Require an S4U comparison and check elevation against the token elevation type

Resolve test account names from well-known SIDs and RIDs instead of English literals
Identify the Administrators group by the name resolved from its well-known SID
2026-08-01 05:11:29 +02:00 · 2026-07-29 21:05:55 +02:00 · 2026-07-29 18:33:52 +02:00 · 2026-07-29 18:14:19 +02:00 · 2026-07-29 18:00:04 +02:00 · 2026-07-29 14:12:42 +02:00
111 changed files with 4865 additions and 4547 deletions
--- a/.github/workflows/test-infrastructure-files.yml
+++ b/.github/workflows/test-infrastructure-files.yml
@@ -249,78 +249,35 @@ jobs:
          docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City_[0-9]*.mmdb
          docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames_[0-9]*.db

-  test-getting-started-script:
+  test-legacy-getting-started-scripts:
    runs-on: ubuntu-latest
    steps:
-      - name: Install jq
-        run: sudo apt-get install -y jq
-
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

-      - name: run script with Zitadel PostgreSQL
-        run: NETBIRD_DOMAIN=use-ip bash -x infrastructure_files/getting-started-with-zitadel.sh
-
-      - name: test Caddy file gen postgres
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen postgres
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen postgres
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen postgres
+      - name: Verify Dex retirement notice
        run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
+          if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Dex installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Dex support is not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/local" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt

-      - name: test zitadel.env file gen postgres
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen postgres
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen postgres
-        run: test -f relay.env
-
-      - name: test zdb.env file gen postgres
-        run: test -f zdb.env
-
-      - name: Postgres run cleanup
+      - name: Verify Zitadel retirement notice
        run: |
-          docker compose down --volumes --rmi all
-          rm -rf docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json zdb.env
-
-      - name: run script with Zitadel CockroachDB
-        run: bash -x infrastructure_files/getting-started-with-zitadel.sh
-        env:
-          NETBIRD_DOMAIN: use-ip
-          ZITADEL_DATABASE: cockroach
-
-      - name: test Caddy file gen CockroachDB
-        run: test -f Caddyfile
-
-      - name: test docker-compose file gen CockroachDB
-        run: test -f docker-compose.yml
-
-      - name: test management.json file gen CockroachDB
-        run: test -f management.json
-
-      - name: test turnserver.conf file gen CockroachDB
-        run: |
-          set -x
-          test -f turnserver.conf
-          grep external-ip turnserver.conf
-
-      - name: test zitadel.env file gen CockroachDB
-        run: test -f zitadel.env
-
-      - name: test dashboard.env file gen CockroachDB
-        run: test -f dashboard.env
-
-      - name: test relay.env file gen CockroachDB
-        run: test -f relay.env
+          if bash infrastructure_files/getting-started-with-zitadel.sh >stdout.txt 2>stderr.txt; then
+            echo "Expected the retired Zitadel installer to fail"
+            exit 1
+          fi
+          test ! -s stdout.txt
+          grep -Fq "Zitadel support and existing Zitadel deployments are not deprecated." stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/zitadel" stderr.txt
+          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-guide" stderr.txt
+          grep -Fq "removed in NetBird v0.80" stderr.txt
--- a/.goreleaser_ui.yaml
+++ b/.goreleaser_ui.yaml
@@ -24,6 +24,8 @@ builds:
    ldflags:
      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production

  - id: netbird-ui-windows-amd64
    dir: client/ui
@@ -39,6 +41,8 @@ builds:
      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
      - -H windowsgui
    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production

  - id: netbird-ui-windows-arm64
    dir: client/ui
@@ -55,6 +59,8 @@ builds:
      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
      - -H windowsgui
    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production

 archives:
  - id: linux-arch
--- a/.goreleaser_ui_darwin.yaml
+++ b/.goreleaser_ui_darwin.yaml
@@ -29,6 +29,8 @@ builds:
    ldflags:
      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production

 universal_binaries:
  - id: netbird-ui-darwin
--- a/client/android/client.go
+++ b/client/android/client.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"os"
 	"slices"
+	"strings"
 	"sync"
 	"time"

@@ -299,6 +300,13 @@ func (c *Client) SetInfoLogLevel() {
 // PeersList return with the list of the PeerInfos
 func (c *Client) PeersList() *PeerInfoArray {

+	// The recorder only caches transfer counters and handshake times; nothing
+	// refreshes them on its own, so without this they read as zero. The desktop
+	// daemon does the same before serving a full peer status.
+	if err := c.recorder.RefreshWireGuardStats(); err != nil {
+		log.Debugf("failed to refresh WireGuard stats: %v", err)
+	}
+
 	fullStatus := c.recorder.GetFullStatus()

 	peerInfos := make([]PeerInfo, len(fullStatus.Peers))
@@ -309,6 +317,20 @@ func (c *Client) PeersList() *PeerInfoArray {
 			FQDN:       p.FQDN,
 			ConnStatus: int(p.ConnStatus),
 			Routes:     PeerRoutes{routes: maps.Keys(p.GetRoutes())},
+
+			PubKey:                     p.PubKey,
+			Latency:                    formatDuration(p.Latency),
+			LatencyMs:                  p.Latency.Milliseconds(),
+			BytesRx:                    p.BytesRx,
+			BytesTx:                    p.BytesTx,
+			ConnStatusUpdate:           formatTime(p.ConnStatusUpdate),
+			Relayed:                    p.Relayed,
+			RosenpassEnabled:           p.RosenpassEnabled,
+			LastWireguardHandshake:     formatTime(p.LastWireguardHandshake),
+			LocalIceCandidateType:      p.LocalIceCandidateType,
+			RemoteIceCandidateType:     p.RemoteIceCandidateType,
+			LocalIceCandidateEndpoint:  p.LocalIceCandidateEndpoint,
+			RemoteIceCandidateEndpoint: p.RemoteIceCandidateEndpoint,
 		}
 		peerInfos[n] = pi
 	}
@@ -439,10 +461,6 @@ func (c *Client) RemoveConnectionListener() {
 	c.recorder.RemoveConnectionListener()
 }

-func (c *Client) toggleRoute(command routeCommand) error {
-	return command.toggleRoute()
-}
-
 func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	client := c.getConnectClient()
 	if client == nil {
@@ -462,22 +480,22 @@ func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	return manager, nil
 }

-func (c *Client) SelectRoute(route string) error {
+func (c *Client) SelectRoute(id string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}

-	return c.toggleRoute(selectRouteCommand{route: route, manager: manager})
+	return manager.SelectRoutes([]route.NetID{route.NetID(id)}, true)
 }

-func (c *Client) DeselectRoute(route string) error {
+func (c *Client) DeselectRoute(id string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}

-	return c.toggleRoute(deselectRouteCommand{route: route, manager: manager})
+	return manager.DeselectRoutes([]route.NetID{route.NetID(id)})
 }

 // getNetworkDomainsFromRoute extracts domains from a route and enriches each domain
@@ -512,3 +530,28 @@ func exportEnvList(list *EnvList) {
 		}
 	}
 }
+
+// formatDuration renders a duration for display, trimming the fractional part
+// to two digits so latencies read as "12.34ms" rather than "12.345678ms".
+func formatDuration(d time.Duration) string {
+	ds := d.String()
+	dotIndex := strings.Index(ds, ".")
+	if dotIndex == -1 {
+		return ds
+	}
+
+	endIndex := min(dotIndex+3, len(ds))
+
+	// Skip the remaining digits so only the unit suffix is appended back.
+	unitStart := endIndex
+	for unitStart < len(ds) && ds[unitStart] >= '0' && ds[unitStart] <= '9' {
+		unitStart++
+	}
+	return ds[:endIndex] + ds[unitStart:]
+}
+
+// formatTime renders a timestamp in UTC using a fixed layout. The zero time is
+// passed through as-is so the UI can recognise it and show "never" instead.
+func formatTime(t time.Time) string {
+	return t.UTC().Format("2006-01-02 15:04:05")
+}
--- a/client/android/peer_notifier.go
+++ b/client/android/peer_notifier.go
@@ -12,12 +12,30 @@ const (
 )

 // PeerInfo describe information about the peers. It designed for the UI usage
+//
+// The fields below ConnStatus back the peer detail screen. Durations and times
+// are pre-formatted into strings so the UI does not have to know Go's layouts;
+// Latency is additionally exposed as LatencyMs for colour coding.
 type PeerInfo struct {
 	IP         string
 	IPv6       string
 	FQDN       string
 	ConnStatus int
 	Routes     PeerRoutes
+
+	PubKey                     string
+	Latency                    string
+	LatencyMs                  int64
+	BytesRx                    int64
+	BytesTx                    int64
+	ConnStatusUpdate           string
+	Relayed                    bool
+	RosenpassEnabled           bool
+	LastWireguardHandshake     string
+	LocalIceCandidateType      string
+	RemoteIceCandidateType     string
+	LocalIceCandidateEndpoint  string
+	RemoteIceCandidateEndpoint string
 }

 func (p *PeerInfo) GetPeerRoutes() *PeerRoutes {
--- a/client/android/profile_manager.go
+++ b/client/android/profile_manager.go
@@ -189,6 +189,19 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 	return nil
 }

