input tokens). Typically 0.1-0.5x input.
-//   - CacheReadPer1k / CacheCreationPer1k: Anthropic-shape rates for
-//     the two ADDITIVE prompt-cache buckets. Typically 0.1x / 1.25x
-//     input.
-//
-// The catalog is the single default-pricing source: the agentnetwork
-// pricing package folds these models into per-surface tables that the
-// synthesizer ships to the proxy's cost_meter.
 type Model struct {
-	ID                 string
-	Label              string
-	InputPer1k         float64
-	OutputPer1k        float64
-	CachedInputPer1k   float64
-	CacheReadPer1k     float64
-	CacheCreationPer1k float64
-	ContextWindow      int
+	ID            string
+	Label         string
+	InputPer1k    float64
+	OutputPer1k   float64
+	ContextWindow int
 }

 // ProviderKind groups catalog entries for UI presentation. The split
@@ -81,17 +65,6 @@ type Provider struct {
 	// surface — the proxy middleware then falls back to URL sniffing
 	// or skips request-side enrichment.
 	ParserID string
-	// PricingSurfaces names the cost-meter pricing surfaces this
-	// provider's Models are priced under ("openai", "anthropic",
-	// "bedrock" — the llm.Parser surface the request parser stamps as
-	// llm.provider at billing time). NOT derivable from ParserID:
-	// bedrock_api and vertex_ai_api leave ParserID empty (URL-sniffed)
-	// yet price under "bedrock" / "anthropic", and kimi_api serves two
-	// body shapes so it prices under both. Nil for gateway/custom
-	// entries, which declare no models. Same (surface, model) pair
-	// contributed by two providers must carry identical rates — the
-	// pricing package's tests enforce that.
-	PricingSurfaces []string
 	// IdentityInjection, when non-nil, instructs the proxy to stamp
 	// the caller's NetBird identity onto upstream requests under the
 	// configured header names. Used for gateways like LiteLLM that
@@ -246,7 +219,6 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#10A37F",
 		ParserID:           "openai",
-		PricingSurfaces:    []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM's
 		// model_prices_and_context_window.json. Notable corrections from
 		// earlier values: o4-mini repriced from $4/$16 to $1.10/$4.40
@@ -254,20 +226,20 @@ var providers = []Provider{
 		// family context windows split between 1.05M for full-size
 		// models and 272K for mini/nano/codex variants.
 		Models: []Model{
-			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, CachedInputPer1k: 0.0005, ContextWindow: 1050000},
-			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, CachedInputPer1k: 0.003, ContextWindow: 1050000},
-			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, CachedInputPer1k: 0.00025, ContextWindow: 1050000},
-			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, CachedInputPer1k: 0.003, ContextWindow: 1050000},
-			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, CachedInputPer1k: 0.000075, ContextWindow: 272000},
-			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, CachedInputPer1k: 0.00002, ContextWindow: 272000},
-			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, CachedInputPer1k: 0.000175, ContextWindow: 272000},
-			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, CachedInputPer1k: 0.000175, ContextWindow: 128000},
-			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, CachedInputPer1k: 0.000275, ContextWindow: 200000},
-			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, CachedInputPer1k: 0.0005, ContextWindow: 1047576},
-			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, CachedInputPer1k: 0.0001, ContextWindow: 1047576},
-			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, CachedInputPer1k: 0.000025, ContextWindow: 1047576},
-			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, CachedInputPer1k: 0.00125, ContextWindow: 128000},
-			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, CachedInputPer1k: 0.000075, ContextWindow: 128000},
+			{ID: "gpt-5.5", Label: "GPT-5.5", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
+			{ID: "gpt-5.5-pro", Label: "GPT-5.5 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
+			{ID: "gpt-5.4-pro", Label: "GPT-5.4 Pro", InputPer1k: 0.030, OutputPer1k: 0.180, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
+			{ID: "gpt-5.3-codex", Label: "GPT-5.3 Codex", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 272000},
+			{ID: "gpt-5.3-chat-latest", Label: "GPT-5.3 Chat", InputPer1k: 0.00175, OutputPer1k: 0.014, ContextWindow: 128000},
+			{ID: "o4-mini", Label: "o4-mini", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
+			{ID: "gpt-4.1-nano", Label: "GPT-4.1 nano", InputPer1k: 0.0001, OutputPer1k: 0.0004, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
 			{ID: "gpt-4-turbo", Label: "GPT-4 Turbo", InputPer1k: 0.01, OutputPer1k: 0.03, ContextWindow: 128000},
 			{ID: "gpt-3.5-turbo", Label: "GPT-3.5 Turbo", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
 			{ID: "text-embedding-3-large", Label: "text-embedding-3-large", InputPer1k: 0.00013, OutputPer1k: 0, ContextWindow: 8191},
@@ -285,7 +257,6 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#D97757",
 		ParserID:           "anthropic",
-		PricingSurfaces:    []string{"anthropic"},
 		// Per Anthropic's current model lineup. Pricing in USD per 1k
 		// tokens. Context windows: 4.6+ family is 1M; Haiku 4.5 stays at
 		// 200K. claude-3-7-sonnet and claude-3-5-haiku retired
@@ -296,14 +267,14 @@ var providers = []Provider{
 		// account to be on >= 30-day data retention or all requests
 		// 400.
 		Models: []Model{
-			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
-			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
-			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
-			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
-			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
+			{ID: "claude-fable-5", Label: "Claude Fable 5", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (deprecated, retires 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
 		},
 	},
 	{
@@ -317,19 +288,18 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#0078D4",
 		ParserID:           "openai",
-		PricingSurfaces:    []string{"openai"},
 		// Mirrors openai_api pricing — Azure resells OpenAI models at the
 		// same per-token rates, just under different deployment names.
 		Models: []Model{
-			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, CachedInputPer1k: 0.0005, ContextWindow: 1050000},
-			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, CachedInputPer1k: 0.00025, ContextWindow: 1050000},
-			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, CachedInputPer1k: 0.000075, ContextWindow: 272000},
-			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, CachedInputPer1k: 0.00002, ContextWindow: 272000},
-			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, CachedInputPer1k: 0.000275, ContextWindow: 200000},
-			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, CachedInputPer1k: 0.0005, ContextWindow: 1047576},
-			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, CachedInputPer1k: 0.0001, ContextWindow: 1047576},
-			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, CachedInputPer1k: 0.00125, ContextWindow: 128000},
-			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, CachedInputPer1k: 0.000075, ContextWindow: 128000},
+			{ID: "gpt-5.5", Label: "GPT-5.5 (Azure)", InputPer1k: 0.005, OutputPer1k: 0.030, ContextWindow: 1050000},
+			{ID: "gpt-5.4", Label: "GPT-5.4 (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.015, ContextWindow: 1050000},
+			{ID: "gpt-5.4-mini", Label: "GPT-5.4 Mini (Azure)", InputPer1k: 0.00075, OutputPer1k: 0.0045, ContextWindow: 272000},
+			{ID: "gpt-5.4-nano", Label: "GPT-5.4 Nano (Azure)", InputPer1k: 0.0002, OutputPer1k: 0.00125, ContextWindow: 272000},
+			{ID: "o4-mini", Label: "o4-mini (Azure)", InputPer1k: 0.0011, OutputPer1k: 0.0044, ContextWindow: 200000},
+			{ID: "gpt-4.1", Label: "GPT-4.1 (Azure)", InputPer1k: 0.002, OutputPer1k: 0.008, ContextWindow: 1047576},
+			{ID: "gpt-4.1-mini", Label: "GPT-4.1 mini (Azure)", InputPer1k: 0.0004, OutputPer1k: 0.0016, ContextWindow: 1047576},
+			{ID: "gpt-4o", Label: "GPT-4o (Azure)", InputPer1k: 0.0025, OutputPer1k: 0.010, ContextWindow: 128000},
+			{ID: "gpt-4o-mini", Label: "GPT-4o mini (Azure)", InputPer1k: 0.00015, OutputPer1k: 0.0006, ContextWindow: 128000},
 			{ID: "gpt-35-turbo", Label: "GPT-3.5 Turbo (Azure)", InputPer1k: 0.0005, OutputPer1k: 0.0015, ContextWindow: 16385},
 		},
 	},
@@ -343,9 +313,6 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF9900",
-		// ParserID stays empty (path-style dispatch via IsBedrockPathStyle);
-		// the request parser meters these under the "bedrock" surface.
-		PricingSurfaces: []string{"bedrock"},
 		// Anthropic models on Bedrock take the anthropic.* prefix and
 		// follow the same lineup / pricing as the first-party Anthropic
 		// catalog entry above. claude-3-7-sonnet and claude-3-5-haiku
@@ -355,13 +322,13 @@ var providers = []Provider{
 		// Llama 3.3 70B entry kept unchanged — LiteLLM tracks only
 		// per-region Llama 3 entries; standalone 3.3 not yet listed.
 		Models: []Model{
-			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
-			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
-			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
-			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
+			{ID: "anthropic.claude-opus-4-8", Label: "Claude Opus 4.8 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-7", Label: "Claude Opus 4.7 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-6", Label: "Claude Opus 4.6 (Bedrock)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "anthropic.claude-opus-4-1", Label: "Claude Opus 4.1 (Bedrock, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "anthropic.claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "anthropic.claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Bedrock)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "anthropic.claude-haiku-4-5", Label: "Claude Haiku 4.5 (Bedrock)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
 			{ID: "meta.llama3-3-70b-instruct", Label: "Llama 3.3 70B (Bedrock)", InputPer1k: 0.00072, OutputPer1k: 0.00072, ContextWindow: 128000},
 			{ID: "amazon.nova-2-lite", Label: "Amazon Nova 2 Lite (Bedrock, preview)", InputPer1k: 0.0003, OutputPer1k: 0.0025, ContextWindow: 1000000},
 			{ID: "amazon.nova-pro", Label: "Amazon Nova Pro (Bedrock)", InputPer1k: 0.0008, OutputPer1k: 0.0032, ContextWindow: 300000},
@@ -391,10 +358,6 @@ var providers = []Provider{
 		AuthHeaderTemplate: "Bearer ${API_KEY}",
 		DefaultContentType: "application/json",
 		BrandColor:         "#4285F4",
-		// ParserID stays empty (path-style dispatch via IsVertexPathStyle);
-		// Anthropic-on-Vertex requests are metered under the "anthropic"
-		// surface with the bare, unversioned model id.
-		PricingSurfaces: []string{"anthropic"},
 		// Vertex carries the model in the URL path and authenticates with a
 		// service-account-minted OAuth token (api_key = "keyfile::<base64 SA>").
 		// Only Anthropic-on-Vertex is metered today: the request parser maps the
@@ -406,14 +369,14 @@ var providers = []Provider{
 		// exists — the router denies unmeterable publishers rather than forward
 		// them uncounted.
 		Models: []Model{
-			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, CacheReadPer1k: 0.001, CacheCreationPer1k: 0.0125, ContextWindow: 1000000},
-			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625, ContextWindow: 1000000},
-			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, CacheReadPer1k: 0.0015, CacheCreationPer1k: 0.01875, ContextWindow: 200000},
-			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 1000000},
-			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003, CacheCreationPer1k: 0.00375, ContextWindow: 200000},
-			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, CacheReadPer1k: 0.0001, CacheCreationPer1k: 0.00125, ContextWindow: 200000},
+			{ID: "claude-fable-5", Label: "Claude Fable 5 (Vertex)", InputPer1k: 0.010, OutputPer1k: 0.050, ContextWindow: 1000000},
+			{ID: "claude-opus-4-8", Label: "Claude Opus 4.8 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-7", Label: "Claude Opus 4.7 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-6", Label: "Claude Opus 4.6 (Vertex)", InputPer1k: 0.005, OutputPer1k: 0.025, ContextWindow: 1000000},
+			{ID: "claude-opus-4-1", Label: "Claude Opus 4.1 (Vertex, deprecated 2026-08-05)", InputPer1k: 0.015, OutputPer1k: 0.075, ContextWindow: 200000},
+			{ID: "claude-sonnet-4-6", Label: "Claude Sonnet 4.6 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
+			{ID: "claude-sonnet-4-5", Label: "Claude Sonnet 4.5 (Vertex)", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 200000},
+			{ID: "claude-haiku-4-5", Label: "Claude Haiku 4.5 (Vertex)", InputPer1k: 0.001, OutputPer1k: 0.005, ContextWindow: 200000},
 		},
 	},
 	{
@@ -427,7 +390,6 @@ var providers = []Provider{
 		DefaultContentType: "application/json",
 		BrandColor:         "#FF7000",
 		ParserID:           "openai",
-		PricingSurfaces:    []string{"openai"},
 		// Pricing + context windows cross-checked against LiteLLM. Key
 		// gotchas the marketing page hides:
 		//   - `mistral-medium-latest` aliases to Medium 3.1 ($0.40/$2),
@@ -486,10 +448,6 @@ var providers = []Provider{
 		// model id "k3") is account-bound seat licensing rather than a
 		// meterable platform key, so it's deliberately not the default.
 		ParserID: "",
-		// Both body shapes are metered: /v1/chat/completions under
-		// "openai", /anthropic/v1/messages under "anthropic" — so the
-		// K3 entry is priced on both surfaces.
-		PricingSurfaces: []string{"openai", "anthropic"},
 		// Pricing per Moonshot's platform rates at K3 launch (July 2026):
 		// $3/$15 per MTok with $0.30 cached input, flat across the 1M-token
 		// window. kimi-k3 is the ONLY model the platform serves newer
@@ -500,14 +458,7 @@ var providers = []Provider{
 		// The consumer app's "K3 Swarm Max" mode is not an API SKU, so it
 		// doesn't appear here.
 		Models: []Model{
-			// Carries both cache shapes: Moonshot reports cache hits
-			// OpenAI-style on /v1/chat/completions (CachedInputPer1k)
-			// and Anthropic-style on /anthropic/v1/messages
-			// (CacheReadPer1k) — $0.30/MTok either way. Each surface's
-			// cost formula reads only its own field, so the superset
-			// entry prices both endpoints correctly. No cache-creation
-			// rate published; writes bill at the input rate.
-			{ID: "kimi-k3", Label: "Kimi K3", InputPer1k: 0.003, OutputPer1k: 0.015, CachedInputPer1k: 0.0003, CacheReadPer1k: 0.0003, ContextWindow: 1000000},
+			{ID: "kimi-k3", Label: "Kimi K3", InputPer1k: 0.003, OutputPer1k: 0.015, ContextWindow: 1000000},
 		},
 	},
 	{
@@ -807,28 +758,13 @@ func IsBedrockPathStyle(providerID string) bool {
 func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
 	models := make([]api.AgentNetworkCatalogModel, 0, len(p.Models))
 	for _, m := range p.Models {
-		am := api.AgentNetworkCatalogModel{
+		models = append(models, api.AgentNetworkCatalogModel{
 			Id:            m.ID,
 			Label:         m.Label,
 			InputPer1k:    m.InputPer1k,
 			OutputPer1k:   m.OutputPer1k,
 			ContextWindow: m.ContextWindow,
-		}
-		// Cache rates are emitted only when configured so the dashboard
-		// can prefill them; 0 stays off the wire (absent = no rate).
-		if m.CachedInputPer1k > 0 {
-			v := m.CachedInputPer1k
-			am.CachedInputPer1k = &v
-		}
-		if m.CacheReadPer1k > 0 {
-			v := m.CacheReadPer1k
-			am.CacheReadPer1k = &v
-		}
-		if m.CacheCreationPer1k > 0 {
-			v := m.CacheCreationPer1k
-			am.CacheCreationPer1k = &v
-		}
-		models = append(models, am)
+		})
 	}
 	kind := api.AgentNetworkCatalogProviderKindProvider
 	switch p.Kind {
@@ -848,10 +784,6 @@ func (p Provider) ToAPIResponse() api.AgentNetworkCatalogProvider {
 		BrandColor:         p.BrandColor,
 		Models:             models,
 	}
-	if len(p.PricingSurfaces) > 0 {
-		surfaces := append([]string(nil), p.PricingSurfaces...)
-		resp.PricingSurfaces = &surfaces
-	}
 	if len(p.ExtraHeaders) > 0 {
 		extras := make([]api.AgentNetworkCatalogExtraHeader, 0, len(p.ExtraHeaders))
 		for _, h := range p.ExtraHeaders {
--- a/management/internals/modules/agentnetwork/handlers/providers_handler.go
+++ b/management/internals/modules/agentnetwork/handlers/providers_handler.go
@@ -7,7 +7,6 @@ package handlers

 import (
 	"encoding/json"
-	"math"
 	"net/http"
 	"net/url"
 	"strings"
@@ -16,7 +15,6 @@ import (

 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -54,45 +52,11 @@ func (h *handler) getCatalogProviders(w http.ResponseWriter, r *http.Request) {
 	entries := catalog.All()
 	out := make([]api.AgentNetworkCatalogProvider, 0, len(entries))
 	for _, e := range entries {
-		resp := e.ToAPIResponse()
-		applyDefaultPricing(e, &resp)
-		out = append(out, resp)
+		out = append(out, e.ToAPIResponse())
 	}
 	util.WriteJSONObject(r.Context(), w, out)
 }