+// RenameProfile changes a profile's display name. The profile ID, and therefore
+// its on-disk filename, is left untouched: only the "name" field of the config
+// is rewritten. This works for the default profile too, whose config lives in
+// netbird.cfg rather than under profiles/.
+func (pm *ProfileManager) RenameProfile(id string, newName string) error {
+	if err := pm.serviceMgr.RenameProfile(profilemanager.ID(id), androidUsername, newName); err != nil {
+		return fmt.Errorf("failed to rename profile: %w", err)
+	}
+
+	log.Infof("renamed profile %s to: %s", id, newName)
+	return nil
+}
+
 // RemoveProfile deletes a profile
 func (pm *ProfileManager) RemoveProfile(id string) error {
 	// Use ServiceManager (removes profile from profiles/ directory)
--- a/client/android/route_command.go
+++ b/client/android/route_command.go
@@ -1,70 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
-
-	"github.com/netbirdio/netbird/client/internal/routemanager"
-	"github.com/netbirdio/netbird/route"
-)
-
-func executeRouteToggle(id string, manager routemanager.Manager,
-	operationName string,
-	routeOperation func(routes []route.NetID, allRoutes []route.NetID) error) error {
-	netID := route.NetID(id)
-	routes := []route.NetID{netID}
-
-	routesMap := manager.GetClientRoutesWithNetID()
-	routes = route.ExpandV6ExitPairs(routes, routesMap)
-
-	log.Debugf("%s with ids: %v", operationName, routes)
-
-	if err := routeOperation(routes, maps.Keys(routesMap)); err != nil {
-		log.Debugf("error when %s: %s", operationName, err)
-		return fmt.Errorf("error %s: %w", operationName, err)
-	}
-
-	manager.TriggerSelection(manager.GetClientRoutes())
-
-	return nil
-}
-
-type routeCommand interface {
-	toggleRoute() error
-}
-
-type selectRouteCommand struct {
-	route   string
-	manager routemanager.Manager
-}
-
-func (s selectRouteCommand) toggleRoute() error {
-	routeSelector := s.manager.GetRouteSelector()
-	if routeSelector == nil {
-		return fmt.Errorf("no route selector available")
-	}
-
-	routeOperation := func(routes []route.NetID, allRoutes []route.NetID) error {
-		return routeSelector.SelectRoutes(routes, true, allRoutes)
-	}
-
-	return executeRouteToggle(s.route, s.manager, "selecting route", routeOperation)
-}
-
-type deselectRouteCommand struct {
-	route   string
-	manager routemanager.Manager
-}
-
-func (d deselectRouteCommand) toggleRoute() error {
-	routeSelector := d.manager.GetRouteSelector()
-	if routeSelector == nil {
-		return fmt.Errorf("no route selector available")
-	}
-
-	return executeRouteToggle(d.route, d.manager, "deselecting route", routeSelector.DeselectRoutes)
-}
--- a/client/internal/conn_mgr.go
+++ b/client/internal/conn_mgr.go
@@ -385,11 +385,20 @@ func inactivityThresholdEnv() *time.Duration {
 		return nil
 	}

-	parsedMinutes, err := strconv.Atoi(envValue)
-	if err != nil || parsedMinutes <= 0 {
-		return nil
+	// Documented format: a Go duration such as "30m" or "1h".
+	if d, err := time.ParseDuration(envValue); err == nil {
+		if d <= 0 {
+			return nil
+		}
+		return &d
 	}

-	d := time.Duration(parsedMinutes) * time.Minute
-	return &d
+	// Backwards compatibility: a bare integer used to be interpreted as minutes.
+	if parsedMinutes, err := strconv.Atoi(envValue); err == nil && parsedMinutes > 0 {
+		d := time.Duration(parsedMinutes) * time.Minute
+		return &d
+	}
+
+	log.Warnf("invalid %s value %q: expected a Go duration such as 30m or 1h", lazyconn.EnvInactivityThreshold, envValue)
+	return nil
 }
--- a/client/internal/conn_mgr_test.go
+++ b/client/internal/conn_mgr_test.go
@@ -104,3 +104,38 @@ func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
 	close(done)
 	wg.Wait()
 }
+
+func TestInactivityThresholdEnv(t *testing.T) {
+	tests := []struct {
+		name string
+		val  string
+		want *time.Duration
+	}{
+		{name: "unset", val: "", want: nil},
+		{name: "go duration minutes", val: "30m", want: durPtr(30 * time.Minute)},
+		{name: "go duration hours", val: "1h", want: durPtr(time.Hour)},
+		{name: "go duration seconds", val: "90s", want: durPtr(90 * time.Second)},
+		{name: "bare integer is minutes (backwards compat)", val: "5", want: durPtr(5 * time.Minute)},
+		{name: "zero duration", val: "0s", want: nil},
+		{name: "zero integer", val: "0", want: nil},
+		{name: "negative duration", val: "-5m", want: nil},
+		{name: "garbage", val: "abc", want: nil},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(lazyconn.EnvInactivityThreshold, tc.val)
+			got := inactivityThresholdEnv()
+			switch {
+			case tc.want == nil && got != nil:
+				t.Fatalf("want nil, got %v", *got)
+			case tc.want != nil && got == nil:
+				t.Fatalf("want %v, got nil", *tc.want)
+			case tc.want != nil && *got != *tc.want:
+				t.Fatalf("want %v, got %v", *tc.want, *got)
+			}
+		})
+	}
+}
+
+func durPtr(d time.Duration) *time.Duration { return &d }
--- a/client/internal/connect.go
+++ b/client/internal/connect.go
@@ -34,6 +34,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/client/internal/tunnelnotifier"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
@@ -136,10 +137,13 @@ func (c *ConnectClient) RunOniOS(
 	// Set GC percent to 5% to reduce memory usage as iOS only allows 50MB of memory for the extension.
 	debug.SetGCPercent(5)

+	notifier := tunnelnotifier.New(networkChangeListener, dnsManager)
+	defer notifier.Close()
+
 	mobileDependency := MobileDependency{
 		FileDescriptor:        fileDescriptor,
-		NetworkChangeListener: networkChangeListener,
-		DnsManager:            dnsManager,
+		NetworkChangeListener: notifier,
+		DnsManager:            notifier,
 		StateFilePath:         stateFilePath,
 		TempDir:               cacheDir,
 	}
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -50,7 +50,6 @@ import (
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
-	"github.com/netbirdio/netbird/client/internal/pqkem"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
@@ -198,10 +197,6 @@ type Engine struct {
 	// rpManager is a Rosenpass manager
 	rpManager *rosenpass.Manager

-	// pqkemManager runs the ML-KEM post-quantum PSK exchange (gated by NB_ENABLE_PQ_MLKEM).
-	// It owns the data-path transport and peer endpoint routing.
-	pqkemManager *pqkem.Manager
-
 	// syncMsgMux is used to guarantee sequential Management Service message processing
 	syncMsgMux *sync.Mutex

@@ -656,30 +651,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.rpManager.SetInterface(e.wgInterface)
 	}

-	// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
-	// transport can bind on the WG overlay IP.
-	if pqkem.Enabled() {
-		tr, pqErr := newPQTransport(e.config.WgAddr.IP)
-		if pqErr != nil {
-			log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
-		} else {
-			cbHandler := pqCallbackHandler{
-				wg: e.wgInterface,
-				// On a persistent rekey failure, re-bootstrap the KEM over Signal: a
-				// fresh signalling offer starts a new exchange that overwrites the
-				// stalled PSK on both sides, recovering from a data-path desync.
-				reoffer: func(remoteKey string) {
-					if conn, ok := e.peerStore.PeerConn(remoteKey); ok {
-						conn.RequestReoffer()
-					}
-				},
-			}
-			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), cbHandler, pqkem.NewLogger())
-			e.pqkemManager.Start(tr)
-			log.Infof("pqkem: enabled (udp port %d on overlay %s)", e.pqkemManager.LocalPort(), e.config.WgAddr.IP)
-		}
-	}
-
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -943,10 +914,6 @@ func (e *Engine) removePeer(peerKey string) error {

 	e.connMgr.RemovePeerConn(peerKey)

-	if e.pqkemManager != nil {
-		e.pqkemManager.RemovePeer(pqkem.RemoteID(peerKey))
-	}
-
 	err := e.statusRecorder.RemovePeer(peerKey)
 	if err != nil {
 		log.Warnf("received error when removing peer %s from status recorder: %v", peerKey, err)
@@ -1933,10 +1900,6 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 		},
 		ICEConfig: e.createICEConfig(),
 	}
-	if e.pqkemManager != nil {
-		config.PQ = pqHandshaker{mgr: e.pqkemManager}
-		config.PQStrict = pqkem.Strict()
-	}

 	serviceDependencies := peer.ServiceDependencies{
 		StatusRecorder:     e.statusRecorder,
@@ -2120,10 +2083,6 @@ func (e *Engine) close() {
 		_ = e.rpManager.Close()
 	}

-	if e.pqkemManager != nil {
-		e.pqkemManager.Stop()
-	}
-
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	if err := e.portForwardManager.GracefullyStop(ctx); err != nil {
@@ -2936,8 +2895,6 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 		Version:         msg.GetBody().GetNetBirdVersion(),
 		RosenpassPubKey: rosenpassPubKey,
 		RosenpassAddr:   rosenpassAddr,
-		MlkemPayload:    msg.GetBody().GetMlkemPayload(),
-		MlkemPort:       int(msg.GetBody().GetMlkemPort()),
 		RelaySrvAddress: msg.GetBody().GetRelayServerAddress(),
 		RelaySrvIP:      relayIP,
 		SessionID:       sessionID,
--- a/client/internal/mobile_dependency.go
+++ b/client/internal/mobile_dependency.go
@@ -11,12 +11,14 @@ import (

 // MobileDependency collect all dependencies for mobile platform
 type MobileDependency struct {
-	// Android only
-	TunAdapter            device.TunAdapter
-	IFaceDiscover         stdnet.ExternalIFaceDiscover
+	// Android and iOS
 	NetworkChangeListener listener.NetworkChangeListener
-	HostDNSAddresses      []netip.AddrPort
-	DnsReadyListener      dns.ReadyListener
+
+	// Android only
+	TunAdapter       device.TunAdapter
+	IFaceDiscover    stdnet.ExternalIFaceDiscover
+	HostDNSAddresses []netip.AddrPort
+	DnsReadyListener dns.ReadyListener

 	//	iOS only
 	DnsManager     dns.IosDnsManager
--- a/client/internal/peer/conn.go
+++ b/client/internal/peer/conn.go
@@ -3,7 +3,6 @@ package peer
 import (
 	"context"
 	"fmt"
-	"math"
 	"net"
 	"net/netip"
 	"runtime"
@@ -27,7 +26,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/monotime"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -76,34 +74,6 @@ type RosenpassConfig struct {
 	PermissiveMode bool
 }

-// PQHandshaker attaches post-quantum ML-KEM material to signalling offers/answers and
-// feeds received material back. It is implemented by the engine over the pqkem
-// manager and is nil when the PQ exchange is disabled. remoteKey is the peer's
-// WireGuard public key.
-type PQHandshaker interface {
-	// OfferPayload returns the KEM offer to embed in an outgoing offer (nil if this
-	// peer is not the KEM initiator) and the local PQ data-path port to announce.
-	OfferPayload(remoteKey string) (payload []byte, port int)
-	// AnswerPayload processes a received KEM offer (nil if absent) and returns the KEM
-	// answer to embed in the outgoing answer (nil if none) and the local PQ port.
-	AnswerPayload(remoteKey string, recvOffer []byte) (payload []byte, port int)
-	// OnAnswer feeds a received KEM answer (nil if absent).
-	OnAnswer(remoteKey string, recvAnswer []byte)
-	// PSK returns the peer's latest derived post-quantum PSK to program at WG
-	// peer-config time (the pull path). ok is false until one has been derived.
-	PSK(remoteKey string) (wgtypes.Key, bool)
-	// SetRemoteAddr registers the peer's data-path endpoint learned from signalling:
-	// its WG overlay IP with the advertised pq UDP port.
-	SetRemoteAddr(remoteKey string, addr netip.AddrPort)
-	// OnDataPathRekeyed signals a fresh WireGuard handshake for the peer; it clocks the
-	// next chained PSK rotation pushed over the data path. sinceActivity is how long
-	// ago the peer last exchanged real user data, so the rotation can be skipped for
-	// idle tunnels.
-	OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration)
-	// OnDataPathDown signals the peer's tunnel went down.
-	OnDataPathDown(remoteKey string)
-}
-
 // ConnConfig is a peer Connection configuration
 type ConnConfig struct {
 	// Key is a public key of a remote peer
@@ -121,12 +91,6 @@ type ConnConfig struct {

 	RosenpassConfig RosenpassConfig

-	// PQ carries post-quantum ML-KEM material on offers/answers; nil when disabled.
-	PQ PQHandshaker
-	// PQStrict fails closed: block peer traffic until the ML-KEM PSK is established,
-	// instead of letting the tunnel come up classically and upgrading to PQ later.
-	PQStrict bool
-
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
 }
@@ -185,11 +149,6 @@ type Conn struct {
 	// pendingFirstPacket is the lazyconn-captured handshake init, replayed once the real
 	// transport is up.
 	pendingFirstPacket []byte
-
-	// pqBlockingKey is a per-conn random sentinel PSK used in PQ strict mode to fail
-	// closed: it is programmed until the real ML-KEM PSK is derived, so no session can
-	// form on a non-PQ key. Per-conn random so two strict peers never match by chance.
-	pqBlockingKey *wgtypes.Key
 }

 // injectPendingFirstPacket replays the captured handshake through the proxy if present, else
@@ -247,14 +206,6 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		metricsRecorder:    services.MetricsRecorder,
 	}

-	if config.PQ != nil && config.PQStrict {
-		if k, err := wgtypes.GenerateKey(); err != nil {
-			connLog.Errorf("pqkem: failed to generate strict-mode sentinel key, strict fail-closed disabled for this peer: %v", err)
-		} else {
-			conn.pqBlockingKey = &k
-		}
-	}
-
 	return conn, nil
 }

@@ -719,22 +670,6 @@ func (conn *Conn) onGuardEvent() {
 	}
 }

-// RequestReoffer sends a fresh signalling offer for the peer, re-running the
-// post-quantum bootstrap over Signal. Used to recover from a persistent data-path
-// rekey failure: a new exchange overwrites the stalled PSK on both sides. No-op if the
-// connection is not open yet.
-func (conn *Conn) RequestReoffer() {
-	conn.mu.Lock()
-	h := conn.handshaker
-	conn.mu.Unlock()
-	if h == nil {
-		return
-	}
-	if err := h.SendOffer(); err != nil {
-		conn.Log.Debugf("pqkem: recovery re-offer failed: %v", err)
-	}
-}
-
 func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
@@ -746,10 +681,6 @@ func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {

 	conn.Log.Warnf("WireGuard handshake timeout detected, closing current connection")

-	if conn.config.PQ != nil {
-		conn.config.PQ.OnDataPathDown(conn.config.Key)
-	}
-
 	// Close the active connection based on current priority
 	switch conn.currentConnPriority {
 	case conntype.Relay:
@@ -792,7 +723,7 @@ func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []by
 		ConnStatus:         conn.evalStatus(),
 		Relayed:            conn.isRelayed(),
 		RelayServerAddress: relayServerAddr,
-		RosenpassEnabled:   conn.quantumResistant(rosenpassPubKey),
+		RosenpassEnabled:   isRosenpassEnabled(rosenpassPubKey),
 	}

 	err := conn.statusRecorder.UpdatePeerRelayedState(peerState)
@@ -811,7 +742,7 @@ func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, updateTime time.Time)
 		RemoteIceCandidateType:     iceConnInfo.RemoteIceCandidateType,
 		LocalIceCandidateEndpoint:  iceConnInfo.LocalIceCandidateEndpoint,
 		RemoteIceCandidateEndpoint: iceConnInfo.RemoteIceCandidateEndpoint,
-		RosenpassEnabled:           conn.quantumResistant(iceConnInfo.RosenpassPubKey),
+		RosenpassEnabled:           isRosenpassEnabled(iceConnInfo.RosenpassPubKey),
 	}

 	err := conn.statusRecorder.UpdatePeerICEState(peerState)
@@ -1015,35 +946,6 @@ func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
 	conn.mu.Unlock()
-
-	// A fresh WireGuard handshake clocks the post-quantum PSK rotation. Pass how long
-	// ago the peer last exchanged real user data (keepalives excluded) so the pqkem
-	// manager can skip rotation on idle tunnels — rotating then would push data-path
-	// traffic that keeps the lazy connection artificially active.
-	if conn.config.PQ != nil {
-		conn.config.PQ.OnDataPathRekeyed(conn.config.Key, conn.dataActivityAge())
-	}
-}
-
-// dataActivityAge returns how long ago the peer last exchanged real user data
-// (WireGuard keepalives excluded), per the same LastActivities signal the
-// lazy-connection inactivity monitor uses. It reports a very large duration when no
-// activity has ever been recorded, so the peer is treated as idle.
-//
-// In kernel mode there is no per-peer data-activity signal (LastActivities is
-// userspace-only), so we cannot tell active from idle. We report zero — always
-// "active" — so PSK rotation is not disabled in kernel mode. Lazy back-to-idle is
-// already limited there; the eBPF WG-activity detection (future) will supply a real
-// signal that excludes handshake/pqkem traffic.
-func (conn *Conn) dataActivityAge() time.Duration {
-	if !conn.config.WgConfig.WgInterface.IsUserspaceBind() {
-		return 0
-	}
-	last, ok := conn.config.WgConfig.WgInterface.LastActivities()[conn.config.WgConfig.RemoteKey]
-	if !ok {
-		return time.Duration(math.MaxInt64)
-	}
-	return monotime.Since(last)
 }

 // recordConnectionMetrics records connection stage timestamps as metrics
@@ -1085,23 +987,6 @@ func (conn *Conn) AgentVersionString() string {
 }

 func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key {
-	// Post-quantum: once the ML-KEM exchange has derived a PSK for this peer, program
-	// it here so the peer's next WireGuard handshake adopts it. Applied at peer-config
-	// time (bootstrap / reconnect); steady-state rotation is pushed separately.
-	if conn.config.PQ != nil {
-		if psk, ok := conn.config.PQ.PSK(conn.config.Key); ok {
-			return &psk
-		}
-		if conn.config.PQStrict && conn.pqBlockingKey != nil {
-			// Fail closed: program a non-matching sentinel so no session forms on a
-			// non-PQ key until the ML-KEM exchange derives the real PSK (pushed via
-			// SetPresharedKey once it converges). "pending" — turns into a "stuck"
-			// warning from the manager if the exchange keeps failing (see raiseFailure).
-			conn.Log.Debugf("pqkem: strict mode — no PQ PSK yet, blocking peer traffic until the ML-KEM exchange converges")
-			return conn.pqBlockingKey
-		}
-	}
-
 	if conn.config.RosenpassConfig.PubKey == nil {
 		return conn.config.WgConfig.PreSharedKey
 	}
@@ -1141,21 +1026,6 @@ func isRosenpassEnabled(remoteRosenpassPubKey []byte) bool {
 	return remoteRosenpassPubKey != nil
 }

-// quantumResistant reports whether the peer's tunnel is post-quantum protected, for
-// the status "Quantum resistance" field: either Rosenpass (the remote advertised a
-// Rosenpass key) or the ML-KEM exchange (a PQ PSK has been derived for this peer).
-func (conn *Conn) quantumResistant(remoteRosenpassPubKey []byte) bool {
-	if isRosenpassEnabled(remoteRosenpassPubKey) {
-		return true
-	}
-	if conn.config.PQ != nil {
-		if _, ok := conn.config.PQ.PSK(conn.config.Key); ok {
-			return true
-		}
-	}
-	return false
-}
-
 func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 	// "Relay up and needed" — the peer uses relay and the transport is connected.
 	relayUsedAndUp := in.peerUsesRelay && in.relayConnected
--- a/client/internal/peer/handshaker.go
+++ b/client/internal/peer/handshaker.go
@@ -39,16 +39,6 @@ type OfferAnswer struct {
 	// This value is the local Rosenpass server address when sending the message
 	RosenpassAddr string