-// applyDefaultPricing overwrites the catalog response's model rates with
-// the LIVE default pricing table, which may differ from the compiled-in
-// catalog rates when the operator provides a defaults_llm_pricing.yaml.
-// This keeps the dashboard's model-row prefill identical to what the
-// proxy will actually bill — the same table the synthesizer ships.
-func applyDefaultPricing(cp catalog.Provider, resp *api.AgentNetworkCatalogProvider) {
-	if len(cp.PricingSurfaces) == 0 {
-		return
-	}
-	for i := range resp.Models {
-		m := &resp.Models[i]
-		e, ok := pricing.LookupDefault(cp.PricingSurfaces, m.Id)
-		if !ok {
-			continue
-		}
-		m.InputPer1k = e.InputPer1k
-		m.OutputPer1k = e.OutputPer1k
-		m.CachedInputPer1k = positiveRatePtr(e.CachedInputPer1k)
-		m.CacheReadPer1k = positiveRatePtr(e.CacheReadPer1k)
-		m.CacheCreationPer1k = positiveRatePtr(e.CacheCreationPer1k)
-	}
-}
-
-// positiveRatePtr renders a cache rate for the API: absent (nil) when
-// unset, matching the catalog response convention.
-func positiveRatePtr(v float64) *float64 {
-	if v <= 0 {
-		return nil
-	}
-	return &v
-}
-
 func (h *handler) getAllProviders(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -249,38 +213,5 @@ func validate(req *api.AgentNetworkProviderRequest, requireAPIKey bool) error {
 	if requireAPIKey && (req.ApiKey == nil || strings.TrimSpace(*req.ApiKey) == "") {
 		return status.Errorf(status.InvalidArgument, "api_key is required")
 	}
-	if req.Models != nil {
-		for i, m := range *req.Models {
-			if err := validateModel(i, m); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-// validateModel is the single ingress guard for operator-entered pricing:
-// these rates are synthesized into the proxy's cost_meter config verbatim,
-// and a negative or non-finite rate there would poison every cost the
-// proxy records, so reject at the API boundary.
-func validateModel(i int, m api.AgentNetworkProviderModel) error {
-	if strings.TrimSpace(m.Id) == "" {
-		return status.Errorf(status.InvalidArgument, "models[%d]: id is required", i)
-	}
-	rates := map[string]*float64{
-		"input_per_1k":          &m.InputPer1k,
-		"output_per_1k":         &m.OutputPer1k,
-		"cached_input_per_1k":   m.CachedInputPer1k,
-		"cache_read_per_1k":     m.CacheReadPer1k,
-		"cache_creation_per_1k": m.CacheCreationPer1k,
-	}
-	for field, v := range rates {
-		if v == nil {
-			continue
-		}
-		if *v < 0 || math.IsNaN(*v) || math.IsInf(*v, 0) {
-			return status.Errorf(status.InvalidArgument, "models[%d] (%s): %s must be a finite, non-negative USD rate", i, m.Id, field)
-		}
-	}
 	return nil
 }
--- a/management/internals/modules/agentnetwork/handlers/providers_handler_test.go
+++ b/management/internals/modules/agentnetwork/handlers/providers_handler_test.go
@@ -1,53 +0,0 @@
-package handlers
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-func f(v float64) *float64 { return &v }
-
-// TestValidate_ModelRates guards the single ingress point for operator-entered
-// pricing. These rates flow verbatim into the proxy's cost_meter config at
-// synthesis time; the proxy treats a bad rate as a chain-build failure, so
-// rejecting here is what keeps an account's gateway from going down.
-func TestValidate_ModelRates(t *testing.T) {
-	base := func(models ...api.AgentNetworkProviderModel) *api.AgentNetworkProviderRequest {
-		key := "sk-test"
-		return &api.AgentNetworkProviderRequest{
-			ProviderId:  "openai_api",
-			Name:        "OpenAI",
-			UpstreamUrl: "https://api.openai.com",
-			ApiKey:      &key,
-			Models:      &models,
-		}
-	}
-
-	valid := api.AgentNetworkProviderModel{
-		Id: "gpt-4o", InputPer1k: 0.0025, OutputPer1k: 0.01,
-		CachedInputPer1k: f(0.00125),
-	}
-	require.NoError(t, validate(base(valid), true), "finite non-negative rates must pass")
-
-	zeroRates := api.AgentNetworkProviderModel{Id: "self-hosted-llama", InputPer1k: 0, OutputPer1k: 0}
-	require.NoError(t, validate(base(zeroRates), true), "explicit zero prices are allowed (free / self-hosted models)")
-
-	cases := map[string]api.AgentNetworkProviderModel{
-		"empty id":           {Id: "  ", InputPer1k: 0.001, OutputPer1k: 0.002},
-		"negative input":     {Id: "m", InputPer1k: -0.001, OutputPer1k: 0.002},
-		"negative output":    {Id: "m", InputPer1k: 0.001, OutputPer1k: -0.002},
-		"NaN input":          {Id: "m", InputPer1k: math.NaN(), OutputPer1k: 0.002},
-		"Inf output":         {Id: "m", InputPer1k: 0.001, OutputPer1k: math.Inf(1)},
-		"negative cached":    {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CachedInputPer1k: f(-1)},
-		"NaN cache read":     {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CacheReadPer1k: f(math.NaN())},
-		"Inf cache creation": {Id: "m", InputPer1k: 0.001, OutputPer1k: 0.002, CacheCreationPer1k: f(math.Inf(-1))},
-	}
-	for name, m := range cases {
-		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
-	}
-}
--- a/management/internals/modules/agentnetwork/pricing/defaults.go
+++ b/management/internals/modules/agentnetwork/pricing/defaults.go
@@ -1,156 +0,0 @@
-// Package pricing builds the default LLM pricing table the synthesizer
-// ships to the proxy's cost_meter middleware. The catalog is the single
-// source of default rates: every catalog provider's models are folded
-// into the pricing surfaces the provider declares (PricingSurfaces),
-// then a small supplemental list adds priced-but-not-operator-selectable
-// entries. Management is the sole pricing authority — the proxy carries
-// no embedded price list and bills exclusively from the table it is
-// sent.
-//go:generate go run gen.go
-
-package pricing
-
-import (
-	"sync"
-	"sync/atomic"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-)
-
-// Entry is a single model's pricing in USD per 1k tokens. This struct IS
-// the wire shape: the synthesizer marshals it verbatim into cost_meter's
-// ConfigJSON, and the proxy unmarshals the same field names.
-//
-// A zero rate means "no rate configured" — the proxy bills that cache
-// bucket at InputPer1k (identical semantics to the retired proxy-embedded
-// table). CachedInputPer1k is the OpenAI shape (cached prompt tokens are
-// a subset of input); CacheReadPer1k / CacheCreationPer1k are the
-// Anthropic shape (additive buckets).
-type Entry struct {
-	InputPer1k         float64 `json:"input_per_1k"`
-	OutputPer1k        float64 `json:"output_per_1k"`
-	CachedInputPer1k   float64 `json:"cached_input_per_1k,omitempty"`
-	CacheReadPer1k     float64 `json:"cache_read_per_1k,omitempty"`
-	CacheCreationPer1k float64 `json:"cache_creation_per_1k,omitempty"`
-}
-
-// supplementalDefaults are (surface, model) entries that are priced but
-// deliberately not operator-selectable in the catalog. Each carries a
-// reason; when one of these models joins a catalog lineup, delete the
-// row here — the collision test fails loudly if the rates ever disagree.
-var supplementalDefaults = map[string]map[string]Entry{
-	"openai": {
-		// GPT-5 (2025) family — kept for gateway requests using the
-		// unsuffixed ids; the dashboard offers only the 5.x lineup.
-		"gpt-5":      {InputPer1k: 0.00125, OutputPer1k: 0.01, CachedInputPer1k: 0.000125},
-		"gpt-5-mini": {InputPer1k: 0.00025, OutputPer1k: 0.002, CachedInputPer1k: 0.000025},
-		"gpt-5-nano": {InputPer1k: 0.00005, OutputPer1k: 0.0004, CachedInputPer1k: 0.000005},
-	},
-	"anthropic": {
-		// claude-opus-5 is not yet in the catalog lineup but gateway /
-		// grandfathered traffic uses it; priced so it isn't skipped.
-		"claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
-		// "kimi-k3[1m]" is the 1M-context alias some Claude Code guides
-		// configure against Moonshot's Anthropic-compatible endpoint;
-		// priced identically to kimi-k3 so those requests aren't skipped.
-		"kimi-k3[1m]": {InputPer1k: 0.003, OutputPer1k: 0.015, CacheReadPer1k: 0.0003},
-	},
-	"bedrock": {
-		"anthropic.claude-opus-5": {InputPer1k: 0.005, OutputPer1k: 0.025, CacheReadPer1k: 0.0005, CacheCreationPer1k: 0.00625},
-	},
-}
-
-var (
-	compiledOnce  sync.Once
-	compiledTable map[string]map[string]Entry
-	// mergedTable holds the current live table when a pricing defaults
-	// file is loaded: the file merged entry-whole over the compiled-in
-	// base. Nil while no file is loaded (or after the file is removed),
-	// in which case the compiled-in table serves. Swapped atomically by
-	// the file loader/reloader; readers never block.
-	mergedTable atomic.Pointer[map[string]map[string]Entry]
-)
-
-// DefaultTable returns the current default pricing table keyed
-// surface -> model -> Entry: the management-side defaults file (see
-// LoadFile / StartReloader) when one is loaded, merged over the
-// compiled-in catalog table, which alone serves as the fallback when no
-// file exists. The snapshot may change between calls as the file is
-// re-read — consumers (the synthesizer on every reconcile, the catalog
-// endpoint on every request) pick up fresh rates automatically. Callers
-// must not mutate the returned maps.
-func DefaultTable() map[string]map[string]Entry {
-	if t := mergedTable.Load(); t != nil {
-		return *t
-	}
-	return compiledBase()
-}
-
-// compiledBase returns the compiled-in table (catalog + supplementals),
-// built once.
-func compiledBase() map[string]map[string]Entry {
-	compiledOnce.Do(func() {
-		compiledTable = buildDefaultTable()
-	})
-	return compiledTable
-}
-
-func buildDefaultTable() map[string]map[string]Entry {
-	out := make(map[string]map[string]Entry)
-	for _, p := range catalog.All() {
-		for _, surface := range p.PricingSurfaces {
-			inner, ok := out[surface]
-			if !ok {
-				inner = make(map[string]Entry)
-				out[surface] = inner
-			}
-			for _, m := range p.Models {
-				// First writer wins; providers contributing the same
-				// (surface, model) must agree on rates — enforced by
-				// TestDefaultTable_NoConflictingContributions.
-				if _, dup := inner[m.ID]; dup {
-					continue
-				}
-				inner[m.ID] = entryFromCatalogModel(m)
-			}
-		}
-	}
-	for surface, models := range supplementalDefaults {
-		inner, ok := out[surface]
-		if !ok {
-			inner = make(map[string]Entry)
-			out[surface] = inner
-		}
-		for id, e := range models {
-			if _, dup := inner[id]; dup {
-				continue
-			}
-			inner[id] = e
-		}
-	}
-	return out
-}
-
-func entryFromCatalogModel(m catalog.Model) Entry {
-	return Entry{
-		InputPer1k:         m.InputPer1k,
-		OutputPer1k:        m.OutputPer1k,
-		CachedInputPer1k:   m.CachedInputPer1k,
-		CacheReadPer1k:     m.CacheReadPer1k,
-		CacheCreationPer1k: m.CacheCreationPer1k,
-	}
-}
-
-// LookupDefault returns the default entry for model on the first of the
-// given surfaces that prices it. Used by the synthesizer to seed a
-// per-provider entry with default cache rates before overlaying the
-// operator's stored prices.
-func LookupDefault(surfaces []string, model string) (Entry, bool) {
-	table := DefaultTable()
-	for _, s := range surfaces {
-		if e, ok := table[s][model]; ok {
-			return e, true
-		}
-	}
-	return Entry{}, false
-}
--- a/management/internals/modules/agentnetwork/pricing/defaults_test.go
+++ b/management/internals/modules/agentnetwork/pricing/defaults_test.go
@@ -1,148 +0,0 @@
-package pricing
-
-import (
-	"math"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-)
-
-// TestDefaultTable_CoversEveryCatalogModel replaces the proxy's old
-// hand-maintained coverage list: because the table is built FROM the
-// catalog, drift is impossible by construction — this test guards the
-// fold itself (every catalog model of every surfaced provider resolves,
-// with exactly the catalog's rates).
-func TestDefaultTable_CoversEveryCatalogModel(t *testing.T) {
-	table := DefaultTable()
-	for _, p := range catalog.All() {
-		if len(p.PricingSurfaces) == 0 {
-			assert.Empty(t, p.Models, "catalog entry %s declares models but no pricing surfaces — those models would never be priced", p.ID)
-			continue
-		}
-		for _, surface := range p.PricingSurfaces {
-			byModel, ok := table[surface]
-			require.True(t, ok, "surface %q (provider %s) missing from default table", surface, p.ID)
-			for _, m := range p.Models {
-				e, ok := byModel[m.ID]
-				require.True(t, ok, "%s/%s (provider %s) missing from default table", surface, m.ID, p.ID)
-				assert.Equal(t, m.InputPer1k, e.InputPer1k, "%s/%s input rate", surface, m.ID)
-				assert.Equal(t, m.OutputPer1k, e.OutputPer1k, "%s/%s output rate", surface, m.ID)
-			}
-		}
-	}
-}
-
-// TestDefaultTable_NoConflictingContributions enforces the collision rule
-// documented on catalog.Provider.PricingSurfaces: when two catalog
-// providers contribute the same (surface, model) pair — azure/vertex
-// mirroring openai/anthropic, kimi on both surfaces — their rates must be
-// identical, because the surface-keyed table can only hold one entry.
-// If a provider ever diverges (e.g. Azure reprices a model), this fails
-// and the divergence must move to per-provider-record pricing.
-func TestDefaultTable_NoConflictingContributions(t *testing.T) {
-	type contribution struct {
-		providerID string
-		entry      Entry
-	}
-	seen := map[string]map[string]contribution{}
-	for _, p := range catalog.All() {
-		for _, surface := range p.PricingSurfaces {
-			if seen[surface] == nil {
-				seen[surface] = map[string]contribution{}
-			}
-			for _, m := range p.Models {
-				e := entryFromCatalogModel(m)
-				if prev, dup := seen[surface][m.ID]; dup {
-					assert.Equal(t, prev.entry, e,
-						"%s/%s: %s and %s contribute different rates", surface, m.ID, prev.providerID, p.ID)
-					continue
-				}
-				seen[surface][m.ID] = contribution{providerID: p.ID, entry: e}
-			}
-		}
-	}
-	// Supplemental entries must never shadow a catalog-contributed model —
-	// they exist precisely because the catalog does NOT list them.
-	for surface, models := range supplementalDefaults {
-		for id := range models {
-			_, fromCatalog := seen[surface][id]
-			assert.False(t, fromCatalog, "supplemental %s/%s is now in the catalog — delete the supplemental row", surface, id)
-		}
-	}
-}
-
-// TestDefaultTable_AllRatesFiniteNonNegative mirrors the proxy-side
-// NewTable validation so a bad catalog edit is caught here, at unit-test
-// time, rather than as a chain-build failure on every proxy.
-func TestDefaultTable_AllRatesFiniteNonNegative(t *testing.T) {
-	for surface, models := range DefaultTable() {
-		for id, e := range models {
-			for field, v := range map[string]float64{
-				"input":          e.InputPer1k,
-				"output":         e.OutputPer1k,
-				"cached_input":   e.CachedInputPer1k,
-				"cache_read":     e.CacheReadPer1k,
-				"cache_creation": e.CacheCreationPer1k,
-			} {
-				assert.False(t, v < 0 || math.IsNaN(v) || math.IsInf(v, 0),
-					"%s/%s: %s rate %v must be finite and non-negative", surface, id, field, v)
-			}
-		}
-	}
-}
-
-// TestDefaultTable_PinnedRates pins rates that previously drifted or are
-// easy to mis-enter (carried over from the proxy's retired
-// defaults_coverage_test), plus the supplemental entries.
-func TestDefaultTable_PinnedRates(t *testing.T) {
-	table := DefaultTable()
-
-	gpt54 := table["openai"]["gpt-5.4"]
-	assert.InDelta(t, 0.0025, gpt54.InputPer1k, 1e-9, "gpt-5.4 input")
-	assert.InDelta(t, 0.015, gpt54.OutputPer1k, 1e-9, "gpt-5.4 output")
-	assert.InDelta(t, 0.00025, gpt54.CachedInputPer1k, 1e-9, "gpt-5.4 cached input")
-
-	sonnet := table["bedrock"]["anthropic.claude-sonnet-4-5"]
-	assert.InDelta(t, 0.003, sonnet.InputPer1k, 1e-9, "bedrock sonnet-4-5 input")
-	assert.InDelta(t, 0.015, sonnet.OutputPer1k, 1e-9, "bedrock sonnet-4-5 output")
-	assert.InDelta(t, 0.0003, sonnet.CacheReadPer1k, 1e-9, "bedrock sonnet-4-5 cache read")
-	assert.InDelta(t, 0.00375, sonnet.CacheCreationPer1k, 1e-9, "bedrock sonnet-4-5 cache creation")
-
-	// Vertex Claude prices under "anthropic" with the bare id.
-	fable := table["anthropic"]["claude-fable-5"]
-	assert.InDelta(t, 0.010, fable.InputPer1k, 1e-9, "claude-fable-5 input")
-	assert.InDelta(t, 0.0125, fable.CacheCreationPer1k, 1e-9, "claude-fable-5 cache creation")
-
-	// Supplementals present on their surfaces.
-	for surface, ids := range map[string][]string{
-		"openai":    {"gpt-5", "gpt-5-mini", "gpt-5-nano"},
-		"anthropic": {"claude-opus-5", "kimi-k3[1m]", "kimi-k3"},
-		"bedrock":   {"anthropic.claude-opus-5"},
-	} {
-		for _, id := range ids {
-			_, ok := table[surface][id]
-			assert.True(t, ok, "%s/%s must be priced", surface, id)
-		}
-	}
-
-	// Embeddings bill input-only — output stays zero.
-	emb := table["openai"]["text-embedding-3-large"]
-	assert.Zero(t, emb.OutputPer1k, "embedding output rate must be zero")
-	assert.Positive(t, emb.InputPer1k, "embedding input rate must be set")
-}
-
-func TestLookupDefault_SurfaceOrder(t *testing.T) {
-	// kimi-k3 exists on both surfaces; first surface in the slice wins.
-	e, ok := LookupDefault([]string{"openai", "anthropic"}, "kimi-k3")
-	require.True(t, ok)
-	assert.InDelta(t, 0.003, e.InputPer1k, 1e-9)
-
-	_, ok = LookupDefault([]string{"bedrock"}, "gpt-4o")
-	assert.False(t, ok, "gpt-4o is not a bedrock model")
-
-	_, ok = LookupDefault(nil, "gpt-4o")
-	assert.False(t, ok, "no surfaces, no match")
-}
--- a/management/internals/modules/agentnetwork/pricing/exampleyaml.go
+++ b/management/internals/modules/agentnetwork/pricing/exampleyaml.go
@@ -1,109 +0,0 @@
-package pricing
-
-import (
-	"bytes"
-	"fmt"
-	"sort"
-	"strconv"
-)
-
-// MarshalDefaultsYAML renders the built-in default pricing table (catalog
-// + supplementals, WITHOUT any operator override) as the YAML schema
-// LoadOverrideFile consumes. It backs the generated
-// defaults_llm_pricing.example.yaml so operators start from a file that
-// matches the compiled-in rates exactly; a golden test keeps the two in
-// sync. Output is deterministic (sorted surfaces and models).
-func MarshalDefaultsYAML() []byte {
-	var b bytes.Buffer
-	b.WriteString(exampleHeader)
-
-	table := buildDefaultTable()
-	surfaces := make([]string, 0, len(table))
-	for s := range table {
-		surfaces = append(surfaces, s)
-	}
-	sort.Strings(surfaces)
-
-	for _, surface := range surfaces {
-		fmt.Fprintf(&b, "\n%s:\n", surface)
-		models := table[surface]
-		ids := make([]string, 0, len(models))
-		for id := range models {
-			ids = append(ids, id)
-		}
-		sort.Strings(ids)
-		for _, id := range ids {
-			e := models[id]
-			fmt.Fprintf(&b, "  %s:\n", yamlKey(id))
-			fmt.Fprintf(&b, "    input_per_1k: %s\n", rate(e.InputPer1k))
-			fmt.Fprintf(&b, "    output_per_1k: %s\n", rate(e.OutputPer1k))
-			if e.CachedInputPer1k > 0 {
-				fmt.Fprintf(&b, "    cached_input_per_1k: %s\n", rate(e.CachedInputPer1k))
-			}
-			if e.CacheReadPer1k > 0 {
-				fmt.Fprintf(&b, "    cache_read_per_1k: %s\n", rate(e.CacheReadPer1k))
-			}
-			if e.CacheCreationPer1k > 0 {
-				fmt.Fprintf(&b, "    cache_creation_per_1k: %s\n", rate(e.CacheCreationPer1k))
-			}
-		}
-	}
-	return b.Bytes()
-}
-
-// rate renders a USD-per-1k rate without float noise ("0.00015", not
-// "0.000150000000...").
-func rate(v float64) string {
-	return strconv.FormatFloat(v, 'f', -1, 64)
-}
-
-// yamlKey quotes model ids that YAML would otherwise misparse (e.g.
-// "kimi-k3[1m]" starts a flow sequence unquoted).
-func yamlKey(id string) string {
-	for _, r := range id {
-		switch r {
-		case '[', ']', '{', '}', ':', '#', ',', '&', '*', '!', '|', '>', '\'', '"', '%', '@', '`':
-			return strconv.Quote(id)
-		}
-	}
-	return id
-}
-
-const exampleHeader = `# Default LLM pricing used by NetBird's Agent Network cost metering.
-# GENERATED from the management catalog — do not edit this file in the
-# repository; regenerate with:
-#
-#   go generate ./management/internals/modules/agentnetwork/pricing
-#
-# Operators: copy this file to <datadir>/defaults_llm_pricing.yaml (or
-# any path configured via management.json:
-#
-#   { "AgentNetwork": { "PricingDefaultsFile": "/path/defaults_llm_pricing.yaml" } }
-#
-# ) and adjust the entries you want to change. Management re-reads the
-# file periodically (mtime poll, every minute): the live table feeds the
-# proxies' cost metering and the dashboard's model-price prefill, so
-# edits apply without a restart. Your file only needs the entries you
-# want to change — but each entry REPLACES the built-in entry for that
-# surface+model whole, so repeat the cache rates you want to keep.
-# Unknown fields and negative or non-finite rates are rejected: at
-# startup that fails boot (for an explicitly configured path); at
-# runtime the previous table is kept and a warning is logged. Deleting
-# the file reverts to the built-in defaults below.
-#
-# Top-level keys are pricing surfaces — the parser shape requests are
-# metered under: "openai" (also Azure, Mistral, and OpenAI-compatible
-# gateways), "anthropic" (also Anthropic-on-Vertex), "bedrock"
-# (normalized ids, e.g. anthropic.claude-sonnet-4-5). Model keys must be
-# the normalized id the proxy meters (version/region suffixes stripped).
-#
-# Values are USD per 1_000 tokens. Optional cache fields:
-#   cached_input_per_1k    OpenAI shape: rate for cached prompt tokens
-#                          (a SUBSET of input tokens). Absent -> cached
-#                          portion bills at input_per_1k.
-#   cache_read_per_1k      Anthropic shape: rate for cache_read tokens
-#                          (ADDITIVE to input). Absent -> input rate.
-#   cache_creation_per_1k  Anthropic shape: rate for cache_creation
-#                          tokens (ADDITIVE to input). Absent -> input
-#                          rate.
-`
--- a/management/internals/modules/agentnetwork/pricing/gen.go
+++ b/management/internals/modules/agentnetwork/pricing/gen.go
@@ -1,20 +0,0 @@
-//go:build ignore
-
-// Regenerates defaults_llm_pricing.example.yaml from the compiled-in
-// default pricing table. Run via:
-//
-//	go generate ./management/internals/modules/agentnetwork/pricing
-package main
-
-import (
-	"log"
-	"os"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
-)
-
-func main() {
-	if err := os.WriteFile("defaults_llm_pricing.example.yaml", pricing.MarshalDefaultsYAML(), 0o644); err != nil {
-		log.Fatalf("write defaults_llm_pricing.example.yaml: %v", err)
-	}
-}
--- a/management/internals/modules/agentnetwork/pricing/override.go
+++ b/management/internals/modules/agentnetwork/pricing/override.go
@@ -1,249 +0,0 @@
-package pricing
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"math"
-	"os"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"gopkg.in/yaml.v3"
-)
-
-// DefaultFileName is the basename probed under management's datadir when
-// AgentNetwork.PricingDefaultsFile doesn't configure an explicit path.
-const DefaultFileName = "defaults_llm_pricing.yaml"
-
-// ReloadInterval is the cadence at which the pricing file's mtime is
-// polled for changes.
-const ReloadInterval = time.Minute
-
-// maxFileBytes bounds the pricing file read so a misconfigured path
-// (pointed at a huge file) cannot exhaust process memory.
-const maxFileBytes = 4 << 20
-
-// pricingFile mirrors the on-disk YAML schema — the same schema the
-// proxy's retired embedded defaults_pricing.yaml used, so files written
-// for it keep working. Keys are pricing surfaces ("openai", "anthropic",
-// "bedrock"); nested keys are normalized model ids.
-type pricingFile map[string]map[string]struct {
-	InputPer1k         float64 `yaml:"input_per_1k"`
-	OutputPer1k        float64 `yaml:"output_per_1k"`
-	CachedInputPer1k   float64 `yaml:"cached_input_per_1k"`
-	CacheReadPer1k     float64 `yaml:"cache_read_per_1k"`
-	CacheCreationPer1k float64 `yaml:"cache_creation_per_1k"`
-}
-
-// fileState tracks the watched pricing file across reloads.
-var fileState struct {
-	mu    sync.Mutex
-	path  string
-	mtime int64
-}
-
-// LoadFile loads the management-side pricing defaults file and makes it
-// the live table (merged entry-whole over the compiled-in fallback; see
-// DefaultTable). The path stays registered for the periodic reloader, so
-// later edits — or the file (re)appearing after deletion — are picked up
-// without a restart.
-//
-// required governs the missing-file case: true for an explicitly
-// configured path (a typo must fail startup rather than silently bill
-// with built-ins the operator believes they replaced), false for the
-// conventional <datadir>/defaults_llm_pricing.yaml probe (absent file =
-// compiled-in defaults, still watched in case it appears). A file that
-// exists but is malformed is always an error at load time.
-func LoadFile(path string, required bool) error {
-	if path == "" {
-		return nil
-	}
-	fileState.mu.Lock()
-	fileState.path = path
-	fileState.mu.Unlock()
-
-	table, mtime, err := readFile(path)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) && !required {
-			log.Infof("agent-network pricing defaults file %s not present; serving built-in defaults", path)
-			return nil
-		}
-		return err
-	}
-	storeFileTable(table, mtime)
-	log.Infof("agent-network pricing defaults loaded from %s", path)
-	return nil
-}
-
-// StartReloader launches the periodic mtime-poll goroutine for the file
-// registered by LoadFile. Runtime failures are lenient — a parse error
-// keeps the previously loaded table and logs a warning; a deleted file
-// reverts to the compiled-in defaults — so a mid-edit save can never
-// take pricing down. Returns immediately when no path was registered.
-func StartReloader(ctx context.Context, interval time.Duration) {
-	fileState.mu.Lock()
-	path := fileState.path
-	fileState.mu.Unlock()
-	if path == "" {
-		return
-	}
-	if interval <= 0 {
-		interval = ReloadInterval
-	}
-	go func() {
-		t := time.NewTicker(interval)
-		defer t.Stop()
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			case <-t.C:
-				reload()
-			}
-		}
-	}()
-}
-
-// reload performs one mtime check + reload cycle.
-func reload() {
-	fileState.mu.Lock()
-	path, lastMtime := fileState.path, fileState.mtime
-	fileState.mu.Unlock()
-
-	log.Debugf("agent-network pricing defaults reload: checking %s for changes", path)
-
-	st, err := os.Stat(path)
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
-			// File removed (or not yet created): serve compiled-in
-			// defaults and reset mtime so a future (re)appearance loads.
-			if mergedTable.Swap(nil) != nil {
-				log.Warnf("agent-network pricing defaults file %s removed; reverting to built-in defaults", path)
-			}
-			setMtime(0)
-			return
-		}
-		log.Warnf("agent-network pricing defaults reload: stat %s: %v", path, err)
-		return
-	}
-	if st.ModTime().UnixNano() == lastMtime {
-		log.Debugf("agent-network pricing defaults %s unchanged since last check", path)
-		return
-	}
-
-	table, mtime, err := readFile(path)
-	if err != nil {
-		// Keep the previously loaded table — never blank prices because
-		// an operator saved mid-edit.
-		log.Warnf("agent-network pricing defaults reload failed for %s (keeping previous table): %v", path, err)
-		return
-	}
-	storeFileTable(table, mtime)
-	log.Infof("agent-network pricing defaults reloaded from %s", path)
-}
-
-func readFile(path string) (map[string]map[string]Entry, int64, error) {
-	f, err := os.Open(path)
-	if err != nil {
-		return nil, 0, fmt.Errorf("open pricing defaults %s: %w", path, err)
-	}
-	defer func() { _ = f.Close() }()
-
-	st, err := f.Stat()
-	if err != nil {
-		return nil, 0, fmt.Errorf("stat pricing defaults %s: %w", path, err)
-	}
-	data, err := io.ReadAll(io.LimitReader(f, maxFileBytes+1))
-	if err != nil {
-		return nil, 0, fmt.Errorf("read pricing defaults %s: %w", path, err)
-	}
-	if len(data) > maxFileBytes {
-		return nil, 0, fmt.Errorf("pricing defaults %s exceeds %d bytes", path, maxFileBytes)
-	}
-	table, err := parsePricingYAML(data)
-	if err != nil {
-		return nil, 0, fmt.Errorf("parse pricing defaults %s: %w", path, err)
-	}
-	return table, st.ModTime().UnixNano(), nil
-}
-
-// storeFileTable merges the parsed file over the compiled-in base and
-// publishes the result as the live table. File entries replace the
-// built-in entry for the same (surface, model) whole — they are not
-// field-merged — and surfaces/models the file doesn't mention keep the
-// built-in rates, so a partial file only needs the entries it changes.
-func storeFileTable(table map[string]map[string]Entry, mtime int64) {
-	base := compiledBase()
-	merged := make(map[string]map[string]Entry, len(base)+len(table))
-	for surface, models := range base {
-		inner := make(map[string]Entry, len(models))
-		for id, e := range models {
-			inner[id] = e
-		}
-		merged[surface] = inner
-	}
-	for surface, models := range table {
-		inner, ok := merged[surface]
-		if !ok {
-			inner = make(map[string]Entry, len(models))
-			merged[surface] = inner
-		}
-		for id, e := range models {
-			inner[id] = e
-		}
-	}
-	mergedTable.Store(&merged)
-	setMtime(mtime)
-}
-
-func setMtime(v int64) {
-	fileState.mu.Lock()
-	fileState.mtime = v
-	fileState.mu.Unlock()
-}
-
-// parsePricingYAML decodes and validates the pricing YAML. Unknown
-// fields are rejected (typos surface instead of silently pricing at 0)
-// and every rate must be a finite, non-negative USD amount — the same
-// constraints the HTTP API enforces on operator per-provider prices.
-func parsePricingYAML(data []byte) (map[string]map[string]Entry, error) {
-	dec := yaml.NewDecoder(bytes.NewReader(data))
-	dec.KnownFields(true)
-
-	var raw pricingFile
-	if err := dec.Decode(&raw); err != nil && !errors.Is(err, io.EOF) {
-		return nil, fmt.Errorf("decode yaml: %w", err)
-	}
-
-	out := make(map[string]map[string]Entry, len(raw))
-	for surface, models := range raw {
-		inner := make(map[string]Entry, len(models))
-		for model, e := range models {
-			for field, v := range map[string]float64{
-				"input_per_1k":          e.InputPer1k,
-				"output_per_1k":         e.OutputPer1k,
-				"cached_input_per_1k":   e.CachedInputPer1k,
-				"cache_read_per_1k":     e.CacheReadPer1k,
-				"cache_creation_per_1k": e.CacheCreationPer1k,
-			} {
-				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
-					return nil, fmt.Errorf("%s/%s: %s must be a finite, non-negative rate, got %v", surface, model, field, v)
-				}
-			}
-			inner[model] = Entry{
-				InputPer1k:         e.InputPer1k,
-				OutputPer1k:        e.OutputPer1k,
-				CachedInputPer1k:   e.CachedInputPer1k,
-				CacheReadPer1k:     e.CacheReadPer1k,
-				CacheCreationPer1k: e.CacheCreationPer1k,
-			}
-		}
-		out[surface] = inner
-	}
-	return out, nil
-}
--- a/management/internals/modules/agentnetwork/pricing/override_test.go
+++ b/management/internals/modules/agentnetwork/pricing/override_test.go
@@ -1,173 +0,0 @@
-package pricing
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// resetFileState snapshots and restores the package-level file state so
-// tests stay order-independent.
-func resetFileState(t *testing.T) {
-	t.Helper()
-	prevMerged := mergedTable.Load()
-	fileState.mu.Lock()
-	prevPath, prevMtime := fileState.path, fileState.mtime
-	fileState.mu.Unlock()
-	t.Cleanup(func() {
-		mergedTable.Store(prevMerged)
-		fileState.mu.Lock()
-		fileState.path, fileState.mtime = prevPath, prevMtime
-		fileState.mu.Unlock()
-	})
-}
-
-func writePricing(t *testing.T, path, yml string) {
-	t.Helper()
-	require.NoError(t, os.WriteFile(path, []byte(yml), 0o600))
-}
-
-func TestLoadFile_MergesOverCompiledDefaults(t *testing.T) {
-	resetFileState(t)
-	path := filepath.Join(t.TempDir(), DefaultFileName)
-	writePricing(t, path, `
-openai:
-  # Reprice a built-in model. The entry replaces the built-in WHOLE:
-  # omitting the cache rate here drops the built-in 0.00125 discount.
-  gpt-4o:
-    input_per_1k: 0.9
-    output_per_1k: 1.8
-  # A model NetBird doesn't know at all.
-  my-private-ft:
-    input_per_1k: 0.01
-    output_per_1k: 0.02
-    cached_input_per_1k: 0.005
-gemini:
-  gemini-pro:
-    input_per_1k: 0.00125
-    output_per_1k: 0.005
-`)
-	require.NoError(t, LoadFile(path, true))
-	table := DefaultTable()
-
-	gpt4o := table["openai"]["gpt-4o"]
-	assert.InDelta(t, 0.9, gpt4o.InputPer1k, 1e-9, "file rate replaces the compiled-in rate")
-	assert.Zero(t, gpt4o.CachedInputPer1k, "entries replace whole — omitted cache rate is dropped, not inherited")
-
-	ft := table["openai"]["my-private-ft"]
-	assert.InDelta(t, 0.005, ft.CachedInputPer1k, 1e-9, "unknown models are added to the surface")
-	_, ok := table["gemini"]["gemini-pro"]
-	assert.True(t, ok, "a surface the catalog doesn't declare can be added")
-
-	// Untouched entries keep compiled-in rates (catalog, other surface,
-	// supplemental).
-	assert.InDelta(t, 0.00015, table["openai"]["gpt-4o-mini"].InputPer1k, 1e-9, "unlisted model keeps compiled rate")
-	assert.InDelta(t, 0.003, table["anthropic"]["claude-sonnet-4-5"].InputPer1k, 1e-9, "unlisted surface untouched")
-	assert.InDelta(t, 0.00125, table["openai"]["gpt-5"].InputPer1k, 1e-9, "supplemental entries untouched")
-
-	// The synthesizer-facing lookup reads the live table too.
-	e, ok := LookupDefault([]string{"openai"}, "gpt-4o")
-	require.True(t, ok)
-	assert.InDelta(t, 0.9, e.InputPer1k, 1e-9, "LookupDefault serves the file-backed rate")
-}
-
-func TestLoadFile_MissingPath(t *testing.T) {
-	resetFileState(t)
-	missing := filepath.Join(t.TempDir(), DefaultFileName)
-
-	require.Error(t, LoadFile(missing, true),
-		"explicitly configured path that doesn't exist must fail startup")
-
-	require.NoError(t, LoadFile(missing, false),
-		"conventional datadir probe tolerates an absent file (compiled-in defaults serve)")
-	assert.Nil(t, mergedTable.Load(), "no file, no merged table")
-	fileState.mu.Lock()
-	path := fileState.path
-	fileState.mu.Unlock()
-	assert.Equal(t, missing, path, "the path stays registered so the reloader picks the file up when it appears")
-}
-
-func TestLoadFile_RejectsInvalid(t *testing.T) {
-	resetFileState(t)
-	dir := t.TempDir()
-	cases := map[string]string{
-		"unknown field (typo)": "openai:\n  gpt-4o:\n    input_per1k: 0.1\n",
-		"negative rate":        "openai:\n  gpt-4o:\n    input_per_1k: -0.1\n",
-		"non-numeric rate":     "openai:\n  gpt-4o:\n    input_per_1k: cheap\n",
-		"not a mapping":        "- just\n- a\n- list\n",
-	}
-	for name, yml := range cases {
-		path := filepath.Join(dir, DefaultFileName)
-		writePricing(t, path, yml)
-		assert.Error(t, LoadFile(path, true), "case %q must be rejected", name)
-	}
-}
-
-// TestReload_LifeCycle drives the reloader's single-shot reload through
-// its full lifecycle: file edit picked up on mtime change, a broken save
-// keeps the previous table, and file removal reverts to the compiled-in
-// defaults (then a re-created file loads again).
-func TestReload_LifeCycle(t *testing.T) {
-	resetFileState(t)
-	path := filepath.Join(t.TempDir(), DefaultFileName)
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.5\n    output_per_1k: 1\n")
-	require.NoError(t, LoadFile(path, true))
-	require.InDelta(t, 0.5, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9)
-
-	// Edit: new mtime, new rates.
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.7\n    output_per_1k: 1.4\n")
-	bumpMtime(t, path)
-	reload()
-	assert.InDelta(t, 0.7, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9, "edit must be picked up")
-
-	// Broken save: previous table survives.
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: -1\n")
-	bumpMtime(t, path)
-	reload()
-	assert.InDelta(t, 0.7, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
-		"a malformed save must keep the previously loaded table, never blank prices")
-
-	// Removal: compiled-in defaults serve again.
-	require.NoError(t, os.Remove(path))
-	reload()
-	assert.InDelta(t, 0.0025, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
-		"file removal reverts to the compiled-in rate")
-
-	// Re-created file loads without a restart.
-	writePricing(t, path, "openai:\n  gpt-4o:\n    input_per_1k: 0.9\n    output_per_1k: 1.8\n")
-	bumpMtime(t, path)
-	reload()
-	assert.InDelta(t, 0.9, DefaultTable()["openai"]["gpt-4o"].InputPer1k, 1e-9,
-		"a file appearing after removal (or after a missing-probe boot) must load")
-}
-
-// bumpMtime pushes the file's mtime forward past the previously recorded
-// value — timestamps can otherwise collide within the test's timescale.
-func bumpMtime(t *testing.T, path string) {
-	t.Helper()
-	st, err := os.Stat(path)
-	require.NoError(t, err)
-	next := st.ModTime().Add(2 * 1e9)
-	require.NoError(t, os.Chtimes(path, next, next))
-}
-
-// TestExampleYAML_InSyncWithBuiltins is the golden guard for
-// defaults_llm_pricing.example.yaml: the shipped example must stay
-// byte-identical to what the compiled-in table renders (catalog edits
-// require `go generate ./management/internals/modules/agentnetwork/pricing`)
-// and must round-trip through the same parser operators' files go
-// through, reproducing the compiled-in table exactly.
-func TestExampleYAML_InSyncWithBuiltins(t *testing.T) {
-	onDisk, err := os.ReadFile("defaults_llm_pricing.example.yaml")
-	require.NoError(t, err, "example file must exist next to the package")
-	require.Equal(t, string(MarshalDefaultsYAML()), string(onDisk),
-		"defaults_llm_pricing.example.yaml is stale — run: go generate ./management/internals/modules/agentnetwork/pricing")
-
-	parsed, err := parsePricingYAML(onDisk)
-	require.NoError(t, err, "the example must be a valid pricing defaults file")
-	assert.Equal(t, buildDefaultTable(), parsed,
-		"parsing the example must reproduce the compiled-in table exactly")
-}
--- a/management/internals/modules/agentnetwork/synthesizer.go
+++ b/management/internals/modules/agentnetwork/synthesizer.go
@@ -233,11 +233,6 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 		return nil, err
 	}