-	// MlkemPayload carries the post-quantum X25519MLKEM768 handshake message
-	// (pqkem-framed offer on an OFFER, answer on an ANSWER) that seeds the
-	// WireGuard PSK. Opaque here — the pqkem library frames and parses it. Nil
-	// when the peer does not run the ML-KEM PQ exchange.
-	MlkemPayload []byte
-
-	// MlkemPort is the peer's ML-KEM PQ service UDP port (bound on its WG overlay
-	// IP) where data-path rekey messages are sent. Zero when not running the exchange.
-	MlkemPort int
-
 	// relay server address
 	RelaySrvAddress string
 	// RelaySrvIP is the IP the remote peer is connected to on its
@@ -91,20 +81,14 @@ type Handshaker struct {

 func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
 	h := &Handshaker{
-		log:           log,
-		config:        config,
-		signaler:      signaler,
-		ice:           ice,
-		relay:         relay,
-		metricsStages: metricsStages,
-		// Buffered by 1: the single Listen goroutine can be busy handling an offer
-		// (sendAnswer does a blocking signal send) exactly when the matching answer
-		// arrives on the other channel. Unbuffered, that answer would hit the
-		// non-blocking send's default and be dropped — fatal for the post-quantum
-		// exchange, which needs the answer to converge. A 1-slot cushion lets it wait
-		// until Listen loops back, without ever blocking the signal receiver.
-		remoteOffersCh: make(chan OfferAnswer, 1),
-		remoteAnswerCh: make(chan OfferAnswer, 1),
+		log:            log,
+		config:         config,
+		signaler:       signaler,
+		ice:            ice,
+		relay:          relay,
+		metricsStages:  metricsStages,
+		remoteOffersCh: make(chan OfferAnswer),
+		remoteAnswerCh: make(chan OfferAnswer),
 	}
 	// assume remote supports ICE until we learn otherwise from received offers
 	h.remoteICESupported.Store(ice != nil)
@@ -136,8 +120,6 @@ func (h *Handshaker) Listen(ctx context.Context) {

 			h.updateRemoteICEState(&remoteOfferAnswer)

-			h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
-
 			if h.relayListener != nil {
 				h.relayListener.Notify(&remoteOfferAnswer)
 			}
@@ -146,7 +128,7 @@ func (h *Handshaker) Listen(ctx context.Context) {
 				h.iceListener(&remoteOfferAnswer)
 			}

-			if err := h.sendAnswer(&remoteOfferAnswer); err != nil {
+			if err := h.sendAnswer(); err != nil {
 				h.log.Errorf("failed to send remote offer confirmation: %s", err)
 				continue
 			}
@@ -160,8 +142,6 @@ func (h *Handshaker) Listen(ctx context.Context) {

 			h.updateRemoteICEState(&remoteOfferAnswer)

-			h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
-
 			if h.relayListener != nil {
 				h.relayListener.Notify(&remoteOfferAnswer)
 			}
@@ -169,10 +149,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 			if h.iceListener != nil && h.RemoteICESupported() {
 				h.iceListener(&remoteOfferAnswer)
 			}
-
-			if h.config.PQ != nil {
-				h.config.PQ.OnAnswer(h.config.Key, remoteOfferAnswer.MlkemPayload)
-			}
 		case <-ctx.Done():
 			h.log.Infof("stop listening for remote offers and answers")
 			return
@@ -180,16 +156,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	}
 }

-// pqRegisterEndpoint feeds the post-quantum handshaker the peer's data-path endpoint
-// (its WG overlay IP plus the advertised pq UDP port) learned from a remote offer/answer.
-func (h *Handshaker) pqRegisterEndpoint(remotePort int) {
-	if h.config.PQ == nil || remotePort <= 0 || remotePort > 65535 || len(h.config.WgConfig.AllowedIps) == 0 {
-		return
-	}
-	addr := netip.AddrPortFrom(h.config.WgConfig.AllowedIps[0].Addr(), uint16(remotePort))
-	h.config.PQ.SetRemoteAddr(h.config.Key, addr)
-}
-
 func (h *Handshaker) SendOffer() error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -229,23 +195,13 @@ func (h *Handshaker) sendOffer() error {
 	}

 	offer := h.buildOfferAnswer()
-	if h.config.PQ != nil {
-		offer.MlkemPayload, offer.MlkemPort = h.config.PQ.OfferPayload(h.config.Key)
-	}
 	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())

 	return h.signaler.SignalOffer(offer, h.config.Key)
 }

-func (h *Handshaker) sendAnswer(remoteOffer *OfferAnswer) error {
+func (h *Handshaker) sendAnswer() error {
 	answer := h.buildOfferAnswer()
-	if h.config.PQ != nil {
-		var recvOffer []byte
-		if remoteOffer != nil {
-			recvOffer = remoteOffer.MlkemPayload
-		}
-		answer.MlkemPayload, answer.MlkemPort = h.config.PQ.AnswerPayload(h.config.Key, recvOffer)
-	}
 	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())

 	return h.signaler.SignalAnswer(answer, h.config.Key)
--- a/client/internal/peer/iface.go
+++ b/client/internal/peer/iface.go
@@ -10,7 +10,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
-	"github.com/netbirdio/netbird/monotime"
 )