-	costMeterJSON, err := buildCostMeterConfigJSON(enabledProviders, groupIndex)
-	if err != nil {
-		return nil, err
-	}
-
 	mergedGuardrails := mergeGuardrails(enabledPolicies, guardrailsByID)
 	applyAccountCollectionControls(&mergedGuardrails, settings)
 	// The proxy guardrail is a per-provider fail-closed backstop; the
@@ -253,7 +248,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	// Use the merged decision (account settings OR policy-required redaction),
 	// not the raw account flag, so a policy that mandates PII redaction is
 	// honored by the capture parsers even when the account toggle is off.
-	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, costMeterJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)
+	middlewares := buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, mergedGuardrails.PromptCapture.RedactPii, mergedGuardrails.PromptCapture.Enabled)

 	priv, pub, err := pickServiceSessionKeys(enabledProviders)
 	if err != nil {
@@ -705,7 +700,7 @@ func buildIdentityExtraHeaders(p *types.Provider, extras []catalog.ExtraHeader)
 // requests bound for gateways like LiteLLM that key budgets and
 // attribution off request headers. CanMutate is required so its
 // HeadersAdd / HeadersRemove pass the framework's mutation gate.
-func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, costMeterJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
+func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byte, redactPii, capturePromptContent bool) []rpservice.MiddlewareConfig {
 	// Both parsers receive an explicit capture flag derived from the account's
 	// enable_prompt_collection toggle; nil/unset would default to the legacy
 	// "always emit" behavior in the middleware, which is precisely what we
@@ -774,13 +769,10 @@ func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON, cost
 			ConfigJSON: []byte("{}"),
 		},
 		{
-			// Carries the full pricing table (defaults + per-provider
-			// operator prices) so the proxy bills without an embedded
-			// price list; see buildCostMeterConfigJSON.
 			ID:         middlewareIDCostMeter,
 			Enabled:    true,
 			Slot:       rpservice.MiddlewareSlotOnResponse,
-			ConfigJSON: costMeterJSON,
+			ConfigJSON: []byte("{}"),
 		},
 		{
 			ID:         middlewareIDLLMResponseParser,
--- a/management/internals/modules/agentnetwork/synthesizer_pricing.go
+++ b/management/internals/modules/agentnetwork/synthesizer_pricing.go
@@ -1,131 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"fmt"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// costMeterConfig is the JSON shape the proxy-side cost_meter middleware
-// expects (mirror-type pattern, same as routerConfig). The top-level
-// "pricing" wrapper is the feature-detection signal: an old proxy's config
-// struct ignores it as an unknown field, and a new proxy treats its
-// absence as "old management" (skips every cost computation and warns).
-type costMeterConfig struct {
-	Pricing *costMeterPricing `json:"pricing,omitempty"`
-}
-
-// costMeterPricing carries the full pricing table:
-//   - Defaults: surface ("openai"/"anthropic"/"bedrock") -> normalized
-//     model id -> rates. The full default table ships to every account —
-//     it is small (~10 KB) and keeps gateway-style providers (which
-//     enumerate no models) priced for every catalog model.
-//   - Providers: provider record id (matched against the
-//     llm.resolved_provider_id metadata llm_router stamps) -> normalized
-//     model id -> rates. Entries are fully materialized here at synth
-//     time — default cache rates already folded in — so the proxy does
-//     two map lookups and no merging.
-type costMeterPricing struct {
-	Defaults  map[string]map[string]pricing.Entry `json:"defaults,omitempty"`
-	Providers map[string]map[string]pricing.Entry `json:"providers,omitempty"`
-}
-
-// buildCostMeterConfigJSON assembles the cost_meter middleware config
-// from the default pricing table plus the operator's stored per-provider
-// model prices. Same orphan rule as the router: a provider no enabled
-// policy authorises is unreachable, so its prices are not shipped.
-//
-// Overlay semantics per model row:
-//   - The row's model id is normalized exactly the way the proxy's
-//     request parser normalizes the ids it meters (bedrock ARN/region/
-//     version stripping, vertex "@version" stripping), so the per-record
-//     lookup key compares equal to llm.model at billing time.
-//   - The entry starts from the default entry for that model (when one
-//     exists) to inherit cache rates the operator didn't state.
-//   - Operator input/output overlay verbatim — including an explicit 0,
-//     which prices the model as free (self-hosted / internal endpoints)
-//     rather than silently reverting to list price.
-//   - Cache-rate pointers overlay only when non-nil: nil means "inherit
-//     the default", an explicit 0 means "no discount, bill this bucket
-//     at the input rate".
-func buildCostMeterConfigJSON(providers []*types.Provider, groupIndex map[string][]string) ([]byte, error) {
-	cfg := costMeterConfig{Pricing: &costMeterPricing{
-		Defaults: pricing.DefaultTable(),
-	}}
-
-	perRecord := make(map[string]map[string]pricing.Entry)
-	for _, p := range providers {
-		if _, hasPolicy := groupIndex[p.ID]; !hasPolicy {
-			// Orphan: unreachable via the router, so unpriceable.
-			continue
-		}
-		if len(p.Models) == 0 {
-			// Gateway-style "claim every model" provider: the defaults
-			// table is its price list.
-			continue
-		}
-		entry, _ := catalog.Lookup(p.ProviderID)
-		models := make(map[string]pricing.Entry, len(p.Models))
-		for _, m := range p.Models {
-			id := normalizePricingModelID(p.ProviderID, m.ID)
-			if id == "" {
-				continue
-			}
-			if _, dup := models[id]; dup {
-				// First occurrence wins on post-normalization duplicates,
-				// matching providerModelIDs' dedup order for routing.
-				continue
-			}
-			models[id] = materializeEntry(entry.PricingSurfaces, id, m)
-		}
-		if len(models) > 0 {
-			perRecord[p.ID] = models
-		}
-	}
-	if len(perRecord) > 0 {
-		cfg.Pricing.Providers = perRecord
-	}
-
-	out, err := json.Marshal(cfg)
-	if err != nil {
-		return nil, fmt.Errorf("marshal cost_meter middleware config: %w", err)
-	}
-	return out, nil
-}
-
-// normalizePricingModelID maps an operator-entered model id onto the
-// normalized id the proxy's request parser emits as llm.model — the key
-// the cost meter looks up at billing time.
-func normalizePricingModelID(catalogProviderID, modelID string) string {
-	switch {
-	case catalog.IsBedrockPathStyle(catalogProviderID):
-		return sharedllm.NormalizeBedrockModel(modelID)
-	case catalog.IsVertexPathStyle(catalogProviderID):
-		return sharedllm.NormalizeVertexModel(modelID)
-	default:
-		return modelID
-	}
-}
-
-// materializeEntry folds the default entry for (surfaces, model) — when
-// one exists — under the operator's stored prices, producing the fully
-// materialized wire entry.
-func materializeEntry(surfaces []string, normalizedID string, m types.ProviderModel) pricing.Entry {
-	e, _ := pricing.LookupDefault(surfaces, normalizedID) // zero Entry on miss
-	e.InputPer1k = m.InputPer1k
-	e.OutputPer1k = m.OutputPer1k
-	if m.CachedInputPer1k != nil {
-		e.CachedInputPer1k = *m.CachedInputPer1k
-	}
-	if m.CacheReadPer1k != nil {
-		e.CacheReadPer1k = *m.CacheReadPer1k
-	}
-	if m.CacheCreationPer1k != nil {
-		e.CacheCreationPer1k = *m.CacheCreationPer1k
-	}
-	return e
-}
--- a/management/internals/modules/agentnetwork/synthesizer_pricing_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_pricing_test.go
@@ -1,105 +0,0 @@
-package agentnetwork
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-)
-
-func fptr(v float64) *float64 { return &v }
-
-func decodeCostMeterConfig(t *testing.T, raw []byte) costMeterConfig {
-	t.Helper()
-	var cfg costMeterConfig
-	require.NoError(t, json.Unmarshal(raw, &cfg), "cost meter config must round-trip")
-	require.NotNil(t, cfg.Pricing, "pricing wrapper must be present")
-	return cfg
-}
-
-// TestBuildCostMeterConfig_BedrockModelNormalization: the operator may
-// paste region-prefixed, versioned, or ARN-wrapped Bedrock ids; the
-// per-record map must be keyed by the normalized id the request parser
-// emits as llm.model, or the lookup never hits at billing time.
-func TestBuildCostMeterConfig_BedrockModelNormalization(t *testing.T) {
-	bedrock := &types.Provider{
-		ID:         "prov-bedrock",
-		ProviderID: "bedrock_api",
-		Enabled:    true,
-		Models: []types.ProviderModel{
-			{ID: "eu.anthropic.claude-sonnet-4-5-20250929-v1:0", InputPer1k: 0.0033, OutputPer1k: 0.0165},
-			// Post-normalization duplicate of the row above under a
-			// different regional spelling — first occurrence wins.
-			{ID: "us.anthropic.claude-sonnet-4-5-20250929-v1:0", InputPer1k: 9.9, OutputPer1k: 9.9},
-		},
-	}
-	raw, err := buildCostMeterConfigJSON([]*types.Provider{bedrock}, map[string][]string{"prov-bedrock": {"grp"}})
-	require.NoError(t, err)
-	cfg := decodeCostMeterConfig(t, raw)
-
-	models := cfg.Pricing.Providers["prov-bedrock"]
-	require.Len(t, models, 1, "both spellings normalize to one model; first row wins")
-	e, ok := models["anthropic.claude-sonnet-4-5"]
-	require.True(t, ok, "key must be the normalized id the parser emits, not the operator's raw spelling")
-	assert.InDelta(t, 0.0033, e.InputPer1k, 1e-9, "first row's rate wins the dedup")
-	assert.InDelta(t, 0.0003, e.CacheReadPer1k, 1e-9, "cache read inherited from the bedrock default entry")
-	assert.InDelta(t, 0.00375, e.CacheCreationPer1k, 1e-9, "cache creation inherited from the bedrock default entry")
-}
-
-// TestBuildCostMeterConfig_CacheRateNilVsZero pins the pointer semantics:
-// nil inherits the default cache rate, explicit 0 clears it (that bucket
-// bills at the input rate on the proxy).
-func TestBuildCostMeterConfig_CacheRateNilVsZero(t *testing.T) {
-	p := &types.Provider{
-		ID:         "prov-oai",
-		ProviderID: "openai_api",
-		Enabled:    true,
-		Models: []types.ProviderModel{
-			{ID: "gpt-4o", InputPer1k: 0.002, OutputPer1k: 0.008},                                    // nil → inherit 0.00125
-			{ID: "gpt-4o-mini", InputPer1k: 0.0001, OutputPer1k: 0.0005, CachedInputPer1k: fptr(0)},  // explicit 0 → no discount
-			{ID: "my-custom-ft", InputPer1k: 0.01, OutputPer1k: 0.02, CachedInputPer1k: fptr(0.005)}, // unknown model, explicit rate
-		},
-	}
-	raw, err := buildCostMeterConfigJSON([]*types.Provider{p}, map[string][]string{"prov-oai": {"grp"}})
-	require.NoError(t, err)
-	cfg := decodeCostMeterConfig(t, raw)
-	models := cfg.Pricing.Providers["prov-oai"]
-
-	assert.InDelta(t, 0.00125, models["gpt-4o"].CachedInputPer1k, 1e-9, "nil cache pointer inherits the default rate")
-	assert.Zero(t, models["gpt-4o-mini"].CachedInputPer1k, "explicit 0 overrides the default (0.000075) — bucket bills at input rate")
-	custom := models["my-custom-ft"]
-	assert.InDelta(t, 0.005, custom.CachedInputPer1k, 1e-9, "unknown model keeps the operator's explicit cache rate")
-	assert.Zero(t, custom.CacheReadPer1k, "no default to inherit for a model outside the catalog")
-}
-
-// TestBuildCostMeterConfig_OrphanAndGatewayProviders: an orphan (no
-// authorising policy) is unreachable so its prices must not ship; a
-// gateway with no model rows relies on the defaults table and gets no
-// per-record entry.
-func TestBuildCostMeterConfig_OrphanAndGatewayProviders(t *testing.T) {
-	orphan := &types.Provider{
-		ID:         "prov-orphan",
-		ProviderID: "openai_api",
-		Enabled:    true,
-		Models:     []types.ProviderModel{{ID: "gpt-4o", InputPer1k: 1, OutputPer1k: 1}},
-	}
-	gateway := &types.Provider{
-		ID:         "prov-litellm",
-		ProviderID: "litellm_proxy",
-		Enabled:    true,
-		Models:     []types.ProviderModel{},
-	}
-	raw, err := buildCostMeterConfigJSON(
-		[]*types.Provider{orphan, gateway},
-		map[string][]string{"prov-litellm": {"grp"}}, // orphan has no policy
-	)
-	require.NoError(t, err)
-	cfg := decodeCostMeterConfig(t, raw)
-
-	assert.NotContains(t, cfg.Pricing.Providers, "prov-orphan", "orphan provider prices must not ship")
-	assert.NotContains(t, cfg.Pricing.Providers, "prov-litellm", "empty-models gateway needs no per-record entry")
-	assert.NotEmpty(t, cfg.Pricing.Defaults["openai"], "defaults still ship so the gateway's catalog-model traffic is priced")
-}
--- a/management/internals/modules/agentnetwork/synthesizer_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_test.go
@@ -33,17 +33,14 @@ func newSynthTestSettings() *types.Settings {

 func newSynthTestProvider() *types.Provider {
 	return &types.Provider{
-		ID:          "prov-1",
-		AccountID:   testAccountID,
-		ProviderID:  "openai_api",
-		Name:        "OpenAI",
-		UpstreamURL: "https://api.openai.com",
-		APIKey:      "sk-test-key",
-		Enabled:     true,
-		// Prices deliberately differ from the catalog's gpt-5.4 rates
-		// (0.0025/0.015) so pricing tests can prove the operator's
-		// stored price overlays the catalog default.
-		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.004, OutputPer1k: 0.02}},
+		ID:                "prov-1",
+		AccountID:         testAccountID,
+		ProviderID:        "openai_api",
+		Name:              "OpenAI",
+		UpstreamURL:       "https://api.openai.com",
+		APIKey:            "sk-test-key",
+		Enabled:           true,
+		Models:            []types.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.0025, OutputPer1k: 0.015}},
 		SessionPrivateKey: "test-priv-key",
 		SessionPublicKey:  "test-pub-key",
 		CreatedAt:         time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
@@ -217,27 +214,7 @@ func TestSynthesizeServices_HappyPath(t *testing.T) {

 	assert.Equal(t, middlewareIDCostMeter, mws[6].ID, "seventh middleware is the cost meter")
 	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[6].Slot, "cost meter runs on_response")
-
-	var costCfg costMeterConfig
-	require.NoError(t, json.Unmarshal(mws[6].ConfigJSON, &costCfg), "cost meter config must unmarshal")
-	require.NotNil(t, costCfg.Pricing, "cost meter config must carry the pricing table — its absence tells the proxy management predates config-delivered pricing")
-
-	gpt4o, ok := costCfg.Pricing.Defaults["openai"]["gpt-4o"]
-	require.True(t, ok, "the full default table ships regardless of the account's providers")
-	assert.InDelta(t, 0.0025, gpt4o.InputPer1k, 1e-9, "default gpt-4o input rate comes from the catalog")
-
-	openaiPrices, ok := costCfg.Pricing.Providers[openai.ID]
-	require.True(t, ok, "operator-priced provider must have a per-record entry")
-	gpt54, ok := openaiPrices["gpt-5.4"]
-	require.True(t, ok, "operator's model row keys the per-record map")
-	assert.InDelta(t, 0.004, gpt54.InputPer1k, 1e-9, "operator input price overlays the catalog default (0.0025)")
-	assert.InDelta(t, 0.02, gpt54.OutputPer1k, 1e-9, "operator output price overlays the catalog default (0.015)")
-	assert.InDelta(t, 0.00025, gpt54.CachedInputPer1k, 1e-9, "cache rate the operator didn't state is inherited from the default entry")
-
-	opus, ok := costCfg.Pricing.Providers[anthropic.ID]["claude-opus-4-7"]
-	require.True(t, ok, "anthropic's model row keys its per-record map")
-	assert.Zero(t, opus.InputPer1k, "operator-stored zero prices ship verbatim — an explicit $0 model bills as free, it does not revert to list price")
-	assert.InDelta(t, 0.0005, opus.CacheReadPer1k, 1e-9, "cache rates still inherit from the default entry")
+	assert.Equal(t, []byte("{}"), mws[6].ConfigJSON, "cost meter carries an explicit empty config")