 type WGIface interface {
@@ -20,11 +19,4 @@ type WGIface interface {
 	GetProxy() wgproxy.Proxy
 	Address() wgaddr.Address
 	RemoveEndpointAddress(key string) error
-	// LastActivities returns the last real-data activity time per peer (WireGuard
-	// keepalives excluded), used to gate post-quantum PSK rotation on active tunnels.
-	LastActivities() map[string]monotime.Time
-	// IsUserspaceBind reports whether WireGuard runs in userspace. Only there does
-	// LastActivities track per-peer data activity; in kernel mode it is unavailable,
-	// so PSK rotation cannot be gated on activity.
-	IsUserspaceBind() bool
 }
--- a/client/internal/peer/signaler.go
+++ b/client/internal/peer/signaler.go
@@ -63,8 +63,6 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 		},
 		RosenpassPubKey: offerAnswer.RosenpassPubKey,
 		RosenpassAddr:   offerAnswer.RosenpassAddr,
-		MlkemPayload:    offerAnswer.MlkemPayload,
-		MlkemPort:       offerAnswer.MlkemPort,
 		RelaySrvAddress: offerAnswer.RelaySrvAddress,
 		RelaySrvIP:      offerAnswer.RelaySrvIP,
 		SessionID:       sessionIDBytes,
--- a/client/internal/pqkem/bench_test.go
+++ b/client/internal/pqkem/bench_test.go
@@ -1,59 +0,0 @@
-package pqkem
-
-import (
-	"crypto/ecdh"
-	"crypto/mlkem"
-	"crypto/rand"
-	"testing"
-)
-
-func BenchmarkX25519Keygen(b *testing.B) {
-	c := ecdh.X25519()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := c.GenerateKey(rand.Reader); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkX25519ECDH(b *testing.B) {
-	c := ecdh.X25519()
-	a, _ := c.GenerateKey(rand.Reader)
-	p, _ := c.GenerateKey(rand.Reader)
-	pub := p.PublicKey()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := a.ECDH(pub); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkMLKEMKeygen(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		if _, err := mlkem.GenerateKey768(); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkMLKEMEncaps(b *testing.B) {
-	dk, _ := mlkem.GenerateKey768()
-	ek := dk.EncapsulationKey()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ek.Encapsulate()
-	}
-}
-
-func BenchmarkMLKEMDecaps(b *testing.B) {
-	dk, _ := mlkem.GenerateKey768()
-	_, ct := dk.EncapsulationKey().Encapsulate()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := dk.Decapsulate(ct); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
--- a/client/internal/pqkem/callbacks.go
+++ b/client/internal/pqkem/callbacks.go
@@ -1,18 +0,0 @@
-package pqkem
-
-// CallbackHandler is implemented by the host and invoked by the library. The
-// library only reports events; the host owns the reaction. Keeping this an
-// interface — rather than touching the transport or keying directly — is what lets
-// the KEM code be extracted as a standalone library.
-type CallbackHandler interface {
-	// OnNewPSKReady fires when a fresh post-quantum PSK has been derived for a peer
-	// and must be programmed into the consumer's secure channel. It is invoked at
-	// the commit point of each side: the initiator on receiving the answer, the
-	// responder on receiving the confirm.
-	OnNewPSKReady(remoteID RemoteID, psk PSK) error
-
-	// OnRekeyFailed fires when an exchange fails to converge within the allotted
-	// time. The host should tear the peer connection down so it re-establishes, and
-	// log a WARN. The library reports the event; it does not dictate the reaction.
-	OnRekeyFailed(remoteID RemoteID) error
-}
--- a/client/internal/pqkem/convergence.go
+++ b/client/internal/pqkem/convergence.go
@@ -1,271 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"time"
-)
-
-// idHex renders an exchange ID for logs.
-func idHex(id ExchangeID) string { return hex.EncodeToString(id[:]) }
-
-// pskFingerprint is a short, non-secret digest of a derived PSK: identical on both
-// peers iff they derived the same key. Logged instead of the raw PSK so debug logs
-// never carry the actual WireGuard preshared key.
-func pskFingerprint(psk PSK) string {
-	sum := sha256.Sum256(psk[:])
-	return hex.EncodeToString(sum[:8])
-}
-
-// startExchange creates a fresh initiator exchange (acknowledging ackID, zero for a
-// bootstrap) and returns the framed offer for the caller to send — pushed over the
-// data path for a chained rekey, or handed to the host for signalling when viaSignal
-// is set. Any previous in-flight exchange for the peer is cancelled.
-func (m *Manager) startExchange(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
-	init, err := NewInitiator()
-	if err != nil {
-		return nil, err
-	}
-	id, err := newExchangeID()
-	if err != nil {
-		return nil, err
-	}
-	raw, err := (&OfferMsg{ExchangeID: id, AckID: ackID, KEMOffer: init.Offer()}).Encode()
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithCancel(m.rootCtx)
-	m.mu.Lock()
-	if old := m.exchanges[remoteID]; old != nil && old.cancel != nil {
-		old.cancel()
-	}
-	m.exchanges[remoteID] = &exchangeCtl{
-		id:        id,
-		state:     stateAwaitingAnswer,
-		startedAt: time.Now(),
-		cancel:    cancel,
-		lastSent:  raw,
-		initiator: init,
-		viaSignal: viaSignal,
-	}
-	m.mu.Unlock()
-
-	m.wait.Add(1)
-	go m.initiatorLoop(ctx, remoteID, id)
-
-	via := "data-path"
-	if viaSignal {
-		via = "signal"
-	}
-	m.trace("pqkem: offer sent", "peer", remoteID, "exchange", idHex(id), "acks", idHex(ackID), "via", via)
-	return raw, nil
-}
-
-// processOffer (responder) first acknowledges the previous exchange the offer names
-// (that offer riding the data path under the freshly adopted key proves it worked),
-// then derives the PSK for the new offer, commits it optimistically, and returns the
-// framed answer. A duplicate offer returns the cached answer without re-deriving.
-func (m *Manager) processOffer(remoteID RemoteID, o *OfferMsg) ([]byte, error) {
-	m.trace("pqkem: offer received", "peer", remoteID, "exchange", idHex(o.ExchangeID), "acks", idHex(o.AckID))
-
-	if o.AckID != (ExchangeID{}) {
-		m.ackConverged(remoteID, o.AckID)
-	}
-
-	m.mu.Lock()
-	if ex := m.exchanges[remoteID]; ex != nil && ex.id == o.ExchangeID {
-		state, last := ex.state, ex.lastSent
-		m.mu.Unlock()
-		if state == stateReserved {
-			return nil, nil
-		}
-		m.trace("pqkem: duplicate offer, resending cached answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
-		return last, nil
-	}
-	// Reserve the slot so a concurrent duplicate offer bails.
-	m.exchanges[remoteID] = &exchangeCtl{id: o.ExchangeID, state: stateReserved, startedAt: time.Now()}
-	m.mu.Unlock()
-
-	answerBytes, psk, err := Respond(o.KEMOffer, m.binding(remoteID))
-	if err != nil {
-		return nil, err
-	}
-	raw, err := (&AnswerMsg{ExchangeID: o.ExchangeID, KEMAnswer: answerBytes}).Encode()
-	if err != nil {
-		return nil, err
-	}
-
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != o.ExchangeID {
-		m.mu.Unlock()
-		m.trace("pqkem: exchange superseded during respond, dropping answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
-		return nil, nil
-	}
-	ex.state = stateAwaitingAck
-	ex.lastSent = raw
-	ex.pendingPSK = psk
-	m.psks[remoteID] = psk
-	m.mu.Unlock()
-
-	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(o.ExchangeID), "role", "responder", "psk_fp", pskFingerprint(psk))
-
-	// Commit optimistically so our data path can rekey to the new PSK.
-	if err := m.cbHandler.OnNewPSKReady(remoteID, psk); err != nil {
-		return nil, err
-	}
-	m.trace("pqkem: answer sent", "peer", remoteID, "exchange", idHex(o.ExchangeID))
-	return raw, nil
-}
-
-// processAnswer (initiator) derives and commits the PSK and parks in
-// stateAwaitingRekey; the next offer (chained from OnDataPathRekeyed) will acknowledge
-// this exchange. Only valid in stateAwaitingAnswer; advancing the state under the
-// lock makes a concurrent/duplicate answer bail.
-func (m *Manager) processAnswer(remoteID RemoteID, a *AnswerMsg) error {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != a.ExchangeID || ex.state != stateAwaitingAnswer {
-		haveID := "none"
-		if ex != nil {
-			haveID = idHex(ex.id)
-		}
-		m.mu.Unlock()
-		m.trace("pqkem: unexpected answer dropped (inconsistency)", "peer", remoteID, "answer_for", idHex(a.ExchangeID), "have_exchange", haveID)
-		return nil
-	}
-	ex.state = stateAwaitingRekey
-	init := ex.initiator
-	ex.initiator = nil
-	m.mu.Unlock()
-
-	m.trace("pqkem: answer received", "peer", remoteID, "exchange", idHex(a.ExchangeID))
-
-	psk, err := init.Finish(a.KEMAnswer, m.binding(remoteID))
-	if err != nil {
-		return err
-	}
-
-	// The initiator has converged: the responder must have derived the key to answer.
-	m.mu.Lock()
-	m.established[remoteID] = true
-	m.failures[remoteID] = 0
-	m.psks[remoteID] = psk
-	m.mu.Unlock()
-
-	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(a.ExchangeID), "role", "initiator", "psk_fp", pskFingerprint(psk))
-
-	return m.cbHandler.OnNewPSKReady(remoteID, psk)
-}
-
-// ackConverged (responder) records convergence of the exchange named by ackID: a
-// later offer acknowledging it proves both sides operate on that exchange's key. Only
-// acts on a matching stateAwaitingAck exchange; anything else is ignored.
-func (m *Manager) ackConverged(remoteID RemoteID, ackID ExchangeID) {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != ackID || ex.state != stateAwaitingAck {
-		m.mu.Unlock()
-		m.trace("pqkem: ack for unknown/mismatched exchange, ignored (inconsistency)", "peer", remoteID, "acks", idHex(ackID))
-		return
-	}
-	delete(m.exchanges, remoteID)
-	m.established[remoteID] = true
-	m.failures[remoteID] = 0
-	_ = time.Since(ex.startedAt) // convergence latency (metrics hook, later step)
-	m.mu.Unlock()
-
-	m.trace("pqkem: previous exchange confirmed by ack", "peer", remoteID, "exchange", idHex(ackID))
-}
-
-// initiatorLoop enforces the offer->answer convergence deadline and retransmits the
-// initiator's outstanding data-path offer while awaiting the answer (a
-// signalling-bootstrapped offer is retransmitted by the host, so it is not resent
-// here). Exhausting the deadline before the answer arrives is a failure. Once the
-// answer is in (state past awaitingAnswer) the loop exits: the next rotation is driven
-// by OnDataPathRekeyed, and the idle wait for it has no deadline.
-func (m *Manager) initiatorLoop(ctx context.Context, remoteID RemoteID, id ExchangeID) {
-	defer m.wait.Done()
-	t := time.NewTicker(m.retryInterval)
-	defer t.Stop()
-
-	attempts := 0
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			m.mu.Lock()
-			ex := m.exchanges[remoteID]
-			if ex == nil || ex.id != id {
-				m.mu.Unlock()
-				return
-			}
-
-			switch ex.state {
-			case stateAwaitingAnswer:
-				if attempts >= m.maxRetries {
-					delete(m.exchanges, remoteID)
-					initial := !m.established[remoteID]
-					fail := m.registerFailureLocked(remoteID)
-					m.mu.Unlock()
-					m.raiseFailure(remoteID, fail, initial)
-					return
-				}
-				viaSignal := ex.viaSignal
-				msg := ex.lastSent
-				attempts++
-				m.mu.Unlock()
-				if !viaSignal {
-					if err := m.pushDataPath(remoteID, msg); err != nil {
-						m.logger.Warn("pqkem: offer retransmit failed", "peer", remoteID, "err", err)
-					}
-				}
-
-			default:
-				// Past awaiting the answer (converged) or superseded: the loop's job
-				// is done. The next rotation is driven externally by OnDataPathRekeyed,
-				// so there is no deadline while idle-waiting for it (that wait can be
-				// as long as the transport's natural rekey interval).
-				m.mu.Unlock()
-				return
-			}
-		}
-	}
-}
-
-// registerFailureLocked applies policy B and reports whether OnRekeyFailed is due:
-// an initial exchange (peer never established) fails immediately; a rekey tolerates
-// up to maxRekeyFailures consecutive misses (we stay on the still-valid previous
-// PSK) before failing. Assumes m.mu is held.
-func (m *Manager) registerFailureLocked(remoteID RemoteID) bool {
-	if !m.established[remoteID] {
-		return true
-	}
-	m.failures[remoteID]++
-	if m.failures[remoteID] >= m.maxRekeyFailures {
-		m.failures[remoteID] = 0
-		return true
-	}
-	return false
-}
-
-// raiseFailure reports a convergence failure. initial distinguishes a never-established
-// peer (bootstrap failed → no PQ PSK at all; in strict mode the peer stays blocked =
-// "stuck") from a rekey failure (a previous PSK is still in force and traffic continues).
-func (m *Manager) raiseFailure(remoteID RemoteID, fail, initial bool) {
-	if !fail {
-		m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID)
-		return
-	}
-	if initial {
-		m.logger.Warn("pqkem: initial exchange failed — no PQ PSK established for peer (strict mode keeps the peer blocked until it converges)", "peer", remoteID)
-	} else {
-		m.logger.Warn("pqkem: rekey failed after retries — staying on the previous PSK", "peer", remoteID)
-	}
-	if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil {
-		m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err)
-	}
-}
--- a/client/internal/pqkem/convergence_test.go
+++ b/client/internal/pqkem/convergence_test.go
@@ -1,74 +0,0 @@
-package pqkem
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// dropTransport is a pqkem.Transport that silently discards everything.
-type dropTransport struct{}
-
-func (dropTransport) Send(netip.AddrPort, []byte) error { return nil }
-func (dropTransport) LocalPort() int                    { return 0 }
-func (dropTransport) Run(func(netip.AddrPort, []byte))  {}
-func (dropTransport) Close() error                      { return nil }
-
-func failedCount(f *fakeWG) int {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return len(f.failed)
-}
-
-func TestManager_InitialTimeoutFailsImmediately(t *testing.T) {
-	wg := newFakeWG()
-	d := NewManager("bbbb", wg, nil) // bbbb > aaaa -> initiator
-	d.Start(dropTransport{})
-	d.retryInterval = 5 * time.Millisecond
-	d.maxRetries = 3
-	defer d.Stop()
-
-	// Bootstrap offer is produced for signalling; no answer ever comes back -> the
-	// initial exchange fails fast.
-	offer, err := d.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-
-	require.Eventually(t, func() bool { return failedCount(wg) == 1 }, time.Second, 5*time.Millisecond)
-}
-
-func TestManager_RekeyToleratesKFailures(t *testing.T) {
-	dA, dB, _, wgB, lbB := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	// Tighten B's timings before any exchange loop spawns (the loop reads these
-	// fields, so writing them after a loop is running would race).
-	dB.retryInterval = 5 * time.Millisecond
-	dB.maxRetries = 2
-
-	// Establish: bootstrap + data-path-rekeyed so B becomes established and its data
-	// path is usable.
-	bootstrap(t, dA, dB)
-	dA.OnDataPathRekeyed("bbbb", 0)
-	dB.OnDataPathRekeyed("aaaa", 0)
-	require.NotEqual(t, PSK{}, wgB.psk("aaaa"))
-
-	// Drop B's outbound so rekeys can no longer converge.
-	lbB.drop.Store(true)
-
-	// K-1 data-path rekeys must NOT raise OnRekeyFailed.
-	for i := 0; i < DefaultMaxRekeyFailures-1; i++ {
-		_, err := dB.startExchange("aaaa", false, ExchangeID{})
-		require.NoError(t, err)
-		time.Sleep(50 * time.Millisecond)
-	}
-	require.Equal(t, 0, failedCount(wgB), "no failure before K attempts")
-
-	// The K-th failure raises it once.
-	_, err := dB.startExchange("aaaa", false, ExchangeID{})
-	require.NoError(t, err)
-	require.Eventually(t, func() bool { return failedCount(wgB) == 1 }, time.Second, 5*time.Millisecond)
-}
--- a/client/internal/pqkem/env.go
+++ b/client/internal/pqkem/env.go
@@ -1,138 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"strconv"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// EnvEnabled is the environment variable that turns the ML-KEM post-quantum
-// exchange on for this client. Accepts on/off aliases plus anything
-// strconv.ParseBool understands (true/false/1/0).
-const EnvEnabled = "NB_ENABLE_PQ_MLKEM"
-
-// Enabled reports whether the ML-KEM PQ exchange is enabled via the environment.
-// An empty or unrecognized value is treated as disabled.
-func Enabled() bool {
-	raw := strings.ToLower(strings.TrimSpace(os.Getenv(EnvEnabled)))
-	switch raw {
-	case "":
-		return false
-	case "on":
-		return true
-	case "off":
-		return false
-	}
-	enabled, err := strconv.ParseBool(raw)
-	if err != nil {
-		log.Warnf("failed to parse %s value %q: %v", EnvEnabled, raw, err)
-		return false
-	}
-	return enabled
-}
-
-// EnvStrict enables strict (fail-closed) mode: block peer traffic until the ML-KEM
-// PSK has been established, instead of the default opportunistic behaviour that lets
-// the tunnel come up classically and upgrades to PQ once the exchange converges.
-const EnvStrict = "NB_PQ_MLKEM_STRICT"
-
-// Strict reports whether strict (fail-closed) mode is enabled via the environment.
-// An empty or unrecognized value is treated as disabled (opportunistic).
-func Strict() bool {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvStrict))) {
-	case "on":
-		return true
-	case "", "off":
-		return false
-	}
-	enabled, err := strconv.ParseBool(strings.TrimSpace(os.Getenv(EnvStrict)))
-	if err != nil {
-		log.Warnf("failed to parse %s value %q: %v", EnvStrict, os.Getenv(EnvStrict), err)
-		return false
-	}
-	return enabled
-}
-
-// EnvLogLevel overrides the ML-KEM manager's slog level (trace/debug/info/warn/error).
-// Defaults to info. The verbose per-exchange lifecycle logs are emitted at trace.
-const EnvLogLevel = "NB_PQ_MLKEM_LOG_LEVEL"
-
-// LevelTrace is a custom slog level below Debug for the verbose per-exchange lifecycle
-// logs, so they stay off unless NB_PQ_MLKEM_LOG_LEVEL=trace (and the daemon log level
-// is trace, since the records are forwarded to logrus).
-const LevelTrace = slog.LevelDebug - 4
-
-// NewLogger builds the slog logger for the ML-KEM manager. It forwards records to
-// logrus so PQ logs land in the same sink as the rest of the daemon (console +
-// client.log) rather than stdout. Verbosity is gated by EnvLogLevel.
-func NewLogger() *slog.Logger {
-	return slog.New(slogToLogrus{})
-}
-
-func logLevel() slog.Level {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvLogLevel))) {
-	case "trace":
-		return LevelTrace
-	case "debug":
-		return slog.LevelDebug
-	case "warn":
-		return slog.LevelWarn
-	case "error":
-		return slog.LevelError
-	default:
-		return slog.LevelInfo
-	}
-}
-
-// slogToLogrus is a slog.Handler that forwards records to logrus, so the ML-KEM
-// manager's logs go wherever the daemon's logrus is configured (console + client.log)
-// instead of stdout. Verbosity is gated by EnvLogLevel via logLevel().
-type slogToLogrus struct {
-	fields log.Fields
-}
-
-func (h slogToLogrus) Enabled(_ context.Context, level slog.Level) bool {
-	return level >= logLevel()
-}
-
-func (h slogToLogrus) Handle(_ context.Context, r slog.Record) error {
-	fields := make(log.Fields, len(h.fields)+r.NumAttrs())
-	for k, v := range h.fields {
-		fields[k] = v
-	}
-	r.Attrs(func(a slog.Attr) bool {
-		fields[a.Key] = a.Value.Any()
-		return true
-	})
-	entry := log.WithFields(fields)
-	switch {
-	case r.Level >= slog.LevelError:
-		entry.Error(r.Message)
-	case r.Level >= slog.LevelWarn:
-		entry.Warn(r.Message)
-	case r.Level >= slog.LevelInfo:
-		entry.Info(r.Message)
-	case r.Level >= slog.LevelDebug:
-		entry.Debug(r.Message)
-	default:
-		entry.Trace(r.Message)
-	}
-	return nil
-}
-
-func (h slogToLogrus) WithAttrs(attrs []slog.Attr) slog.Handler {
-	fields := make(log.Fields, len(h.fields)+len(attrs))
-	for k, v := range h.fields {
-		fields[k] = v
-	}
-	for _, a := range attrs {
-		fields[a.Key] = a.Value.Any()
-	}
-	return slogToLogrus{fields: fields}
-}
-
-func (h slogToLogrus) WithGroup(_ string) slog.Handler { return h }
--- a/client/internal/pqkem/kem.go
+++ b/client/internal/pqkem/kem.go
@@ -1,178 +0,0 @@
-// Package pqkem is a spike (NET-1406) for a post-quantum pre-shared-key exchange
-// that could replace Rosenpass. It performs an X25519MLKEM768 hybrid key