 	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].ID, "eighth middleware is the response parser")
 	assert.Equal(t, rpservice.MiddlewareSlotOnResponse, mws[7].Slot, "response parser runs on_response")
--- a/management/internals/modules/agentnetwork/types/provider.go
+++ b/management/internals/modules/agentnetwork/types/provider.go
@@ -14,24 +14,10 @@ import (
 // ProviderModel is one row in the provider's models list. The operator
 // pins the per-1k input/output price for cost tracking; ID is the
 // model identifier the upstream provider expects on the wire.
-//
-// The three cache rates are pointers because absence is meaningful: nil
-// means "inherit NetBird's default rate for this model" (folded in at
-// synthesis time), while an explicit 0 means "no discount — bill this
-// cache bucket at the input rate".
 type ProviderModel struct {
 	ID          string  `json:"id"`
 	InputPer1k  float64 `json:"input_per_1k"`
 	OutputPer1k float64 `json:"output_per_1k"`
-	// CachedInputPer1k is the OpenAI-shape rate for cached prompt tokens
-	// (a subset of input tokens).
-	CachedInputPer1k *float64 `json:"cached_input_per_1k,omitempty"`
-	// CacheReadPer1k is the Anthropic-shape rate for cache-read tokens
-	// (additive to input tokens).
-	CacheReadPer1k *float64 `json:"cache_read_per_1k,omitempty"`
-	// CacheCreationPer1k is the Anthropic-shape rate for cache-creation
-	// tokens (additive to input tokens).
-	CacheCreationPer1k *float64 `json:"cache_creation_per_1k,omitempty"`
 }

 // Provider is an Agent Network AI provider record persisted per account.
@@ -142,12 +128,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 	if req.Models != nil {
 		for _, m := range *req.Models {
 			p.Models = append(p.Models, ProviderModel{
-				ID:                 m.Id,
-				InputPer1k:         m.InputPer1k,
-				OutputPer1k:        m.OutputPer1k,
-				CachedInputPer1k:   copyFloatPtr(m.CachedInputPer1k),
-				CacheReadPer1k:     copyFloatPtr(m.CacheReadPer1k),
-				CacheCreationPer1k: copyFloatPtr(m.CacheCreationPer1k),
+				ID:          m.Id,
+				InputPer1k:  m.InputPer1k,
+				OutputPer1k: m.OutputPer1k,
 			})
 		}
 	}
@@ -181,12 +164,9 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	models := make([]api.AgentNetworkProviderModel, 0, len(p.Models))
 	for _, m := range p.Models {
 		models = append(models, api.AgentNetworkProviderModel{
-			Id:                 m.ID,
-			InputPer1k:         m.InputPer1k,
-			OutputPer1k:        m.OutputPer1k,
-			CachedInputPer1k:   copyFloatPtr(m.CachedInputPer1k),
-			CacheReadPer1k:     copyFloatPtr(m.CacheReadPer1k),
-			CacheCreationPer1k: copyFloatPtr(m.CacheCreationPer1k),
+			Id:          m.ID,
+			InputPer1k:  m.InputPer1k,
+			OutputPer1k: m.OutputPer1k,
 		})
 	}
 	created := p.CreatedAt
@@ -221,27 +201,11 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	return resp
 }

-// copyFloatPtr returns a fresh pointer to the same value, or nil. Keeps
-// stored models and API payloads from aliasing each other's rate fields.
-func copyFloatPtr(v *float64) *float64 {
-	if v == nil {
-		return nil
-	}
-	out := *v
-	return &out
-}
-
 // Copy returns a deep copy of the provider.
 func (p *Provider) Copy() *Provider {
 	clone := *p
 	if p.Models != nil {
-		clone.Models = make([]ProviderModel, len(p.Models))
-		for i, m := range p.Models {
-			m.CachedInputPer1k = copyFloatPtr(m.CachedInputPer1k)
-			m.CacheReadPer1k = copyFloatPtr(m.CacheReadPer1k)
-			m.CacheCreationPer1k = copyFloatPtr(m.CacheCreationPer1k)
-			clone.Models[i] = m
-		}
+		clone.Models = append([]ProviderModel(nil), p.Models...)
 	}
 	if p.ExtraValues != nil {
 		clone.ExtraValues = make(map[string]string, len(p.ExtraValues))
--- a/management/internals/modules/agentnetwork/wire_shape_test.go
+++ b/management/internals/modules/agentnetwork/wire_shape_test.go
@@ -103,12 +103,6 @@ func TestSynthesizedService_WireShape(t *testing.T) {

 	assert.Equal(t, middlewareIDCostMeter, mws[6].GetId(), "seventh middleware id")
 	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[6].GetSlot(), "cost meter slot")
-	var costCfg costMeterConfig
-	require.NoError(t, json.Unmarshal(mws[6].GetConfigJson(), &costCfg), "cost meter config JSON must decode from the wire")
-	require.NotNil(t, costCfg.Pricing, "the pricing table must travel on the wire — the proxy has no embedded price list to fall back to")
-	assert.NotEmpty(t, costCfg.Pricing.Defaults["openai"], "default table rides in every mapping")
-	assert.NotEmpty(t, costCfg.Pricing.Defaults["anthropic"], "default table covers all surfaces")
-	assert.NotEmpty(t, costCfg.Pricing.Defaults["bedrock"], "default table covers all surfaces")

 	assert.Equal(t, middlewareIDLLMResponseParser, mws[7].GetId(), "eighth middleware id")
 	assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[7].GetSlot(), "response parser slot")
--- a/management/internals/server/config/config.go
+++ b/management/internals/server/config/config.go
@@ -55,8 +55,6 @@ type Config struct {

 	ReverseProxy ReverseProxy

-	AgentNetwork AgentNetwork
-
 	// disable default all-to-all policy
 	DisableDefaultPolicy bool

@@ -187,25 +185,6 @@ type StoreConfig struct {
 	Engine types.Engine
 }

-// AgentNetwork contains agent-network (LLM gateway) configuration.
-type AgentNetwork struct {
-	// PricingDefaultsFile is the path to the YAML file holding the default
-	// LLM pricing table (defaults_llm_pricing.yaml). A relative path is
-	// resolved against <Datadir>, so a bare filename lands alongside the
-	// store. Empty falls back to probing <Datadir>/defaults_llm_pricing.yaml;
-	// with no file present the compiled-in defaults serve. Schema: surface ("openai"/"anthropic"/
-	// "bedrock") -> model -> rates in USD per 1k tokens (input_per_1k,
-	// output_per_1k, and the optional cached_input_per_1k /
-	// cache_read_per_1k / cache_creation_per_1k). File entries replace the
-	// compiled-in entry for the same surface+model whole; everything else
-	// keeps the compiled-in rates. The file is re-read periodically (mtime
-	// poll), and the live table feeds both the synthesizer (what proxies
-	// bill with) and the dashboard's catalog endpoint (what model rows
-	// prefill with). An explicitly configured path that fails to load
-	// fails startup; runtime reload errors keep the previous table.
-	PricingDefaultsFile string
-}
-
 // ReverseProxy contains reverse proxy configuration in front of management.
 type ReverseProxy struct {
 	// TrustedHTTPProxies represents a list of trusted HTTP proxies by their IP prefixes.
--- a/proxy/internal/llm/bedrock_model.go
+++ b/proxy/internal/llm/bedrock_model.go
@@ -0,0 +1,38 @@
+package llm
+
+import (
+	"regexp"
+	"strings"
+)
+
+// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
+// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
+var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+
+// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
+// version/throughput suffix of a Bedrock model id.
+var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+
+// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key, e.g.
+// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
+// and the inference-profile ARN's last segment likewise. It is the single
+// source of truth shared by the request parser (which normalizes the request
+// model from the URL path) and the router (which normalizes the operator's
+// registered Bedrock model ids so both sides compare equal).
+func NormalizeBedrockModel(modelID string) string {
+	m := modelID
+	if strings.HasPrefix(m, "arn:") {
+		if i := strings.LastIndex(m, "/"); i >= 0 {
+			m = m[i+1:]
+		}
+	}
+	for _, p := range bedrockRegionPrefixes {
+		if strings.HasPrefix(m, p) {
+			m = m[len(p):]
+			break
+		}
+	}
+	return bedrockVersionSuffix.ReplaceAllString(m, "")
+}
--- a/proxy/internal/llm/bedrock_model_test.go
+++ b/proxy/internal/llm/bedrock_model_test.go
@@ -11,8 +11,6 @@ func TestNormalizeBedrockModel(t *testing.T) {
 		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
 		"us.anthropic.claude-haiku-4-5":                "anthropic.claude-haiku-4-5",
 		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
-		"apac.anthropic.claude-haiku-4-5-v1:0":         "anthropic.claude-haiku-4-5",
-		"amazon.nova-2-lite-v1:0":                      "amazon.nova-2-lite",
 		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
 		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
 		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
@@ -23,14 +21,3 @@ func TestNormalizeBedrockModel(t *testing.T) {
 		require.Equal(t, want, NormalizeBedrockModel(in), "normalize %q", in)
 	}
 }
-
-func TestNormalizeVertexModel(t *testing.T) {
-	cases := map[string]string{
-		"claude-sonnet-4-5@20250929": "claude-sonnet-4-5",
-		"claude-haiku-4-5":           "claude-haiku-4-5",
-		"gpt-4o@2024-08-06":          "gpt-4o",
-	}
-	for in, want := range cases {
-		require.Equal(t, want, NormalizeVertexModel(in), "normalize %q", in)
-	}
-}
--- a/proxy/internal/llm/fixtures/pricing.yaml
+++ b/proxy/internal/llm/fixtures/pricing.yaml
@@ -0,0 +1,59 @@
+# Realistic-pricing starter for llm_observability. Drop this into the
+# directory you point the proxy at via --plugin-data-dir, then reference it
+# from the target's plugin config:
+#
+#   plugins:
+#     - id: llm_observability
+#       enabled: true
+#       params:
+#         pricing_path: pricing.yaml
+#
+# Values are USD per 1_000 tokens. Public list prices drift; treat this as a
+# starting point and keep your production copy current.
+
+openai:
+  # GPT-5 family
+  gpt-5:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+  gpt-5-mini:
+    input_per_1k: 0.00025
+    output_per_1k: 0.002
+  gpt-5-nano:
+    input_per_1k: 0.00005
+    output_per_1k: 0.0004
+  gpt-5.4:
+    input_per_1k: 0.00125
+    output_per_1k: 0.01
+  # GPT-4o family
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+  # Embeddings
+  text-embedding-3-large:
+    input_per_1k: 0.00013
+    output_per_1k: 0
+  text-embedding-3-small:
+    input_per_1k: 0.00002
+    output_per_1k: 0
+
+anthropic:
+  # Claude 4.x family
+  claude-opus-4-7:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+  claude-sonnet-4-7:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+  claude-haiku-4-5:
+    input_per_1k: 0.0008
+    output_per_1k: 0.004
--- a/proxy/internal/llm/model.go
+++ b/proxy/internal/llm/model.go
@@ -1,21 +0,0 @@
-package llm
-
-import (
-	sharedllm "github.com/netbirdio/netbird/shared/llm"
-)
-
-// NormalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
-// prefix, and the version/throughput suffix from a Bedrock model id so it
-// matches the catalog/pricing key. Thin delegate to the shared implementation
-// (shared/llm), which management also uses at synthesis time so both sides of
-// the pricing / routing contract normalize identically.
-func NormalizeBedrockModel(modelID string) string {
-	return sharedllm.NormalizeBedrockModel(modelID)
-}
-
-// NormalizeVertexModel strips the "@version" suffix from a Vertex AI model id
-// so it matches the catalog/pricing key. Thin delegate to shared/llm, kept
-// beside NormalizeBedrockModel for the same contract reason.
-func NormalizeVertexModel(modelID string) string {
-	return sharedllm.NormalizeVertexModel(modelID)
-}
--- a/proxy/internal/llm/pricing/defaults_coverage_test.go
+++ b/proxy/internal/llm/pricing/defaults_coverage_test.go
@@ -0,0 +1,65 @@
+package pricing
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestDefaultTable_FirstPartyModelCoverage guards the embedded defaults against
+// silent drift/gaps: every metered first-party model the management catalog
+// enumerates must resolve to a price, and a few rates that previously drifted
+// are pinned to their LiteLLM-validated values. Keep this list in step with the
+// catalog (management/server/agentnetwork/catalog) when adding models.
+func TestDefaultTable_FirstPartyModelCoverage(t *testing.T) {
+	tbl := DefaultTable()
+	require.NotNil(t, tbl, "embedded default pricing table must load")
+
+	mustPrice := map[string][]string{
+		// openai parser covers openai_api, azure_openai_api, and mistral_api.
+		"openai": {
+			"gpt-5.5", "gpt-5.5-pro", "gpt-5.4", "gpt-5.4-mini", "gpt-5.4-nano",
+			"gpt-5.3-codex", "gpt-5.3-chat-latest", "o4-mini",
+			"gpt-4.1", "gpt-4.1-mini", "gpt-4.1-nano", "gpt-4o", "gpt-4o-mini",
+			"gpt-4-turbo", "gpt-3.5-turbo", "gpt-35-turbo",
+			"text-embedding-3-large", "text-embedding-3-small",
+			"mistral-large-latest", "mistral-medium-3-5", "codestral-2508",
+			"ministral-8b-latest", "mistral-embed",
+		},
+		"anthropic": {
+			"claude-fable-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
+			"claude-opus-4-1", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5",
+		},
+		// bedrock keys are the normalized ids the request parser emits.
+		"bedrock": {
+			"anthropic.claude-opus-5", "anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
+			"anthropic.claude-opus-4-1", "anthropic.claude-sonnet-4-6", "anthropic.claude-sonnet-4-5",
+			"anthropic.claude-haiku-4-5", "meta.llama3-3-70b-instruct",
+			"amazon.nova-pro", "amazon.nova-lite", "amazon.nova-micro", "amazon.nova-2-lite",
+		},
+	}
+	for provider, models := range mustPrice {
+		for _, m := range models {
+			_, ok := tbl.Cost(provider, m, 1000, 1000, 0, 0)
+			assert.True(t, ok, "%s/%s must be priced in the embedded defaults", provider, m)
+		}
+	}
+
+	// Pin per-direction rates independently (input-only then output-only) so a
+	// swap or skew of input<->output that preserves the combined total is still
+	// caught — these are rates that previously drifted or are easy to mis-enter.
+	in, ok := tbl.Cost("openai", "gpt-5.4", 1000, 0, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.0025, in, 1e-9, "gpt-5.4 input = 0.0025 per 1k")
+	out, ok := tbl.Cost("openai", "gpt-5.4", 0, 1000, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.015, out, 1e-9, "gpt-5.4 output = 0.015 per 1k")
+
+	in, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 1000, 0, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.003, in, 1e-9, "bedrock sonnet-4-5 input = 0.003 per 1k")
+	out, ok = tbl.Cost("bedrock", "anthropic.claude-sonnet-4-5", 0, 1000, 0, 0)
+	require.True(t, ok)
+	assert.InDelta(t, 0.015, out, 1e-9, "bedrock sonnet-4-5 output = 0.015 per 1k")
+}
--- a/management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml
+++ b/management/internals/modules/agentnetwork/pricing/defaults_llm_pricing.example.yaml
@@ -1,196 +1,66 @@
-# Default LLM pricing used by NetBird's Agent Network cost metering.
-# GENERATED from the management catalog — do not edit this file in the
-# repository; regenerate with:
+# Embedded default pricing for llm_observability. Compiled into the proxy
+# binary via go:embed in pricing.go; cost annotation works out of the box
+# without any operator action.
 #
-#   go generate ./management/internals/modules/agentnetwork/pricing
+# Operators override entries by dropping a pricing.yaml into --plugin-data-dir
+# (or whichever basename is given via params.pricing_path). The override file
+# only needs entries the operator wants to change; missing entries fall
+# through to these defaults.
 #
-# Operators: copy this file to <datadir>/defaults_llm_pricing.yaml (or
-# any path configured via management.json:
+# Values are USD per 1_000 tokens. Public list prices drift; ship a fresh
+# binary or override individual entries via the override file as needed.
 #
-#   { "AgentNetwork": { "PricingDefaultsFile": "/path/defaults_llm_pricing.yaml" } }
-#
-# ) and adjust the entries you want to change. Management re-reads the
-# file periodically (mtime poll, every minute): the live table feeds the
-# proxies' cost metering and the dashboard's model-price prefill, so
-# edits apply without a restart. Your file only needs the entries you
-# want to change — but each entry REPLACES the built-in entry for that
-# surface+model whole, so repeat the cache rates you want to keep.
-# Unknown fields and negative or non-finite rates are rejected: at
-# startup that fails boot (for an explicitly configured path); at
-# runtime the previous table is kept and a warning is logged. Deleting
-# the file reverts to the built-in defaults below.
-#
-# Top-level keys are pricing surfaces — the parser shape requests are
-# metered under: "openai" (also Azure, Mistral, and OpenAI-compatible
-# gateways), "anthropic" (also Anthropic-on-Vertex), "bedrock"
-# (normalized ids, e.g. anthropic.claude-sonnet-4-5). Model keys must be
-# the normalized id the proxy meters (version/region suffixes stripped).
-#
-# Values are USD per 1_000 tokens. Optional cache fields:
-#   cached_input_per_1k    OpenAI shape: rate for cached prompt tokens
-#                          (a SUBSET of input tokens). Absent -> cached
-#                          portion bills at input_per_1k.
-#   cache_read_per_1k      Anthropic shape: rate for cache_read tokens
-#                          (ADDITIVE to input). Absent -> input rate.
-#   cache_creation_per_1k  Anthropic shape: rate for cache_creation
-#                          tokens (ADDITIVE to input). Absent -> input
-#                          rate.
-
-anthropic:
-  claude-fable-5:
-    input_per_1k: 0.01
-    output_per_1k: 0.05
-    cache_read_per_1k: 0.001
-    cache_creation_per_1k: 0.0125
-  claude-haiku-4-5:
-    input_per_1k: 0.001
-    output_per_1k: 0.005
-    cache_read_per_1k: 0.0001
-    cache_creation_per_1k: 0.00125
-  claude-opus-4-1:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-    cache_read_per_1k: 0.0015
-    cache_creation_per_1k: 0.01875
-  claude-opus-4-6:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-7:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-4-8:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-opus-5:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  kimi-k3:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.0003
-    cache_read_per_1k: 0.0003
-  "kimi-k3[1m]":
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-
-bedrock:
-  amazon.nova-2-lite:
-    input_per_1k: 0.0003
-    output_per_1k: 0.0025
-  amazon.nova-lite:
-    input_per_1k: 0.00006
-    output_per_1k: 0.00024
-  amazon.nova-micro:
-    input_per_1k: 0.000035
-    output_per_1k: 0.00014
-  amazon.nova-pro:
-    input_per_1k: 0.0008
-    output_per_1k: 0.0032
-  anthropic.claude-haiku-4-5:
-    input_per_1k: 0.001
-    output_per_1k: 0.005
-    cache_read_per_1k: 0.0001
-    cache_creation_per_1k: 0.00125
-  anthropic.claude-opus-4-1:
-    input_per_1k: 0.015
-    output_per_1k: 0.075
-    cache_read_per_1k: 0.0015
-    cache_creation_per_1k: 0.01875
-  anthropic.claude-opus-4-6:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-7:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-4-8:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-opus-5:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
-  anthropic.claude-sonnet-4-5:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  anthropic.claude-sonnet-4-6:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cache_read_per_1k: 0.0003
-    cache_creation_per_1k: 0.00375
-  meta.llama3-3-70b-instruct:
-    input_per_1k: 0.00072
-    output_per_1k: 0.00072
+# Optional cache fields:
+#   cached_input_per_1k    OpenAI: rate for prompt_tokens_details.cached_tokens
+#                          (a SUBSET of prompt_tokens). Typically 0.5x input.
+#                          Absent → cached portion bills at input_per_1k.
+#   cache_read_per_1k      Anthropic: rate for cache_read_input_tokens
+#                          (ADDITIVE to input_tokens). Typically 0.1x input.
+#                          Absent → cache reads bill at input_per_1k.
+#   cache_creation_per_1k  Anthropic: rate for cache_creation_input_tokens
+#                          (ADDITIVE to input_tokens). Typically 1.25x input.
+#                          Absent → cache writes bill at input_per_1k.

 openai:
-  codestral-2508:
-    input_per_1k: 0.0003
-    output_per_1k: 0.0009
-  codestral-latest:
-    input_per_1k: 0.001
-    output_per_1k: 0.003
-  devstral-medium-latest:
-    input_per_1k: 0.0004
-    output_per_1k: 0.002
-  devstral-small-latest:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0003
-  gpt-3.5-turbo:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  gpt-35-turbo:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  gpt-4-turbo:
-    input_per_1k: 0.01
+  # OpenAI + OpenAI-compatible providers (openai_api, azure_openai_api,
+  # mistral_api, and the openai-parser gateways) all emit llm.provider="openai",
+  # so their models are priced here. Kept in sync with the management catalog;
+  # rates cross-checked against LiteLLM model_prices_and_context_window.json.
+
+  # GPT-5.x family — cache reads 10% of input (0.1x).
+  gpt-5.5:
+    input_per_1k: 0.005
    output_per_1k: 0.03
-  gpt-4.1:
-    input_per_1k: 0.002
-    output_per_1k: 0.008
    cached_input_per_1k: 0.0005
-  gpt-4.1-mini:
-    input_per_1k: 0.0004
-    output_per_1k: 0.0016
-    cached_input_per_1k: 0.0001
-  gpt-4.1-nano:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0004
-    cached_input_per_1k: 0.000025
-  gpt-4o:
+  gpt-5.5-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.4:
    input_per_1k: 0.0025
-    output_per_1k: 0.01
-    cached_input_per_1k: 0.00125
-  gpt-4o-mini:
-    input_per_1k: 0.00015
-    output_per_1k: 0.0006
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.00025
+  gpt-5.4-pro:
+    input_per_1k: 0.03
+    output_per_1k: 0.18
+    cached_input_per_1k: 0.003
+  gpt-5.4-mini:
+    input_per_1k: 0.00075
+    output_per_1k: 0.0045
    cached_input_per_1k: 0.000075
+  gpt-5.4-nano:
+    input_per_1k: 0.0002
+    output_per_1k: 0.00125
+    cached_input_per_1k: 0.00002
+  gpt-5.3-codex:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  gpt-5.3-chat-latest:
+    input_per_1k: 0.00175
+    output_per_1k: 0.014
+    cached_input_per_1k: 0.000175
+  # GPT-5 (2025) family — kept for gateway requests using the unsuffixed ids.
  gpt-5:
    input_per_1k: 0.00125
    output_per_1k: 0.01
@@ -203,80 +73,226 @@ openai:
    input_per_1k: 0.00005
    output_per_1k: 0.0004
    cached_input_per_1k: 0.000005
-  gpt-5.3-chat-latest:
-    input_per_1k: 0.00175
-    output_per_1k: 0.014
-    cached_input_per_1k: 0.000175
-  gpt-5.3-codex:
-    input_per_1k: 0.00175
-    output_per_1k: 0.014
-    cached_input_per_1k: 0.000175
-  gpt-5.4:
-    input_per_1k: 0.0025
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.00025
-  gpt-5.4-mini:
-    input_per_1k: 0.00075
-    output_per_1k: 0.0045
-    cached_input_per_1k: 0.000075
-  gpt-5.4-nano:
-    input_per_1k: 0.0002
-    output_per_1k: 0.00125
-    cached_input_per_1k: 0.00002
-  gpt-5.4-pro:
-    input_per_1k: 0.03
-    output_per_1k: 0.18
-    cached_input_per_1k: 0.003
-  gpt-5.5:
-    input_per_1k: 0.005
-    output_per_1k: 0.03
-    cached_input_per_1k: 0.0005
-  gpt-5.5-pro:
-    input_per_1k: 0.03
-    output_per_1k: 0.18
-    cached_input_per_1k: 0.003
-  kimi-k3:
-    input_per_1k: 0.003
-    output_per_1k: 0.015
-    cached_input_per_1k: 0.0003
-    cache_read_per_1k: 0.0003
-  magistral-medium-latest:
-    input_per_1k: 0.002
-    output_per_1k: 0.005
-  magistral-small-latest:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  ministral-3-14b-2512:
-    input_per_1k: 0.0002
-    output_per_1k: 0.0002
-  ministral-3-3b-2512:
-    input_per_1k: 0.0001
-    output_per_1k: 0.0001
-  ministral-8b-latest:
-    input_per_1k: 0.00015
-    output_per_1k: 0.00015
-  mistral-embed:
-    input_per_1k: 0.0001
-    output_per_1k: 0
-  mistral-large-latest:
-    input_per_1k: 0.0005
-    output_per_1k: 0.0015
-  mistral-medium-3-5:
-    input_per_1k: 0.0015
-    output_per_1k: 0.0075
-  mistral-medium-latest:
-    input_per_1k: 0.0004
-    output_per_1k: 0.002
-  mistral-small-latest:
-    input_per_1k: 0.00006
-    output_per_1k: 0.00018
  o4-mini:
    input_per_1k: 0.0011
    output_per_1k: 0.0044
    cached_input_per_1k: 0.000275
+  # GPT-4.1 family — cache reads 25% of input.
+  gpt-4.1:
+    input_per_1k: 0.002
+    output_per_1k: 0.008
+    cached_input_per_1k: 0.0005
+  gpt-4.1-mini:
+    input_per_1k: 0.0004
+    output_per_1k: 0.0016
+    cached_input_per_1k: 0.0001
+  gpt-4.1-nano:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0004
+    cached_input_per_1k: 0.000025
+  # GPT-4o family — cache reads 50% of input (0.5x).
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.00125
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+    cached_input_per_1k: 0.000075
+  # Older GPT — no prompt caching.
+  gpt-4-turbo:
+    input_per_1k: 0.01
+    output_per_1k: 0.03
+  gpt-3.5-turbo:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  gpt-35-turbo: # Azure deployment alias of gpt-3.5-turbo
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  # Embeddings — no caching, no output tokens.
  text-embedding-3-large:
    input_per_1k: 0.00013
    output_per_1k: 0
  text-embedding-3-small:
    input_per_1k: 0.00002
    output_per_1k: 0
+
+  # Mistral (mistral_api) — routed via the openai parser; no prompt caching.
+  mistral-large-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  mistral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  mistral-medium-3-5:
+    input_per_1k: 0.0015
+    output_per_1k: 0.0075
+  mistral-small-latest:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00018
+  magistral-medium-latest:
+    input_per_1k: 0.002
+    output_per_1k: 0.005
+  magistral-small-latest:
+    input_per_1k: 0.0005
+    output_per_1k: 0.0015
+  devstral-medium-latest:
+    input_per_1k: 0.0004
+    output_per_1k: 0.002
+  devstral-small-latest:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0003
+  codestral-2508:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0009
+  codestral-latest:
+    input_per_1k: 0.001
+    output_per_1k: 0.003
+  ministral-3-14b-2512:
+    input_per_1k: 0.0002
+    output_per_1k: 0.0002
+  ministral-8b-latest:
+    input_per_1k: 0.00015
+    output_per_1k: 0.00015
+  ministral-3-3b-2512:
+    input_per_1k: 0.0001
+    output_per_1k: 0.0001
+  mistral-embed:
+    input_per_1k: 0.0001
+    output_per_1k: 0
+
+  # Kimi / Moonshot AI (kimi_api) — OpenAI-compatible /v1 endpoint. Moonshot
+  # reports cache hits OpenAI-style when present; cached input is 10% of
+  # input ($0.30 vs $3.00 per MTok). kimi-k3 is the only model the platform
+  # serves newer accounts (K2-era ids and kimi-latest 404), matching the
+  # management catalog.
+  kimi-k3:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cached_input_per_1k: 0.0003
+
+anthropic:
+  # Claude 4.x family — cache reads ≈10% of input, cache writes ≈125% of input.
+  # Pricing source: Anthropic's current published rates per million tokens,
+  # divided by 1000 for the per-1k figures stored here.
+  claude-fable-5:
+    input_per_1k: 0.010
+    output_per_1k: 0.050
+    cache_read_per_1k: 0.001
+    cache_creation_per_1k: 0.0125
+  claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+
+  # Kimi / Moonshot AI (kimi_api) via the Anthropic-compatible endpoint
+  # (/anthropic/v1/messages — the official Claude Code setup). Same rates
+  # as the OpenAI-shape entry above. "kimi-k3[1m]" is the model id some
+  # Claude Code guides set for the 1M-context alias; priced identically so
+  # cost metering doesn't silently skip those requests.
+  kimi-k3:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+  "kimi-k3[1m]":
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+
+bedrock:
+  # AWS Bedrock model ids, normalised by the request parser (cross-region
+  # inference-profile prefix + version/throughput suffix stripped), e.g.
+  # eu.anthropic.claude-sonnet-4-5-20250929-v1:0 -> anthropic.claude-sonnet-4-5.
+  # Anthropic-on-Bedrock keeps the additive cache buckets (read ≈0.1x input,
+  # write ≈1.25x input); Nova / Llama report no cache, so cost is input+output.
+  anthropic.claude-opus-5:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-8:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-7:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-6:
+    input_per_1k: 0.005
+    output_per_1k: 0.025
+    cache_read_per_1k: 0.0005
+    cache_creation_per_1k: 0.00625
+  anthropic.claude-opus-4-1:
+    input_per_1k: 0.015
+    output_per_1k: 0.075
+    cache_read_per_1k: 0.0015
+    cache_creation_per_1k: 0.01875
+  anthropic.claude-sonnet-4-6:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+  anthropic.claude-haiku-4-5:
+    input_per_1k: 0.001
+    output_per_1k: 0.005
+    cache_read_per_1k: 0.0001
+    cache_creation_per_1k: 0.00125
+  meta.llama3-3-70b-instruct:
+    input_per_1k: 0.00072
+    output_per_1k: 0.00072
+  amazon.nova-2-lite:
+    input_per_1k: 0.0003
+    output_per_1k: 0.0025
+  amazon.nova-pro:
+    input_per_1k: 0.0008
+    output_per_1k: 0.0032
+  amazon.nova-lite:
+    input_per_1k: 0.00006
+    output_per_1k: 0.00024
+  amazon.nova-micro:
+    input_per_1k: 0.000035
+    output_per_1k: 0.00014
--- a/proxy/internal/llm/pricing/pricing.go
+++ b/proxy/internal/llm/pricing/pricing.go
@@ -1,30 +1,102 @@
-// Package pricing implements the pricing table and cost formula the
-// cost_meter middleware uses to convert LLM token usage into a USD cost
-// estimate. The table's content arrives from the management server inside
-// cost_meter's middleware config (synthesized from the catalog plus the
-// operator's stored per-provider prices) — the proxy carries no embedded
-// price list. Price updates ride the ordinary mapping push: a chain
-// rebuild constructs a fresh table, so there is nothing to reload.
+// Package pricing implements the embedded-default + override pricing table
+// shared by middleware that converts LLM token usage into a USD cost
+// estimate. The table is hot-reloadable from a basename under the proxy
+// data directory; missing override files keep the embedded defaults so
+// cost annotation works without operator action.
 package pricing

 import (
+	"bytes"
+	"context"
+	_ "embed"
+	"errors"
 	"fmt"
+	"io"
+	"io/fs"
 	"math"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/metric"
+	"gopkg.in/yaml.v3"
 )

+//go:embed defaults_pricing.yaml
+var defaultPricingYAML []byte
+
+var (
+	defaultTableOnce sync.Once
+	defaultTablePtr  *Table
+)
+
+// DefaultTable returns the pricing table embedded in the binary. The result
+// is parsed once and shared; callers must not mutate the returned value.
+// Cost annotation works without any operator action because every loader
+// starts with this table.
+func DefaultTable() *Table {
+	defaultTableOnce.Do(func() {
+		t, err := parsePricingBytes(defaultPricingYAML)
+		if err != nil {
+			panic(fmt.Sprintf("llmobs: embedded default pricing failed to parse: %v", err))
+		}
+		defaultTablePtr = t
+	})
+	return defaultTablePtr
+}
+
+// mergeOver returns a new Table containing every entry from base, with any
+// matching entry from overlay replacing the base value. Either argument may
+// be nil. Result is a fresh allocation so callers can mutate / Store safely.
+func mergeOver(base, overlay *Table) *Table {
+	if overlay == nil || len(overlay.entries) == 0 {
+		return base
+	}
+	if base == nil || len(base.entries) == 0 {
+		return overlay
+	}
+	out := make(map[string]map[string]Entry, len(base.entries))
+	for provider, models := range base.entries {
+		inner := make(map[string]Entry, len(models))
+		for model, e := range models {
+			inner[model] = e
+		}
+		out[provider] = inner
+	}
+	for provider, models := range overlay.entries {
+		inner, ok := out[provider]
+		if !ok {
+			inner = make(map[string]Entry, len(models))
+			out[provider] = inner
+		}
+		for model, e := range models {
+			inner[model] = e
+		}
+	}
+	return &Table{entries: out}
+}
+
 // Entry is a single model's input and output pricing, expressed in USD per
 // 1000 tokens.
 //
 // CachedInputPer1K applies to OpenAI's cached prompt tokens, which are a
 // subset of input_tokens — when set, the cached portion is billed at this
 // rate and the non-cached remainder at InputPer1K. Zero means "no discount
-// configured", and cached tokens are billed at InputPer1K.
+// configured", and cached tokens are billed at InputPer1K (matches current
+// behaviour where cached counts weren't extracted at all).
 //
 // CacheReadPer1K and CacheCreationPer1K apply to Anthropic's two prompt-
 // cache fields, which are additive to input_tokens: cache_read is the
 // cheaper read-from-cache rate, cache_creation is the more expensive
 // write-to-cache rate. Zero means "no rate configured" and the
-// corresponding token bucket is billed at InputPer1K.
+// corresponding token bucket is billed at InputPer1K. This is more
+// accurate than today's behaviour, where Anthropic's cache tokens are
+// ignored and not charged at all.
 type Entry struct {
 	InputPer1K         float64
 	OutputPer1K        float64
@@ -33,102 +105,33 @@ type Entry struct {
 	CacheCreationPer1K float64
 }

-// EntryJSON is the wire shape of a pricing entry inside cost_meter's
-// middleware config. Field names are the management→proxy contract; the
-// management synthesizer marshals the same names (its pricing.Entry).
-type EntryJSON struct {
-	InputPer1K         float64 `json:"input_per_1k"`
-	OutputPer1K        float64 `json:"output_per_1k"`
-	CachedInputPer1K   float64 `json:"cached_input_per_1k"`
-	CacheReadPer1K     float64 `json:"cache_read_per_1k"`
-	CacheCreationPer1K float64 `json:"cache_creation_per_1k"`
-}
-
-// Table is a provider-surface-to-model pricing lookup. Instances are
-// immutable once built; a mapping update builds a whole new middleware
-// instance (and with it a new table) rather than mutating this one.
+// Table is a provider-to-model pricing lookup. Instances are immutable once
+// built and are swapped atomically by Loader.
 type Table struct {
 	entries map[string]map[string]Entry
 }

-// NewEntries validates and converts a wire-shape map (surface-or-record ->
-// model -> rates) into the internal representation. Every rate must be a
-// finite, non-negative USD amount; a violation is returned as an error so
-// a corrupt config fails the chain build loudly instead of mispricing.
-// Management validates the same constraints at its API boundary, so this
-// is defense-in-depth. Nil input yields an empty (never-matching) map.
-func NewEntries(raw map[string]map[string]EntryJSON) (map[string]map[string]Entry, error) {
-	out := make(map[string]map[string]Entry, len(raw))
-	for outer, models := range raw {
-		inner := make(map[string]Entry, len(models))
-		for model, e := range models {
-			for field, v := range map[string]float64{
-				"input_per_1k":          e.InputPer1K,
-				"output_per_1k":         e.OutputPer1K,
-				"cached_input_per_1k":   e.CachedInputPer1K,
-				"cache_read_per_1k":     e.CacheReadPer1K,
-				"cache_creation_per_1k": e.CacheCreationPer1K,
-			} {
-				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
-					return nil, fmt.Errorf("pricing %s/%s: %s must be a finite, non-negative rate, got %v", outer, model, field, v)
-				}
-			}
-			// EntryJSON and Entry are field-identical (tags aside), so a
-			// direct conversion carries all five rates.
-			inner[model] = Entry(e)
-		}
-		out[outer] = inner
-	}
-	return out, nil
-}
-
-// NewTable builds an immutable Table from the wire-shape defaults map.
-// See NewEntries for validation semantics.
-func NewTable(raw map[string]map[string]EntryJSON) (*Table, error) {
-	entries, err := NewEntries(raw)
-	if err != nil {
-		return nil, err
-	}
-	return &Table{entries: entries}, nil
-}
-
-// Lookup returns the entry for the given provider surface and model.
-func (t *Table) Lookup(provider, model string) (Entry, bool) {
-	if t == nil {
-		return Entry{}, false
-	}
-	byModel, ok := t.entries[provider]
-	if !ok {
-		return Entry{}, false
-	}
-	e, ok := byModel[model]
-	return e, ok
-}
-
-// Has reports whether the provider/model pair is present in the table.
-func (t *Table) Has(provider, model string) bool {
-	_, ok := t.Lookup(provider, model)
-	return ok
-}
-
 // Cost returns the estimated USD cost for the given token counts. ok is
 // false when the provider or model is not present in the table; the caller
 // can still emit token metrics with a model=unknown label.
+//
+// Provider-shape semantics for cached / cache-creation counts:
+//
+//   - OpenAI: cachedInput is a SUBSET of inTokens. The cached portion is
+//     billed at CachedInputPer1K (or InputPer1K when no override), and the
+//     non-cached remainder of inTokens at InputPer1K. cacheCreation is
+//     ignored (OpenAI has no analogue).
+//   - Anthropic: cachedInput (cache_read) and cacheCreation are ADDITIVE to
+//     inTokens. The three buckets are billed at CacheReadPer1K,
+//     CacheCreationPer1K, and InputPer1K respectively, each falling back
+//     to InputPer1K when the corresponding rate is zero.
+//   - Other providers: cached and cacheCreation are ignored; cost is
+//     inTokens*InputPer1K + outTokens*OutputPer1K.
 func (t *Table) Cost(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (float64, bool) {
 	c, ok := t.Costs(provider, model, inTokens, outTokens, cachedInput, cacheCreation)
 	return c.TotalUSD, ok
 }

-// Costs returns the estimated USD cost split for the given token counts.
-// The provider surface selects the cache formula; see EntryCosts.
-func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool) {
-	entry, ok := t.Lookup(provider, model)
-	if !ok {
-		return Costs{}, false
-	}
-	return EntryCosts(entry, provider, inTokens, outTokens, cachedInput, cacheCreation), true
-}
-
 // Costs is a per-request cost split. The four per-bucket fields are the base
 // of the breakdown — one per token bucket the provider bills separately — and
 // the two aggregates are derived from them:
@@ -162,25 +165,9 @@ func newCosts(input, cachedInput, cacheCreation, output float64) Costs {
 	}
 }