-// encapsulation and derives a 32-byte pre-shared key (PSK).
-//
-// The exchange is a single round trip designed to ride the (already
-// authenticated) Signal offer/answer channel:
-//
-//	initiator --Offer(1216B)--> responder
-//	initiator <--Answer(1120B)-- responder
-//
-// Both sides then hold the same PSK, which is bound to the two peers' identities
-// (their peer identity keys) so the derived key cannot be transplanted
-// to a different peer pair even if the transport authentication were bypassed.
-//
-// Combiner note: this follows draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768 — on
-// the wire ML-KEM ‖ X25519 (the draft deliberately reversed the share order for
-// this group), and ML-KEM_ss ‖ X25519_ss as the KDF input. The PSK is derived with
-// HKDF-SHA256 over that hybrid secret, salted with a domain-separation label and
-// bound (via the HKDF info) to the full transcript and the canonicalised peer
-// identities.
-package pqkem
-
-import (
-	"crypto/ecdh"
-	"crypto/hkdf"
-	"crypto/mlkem"
-	"crypto/rand"
-	"crypto/sha256"
-	"fmt"
-)
-
-const (
-	// OfferSize is the initiator message: ML-KEM-768 encapsulation key ‖ X25519 public key
-	// (share order per draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768).
-	OfferSize = mlkem.EncapsulationKeySize768 + 32 // 1216
-	// AnswerSize is the responder message: ML-KEM-768 ciphertext ‖ X25519 public key.
-	AnswerSize = mlkem.CiphertextSize768 + 32 // 1120
-
-	pskLabel = "netbird-pq-psk-v1"
-)
-
-// PSK is the 32-byte derived pre-shared key handed to the consumer to key its channel.
-type PSK [32]byte
-
-// Binding identifies the peer pair the PSK is derived for. Callers set both
-// peer identity keys; the order does not matter (it is canonicalised).
-type Binding struct {
-	LocalID  []byte
-	RemoteID []byte
-}
-
-// Initiator holds the ephemeral secrets between Offer and Finish.
-type Initiator struct {
-	x25519  *ecdh.PrivateKey
-	mlkemDK *mlkem.DecapsulationKey768
-	offer   []byte
-}
-
-// NewInitiator generates the ephemeral X25519 + ML-KEM-768 keypairs.
-func NewInitiator() (*Initiator, error) {
-	x, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, fmt.Errorf("x25519 keygen: %w", err)
-	}
-	dk, err := mlkem.GenerateKey768()
-	if err != nil {
-		return nil, fmt.Errorf("ml-kem keygen: %w", err)
-	}
-
-	offer := make([]byte, 0, OfferSize)
-	offer = append(offer, dk.EncapsulationKey().Bytes()...)
-	offer = append(offer, x.PublicKey().Bytes()...)
-
-	return &Initiator{x25519: x, mlkemDK: dk, offer: offer}, nil
-}
-
-// Offer returns the initiator message to send over Signal.
-func (i *Initiator) Offer() []byte {
-	return i.offer
-}
-
-// Finish consumes the responder's answer and derives the PSK.
-func (i *Initiator) Finish(answer []byte, b Binding) (PSK, error) {
-	if len(answer) != AnswerSize {
-		return PSK{}, fmt.Errorf("answer: got %d bytes, want %d", len(answer), AnswerSize)
-	}
-	ct := answer[:mlkem.CiphertextSize768]
-	peerX := answer[mlkem.CiphertextSize768:]
-
-	ssMLKEM, err := i.mlkemDK.Decapsulate(ct)
-	if err != nil {
-		return PSK{}, fmt.Errorf("ml-kem decapsulate: %w", err)
-	}
-	pub, err := ecdh.X25519().NewPublicKey(peerX)
-	if err != nil {
-		return PSK{}, fmt.Errorf("parse peer x25519: %w", err)
-	}
-	ssX, err := i.x25519.ECDH(pub)
-	if err != nil {
-		return PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
-	}
-
-	return derivePSK(ssMLKEM, ssX, i.offer, answer, b)
-}
-
-// Respond consumes an initiator offer, produces the answer, and derives the PSK.
-func Respond(offer []byte, b Binding) (answer []byte, psk PSK, err error) {
-	if len(offer) != OfferSize {
-		return nil, PSK{}, fmt.Errorf("offer: got %d bytes, want %d", len(offer), OfferSize)
-	}
-	peerEK := offer[:mlkem.EncapsulationKeySize768]
-	peerX := offer[mlkem.EncapsulationKeySize768:]
-
-	ek, err := mlkem.NewEncapsulationKey768(peerEK)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("parse peer ml-kem key: %w", err)
-	}
-	ssMLKEM, ct := ek.Encapsulate()
-
-	x, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("x25519 keygen: %w", err)
-	}
-	pub, err := ecdh.X25519().NewPublicKey(peerX)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("parse peer x25519: %w", err)
-	}
-	ssX, err := x.ECDH(pub)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
-	}
-
-	answer = make([]byte, 0, AnswerSize)
-	answer = append(answer, ct...)
-	answer = append(answer, x.PublicKey().Bytes()...)
-
-	// derivePSK uses the same argument order on both sides; the responder's local
-	// binding is the mirror of the initiator's, canonicalised inside derivePSK.
-	psk, err = derivePSK(ssMLKEM, ssX, offer, answer, b)
-	if err != nil {
-		return nil, PSK{}, err
-	}
-	return answer, psk, nil
-}
-
-// derivePSK runs HKDF-SHA256 over the hybrid shared secret (ML-KEM_ss ‖ X25519_ss,
-// per draft-ietf-tls-ecdhe-mlkem), salted with the domain-separation label, and binds
-// the result — via the HKDF info — to the full transcript (offer ‖ answer) and the
-// canonicalised peer identities, so the PSK cannot be transplanted to another peer
-// pair or a different exchange.
-func derivePSK(ssMLKEM, ssX, offer, answer []byte, b Binding) (PSK, error) {
-	lo, hi := canonicalPair(b.LocalID, b.RemoteID)
-
-	ikm := make([]byte, 0, len(ssMLKEM)+len(ssX))
-	ikm = append(ikm, ssMLKEM...)
-	ikm = append(ikm, ssX...)
-
-	info := make([]byte, 0, len(offer)+len(answer)+len(lo)+len(hi))
-	info = append(info, offer...)
-	info = append(info, answer...)
-	info = append(info, lo...)
-	info = append(info, hi...)
-
-	var psk PSK
-	key, err := hkdf.Key(sha256.New, ikm, []byte(pskLabel), string(info), len(psk))
-	if err != nil {
-		return PSK{}, fmt.Errorf("hkdf derive psk: %w", err)
-	}
-	copy(psk[:], key)
-	return psk, nil
-}
-
-func canonicalPair(a, b []byte) (lo, hi []byte) {
-	if string(a) <= string(b) {
-		return a, b
-	}
-	return b, a
-}
--- a/client/internal/pqkem/kem_test.go
+++ b/client/internal/pqkem/kem_test.go
@@ -1,89 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-var (
-	wgA = []byte("peer-A-wireguard-pubkey-32bytes!")
-	wgB = []byte("peer-B-wireguard-pubkey-32bytes!")
-)
-
-func TestExchange_DerivesMatchingPSK(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	require.Len(t, init.Offer(), OfferSize)
-
-	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-	require.Len(t, answer, AnswerSize)
-
-	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-	require.NoError(t, err)
-
-	require.Equal(t, pskB, pskA, "both sides must derive the same PSK")
-	require.NotEqual(t, PSK{}, pskA, "PSK must not be zero")
-}
-
-func TestExchange_PSKBoundToPeerIdentities(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	// responder computes with the honest pair...
-	_, pskHonest, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	// ...a second responder run with a different peer identity yields a different PSK,
-	// even though the KEM material would otherwise combine identically.
-	wgC := []byte("peer-C-wireguard-pubkey-32bytes!")
-	_, pskWrong, err := Respond(init.Offer(), Binding{LocalID: wgC, RemoteID: wgA})
-	require.NoError(t, err)
-
-	require.NotEqual(t, pskHonest, pskWrong, "PSK must be bound to the peer pair")
-}
-
-func TestExchange_RejectsMalformedMessages(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	_, _, err = Respond(init.Offer()[:10], Binding{})
-	require.Error(t, err)
-
-	_, err = init.Finish([]byte("too short"), Binding{})
-	require.Error(t, err)
-}
-
-// TestExchange_ReportSizesAndTiming is a spike measurement, not a pass/fail gate.
-// Run with: go test -run TestExchange_ReportSizesAndTiming -v ./client/internal/pqkem/
-func TestExchange_ReportSizesAndTiming(t *testing.T) {
-	const iters = 200
-
-	var tInit, tResp, tFinish time.Duration
-	for i := 0; i < iters; i++ {
-		s0 := time.Now()
-		init, err := NewInitiator()
-		require.NoError(t, err)
-		tInit += time.Since(s0)
-
-		s1 := time.Now()
-		answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-		require.NoError(t, err)
-		tResp += time.Since(s1)
-
-		s2 := time.Now()
-		_, err = init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-		require.NoError(t, err)
-		tFinish += time.Since(s2)
-	}
-
-	t.Logf("wire sizes:   offer=%d B   answer=%d B   (Rosenpass static pubkey ~524160 B)", OfferSize, AnswerSize)
-	t.Logf("total on-wire per handshake: %d B  (~%.0fx smaller than RP static key)", OfferSize+AnswerSize, 524160.0/float64(OfferSize+AnswerSize))
-	t.Logf("avg NewInitiator (keygen): %s", tInit/iters)
-	t.Logf("avg Respond (encaps+dh):   %s", tResp/iters)
-	t.Logf("avg Finish (decaps+dh):    %s", tFinish/iters)
-	t.Logf("avg full handshake CPU:    %s", (tInit+tResp+tFinish)/iters)
-}
--- a/client/internal/pqkem/manager.go
+++ b/client/internal/pqkem/manager.go
@@ -1,399 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"crypto/rand"
-	"fmt"
-	"log/slog"
-	"net/netip"
-	"sync"
-	"time"
-)
-
-const (
-	// DefaultRetryInterval is how often the initiator retransmits its outstanding
-	// data-path offer while awaiting the answer.
-	DefaultRetryInterval = 2 * time.Second
-	// DefaultMaxRetries bounds how many ticks an exchange may run before it is
-	// declared failed. The convergence deadline is thus MaxRetries * RetryInterval.
-	DefaultMaxRetries = 10
-	// DefaultMaxRekeyFailures is how many consecutive rekey (non-initial) failures
-	// are tolerated before OnRekeyFailed. The initial exchange fails immediately.
-	DefaultMaxRekeyFailures = 3
-
-	// rotationActivityWindow gates rotation on recent real-data activity: a rekey
-	// clocks a rotation only if the peer exchanged user data within this window. It
-	// must stay shorter than the data path's rekey interval (WireGuard
-	// REKEY_AFTER_TIME ~120s) so the rotation's own traffic — which itself renews the
-	// activity signal — ages out before the next rekey, letting an idle tunnel stop