-// EntryCosts computes the USD cost split for the given entry and token
-// counts. The surface (the llm.provider value the request parser stamps)
-// selects the cache formula; the entry may come from the surface-keyed
-// defaults table or from a per-provider-record override — the math is
-// identical either way.
-//
-// Provider-shape semantics for cached / cache-creation counts:
-//
-//   - "openai": cachedInput is a SUBSET of inTokens. The cached portion is
-//     billed at CachedInputPer1K (or InputPer1K when no override), and the
-//     non-cached remainder of inTokens at InputPer1K. cacheCreation is
-//     ignored (OpenAI has no analogue).
-//   - "anthropic", "bedrock": cachedInput (cache_read) and cacheCreation are
-//     ADDITIVE to inTokens. The three buckets are billed at CacheReadPer1K,
-//     CacheCreationPer1K, and InputPer1K respectively, each falling back
-//     to InputPer1K when the corresponding rate is zero.
-//   - Other surfaces: cached and cacheCreation are ignored; cost is
-//     inTokens*InputPer1K + outTokens*OutputPer1K.
-func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, cacheCreation int64) Costs {
+// Costs returns the estimated USD cost split for the given token counts, with
+// the same semantics as Cost.
+func (t *Table) Costs(provider, model string, inTokens, outTokens, cachedInput, cacheCreation int64) (Costs, bool) {
 	// Clamp negatives to zero before any pricing math so a malformed
 	// upstream count can never produce a negative cost.
 	if inTokens < 0 {
@@ -195,8 +182,19 @@ func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, c
 	if cacheCreation < 0 {
 		cacheCreation = 0
 	}
+	if t == nil {
+		return Costs{}, false
+	}
+	byModel, ok := t.entries[provider]
+	if !ok {
+		return Costs{}, false
+	}
+	entry, ok := byModel[model]
+	if !ok {
+		return Costs{}, false
+	}
 	output := (float64(outTokens) / 1000.0) * entry.OutputPer1K
-	switch surface {
+	switch provider {
 	case "openai":
 		// cachedInput is a subset of inTokens; clamp so a malformed
 		// upstream (cached > total) can't produce a negative remainder.
@@ -210,7 +208,7 @@ func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, c
 		}
 		nonCached := float64(inTokens-clamped) / 1000.0 * entry.InputPer1K
 		cached := float64(clamped) / 1000.0 * cachedRate
-		return newCosts(nonCached, cached, 0, output)
+		return newCosts(nonCached, cached, 0, output), true
 	case "anthropic", "bedrock":
 		// Bedrock-Anthropic returns the same additive cache buckets as
 		// first-party Anthropic; non-Anthropic Bedrock models simply report
@@ -226,9 +224,266 @@ func EntryCosts(entry Entry, surface string, inTokens, outTokens, cachedInput, c
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
 		read := float64(cachedInput) / 1000.0 * readRate
 		create := float64(cacheCreation) / 1000.0 * createRate
-		return newCosts(input, read, create, output)
+		return newCosts(input, read, create, output), true
 	default:
 		input := float64(inTokens) / 1000.0 * entry.InputPer1K
-		return newCosts(input, 0, 0, output)
+		return newCosts(input, 0, 0, output), true
 	}
 }
+
+// Has reports whether the provider/model pair is present in the table.
+func (t *Table) Has(provider, model string) bool {
+	if t == nil {
+		return false
+	}
+	byModel, ok := t.entries[provider]
+	if !ok {
+		return false
+	}
+	_, ok = byModel[model]
+	return ok
+}
+
+// pricingFile mirrors the on-disk YAML schema. Keys are provider names; the
+// nested map keys are model names.
+type pricingFile map[string]map[string]struct {
+	InputPer1K         float64 `yaml:"input_per_1k"`
+	OutputPer1K        float64 `yaml:"output_per_1k"`
+	CachedInputPer1K   float64 `yaml:"cached_input_per_1k"`
+	CacheReadPer1K     float64 `yaml:"cache_read_per_1k"`
+	CacheCreationPer1K float64 `yaml:"cache_creation_per_1k"`
+}
+
+const (
+	// ReloadInterval is the mtime-poll cadence for the background reloader.
+	ReloadInterval = 30 * time.Second
+
+	// errorBackoff bounds how often the loader logs a repeated parse error.
+	errorBackoff = 5 * time.Minute
+)
+
+var basenameRegex = regexp.MustCompile(`^[a-zA-Z0-9._-]+$`)
+
+// Loader is a confined, hot-reloadable pricing table reader. Construction
+// must succeed against the target file; subsequent reload failures keep the
+// previously-loaded table so callers never observe a blank price list.
+type Loader struct {
+	baseDir  string
+	fullPath string
+	pluginID string
+	table    atomic.Pointer[Table]
+	mtime    atomic.Int64
+	failures metric.Int64Counter
+	interval time.Duration
+}
+
+// NewLoader returns a pricing loader that overlays an optional file-based
+// table on top of the embedded defaults. Missing override file, baseDir, or
+// relPath is not an error: the loader keeps the embedded defaults so cost
+// metadata is still emitted for known models.
+//
+// Errors:
+//   - bad basename, traversal segment, or absolute relPath are rejected so a
+//     misconfigured target surfaces immediately.
+//   - permission errors and YAML parse errors keep the defaults but log a
+//     warning; cost annotation does not silently break.
+//
+// failures is optional; pass nil in tests that do not care about
+// reload-failure telemetry.
+func NewLoader(baseDir, relPath, pluginID string, failures metric.Int64Counter) (*Loader, error) {
+	defaults := DefaultTable()
+	l := &Loader{
+		baseDir:  baseDir,
+		pluginID: pluginID,
+		failures: failures,
+	}
+	l.table.Store(defaults)
+
+	if strings.TrimSpace(baseDir) == "" || strings.TrimSpace(relPath) == "" {
+		return l, nil
+	}
+
+	full, err := resolveMiddlewareDataPath(baseDir, relPath)
+	if err != nil {
+		return nil, err
+	}
+	l.fullPath = full
+
+	overlay, mtime, err := loadPricing(full)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// Override file is optional. Defaults already stored.
+			return l, nil
+		}
+		// Symlink rejection, oversize file, parse failure, permission errors
+		// — surface so a misconfigured operator sees the problem instead of
+		// silently running with stale defaults.
+		return nil, fmt.Errorf("load pricing %s: %w", full, err)
+	}
+	l.table.Store(mergeOver(defaults, overlay))
+	l.mtime.Store(mtime.UnixNano())
+	return l, nil
+}
+
+// Get returns the current pricing table. The returned pointer is immutable;
+// callers must not mutate its contents.
+func (l *Loader) Get() *Table {
+	if l == nil {
+		return nil
+	}
+	return l.table.Load()
+}
+
+// WatchesFile reports whether this loader is bound to an override file on
+// disk. False for defaults-only loaders (no operator override given).
+// Callers use this to decide whether to spawn the mtime-poll goroutine.
+func (l *Loader) WatchesFile() bool {
+	if l == nil {
+		return false
+	}
+	return l.fullPath != ""
+}
+
+// SetReloadInterval overrides the mtime-poll cadence used by Reload. Calls
+// after Reload has started have no effect on the running loop. Intended for
+// tests; production code uses the default ReloadInterval.
+func (l *Loader) SetReloadInterval(d time.Duration) {
+	if l == nil || d <= 0 {
+		return
+	}
+	l.interval = d
+}
+
+// Reload runs a polling loop that checks the pricing file mtime every
+// ReloadInterval (or the value passed to SetReloadInterval). Returns when
+// ctx is cancelled.
+func (l *Loader) Reload(ctx context.Context) {
+	if l == nil {
+		return
+	}
+	interval := l.interval
+	if interval <= 0 {
+		interval = ReloadInterval
+	}
+	t := time.NewTicker(interval)
+	defer t.Stop()
+
+	var lastErrAt time.Time
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			if err := l.reload(); err != nil {
+				if l.failures != nil {
+					l.failures.Add(ctx, 1, metric.WithAttributes(
+						attribute.String("plugin", l.pluginID),
+					))
+				}
+				now := time.Now()
+				if now.Sub(lastErrAt) >= errorBackoff {
+					log.Warnf("llmobs: pricing reload failed for %s: %v", l.fullPath, err)
+					lastErrAt = now
+				}
+			}
+		}
+	}
+}
+
+// reload performs a single-shot mtime check and reload. The reloaded
+// override file is merged on top of the embedded defaults; missing override
+// (e.g. operator deleted the file) is not an error and reverts to defaults.
+func (l *Loader) reload() error {
+	if l.fullPath == "" {
+		// Defaults-only loader; nothing on disk to reload.
+		return nil
+	}
+	mtime, err := statMtime(l.fullPath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// File was removed since startup. Drop back to defaults and
+			// reset mtime so a future re-creation triggers a reload.
+			l.table.Store(DefaultTable())
+			l.mtime.Store(0)
+			return nil
+		}
+		return err
+	}
+	if mtime.UnixNano() == l.mtime.Load() {
+		return nil
+	}
+
+	overlay, newMtime, err := loadPricing(l.fullPath)
+	if err != nil {
+		return err
+	}
+	l.table.Store(mergeOver(DefaultTable(), overlay))
+	l.mtime.Store(newMtime.UnixNano())
+	return nil
+}
+
+// resolveMiddlewareDataPath validates relPath is a safe basename and resolves
+// it under baseDir. An additional cleaned-prefix check guards against
+// CVE-style edge cases where Join is used with trailing path segments.
+func resolveMiddlewareDataPath(baseDir, relPath string) (string, error) {
+	if strings.TrimSpace(baseDir) == "" {
+		return "", errors.New("middleware-data-dir is not configured")
+	}
+	if relPath == "" {
+		return "", errors.New("pricing path is empty")
+	}
+	if !basenameRegex.MatchString(relPath) {
+		return "", fmt.Errorf("pricing path %q is not a safe basename", relPath)
+	}
+	if filepath.IsAbs(relPath) {
+		return "", fmt.Errorf("pricing path %q must be a basename, not absolute", relPath)
+	}
+
+	cleanBase, err := filepath.Abs(filepath.Clean(baseDir))
+	if err != nil {
+		return "", fmt.Errorf("resolve middleware-data-dir: %w", err)
+	}
+	full := filepath.Join(cleanBase, relPath)
+	cleanedFull := filepath.Clean(full)
+	if !strings.HasPrefix(cleanedFull, cleanBase+string(filepath.Separator)) && cleanedFull != cleanBase {
+		return "", fmt.Errorf("pricing path %q escapes middleware-data-dir", relPath)
+	}
+	return cleanedFull, nil
+}
+
+func parsePricingBytes(data []byte) (*Table, error) {
+	dec := yaml.NewDecoder(bytes.NewReader(data))
+	dec.KnownFields(true)
+
+	var raw pricingFile
+	if err := dec.Decode(&raw); err != nil && !errors.Is(err, io.EOF) {
+		return nil, fmt.Errorf("decode pricing yaml: %w", err)
+	}
+
+	out := make(map[string]map[string]Entry, len(raw))
+	for provider, models := range raw {
+		inner := make(map[string]Entry, len(models))
+		for model, entry := range models {
+			for field, v := range map[string]float64{
+				"input_per_1k":          entry.InputPer1K,
+				"output_per_1k":         entry.OutputPer1K,
+				"cached_input_per_1k":   entry.CachedInputPer1K,
+				"cache_read_per_1k":     entry.CacheReadPer1K,
+				"cache_creation_per_1k": entry.CacheCreationPer1K,
+			} {
+				if v < 0 || math.IsNaN(v) || math.IsInf(v, 0) {
+					return nil, fmt.Errorf("pricing %s/%s: %s must be a finite, non-negative rate, got %v", provider, model, field, v)
+				}
+			}
+			inner[model] = Entry{
+				InputPer1K:         entry.InputPer1K,
+				OutputPer1K:        entry.OutputPer1K,
+				CachedInputPer1K:   entry.CachedInputPer1K,
+				CacheReadPer1K:     entry.CacheReadPer1K,
+				CacheCreationPer1K: entry.CacheCreationPer1K,
+			}
+		}
+		out[provider] = inner
+	}
+	return &Table{entries: out}, nil
+}
--- a/proxy/internal/llm/pricing/pricing_other.go
+++ b/proxy/internal/llm/pricing/pricing_other.go
@@ -0,0 +1,20 @@
+//go:build !unix
+
+package pricing
+
+import (
+	"fmt"
+	"time"
+)
+
+// loadPricing is unavailable on non-Unix platforms because O_NOFOLLOW and
+// fstat-from-FD are required to honour the spec's symlink-safety rules. The
+// proxy is only deployed on Linux today; a Windows port would need an
+// equivalent path-as-handle implementation.
+func loadPricing(path string) (*Table, time.Time, error) {
+	return nil, time.Time{}, fmt.Errorf("llmobs pricing loader is not supported on this platform: %s", path)
+}
+
+func statMtime(path string) (time.Time, error) {
+	return time.Time{}, fmt.Errorf("llmobs pricing loader is not supported on this platform: %s", path)
+}
--- a/proxy/internal/llm/pricing/pricing_test.go
+++ b/proxy/internal/llm/pricing/pricing_test.go
@@ -1,13 +1,47 @@
+//go:build unix
+
 package pricing

 import (
-	"math"
+	"context"
+	"os"
+	"path/filepath"
 	"testing"
+	"time"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

+func copyFixture(t *testing.T, src, dst string) {
+	t.Helper()
+	data, err := os.ReadFile(src)
+	require.NoError(t, err, "read source fixture")
+	require.NoError(t, os.WriteFile(dst, data, 0o600), "write target fixture")
+}
+
+func TestNewLoader_HappyPath(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err, "NewLoader must succeed with a valid fixture")
+	table := l.Get()
+	require.NotNil(t, table, "table populated after load")
+
+	cost, ok := table.Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "known provider/model resolves")
+	assert.InDelta(t, 0.00075, cost, 1e-9, "cost = 0.00015 + 0.0006 per 1k tokens")
+
+	cost, ok = table.Cost("openai", "gpt-4o", 2000, 1000, 0, 0)
+	require.True(t, ok, "second known model resolves")
+	assert.InDelta(t, 0.015, cost, 1e-9, "cost for gpt-4o: 2*0.0025 + 1*0.01")
+
+	cost, ok = table.Cost("anthropic", "claude-sonnet-4-5", 1000, 1000, 0, 0)
+	require.True(t, ok, "anthropic model resolves")
+	assert.InDelta(t, 0.018, cost, 1e-9, "cost for claude-sonnet-4-5: 0.003 + 0.015")
+}
+
 // TestCost_OpenAICachedSubsetDiscount proves OpenAI's cached input
 // tokens are billed at the configured cached_input_per_1k rate while
 // the non-cached remainder of input_tokens is billed at the regular
@@ -31,9 +65,11 @@ func TestCost_OpenAICachedSubsetDiscount(t *testing.T) {
 		"cached subset must bill at the discount rate; non-cached remainder at regular rate")
 }

-// TestCost_OpenAICachedFallsBackToInputRate covers the fallback
-// contract: when CachedInputPer1K is unset (zero), cached tokens bill
-// at the regular input rate.
+// TestCost_OpenAICachedFallsBackToInputRate covers the operator
+// opt-in contract: when CachedInputPer1K is unset (zero), cached
+// tokens bill at the regular input rate. This matches today's
+// behaviour (cached counts weren't extracted at all so they
+// implicitly billed at the input rate via prompt_tokens).
 func TestCost_OpenAICachedFallsBackToInputRate(t *testing.T) {
 	tbl := &Table{entries: map[string]map[string]Entry{
 		"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
@@ -42,7 +78,7 @@ func TestCost_OpenAICachedFallsBackToInputRate(t *testing.T) {
 	require.True(t, ok)
 	want := 0.0025 + (500.0/1000.0)*0.01
 	assert.InDelta(t, want, cost, 1e-12,
-		"absent cached_input_per_1k rate must fall back to input_per_1k")
+		"absent cached_input_per_1k rate must fall back to input_per_1k — same as pre-feature behaviour")
 }

 // TestCost_OpenAIClampsCachedToInputCount is the defensive guard
@@ -64,7 +100,10 @@ func TestCost_OpenAIClampsCachedToInputCount(t *testing.T) {
 // TestCost_AnthropicCacheReadAndCreationAreAdditive proves the
 // Anthropic shape: cache_read and cache_creation tokens are
 // ADDITIVE to input_tokens (not subset), each billed at its own
-// configured rate.
+// configured rate. The two rates pull in opposite directions —
+// cache_read is the cheaper read-from-cache rate (≈0.1× input),
+// cache_creation is the more expensive write-to-cache rate
+// (≈1.25× input).
 func TestCost_AnthropicCacheReadAndCreationAreAdditive(t *testing.T) {
 	tbl := &Table{entries: map[string]map[string]Entry{
 		"anthropic": {"claude-sonnet": {
@@ -86,9 +125,11 @@ func TestCost_AnthropicCacheReadAndCreationAreAdditive(t *testing.T) {
 		"each Anthropic input bucket must bill at its own configured rate")
 }

-// TestCost_AnthropicCacheRatesFallBackToInput covers the no-rate
+// TestCost_AnthropicCacheRatesFallBackToInput covers the no-opt-in
 // path: when neither CacheReadPer1K nor CacheCreationPer1K is set,
-// cache tokens bill at the regular input rate.
+// cache tokens bill at the regular input rate. This is more
+// accurate than today's behaviour (cache tokens ignored entirely)
+// without requiring operators to opt in via YAML.
 func TestCost_AnthropicCacheRatesFallBackToInput(t *testing.T) {
 	tbl := &Table{entries: map[string]map[string]Entry{
 		"anthropic": {"claude-sonnet": {InputPer1K: 0.003, OutputPer1K: 0.015}},
@@ -98,39 +139,259 @@ func TestCost_AnthropicCacheRatesFallBackToInput(t *testing.T) {
 	// Without overrides: every input bucket at input_per_1k.
 	want := ((256.0+768.0+512.0)/1000.0)*0.003 + (200.0/1000.0)*0.015
 	assert.InDelta(t, want, cost, 1e-12,
-		"absent cache rates must fall back to input_per_1k")
+		"absent cache rates must fall back to input_per_1k — Anthropic cache tokens were ignored before this change, billing at input rate is more accurate as a default")
 }

-// TestEntryCosts_SurfaceSelectsFormula pins that the formula branches on
-// the SURFACE, not on which table the entry came from: the same entry
-// bills a subset carve-out on "openai", additive buckets on
-// "anthropic"/"bedrock", and ignores cache counts everywhere else. This
-// is what keeps per-provider-record entries (looked up by record id)
-// mathematically identical to defaults-table entries.
-func TestEntryCosts_SurfaceSelectsFormula(t *testing.T) {
-	e := Entry{InputPer1K: 0.002, OutputPer1K: 0.01, CachedInputPer1K: 0.001, CacheReadPer1K: 0.0002, CacheCreationPer1K: 0.0025}
+func TestNewLoader_UnknownModel(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))

-	openai := EntryCosts(e, "openai", 1000, 0, 400, 300)
-	assert.InDelta(t, (600.0/1000.0)*0.002+(400.0/1000.0)*0.001, openai.TotalUSD, 1e-12,
-		"openai: cached is a subset, cacheCreation ignored")
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)

-	anthropic := EntryCosts(e, "anthropic", 1000, 0, 400, 300)
-	assert.InDelta(t, 0.002+(400.0/1000.0)*0.0002+(300.0/1000.0)*0.0025, anthropic.TotalUSD, 1e-12,
-		"anthropic: cache buckets are additive")
+	_, ok := l.Get().Cost("openai", "fantasy-model", 10, 10, 0, 0)
+	assert.False(t, ok, "unknown model returns ok=false")

-	bedrock := EntryCosts(e, "bedrock", 1000, 0, 400, 300)
-	assert.InDelta(t, anthropic.TotalUSD, bedrock.TotalUSD, 1e-12, "bedrock shares the anthropic formula")
-
-	other := EntryCosts(e, "gemini", 1000, 0, 400, 300)
-	assert.InDelta(t, 0.002, other.TotalUSD, 1e-12, "unknown surface: cache counts ignored")
+	_, ok = l.Get().Cost("cohere", "anything", 10, 10, 0, 0)
+	assert.False(t, ok, "unknown provider returns ok=false")
 }

-// TestEntryCosts_ClampsNegativeTokens: malformed upstream counts must
-// never produce a negative cost.
-func TestEntryCosts_ClampsNegativeTokens(t *testing.T) {
-	e := Entry{InputPer1K: 0.002, OutputPer1K: 0.01}
-	c := EntryCosts(e, "openai", -50, -10, -5, -3)
-	assert.Zero(t, c.TotalUSD, "all-negative counts clamp to zero cost")
+func TestNewLoader_InvalidYAMLRejected(t *testing.T) {
+	base := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(base, "pricing.yaml"), []byte("\t- this is not: valid: yaml: :["), 0o600))
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "invalid YAML must surface as construction error")
+}
+
+func TestLoader_ReloadKeepsPreviousOnParseError(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+	require.NotNil(t, l.Get(), "initial table populated")
+
+	// Overwrite with content that violates the strict schema (extra field)
+	// plus a bumped mtime to trigger reload.
+	require.NoError(t, os.WriteFile(target, []byte("openai:\n  gpt-4o:\n    input_per_1k: 1.0\n    output_per_1k: 2.0\n    bogus_field: nope\n"), 0o600))
+	future := time.Now().Add(time.Hour)
+	require.NoError(t, os.Chtimes(target, future, future))
+
+	err = l.reload()
+	require.Error(t, err, "parse error surfaced by reload()")
+
+	cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "previous table still available after parse failure")
+	assert.InDelta(t, 0.00075, cost, 1e-9, "previous cost preserved")
+}
+
+func TestLoader_ReloadNoChangeIsNoOp(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+	ptrBefore := l.Get()
+
+	require.NoError(t, l.reload(), "no-change reload must not error")
+	ptrAfter := l.Get()
+	assert.Same(t, ptrBefore, ptrAfter, "table pointer unchanged when mtime unchanged")
+}
+
+func TestLoader_ReloadDetectsChange(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+
+	updated := []byte("openai:\n  gpt-4o-mini:\n    input_per_1k: 1.00\n    output_per_1k: 2.00\n")
+	require.NoError(t, os.WriteFile(target, updated, 0o600))
+	future := time.Now().Add(time.Hour)
+	require.NoError(t, os.Chtimes(target, future, future))
+
+	require.NoError(t, l.reload(), "reload must succeed on valid new content")
+
+	cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "updated model still present")
+	assert.InDelta(t, 3.0, cost, 0.0001, "new prices are applied: 1 + 2 per 1k")
+}
+
+// TestLoader_ReloadGoroutinePicksUpChanges proves the background goroutine
+// started via Reload actually swaps the pricing table when the file changes
+// on disk. Without that goroutine running, pricing edits would never reach
+// requests until a proxy restart.
+func TestLoader_ReloadGoroutinePicksUpChanges(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+	l.SetReloadInterval(20 * time.Millisecond)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	done := make(chan struct{})
+	go func() {
+		l.Reload(ctx)
+		close(done)
+	}()
+
+	// Before any rewrite, the loader holds the fixture's prices.
+	costBefore, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+	require.True(t, ok, "fixture model must resolve initially")
+	assert.InDelta(t, 0.00075, costBefore, 1e-9, "fixture prices apply before rewrite")
+
+	updated := []byte("openai:\n  gpt-4o-mini:\n    input_per_1k: 1.00\n    output_per_1k: 2.00\n")
+	require.NoError(t, os.WriteFile(target, updated, 0o600))
+	future := time.Now().Add(time.Hour)
+	require.NoError(t, os.Chtimes(target, future, future))
+
+	deadline := time.Now().Add(2 * time.Second)
+	for {
+		cost, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+		if ok && cost > 2.5 {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("background reloader did not pick up rewrite within deadline")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Reload loop did not exit after cancel")
+	}
+}
+
+func TestLoader_ReloadBackgroundLoopCancellation(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+	l, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.NoError(t, err)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		l.Reload(ctx)
+		close(done)
+	}()
+	cancel()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Reload loop did not exit on context cancel")
+	}
+}
+
+func TestNewLoader_PathValidation(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	cases := []struct {
+		name    string
+		relPath string
+	}{
+		{"traversal", "../../etc/passwd"},
+		{"absolute", "/etc/passwd"},
+		{"slash in basename", "sub/pricing.yaml"},
+		{"control chars", "pricing\x00.yaml"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := NewLoader(base, tc.relPath, "llm_observability", nil)
+			require.Error(t, err, "NewLoader must reject %q", tc.relPath)
+		})
+	}
+
+	// Empty relPath is no longer a validation error: the loader treats it
+	// as "no override file, defaults only" so cost metadata is still
+	// emitted for the embedded models out of the box.
+	t.Run("empty falls back to defaults", func(t *testing.T) {
+		l, err := NewLoader(base, "", "llm_observability", nil)
+		require.NoError(t, err, "empty relPath should yield a defaults-only loader")
+		require.NotNil(t, l, "loader must be returned")
+		require.False(t, l.WatchesFile(), "no file watching when no override is given")
+		_, ok := l.Get().Cost("openai", "gpt-4o-mini", 1000, 1000, 0, 0)
+		assert.True(t, ok, "embedded defaults should still resolve gpt-4o-mini")
+	})
+}
+
+// TestNewLoader_PathValidation_Extended covers the remaining attack shapes
+// called out in C2: dot references, embedded traversal segments, and a
+// newline in the basename. The basename regex must reject each one even
+// though filepath.Clean would otherwise collapse them.
+func TestNewLoader_PathValidation_Extended(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing.yaml"))
+
+	cases := []struct {
+		name    string
+		relPath string
+	}{
+		{"dot", "."},
+		{"dotdot", ".."},
+		{"relative traversal", "../pricing.yaml"},
+		{"embedded slash", "pri/cing.yaml"},
+		{"newline", "pricing\n.yaml"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			_, err := NewLoader(base, tc.relPath, "llm_observability", nil)
+			require.Error(t, err, "NewLoader must reject %q", tc.relPath)
+		})
+	}
+}
+
+// TestNewLoader_ValidBasenameLoads proves the allowlist is exclusive: a
+// basename containing only safe characters under baseDir loads. Without this
+// a regression that over-tightened the regex would silently break valid
+// deployments.
+func TestNewLoader_ValidBasenameLoads(t *testing.T) {
+	base := t.TempDir()
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), filepath.Join(base, "pricing-v2_prod.yaml"))
+
+	l, err := NewLoader(base, "pricing-v2_prod.yaml", "llm_observability", nil)
+	require.NoError(t, err, "basename with _, -, . must load")
+	require.NotNil(t, l.Get(), "table populated")
+}
+
+// TestNewLoader_SymlinkOutsideBaseDirRejected constructs a symlink under
+// baseDir that points to a file outside it. O_NOFOLLOW must refuse to open
+// the symlink even though the symlink path itself is a valid basename under
+// baseDir.
+func TestNewLoader_SymlinkOutsideBaseDirRejected(t *testing.T) {
+	outside := t.TempDir()
+	target := filepath.Join(outside, "evil.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), target)
+
+	base := t.TempDir()
+	link := filepath.Join(base, "pricing.yaml")
+	require.NoError(t, os.Symlink(target, link), "symlink setup")
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "O_NOFOLLOW must reject symlink even when it points outside baseDir")
+}
+
+func TestNewLoader_SymlinkRejected(t *testing.T) {
+	base := t.TempDir()
+	concrete := filepath.Join(base, "real.yaml")
+	copyFixture(t, filepath.Join("..", "fixtures", "pricing.yaml"), concrete)
+
+	link := filepath.Join(base, "pricing.yaml")
+	require.NoError(t, os.Symlink(concrete, link), "symlink setup")
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "O_NOFOLLOW must reject symlinked targets")
 }

 func TestTableCost_NilSafe(t *testing.T) {
@@ -141,37 +402,31 @@ func TestTableCost_NilSafe(t *testing.T) {
 	assert.False(t, t1.Has("x", "y"), "nil table has nothing")
 }

-func TestNewTable_ValidatesRates(t *testing.T) {
-	good := map[string]map[string]EntryJSON{
-		"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01, CachedInputPer1K: 0.00125}},
-	}
-	tbl, err := NewTable(good)
-	require.NoError(t, err)
-	cost, ok := tbl.Cost("openai", "gpt-4o", 1000, 1000, 0, 0)
-	require.True(t, ok, "entry survives the wire conversion")
-	assert.InDelta(t, 0.0125, cost, 1e-9)
-
-	_, ok = tbl.Cost("openai", "unknown-model", 1, 1, 0, 0)
-	assert.False(t, ok, "unknown model misses")
-
-	for name, bad := range map[string]EntryJSON{
-		"negative input":  {InputPer1K: -1, OutputPer1K: 0.01},
-		"NaN output":      {InputPer1K: 0.01, OutputPer1K: math.NaN()},
-		"Inf cache read":  {InputPer1K: 0.01, OutputPer1K: 0.01, CacheReadPer1K: math.Inf(1)},
-		"negative cached": {InputPer1K: 0.01, OutputPer1K: 0.01, CachedInputPer1K: -0.001},
-	} {
-		_, err := NewTable(map[string]map[string]EntryJSON{"openai": {"m": bad}})
-		assert.Error(t, err, "case %q must be rejected so a corrupt config fails the chain build instead of mispricing", name)
-	}
+func TestLoaderGet_NilSafe(t *testing.T) {
+	var l *Loader
+	assert.Nil(t, l.Get(), "nil loader returns nil table")
 }

-func TestNewTable_NilAndEmpty(t *testing.T) {
-	tbl, err := NewTable(nil)
-	require.NoError(t, err, "nil map builds an empty (never-matching) table")
-	_, ok := tbl.Cost("openai", "gpt-4o", 1, 1, 0, 0)
-	assert.False(t, ok, "empty table prices nothing")
+// TestNewLoader_RejectsOversizedFile_FixesM4 proves the loader bounds reads
+// at maxPricingBytes so a hostile file cannot exhaust process memory.
+func TestNewLoader_RejectsOversizedFile_FixesM4(t *testing.T) {
+	base := t.TempDir()
+	target := filepath.Join(base, "pricing.yaml")

-	entries, err := NewEntries(nil)
-	require.NoError(t, err)
-	assert.Empty(t, entries, "nil in, empty (never-matching) map out for the per-record map")
+	// Build a YAML payload larger than the cap. We pad with valid YAML
+	// comments so a partial read would still fail the size check rather
+	// than the parser.
+	header := "openai:\n"
+	bigComment := make([]byte, maxPricingBytes+1024)
+	for i := range bigComment {
+		bigComment[i] = ' '
+	}
+	bigComment[0] = '#'
+	bigComment[len(bigComment)-1] = '\n'
+	payload := append([]byte(header), bigComment...)
+	require.NoError(t, os.WriteFile(target, payload, 0o600))
+
+	_, err := NewLoader(base, "pricing.yaml", "llm_observability", nil)
+	require.Error(t, err, "oversized pricing file must be rejected")
+	assert.Contains(t, err.Error(), "exceeds", "rejection must reference the byte cap")
 }
--- a/proxy/internal/llm/pricing/pricing_unix.go
+++ b/proxy/internal/llm/pricing/pricing_unix.go
@@ -0,0 +1,68 @@
+//go:build unix
+
+package pricing
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"syscall"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// maxPricingBytes caps the size of the pricing YAML on read so a hostile or
+// runaway file cannot exhaust process memory during reload. 1 MiB is several
+// orders of magnitude larger than any reasonable pricing table.
+const maxPricingBytes int64 = 1 << 20
+
+// loadPricing opens the file with O_NOFOLLOW, fstats the open descriptor,
+// and parses from that same descriptor. Never re-opens by path so a
+// mid-read rename or symlink swap cannot substitute content. Bytes are
+// capped at maxPricingBytes so the loader cannot be coerced into reading an
+// unbounded file.
+func loadPricing(path string) (*Table, time.Time, error) {
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NOFOLLOW, 0)
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("open %s: %w", path, err)
+	}
+	defer func() {
+		if cerr := f.Close(); cerr != nil {
+			log.Debugf("close pricing file %s: %v", path, cerr)
+		}
+	}()
+
+	info, err := f.Stat()
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("fstat %s: %w", path, err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, time.Time{}, fmt.Errorf("pricing file %s is not a regular file", path)
+	}
+
+	data, err := io.ReadAll(io.LimitReader(f, maxPricingBytes+1))
+	if err != nil {
+		return nil, time.Time{}, fmt.Errorf("read %s: %w", path, err)
+	}
+	if int64(len(data)) > maxPricingBytes {
+		return nil, time.Time{}, fmt.Errorf("pricing file %s exceeds %d bytes", path, maxPricingBytes)
+	}
+
+	table, err := parsePricingBytes(data)
+	if err != nil {
+		return nil, time.Time{}, err
+	}
+	return table, info.ModTime(), nil
+}
+
+// statMtime returns the mtime of the file at path. It uses lstat semantics
+// via os.Lstat so a symlink swap is detected even though O_NOFOLLOW will
+// later reject the open.
+func statMtime(path string) (time.Time, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("lstat %s: %w", path, err)
+	}
+	return info.ModTime(), nil
+}
--- a/proxy/internal/middleware/builtin/builtin.go
+++ b/proxy/internal/middleware/builtin/builtin.go
@@ -36,13 +36,15 @@ var defaultRegistry = middleware.NewRegistry()

 // FactoryContext is the per-process bag that concrete factories may
 // consult during construction. It carries the proxy-lifetime context,
-// the OTel meter, and the proxy logger.
+// the data directory used for static config files (pricing tables,
+// allowlists), the OTel meter, and the proxy logger.
 //
 // Configure must be called once at boot before any chain build calls
 // Resolve. Calling it twice overwrites the prior value; tests may rely
 // on this to reset state.
 type FactoryContext struct {
 	Context    context.Context
+	DataDir    string
 	Meter      metric.Meter
 	Logger     *log.Logger
 	MgmtClient MgmtClient
@@ -56,11 +58,12 @@ var (
 // Configure stores the per-process FactoryContext. Concrete factories
 // reach for it via Context(). mgmt may be nil on tests / standalone
 // builds with no management server; consumers must guard.
-func Configure(ctx context.Context, meter metric.Meter, logger *log.Logger, mgmt MgmtClient) {
+func Configure(ctx context.Context, dataDir string, meter metric.Meter, logger *log.Logger, mgmt MgmtClient) {
 	ctxMu.Lock()
 	defer ctxMu.Unlock()
 	ctxStore = FactoryContext{
 		Context:    ctx,
+		DataDir:    dataDir,
 		Meter:      meter,
 		Logger:     logger,
 		MgmtClient: mgmt,
--- a/proxy/internal/middleware/builtin/cost_calculation_matrix_test.go
+++ b/proxy/internal/middleware/builtin/cost_calculation_matrix_test.go
@@ -12,7 +12,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	mgmtpricing "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
 	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/cost_meter"
@@ -20,20 +19,17 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin/llm_response_parser"
 )

-// Drives the real pipeline (llm_request_parser → llm_response_parser → cost_meter) on the REAL default pricing
-// table management ships (mgmtpricing.DefaultTable, catalog-derived) and asserts exact USD amounts hardcoded from
-// the vendors' published prices, including the cache split. This is the cross-stack pricing contract test: the
-// management-side Entry JSON must decode into the proxy-side table and produce these exact costs.
+// Drives the real pipeline (llm_request_parser → llm_response_parser → cost_meter) on the embedded default pricing
+// table and asserts exact USD amounts hardcoded from the vendors' published prices, including the cache split.
 func TestCostCalculation_ProviderMatrix(t *testing.T) {
-	builtin.Configure(context.Background(), nil, nil, nil)
+	// Empty data dir → embedded defaults, like a proxy with no pricing override.
+	builtin.Configure(context.Background(), t.TempDir(), nil, nil, nil)

 	reqMW, err := llm_request_parser.Factory{}.New(nil)
 	require.NoError(t, err, "build llm_request_parser")
 	respMW, err := llm_response_parser.Factory{}.New(nil)
 	require.NoError(t, err, "build llm_response_parser")
-	costCfgJSON, err := json.Marshal(map[string]any{"pricing": map[string]any{"defaults": mgmtpricing.DefaultTable()}})
-	require.NoError(t, err, "marshal management default table into cost_meter config")
-	costMW, err := cost_meter.Factory{}.New(costCfgJSON)
+	costMW, err := cost_meter.Factory{}.New(nil)
 	require.NoError(t, err, "build cost_meter")
 	t.Cleanup(func() { _ = costMW.Close() })

--- a/proxy/internal/middleware/builtin/cost_meter/factory.go
+++ b/proxy/internal/middleware/builtin/cost_meter/factory.go
@@ -2,6 +2,7 @@ package cost_meter

 import (
 	"bytes"
+	"context"
 	"encoding/json"
 	"fmt"

@@ -10,27 +11,16 @@ import (
 	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
 )

-// Config is the on-wire configuration for the middleware, synthesized by
-// management (buildCostMeterConfigJSON). The proxy has no embedded price
-// list: this payload is the only pricing source, and updates arrive as
-// ordinary mapping pushes that rebuild the chain (and with it this
-// middleware instance) — no per-request fetches, no reload loops.
-type Config struct {
-	Pricing *PricingConfig `json:"pricing"`
-}
+// defaultPricingFilename is the basename probed inside the proxy data
+// directory when no override is configured.
+const defaultPricingFilename = "pricing.yaml"

-// PricingConfig carries the full pricing table:
-//   - Defaults: parser surface ("openai"/"anthropic"/"bedrock") ->
-//     normalized model id -> rates, matched against llm.provider +
-//     llm.model.
-//   - Providers: provider record id -> normalized model id -> rates,
-//     matched against the llm.resolved_provider_id metadata llm_router
-//     stamps. Entries arrive fully materialized (management folds default
-//     cache rates in at synth time), so lookup order is simply
-//     per-record first, defaults second.
-type PricingConfig struct {
-	Defaults  map[string]map[string]pricing.EntryJSON `json:"defaults"`
-	Providers map[string]map[string]pricing.EntryJSON `json:"providers"`
+// Config is the on-wire configuration for the middleware.
+type Config struct {
+	// PricingPath optionally overrides the basename of the pricing
+	// file probed inside the proxy data directory. When empty the
+	// loader falls back to "pricing.yaml".
+	PricingPath string `json:"pricing_path"`
 }

 // Factory builds cost_meter instances from raw config bytes.
@@ -39,45 +29,45 @@ type Factory struct{}
 // ID returns the registry identifier.
 func (Factory) ID() string { return ID }

-// New constructs a middleware instance. Empty, null, and {} configs are
-// accepted for backward compatibility with a management server that
-// predates config-delivered pricing — the instance then skips every cost
-// computation (unknown_model) and a warning is logged once at build time.
-// Non-empty rawConfig that fails to unmarshal, or a table carrying a
-// non-finite / negative rate, is rejected so misconfigurations surface at
-// chain build time.
+// New constructs a middleware instance. Empty, null, and {} configs
+// are accepted; non-empty rawConfig that fails to unmarshal is
+// rejected so misconfigurations surface at chain build time. The
+// pricing loader is built once per instance and reused across
+// invocations.
 func (Factory) New(rawConfig []byte) (middleware.Middleware, error) {
 	cfg, err := decodeConfig(rawConfig)
 	if err != nil {
 		return nil, err
 	}

-	if cfg.Pricing == nil {
-		if logger := builtin.Context().Logger; logger != nil {
-			logger.Warnf("cost_meter: no pricing table in middleware config; management predates config-delivered pricing — every request will record cost.skipped=unknown_model ($0)")
-		}
-		return newMiddleware(mustEmptyTable(), nil), nil
+	fctx := builtin.Context()
+	pricingPath := cfg.PricingPath
+	if pricingPath == "" {
+		pricingPath = defaultPricingFilename
 	}

-	defaults, err := pricing.NewTable(cfg.Pricing.Defaults)
+	loader, err := pricing.NewLoader(fctx.DataDir, pricingPath, ID, nil)
 	if err != nil {
-		return nil, fmt.Errorf("cost_meter pricing defaults: %w", err)
+		return nil, fmt.Errorf("init pricing loader: %w", err)
 	}
-	perRecord, err := pricing.NewEntries(cfg.Pricing.Providers)
-	if err != nil {
-		return nil, fmt.Errorf("cost_meter per-provider pricing: %w", err)
-	}
-	return newMiddleware(defaults, perRecord), nil
+
+	cancel := startReloader(fctx.Context, loader)
+
+	return newMiddleware(loader, cancel), nil
 }

-// mustEmptyTable returns a valid empty table. NewTable on a nil map cannot
-// fail; the panic guard documents that invariant.
-func mustEmptyTable() *pricing.Table {
-	t, err := pricing.NewTable(nil)
-	if err != nil {
-		panic(fmt.Sprintf("cost_meter: empty pricing table must build: %v", err))
+// startReloader binds the loader's mtime-poll goroutine to a context
+// derived from the proxy-lifetime context and returns its cancel func so
+// the owning middleware can stop the goroutine on teardown. Returns nil
+// when there's nothing to watch (nil context or defaults-only loader), in
+// which case the middleware's Close is a no-op.
+func startReloader(ctx context.Context, loader *pricing.Loader) context.CancelFunc {
+	if ctx == nil || !loader.WatchesFile() {
+		return nil
 	}
-	return t
+	cctx, cancel := context.WithCancel(ctx)
+	go loader.Reload(cctx)
+	return cancel
 }

 // decodeConfig accepts empty, null, and {} configs, returning a
--- a/proxy/internal/middleware/builtin/cost_meter/middleware.go
+++ b/proxy/internal/middleware/builtin/cost_meter/middleware.go
@@ -1,9 +1,7 @@
 // Package cost_meter implements the SlotOnResponse middleware that
 // converts token-usage metadata emitted by llm_response_parser into a
-// per-request USD cost estimate. Pricing arrives from management inside
-// the middleware config: a per-provider-record table (the operator's
-// stored prices, matched via llm.resolved_provider_id) consulted first,
-// then the surface-keyed defaults table.
+// per-request USD cost estimate. The middleware uses the shared pricing
+// loader so operator pricing overrides apply to the chain.
 package cost_meter

 import (
@@ -19,9 +17,7 @@ import (
 const ID = "cost_meter"

 // Version is the implementation version emitted via the spec merge.
-// 1.1.0: pricing is config-delivered (defaults + per-provider-record
-// entries) instead of proxy-embedded.
-const Version = "1.1.0"
+const Version = "1.0.0"

 // Skip reasons emitted under KeyCostSkipped. The set is closed; the
 // dashboard surfaces these verbatim.
@@ -46,21 +42,19 @@ var metadataKeys = []string{
 }

 // Middleware computes a per-response cost estimate from the token
-// counts emitted upstream by llm_response_parser. Both tables are
-// immutable — a pricing change arrives as a mapping push that rebuilds
-// the chain with a fresh instance.
+// counts emitted upstream by llm_response_parser.
 type Middleware struct {
-	// defaults is the surface-keyed table (llm.provider x llm.model).
-	defaults *pricing.Table
-	// perRecord is keyed by provider record id (llm.resolved_provider_id)
-	// then normalized model id; entries arrive fully materialized from
-	// management. Consulted before defaults. May be nil.
-	perRecord map[string]map[string]pricing.Entry
+	loader *pricing.Loader
+	// cancel stops this instance's pricing-reload goroutine. Non-nil only
+	// when the loader watches an override file; Close calls it so a chain
+	// rebuild doesn't leak a poll goroutine per retired instance.
+	cancel context.CancelFunc
 }

-// newMiddleware constructs a Middleware over the given pricing tables.
-func newMiddleware(defaults *pricing.Table, perRecord map[string]map[string]pricing.Entry) *Middleware {
-	return &Middleware{defaults: defaults, perRecord: perRecord}
+// newMiddleware constructs a Middleware bound to the given pricing loader.
+// cancel may be nil (defaults-only loader with no reloader to stop).
+func newMiddleware(loader *pricing.Loader, cancel context.CancelFunc) *Middleware {
+	return &Middleware{loader: loader, cancel: cancel}
 }

 // ID returns the registry identifier.
@@ -85,9 +79,16 @@ func (m *Middleware) MetadataKeys() []string {
 // response.
 func (m *Middleware) MutationsSupported() bool { return false }

-// Close releases resources owned by the middleware. Stateless — the
-// pricing tables are plain maps owned by this instance.
-func (m *Middleware) Close() error { return nil }
+// Close stops this instance's pricing-reload goroutine, if any. Called by
+// the chain when a rebuild retires the instance, so the mtime-poll loop
+// doesn't outlive the chain it belonged to. Safe to call on a nil receiver
+// and on an instance with no reloader.
+func (m *Middleware) Close() error {
+	if m != nil && m.cancel != nil {
+		m.cancel()
+	}
+	return nil
+}

 // Invoke reads provider, model, and token metadata, looks up pricing,
 // and emits either KeyCostUSDTotal or KeyCostSkipped. The decision is
@@ -143,7 +144,8 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 		return out, nil
 	}

-	costs, ok := m.lookupCosts(in.Metadata, provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
+	table := m.loader.Get()
+	costs, ok := table.Costs(provider, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
 	if !ok {
 		out.Metadata = skip(skipUnknownModel)
 		return out, nil
@@ -162,26 +164,6 @@ func (m *Middleware) Invoke(_ context.Context, in *middleware.Input) (*middlewar
 	return out, nil
 }

-// lookupCosts resolves the price for this request and computes the cost
-// split. Resolution order:
-//
-//  1. Per-provider-record entry: the operator's stored price for the
-//     provider route that served the request, keyed by the
-//     llm.resolved_provider_id metadata llm_router stamped on the allow
-//     path. Absent metadata (e.g. no router in the chain) skips this tier.
-//  2. Surface defaults: the catalog-derived table keyed by llm.provider.
-//
-// The surface always selects the cache formula — a per-record entry for an
-// Anthropic route still bills its cache buckets additively.
-func (m *Middleware) lookupCosts(md []middleware.KV, surface, model string, inTokens, outTokens, cachedTokens, cacheCreationTokens int64) (pricing.Costs, bool) {
-	if recordID := lookupKV(md, middleware.KeyLLMResolvedProviderID); recordID != "" {
-		if entry, ok := m.perRecord[recordID][model]; ok {
-			return pricing.EntryCosts(entry, surface, inTokens, outTokens, cachedTokens, cacheCreationTokens), true
-		}
-	}
-	return m.defaults.Costs(surface, model, inTokens, outTokens, cachedTokens, cacheCreationTokens)
-}
-
 // usd renders a cost as the fixed-precision string every cost.usd_* key
 // carries, so the per-bucket values and the aggregates round identically.
 //
--- a/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
+++ b/proxy/internal/middleware/builtin/cost_meter/middleware_test.go
@@ -3,50 +3,39 @@ package cost_meter
 import (
 	"context"
 	"encoding/json"
+	"os"
+	"path/filepath"
 	"testing"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"

-	"github.com/netbirdio/netbird/proxy/internal/llm/pricing"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
+	"github.com/netbirdio/netbird/proxy/internal/middleware/builtin"
 )

-// fixtureConfig mirrors what management's buildCostMeterConfigJSON ships:
-// a surface-keyed defaults table. Rates match the retired YAML fixture so
-// every cost assertion below is byte-identical to the pre-feature values.
-func fixtureConfig(t *testing.T) []byte {
-	t.Helper()
-	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
-		Defaults: map[string]map[string]pricing.EntryJSON{
-			"openai": {
-				"gpt-4o":      {InputPer1K: 0.0025, OutputPer1K: 0.01},
-				"gpt-4o-mini": {InputPer1K: 0.00015, OutputPer1K: 0.0006},
-			},
-			"anthropic": {
-				"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015},
-			},
-		},
-	}})
-	require.NoError(t, err)
-	return raw
-}
+const fixturePricing = `openai:
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+  gpt-4o-mini:
+    input_per_1k: 0.00015
+    output_per_1k: 0.0006
+anthropic:
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+`

-// fixtureConfigWithCache adds the cache-rate fields.
-func fixtureConfigWithCache(t *testing.T) []byte {
+// configureBuiltin points the package-level FactoryContext at a tmp
+// directory containing the test pricing fixture. Returns the path so
+// callers can override files later if needed.
+func configureBuiltin(t *testing.T) string {
 	t.Helper()
-	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
-		Defaults: map[string]map[string]pricing.EntryJSON{
-			"openai": {
-				"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01, CachedInputPer1K: 0.00125},
-			},
-			"anthropic": {
-				"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015, CacheReadPer1K: 0.0003, CacheCreationPer1K: 0.00375},
-			},
-		},
-	}})
-	require.NoError(t, err)
-	return raw
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pricing.yaml"), []byte(fixturePricing), 0o600), "write pricing fixture")
+	builtin.Configure(context.Background(), dir, nil, nil, nil)
+	return dir
 }

 func metaValue(t *testing.T, kvs []middleware.KV, key string) (string, bool) {
@@ -67,7 +56,8 @@ func buildMiddleware(t *testing.T, raw []byte) middleware.Middleware {
 }

 func TestMiddleware_StaticSurface(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	assert.Equal(t, ID, mw.ID(), "ID must match the registered constant")
 	assert.Equal(t, Version, mw.Version(), "Version must match the constant")
@@ -89,10 +79,8 @@ func TestMiddleware_StaticSurface(t *testing.T) {
 	assert.Equal(t, expected, keys, "metadata key allowlist must match the spec")
 }

-// TestFactory_AcceptsEmptyAndJSONConfig: empty/null/{} configs are what an
-// old management (pre config-delivered pricing) sends — they must build a
-// working (all-skip) instance, never fail the chain.
 func TestFactory_AcceptsEmptyAndJSONConfig(t *testing.T) {
+	configureBuiltin(t)
 	cases := [][]byte{nil, {}, []byte("null"), []byte("{}"), []byte("   ")}
 	for _, raw := range cases {
 		mw, err := Factory{}.New(raw)
@@ -102,57 +90,15 @@ func TestFactory_AcceptsEmptyAndJSONConfig(t *testing.T) {
 }

 func TestFactory_RejectsMalformedConfig(t *testing.T) {
+	configureBuiltin(t)
 	mw, err := Factory{}.New([]byte("{not json"))
 	require.Error(t, err, "malformed config must surface at construction")
 	assert.Nil(t, mw, "no instance is returned on error")
 }

-// TestFactory_RejectsInvalidRates: a non-finite or negative rate anywhere
-// in the table fails the chain build (defense-in-depth behind management's
-// API validation) rather than silently mispricing.
-func TestFactory_RejectsInvalidRates(t *testing.T) {
-	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
-		Defaults: map[string]map[string]pricing.EntryJSON{
-			"openai": {"gpt-4o": {InputPer1K: -0.0025, OutputPer1K: 0.01}},
-		},
-	}})
-	require.NoError(t, err)
-	mw, err := Factory{}.New(raw)
-	require.Error(t, err, "negative rate must fail the build")
-	assert.Nil(t, mw)
-
-	raw, err = json.Marshal(Config{Pricing: &PricingConfig{
-		Providers: map[string]map[string]pricing.EntryJSON{
-			"prov-1": {"m": {InputPer1K: 0.01, OutputPer1K: 0.01, CacheReadPer1K: -1}},
-		},
-	}})
-	require.NoError(t, err)
-	_, err = Factory{}.New(raw)
-	require.Error(t, err, "per-record tables validate too")
-}
-
-// TestFactory_NilPricingSkipsEverything is the version-skew contract: a
-// new proxy under an old management ({} config) must build, allow, and
-// skip with unknown_model — degraded but never broken.
-func TestFactory_NilPricingSkipsEverything(t *testing.T) {
-	mw := buildMiddleware(t, []byte("{}"))
-	out, err := mw.Invoke(context.Background(), &middleware.Input{
-		Metadata: []middleware.KV{
-			{Key: middleware.KeyLLMProvider, Value: "openai"},
-			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
-			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
-		},
-	})
-	require.NoError(t, err)
-	assert.Equal(t, middleware.DecisionAllow, out.Decision, "cost_meter always allows")
-	value, ok := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
-	require.True(t, ok, "no pricing table means every request skips")
-	assert.Equal(t, skipUnknownModel, value)
-}
-
-func TestFactory_ConfigDefaultsPriceRequests(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+func TestFactory_DefaultPricingPathLoadsFixture(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -170,78 +116,34 @@ func TestFactory_ConfigDefaultsPriceRequests(t *testing.T) {
 	assert.Equal(t, "0.000750000", value, "0.00015 + 0.0006 per 1k tokens, 9-decimal format")
 }

-// TestInvoke_PerRecordEntryBeatsDefaults: when llm_router resolved a
-// provider record whose operator pinned a price for the model, that price
-// wins over the surface default.
-func TestInvoke_PerRecordEntryBeatsDefaults(t *testing.T) {
-	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
-		Defaults: map[string]map[string]pricing.EntryJSON{
-			"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
-		},
-		Providers: map[string]map[string]pricing.EntryJSON{
-			"prov-azure": {"gpt-4o": {InputPer1K: 0.005, OutputPer1K: 0.02}},
-		},
-	}})
-	require.NoError(t, err)
-	mw := buildMiddleware(t, raw)
+func TestFactory_PricingPathOverride(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "custom.yaml"), []byte(fixturePricing), 0o600), "write custom pricing")
+	builtin.Configure(context.Background(), dir, nil, nil, nil)

+	raw, err := json.Marshal(Config{PricingPath: "custom.yaml"})
+	require.NoError(t, err)
+
+	mw := buildMiddleware(t, raw)
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMProvider, Value: "openai"},
 			{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-azure"},
-			{Key: middleware.KeyLLMInputTokens, Value: "1000"},
+			{Key: middleware.KeyLLMInputTokens, Value: "2000"},
 			{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
 		},
 	})
 	require.NoError(t, err)
+
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
-	require.True(t, ok)
-	assert.Equal(t, "0.025000000", value, "operator's per-record price (0.005+0.02) wins over the default (0.0025+0.01)")
+	require.True(t, ok, "cost.usd_total must be emitted with custom pricing path")
+	assert.Equal(t, "0.015000000", value, "2*0.0025 + 1*0.01 = 0.015 with 9-decimal format")
 }

-// TestInvoke_PerRecordMissFallsBackToDefaults: a resolved record with no
-// entry for this model (or no entries at all) falls through to the
-// surface defaults — gateway providers rely on exactly this.
-func TestInvoke_PerRecordMissFallsBackToDefaults(t *testing.T) {
-	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
-		Defaults: map[string]map[string]pricing.EntryJSON{
-			"openai": {"gpt-4o": {InputPer1K: 0.0025, OutputPer1K: 0.01}},
-		},
-		Providers: map[string]map[string]pricing.EntryJSON{
-			"prov-1": {"some-other-model": {InputPer1K: 1, OutputPer1K: 1}},
-		},
-	}})
-	require.NoError(t, err)
-	mw := buildMiddleware(t, raw)
+func TestInvoke_ComputesCostForKnownModel(t *testing.T) {
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

-	for name, recordID := range map[string]string{
-		"record with other models": "prov-1",
-		"record with no entries":   "prov-gateway",
-	} {
-		t.Run(name, func(t *testing.T) {
-			out, err := mw.Invoke(context.Background(), &middleware.Input{
-				Metadata: []middleware.KV{
-					{Key: middleware.KeyLLMProvider, Value: "openai"},
-					{Key: middleware.KeyLLMModel, Value: "gpt-4o"},
-					{Key: middleware.KeyLLMResolvedProviderID, Value: recordID},
-					{Key: middleware.KeyLLMInputTokens, Value: "1000"},
-					{Key: middleware.KeyLLMOutputTokens, Value: "1000"},
-				},
-			})
-			require.NoError(t, err)
-			value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
-			require.True(t, ok, "per-record miss must fall back to the surface default, not skip")
-			assert.Equal(t, "0.012500000", value, "default rates apply")
-		})
-	}
-}
-
-// TestInvoke_NoResolvedProviderIDUsesDefaults: metadata without a
-// resolved provider id (router denied, or a chain without llm_router)
-// prices from the defaults table directly.
-func TestInvoke_NoResolvedProviderIDUsesDefaults(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
 			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
@@ -251,15 +153,17 @@ func TestInvoke_NoResolvedProviderIDUsesDefaults(t *testing.T) {
 		},
 	})
 	require.NoError(t, err)
+
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
-	require.True(t, ok)
+	require.True(t, ok, "cost.usd_total must be emitted")
 	assert.Equal(t, "0.018000000", value, "0.003 + 0.015 = 0.018 with 9-decimal format")
 	_, skipped := metaValue(t, out.Metadata, middleware.KeyCostSkipped)
 	assert.False(t, skipped, "cost.skipped must not be set when cost is computed")
 }

 func TestInvoke_MissingProvider(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -275,7 +179,8 @@ func TestInvoke_MissingProvider(t *testing.T) {
 }

 func TestInvoke_MissingModel(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -291,7 +196,8 @@ func TestInvoke_MissingModel(t *testing.T) {
 }

 func TestInvoke_MissingTokens(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	cases := []struct {
 		name string
@@ -334,7 +240,8 @@ func TestInvoke_MissingTokens(t *testing.T) {
 }

 func TestInvoke_UnparseableTokens(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	cases := []struct {
 		name string
@@ -364,7 +271,8 @@ func TestInvoke_UnparseableTokens(t *testing.T) {
 }

 func TestInvoke_ZeroTokens(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -383,7 +291,8 @@ func TestInvoke_ZeroTokens(t *testing.T) {
 }

 func TestInvoke_UnknownModel(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -400,7 +309,8 @@ func TestInvoke_UnknownModel(t *testing.T) {
 }

 func TestInvoke_NilInput(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfig(t))
+	configureBuiltin(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), nil)
 	require.NoError(t, err)
@@ -409,12 +319,36 @@ func TestInvoke_NilInput(t *testing.T) {
 	assert.Empty(t, out.Metadata, "no metadata must be emitted on nil input")
 }

+const fixturePricingWithCache = `openai:
+  gpt-4o:
+    input_per_1k: 0.0025
+    output_per_1k: 0.01
+    cached_input_per_1k: 0.00125
+anthropic:
+  claude-sonnet-4-5:
+    input_per_1k: 0.003
+    output_per_1k: 0.015
+    cache_read_per_1k: 0.0003
+    cache_creation_per_1k: 0.00375
+`
+
+// configureBuiltinWithCacheRates points the package-level
+// FactoryContext at a tmp directory containing pricing entries that
+// include the cache rate fields.
+func configureBuiltinWithCacheRates(t *testing.T) {
+	t.Helper()
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "pricing.yaml"), []byte(fixturePricingWithCache), 0o600), "write cache-aware pricing fixture")
+	builtin.Configure(context.Background(), dir, nil, nil, nil)
+}
+
 // TestInvoke_OpenAICachedSubsetDiscount proves the OpenAI shape end
 // to end through the middleware: cached_input_tokens is treated as a
 // SUBSET of input_tokens and discounted at the configured rate, not
 // added on top.
 func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfigWithCache(t))
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -456,7 +390,8 @@ func TestInvoke_OpenAICachedSubsetDiscount(t *testing.T) {
 // shape: cache_read and cache_creation are additive to input_tokens
 // and each carries its own rate.
 func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfigWithCache(t))
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -494,37 +429,8 @@ func TestInvoke_AnthropicCacheBucketsAdditive(t *testing.T) {
 		"output bucket bills 200 tokens at 0.015/1k")
 }

-// TestInvoke_PerRecordEntryUsesSurfaceFormula: a per-record entry for an
-// anthropic-surface request must bill its cache buckets additively — the
-// formula follows llm.provider, not which table the entry came from.
-func TestInvoke_PerRecordEntryUsesSurfaceFormula(t *testing.T) {
-	raw, err := json.Marshal(Config{Pricing: &PricingConfig{
-		Providers: map[string]map[string]pricing.EntryJSON{
-			"prov-ant": {"claude-sonnet-4-5": {InputPer1K: 0.003, OutputPer1K: 0.015, CacheReadPer1K: 0.0003, CacheCreationPer1K: 0.00375}},
-		},
-	}})
-	require.NoError(t, err)
-	mw := buildMiddleware(t, raw)
-
-	out, err := mw.Invoke(context.Background(), &middleware.Input{
-		Metadata: []middleware.KV{
-			{Key: middleware.KeyLLMProvider, Value: "anthropic"},
-			{Key: middleware.KeyLLMModel, Value: "claude-sonnet-4-5"},
-			{Key: middleware.KeyLLMResolvedProviderID, Value: "prov-ant"},
-			{Key: middleware.KeyLLMInputTokens, Value: "256"},
-			{Key: middleware.KeyLLMOutputTokens, Value: "200"},
-			{Key: middleware.KeyLLMCachedInputTokens, Value: "768"},
-			{Key: middleware.KeyLLMCacheCreationTokens, Value: "512"},
-		},
-	})
-	require.NoError(t, err)
-	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
-	require.True(t, ok)
-	assert.Equal(t, "0.005918400", value, "identical math to the defaults-table entry with the same rates")
-}
-
 // assertBucket asserts one per-bucket cost key carries the expected
-// 9-decimal value.
+// 6-decimal value.
 func assertBucket(t *testing.T, md []middleware.KV, key, want, msg string) {
 	t.Helper()
 	got, ok := metaValue(t, md, key)
@@ -533,10 +439,13 @@ func assertBucket(t *testing.T, md []middleware.KV, key, want, msg string) {
 }

 // TestInvoke_CachedTokensAbsentFallsBackToBaseFormula covers the
-// no-cache-metadata path: with no cached keys emitted, the meter must
-// produce exactly the input+output cost.
+// "operator hasn't opted in" path: with no cached metadata keys
+// emitted, the meter must produce exactly the same cost as before
+// the feature landed. Critical so operators with the new binary but
+// no YAML changes see no behavioural drift on OpenAI requests.
 func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfigWithCache(t))
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -551,7 +460,7 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 	value, ok := metaValue(t, out.Metadata, middleware.KeyCostUSDTotal)
 	require.True(t, ok)
 	// 1000 input * 0.0025 + 500 output * 0.01 = 0.0025 + 0.005 = 0.0075
-	assert.Equal(t, "0.007500000", value, "no cached metadata = plain input+output cost")
+	assert.Equal(t, "0.007500000", value, "no cached metadata = same cost as before the feature landed")
 }

 // TestInvoke_UnparseableCachedTokensSkippedSilently proves the
@@ -560,7 +469,8 @@ func TestInvoke_CachedTokensAbsentFallsBackToBaseFormula(t *testing.T) {
 // regular formula. Cache buckets are a refinement, never a reason to
 // abort cost computation.
 func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
-	mw := buildMiddleware(t, fixtureConfigWithCache(t))
+	configureBuiltinWithCacheRates(t)
+	mw := buildMiddleware(t, nil)

 	out, err := mw.Invoke(context.Background(), &middleware.Input{
 		Metadata: []middleware.KV{
@@ -577,10 +487,22 @@ func TestInvoke_UnparseableCachedTokensSkippedSilently(t *testing.T) {
 	assert.Equal(t, "0.007500000", value, "same as the no-cached-metadata path")
 }

-// TestMiddleware_CloseNilSafe confirms Close is a no-op (no panic) even
-// for a nil receiver.
+// TestMiddleware_CloseCancelsReloader proves Close stops the per-instance
+// pricing-reload goroutine: a chain rebuild retires the old instance and
+// calls Close, which must invoke the cancel func startReloader handed it so
+// the mtime-poll loop doesn't outlive the chain.
+func TestMiddleware_CloseCancelsReloader(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	m := newMiddleware(nil, cancel)
+
+	require.NoError(t, m.Close(), "Close must not error")
+	require.Error(t, ctx.Err(), "Close must cancel the reloader context so the poll goroutine exits")
+}
+
+// TestMiddleware_CloseNilSafe confirms Close is a no-op (no panic) for an
+// instance with no reloader and for a nil receiver.
 func TestMiddleware_CloseNilSafe(t *testing.T) {
-	require.NoError(t, newMiddleware(nil, nil).Close(), "Close must be a no-op")
+	require.NoError(t, newMiddleware(nil, nil).Close(), "no-reloader Close must be a no-op")
 	var m *Middleware
 	require.NoError(t, m.Close(), "nil-receiver Close must be safe")
 }
--- a/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
+++ b/proxy/internal/middleware/builtin/llm_request_parser/bedrock_test.go
@@ -6,6 +6,23 @@ import (
 	"github.com/stretchr/testify/require"
 )

+func TestNormalizeBedrockModel(t *testing.T) {
+	cases := map[string]string{
+		"eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+		"us.anthropic.claude-opus-4-8-20250101-v1:0":   "anthropic.claude-opus-4-8",
+		"apac.anthropic.claude-haiku-4-5-v1:0":         "anthropic.claude-haiku-4-5",
+		"anthropic.claude-sonnet-4-5-20250929-v1:0":    "anthropic.claude-sonnet-4-5",
+		"meta.llama3-3-70b-instruct-v1:0":              "meta.llama3-3-70b-instruct",
+		"amazon.nova-pro-v1:0":                         "amazon.nova-pro",
+		"amazon.nova-2-lite-v1:0":                      "amazon.nova-2-lite",
+		// Inference-profile ARN — model id lives in the last path segment.
+		"arn:aws:bedrock:eu-central-1:123456789012:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0": "anthropic.claude-sonnet-4-5",
+	}
+	for in, want := range cases {
+		require.Equal(t, want, normalizeBedrockModel(in), "normalize %q", in)
+	}
+}
+
 func TestParseBedrockPath(t *testing.T) {
 	tests := []struct {
 		path   string
--- a/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
+++ b/proxy/internal/middleware/builtin/llm_request_parser/middleware.go
@@ -8,6 +8,7 @@ package llm_request_parser
 import (
 	"context"
 	"net/url"
+	"regexp"
 	"strconv"
 	"strings"
 	"unicode/utf8"
@@ -252,7 +253,9 @@ func parseVertexPath(reqPath string) (vertexRequest, bool) {
 	if c := strings.LastIndex(rest, ":"); c >= 0 {
 		model, action = rest[:c], rest[c+1:]
 	}
-	model = llm.NormalizeVertexModel(model)
+	if at := strings.Index(model, "@"); at >= 0 {
+		model = model[:at]
+	}
 	if model == "" {
 		return vertexRequest{}, false
 	}
@@ -340,6 +343,14 @@ func trimBedrockNamespace(reqPath string) string {
 	return reqPath
 }

+// bedrockRegionPrefixes are the cross-region inference-profile prefixes that
+// front a Bedrock model id (e.g. "eu.anthropic.claude-...").
+var bedrockRegionPrefixes = []string{"us.", "eu.", "apac.", "global."}
+
+// bedrockVersionSuffix matches the trailing "-vN[:N]" or "-YYYYMMDD-vN[:N]"
+// version/throughput suffix of a Bedrock model id.
+var bedrockVersionSuffix = regexp.MustCompile(`-(\d{8}-)?v\d+(:\d+)?$`)
+
 // parseBedrockPath extracts the model and streaming/converse flags from an AWS
 // Bedrock runtime model endpoint:
 //
@@ -364,7 +375,7 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 	if decoded, err := url.PathUnescape(rawModel); err == nil {
 		rawModel = decoded
 	}
-	model := llm.NormalizeBedrockModel(rawModel)
+	model := normalizeBedrockModel(rawModel)
 	if model == "" {
 		return bedrockRequest{}, false
 	}
@@ -378,6 +389,30 @@ func parseBedrockPath(reqPath string) (bedrockRequest, bool) {
 	}
 }

+// normalizeBedrockModel strips an ARN wrapper, a cross-region inference-profile
+// prefix, and the version/throughput suffix from a Bedrock model id so it
+// matches the catalog/pricing key, e.g.
+// "eu.anthropic.claude-sonnet-4-5-20250929-v1:0" -> "anthropic.claude-sonnet-4-5"
+// and "arn:aws:bedrock:eu-central-1:123:inference-profile/eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
+// -> "anthropic.claude-sonnet-4-5".
+func normalizeBedrockModel(modelID string) string {
+	m := modelID
+	// A full ARN (inference-profile / provisioned-throughput / foundation-model)
+	// carries the model id in its last path segment.
+	if strings.HasPrefix(m, "arn:") {
+		if i := strings.LastIndex(m, "/"); i >= 0 {
+			m = m[i+1:]
+		}
+	}
+	for _, p := range bedrockRegionPrefixes {
+		if strings.HasPrefix(m, p) {
+			m = m[len(p):]
+			break
+		}
+	}
+	return bedrockVersionSuffix.ReplaceAllString(m, "")
+}
+
 // invokeBedrock emits the model/provider/session/prompt for an AWS Bedrock
 // request. Bedrock is metered under the dedicated "bedrock" parser, which reads
 // both the InvokeModel and Converse response shapes.
--- a/proxy/internal/proxy/agent_network_chain_realstack_test.go
+++ b/proxy/internal/proxy/agent_network_chain_realstack_test.go
@@ -18,10 +18,10 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/test/bufconn"

-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/proxy/internal/middleware"
 	"github.com/netbirdio/netbird/proxy/internal/middleware/bodytap"
@@ -134,18 +134,14 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 		RedactPii:              true,
 	}))
 	require.NoError(t, st.SaveAgentNetworkProvider(ctx, &agentNetworkTypes.Provider{
-		ID:          providerID,
-		AccountID:   testAccountID,
-		ProviderID:  "openai_api",
-		Name:        "openai-fullchain-test",
-		UpstreamURL: upstream.URL, // router rewrites to this
-		APIKey:      "sk-test",
-		Enabled:     true,
-		// Operator-pinned prices deliberately differ from the catalog's
-		// gpt-5.4 rates (0.0025/0.015) so the cost assertion below proves
-		// the per-provider-record price — not the default table — billed
-		// this request: stored price → synth → wire → cost_meter.
-		Models:            []agentNetworkTypes.ProviderModel{{ID: "gpt-5.4", InputPer1k: 0.004, OutputPer1k: 0.02}},
+		ID:                providerID,
+		AccountID:         testAccountID,
+		ProviderID:        "openai_api",
+		Name:              "openai-fullchain-test",
+		UpstreamURL:       upstream.URL, // router rewrites to this
+		APIKey:            "sk-test",
+		Enabled:           true,
+		Models:            []agentNetworkTypes.ProviderModel{{ID: "gpt-5.4"}},
 		SessionPrivateKey: "priv",
 		SessionPublicKey:  "pub",
 	}))
@@ -180,7 +176,7 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {

 	// ---- 5. Wire the middleware framework — same registry the proxy uses
 	// in production, configured with our bufconn-backed management client.
-	mwbuiltin.Configure(ctx, nil, testLogger, mgmtClient)
+	mwbuiltin.Configure(ctx, t.TempDir(), nil, testLogger, mgmtClient)
 	registry := mwbuiltin.DefaultRegistry()
 	mwMetrics, err := middleware.NewMetrics(nil)
 	require.NoError(t, err)
@@ -287,23 +283,13 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 			if r.DimensionKind == agentNetworkTypes.DimensionGroup &&
 				r.DimensionID == adminGroupID &&
 				r.WindowSeconds == 60 &&
-				r.TokensInput+r.TokensOutput > 0 &&
-				r.CostUSD > 0 {
+				r.TokensInput+r.TokensOutput > 0 {
 				return true
 			}
 		}
 		return false
 	}, 5*time.Second, 50*time.Millisecond,
-		"Admins group consumption row must increment via the response leg WITH a non-zero cost — a zero cost means the operator's stored price never reached cost_meter (synth → wire → per-record lookup broken)")
-
-	// 8a-cost. Exact cost from the OPERATOR's stored price, not the catalog
-	// default: 12 prompt tokens × 0.004/1k + 40 completion tokens × 0.02/1k
-	// = 0.000048 + 0.0008 = 0.000848. With catalog rates it would be 0.00063
-	// — this assertion distinguishes the two, closing the loop on the whole
-	// dynamic-pricing feature (dashboard save → synth → gRPC wire →
-	// llm.resolved_provider_id lookup → billing).
-	assert.Equal(t, "0.000848000", cd.GetMetadata()["cost.usd_total"],
-		"cost must be computed from the provider record's operator-pinned price")
+		"Admins group consumption row must increment via the response leg — if this fails the proxy's respInput dropped UserGroups again or the parser/recorder wiring is broken")

 	// 8b. Both the captured prompt and the captured completion are
 	// redacted — proves the synth threads redact_pii=true into BOTH parser
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Viktor Liu	0f5d2d91fb	[client] Authorize daemon IPC callers by their local identity (#6967 )	2026-07-29 20:32:26 +02:00
Pascal Fischer	0b7e6a9f46	[signal] make pprof configurable (#6963 )	2026-07-29 16:54:01 +02:00
Viktor Liu	f2c1070f95	[client] Fix UI crash on Windows builds without dark-mode support (#6958 )	2026-07-29 13:52:18 +02:00
Brandon Hopkins	df39c2b254	[infrastructure] Deprecate legacy Dex and Zitadel getting-started scripts (#6952 ) ## Describe your changes Retire the legacy Dex and Zitadel installation scripts by replacing their implementations with compatibility notices that: - Exit unsuccessfully before making any system changes. - Direct new deployments to `getting-started.sh` and the self-hosting quickstart. - Explain that the current installer uses NetBird's embedded Dex-based identity provider. - Direct users to configure Zitadel through the NetBird Dashboard or follow the advanced guide for a standalone identity-provider deployment. - Clarify that Dex support, Zitadel support, and existing deployments are not deprecated. - Announce that the compatibility notices will be removed in NetBird v0.80. Replace the legacy Zitadel provisioning workflow with CI checks that verify both scripts fail, write their notices to stderr, and include the expected documentation links and removal version. ## Issue ticket number and link No single issue tracks this deprecation. Related to: - Legacy installer failures: #4980, #4698, #3566, #3010, #2834, #2094, #2046, and #1966. - Legacy installer enhancement requests: #4510 and #1785. ## Stack Standalone PR based on `main`. <!-- branch-stack --> ### Checklist - [ ] Is it a bug fix - [ ] Is a typo/documentation fix - [ ] Is a feature enhancement - [ ] It is a refactor - [x] Created tests that fail without the change (if possible) - [x] This change does not modify the public API, gRPC protocols, functionality behavior, CLI / service flags, or introduce a new feature — OR I have discussed it with the NetBird team beforehand (link the issue / Slack thread in the description). See [CONTRIBUTING.md](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTING.md#discuss-changes-with-the-netbird-team-first). > By submitting this pull request, you confirm that you have read and agree to the terms of the [Contributor License Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md). ## Documentation Select exactly one: - [ ] I added/updated documentation for this change - [x] Documentation is not needed for this change because the compatibility notices link to the existing quickstart, identity-provider, and advanced deployment documentation. ### Docs PR URL (required if "docs added" is checked) Paste the PR link from https://github.com/netbirdio/docs here: N/A <!-- codesmith:footer --> --- <a href="https://app.blacksmith.sh/netbirdio/codesmith/netbird/pr/6952"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img alt="View with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a> <a href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787867848&installation_model_id=427504&pr_number=6952&repository=netbirdio%2Fnetbird&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fnetbird%2Fpull%2F6952&signature=0dcc8cda6a3daa5647fa0d40a0f143fef9ad6258aa9ba07a861e658efd244ad1"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img alt="Autofix with [code]smith" src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a> <sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you need. Autofix is disabled.</sup> <!-- codesmith:autofix:disabled --> <!-- /codesmith:footer --> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - Breaking Changes - Retired the legacy Dex and Zitadel getting-started installation scripts. - These scripts now exit with an explanatory deprecation message and direct users to the current setup flow and documentation. - Existing workflows now verify that the retired scripts fail as expected and provide the appropriate migration guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->	2026-07-29 12:20:43 +02:00