-	// rotating instead of self-sustaining.
-	rotationActivityWindow = 90 * time.Second
-)
-
-// LocalID and RemoteID are peer identity keys (e.g. WireGuard public keys). They are
-// distinct types so the local and a remote identity cannot be mixed up.
-type (
-	LocalID  string
-	RemoteID string
-)
-
-// Transport is the data-path socket the Manager drives (the analogue of
-// go-rosenpass's Conn). It is a dumb mover of bytes to/from endpoints: the Manager
-// owns the remoteID<->endpoint routing and hands the transport a resolved endpoint
-// to Send, and reverse-resolves the source of each inbound datagram. Its lifecycle
-// belongs to the Manager (Run at Start, Close at Stop).
-type Transport interface {
-	// Send delivers msg to the given data-path endpoint.
-	Send(endpoint netip.AddrPort, msg []byte) error
-	// LocalPort is the bound local UDP port, announced to peers so they know where
-	// to send data-path messages.
-	LocalPort() int
-	// Run starts delivering inbound datagrams as (source endpoint, msg) to onInbound
-	// and returns immediately; it runs until Close.
-	Run(onInbound func(src netip.AddrPort, msg []byte))
-	// Close stops delivery and releases the socket.
-	Close() error
-}
-
-// exchangeState is the single source of truth for an exchange's role and phase.
-type exchangeState uint8
-
-const (
-	stateReserved       exchangeState = iota // responder: deriving the answer
-	stateAwaitingAnswer                      // initiator: offer sent, awaiting the answer
-	stateAwaitingRekey                       // initiator: PSK derived+set, awaiting OnDataPathRekeyed to chain the next offer
-	stateAwaitingAck                         // responder: answer sent, awaiting the next offer that acks this exchange
-)
-
-// exchangeCtl holds all state for one in-flight exchange with a peer, under the
-// Manager's single lock. state drives every decision. lastSent is the current
-// data-path retransmit payload (the offer, for the initiator). initiator is the
-// ephemeral handle used at Finish; pendingPSK is the responder's derived key.
-// viaSignal records that the offer went to the host for the signalling channel, so
-// the loop does not retransmit it on the data path. Only the initiator runs a
-// retransmit loop, so only it sets cancel.
-type exchangeCtl struct {
-	id         ExchangeID
-	state      exchangeState
-	startedAt  time.Time
-	cancel     context.CancelFunc
-	lastSent   []byte
-	initiator  *Initiator
-	pendingPSK PSK
-	viaSignal  bool
-}
-
-// Manager is the stateful orchestrator — the analogue of go-rosenpass's Server. It
-// drives the X25519MLKEM768 exchange, owns the peer endpoint routing and the data-path
-// transport, and surfaces the derived PSK and convergence to the host via
-// CallbackHandler. It is event-driven: the bootstrap is triggered by the host
-// (SignalOffer) and each rotation is clocked by OnDataPathRekeyed. The cryptography is
-// the pure kem.go primitives; all state lives here under one lock.
-type Manager struct {
-	localID   LocalID
-	cbHandler CallbackHandler
-	logger    *slog.Logger
-
-	retryInterval    time.Duration
-	maxRetries       int
-	maxRekeyFailures int
-
-	rootCtx    context.Context
-	rootCancel context.CancelFunc
-
-	mu          sync.Mutex
-	transport   Transport
-	exchanges   map[RemoteID]*exchangeCtl   // in-flight exchange per peer
-	established map[RemoteID]bool           // peer has completed at least one exchange
-	failures    map[RemoteID]int            // consecutive rekey failures per peer
-	psks        map[RemoteID]PSK            // latest derived PSK per peer (pulled at WG peer-config time)
-	peerAddrs   map[RemoteID]netip.AddrPort // remoteID -> data-path endpoint (send routing)
-	peersByAddr map[netip.AddrPort]RemoteID // reverse: source endpoint -> remoteID (inbound)
-	wait        sync.WaitGroup
-}
-
-// NewManager builds a manager for the local peer identified by its peer identity key
-// (used for the deterministic initiator role and the identity binding). A nil logger
-// falls back to slog.Default(). Install the data-path transport with Start.
-func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manager {
-	if logger == nil {
-		logger = slog.Default()
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	return &Manager{
-		localID:          localID,
-		cbHandler:        h,
-		logger:           logger,
-		retryInterval:    DefaultRetryInterval,
-		maxRetries:       DefaultMaxRetries,
-		maxRekeyFailures: DefaultMaxRekeyFailures,
-		rootCtx:          ctx,
-		rootCancel:       cancel,
-		exchanges:        make(map[RemoteID]*exchangeCtl),
-		established:      make(map[RemoteID]bool),
-		failures:         make(map[RemoteID]int),
-		psks:             make(map[RemoteID]PSK),
-		peerAddrs:        make(map[RemoteID]netip.AddrPort),
-		peersByAddr:      make(map[netip.AddrPort]RemoteID),
-	}
-}
-
-// Start installs the data-path transport and begins its inbound delivery. The Manager
-// owns it from here; Stop closes it. Start/Stop are the transport lifecycle pair.
-func (m *Manager) Start(t Transport) {
-	m.mu.Lock()
-	m.transport = t
-	m.mu.Unlock()
-	if t != nil {
-		t.Run(m.onDataPathInbound)
-	}
-}
-
-// LocalPort is the data-path transport's bound UDP port (0 if no transport), to be
-// announced to peers.
-func (m *Manager) LocalPort() int {
-	m.mu.Lock()
-	t := m.transport
-	m.mu.Unlock()
-	if t == nil {
-		return 0
-	}
-	return t.LocalPort()
-}
-
-// IsInitiator reports whether the local peer drives the exchange for this remote
-// peer. Roles are deterministic (lexicographic identity-key compare) so exactly one
-// side initiates, mirroring how Rosenpass picks its handshake initiator.
-func (m *Manager) IsInitiator(remoteID RemoteID) bool {
-	return string(m.localID) > string(remoteID)
-}
-
-// PSK returns the latest PSK derived for the peer, for the host to program at WG
-// peer-config time (the pull path). ok is false until an exchange has derived one.
-func (m *Manager) PSK(remoteID RemoteID) (PSK, bool) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	psk, ok := m.psks[remoteID]
-	return psk, ok
-}
-
-// trace logs at LevelTrace, the verbose per-exchange lifecycle level gated by
-// NB_PQ_MLKEM_LOG_LEVEL=trace.
-func (m *Manager) trace(msg string, args ...any) {
-	m.logger.Log(context.Background(), LevelTrace, msg, args...)
-}
-
-// AddPeer registers where a peer's data-path messages are sent and received: its
-// overlay endpoint (IP:port). Re-adding updates the endpoint.
-func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
-	if !endpoint.IsValid() {
-		return
-	}
-	m.mu.Lock()
-	if old, ok := m.peerAddrs[remoteID]; ok {
-		delete(m.peersByAddr, old)
-	}
-	m.peerAddrs[remoteID] = endpoint
-	m.peersByAddr[endpoint] = remoteID
-	m.mu.Unlock()
-}
-
-// RemovePeer stops any in-flight exchange for a peer and drops its state and routing.
-func (m *Manager) RemovePeer(remoteID RemoteID) {
-	m.mu.Lock()
-	if ex, ok := m.exchanges[remoteID]; ok {
-		if ex.cancel != nil {
-			ex.cancel()
-		}
-		delete(m.exchanges, remoteID)
-	}
-	delete(m.established, remoteID)
-	delete(m.failures, remoteID)
-	delete(m.psks, remoteID)
-	if ep, ok := m.peerAddrs[remoteID]; ok {
-		delete(m.peersByAddr, ep)
-		delete(m.peerAddrs, remoteID)
-	}
-	m.mu.Unlock()
-}
-
-// Stop cancels all in-flight exchanges, closes the transport, and waits for the
-// exchange goroutines to exit.
-func (m *Manager) Stop() {
-	m.rootCancel()
-	m.wait.Wait()
-	m.mu.Lock()
-	t := m.transport
-	m.transport = nil
-	m.exchanges = make(map[RemoteID]*exchangeCtl)
-	m.psks = make(map[RemoteID]PSK)
-	m.mu.Unlock()
-	if t != nil {
-		if err := t.Close(); err != nil {
-			m.logger.Warn("pqkem: closing data-path transport", "err", err)
-		}
-	}
-}
-
-// ---- Signalling channel (host-driven; rides the host's negotiation) ----
-
-// SignalOffer returns the KEM offer for the host to embed in its outgoing offer to
-// remoteID (bootstrap). It returns (nil, nil) when the local peer is not the
-// initiator. It is idempotent for an in-flight bootstrap: a repeat call returns the
-// same offer rather than starting a new exchange.
-func (m *Manager) SignalOffer(remoteID RemoteID) ([]byte, error) {
-	if !m.IsInitiator(remoteID) {
-		return nil, nil
-	}
-	m.mu.Lock()
-	if ex := m.exchanges[remoteID]; ex != nil && ex.viaSignal && ex.state == stateAwaitingAnswer {
-		last := ex.lastSent
-		m.mu.Unlock()
-		return last, nil
-	}
-	m.mu.Unlock()
-	// bootstrap offer acknowledges nothing (zero AckID).
-	return m.startExchange(remoteID, true, ExchangeID{})
-}
-
-// SignalOnOffer processes a KEM offer the host extracted from an incoming offer and
-// returns the KEM answer for the host to embed in its outgoing answer.
-func (m *Manager) SignalOnOffer(remoteID RemoteID, offer []byte) ([]byte, error) {
-	typ, msg, err := Decode(offer)
-	if err != nil {
-		return nil, fmt.Errorf("decode signal offer from %s: %w", remoteID, err)
-	}
-	if typ != MsgOffer {
-		return nil, fmt.Errorf("expected offer from %s, got type %d", remoteID, typ)
-	}
-	return m.processOffer(remoteID, msg.(*OfferMsg))
-}
-
-// SignalOnAnswer processes a KEM answer the host extracted from an incoming answer.
-// There is no reply: the next offer (over the data path) acknowledges this exchange.
-func (m *Manager) SignalOnAnswer(remoteID RemoteID, answer []byte) error {
-	typ, msg, err := Decode(answer)
-	if err != nil {
-		return fmt.Errorf("decode signal answer from %s: %w", remoteID, err)
-	}
-	if typ != MsgAnswer {
-		return fmt.Errorf("expected answer from %s, got type %d", remoteID, typ)
-	}
-	return m.processAnswer(remoteID, msg.(*AnswerMsg))
-}
-
-// ---- Data path ----
-
-// onDataPathInbound is the transport's inbound handler: it reverse-resolves the
-// source endpoint to a peer and dispatches. Unknown sources are dropped.
-func (m *Manager) onDataPathInbound(src netip.AddrPort, msg []byte) {
-	m.mu.Lock()
-	remoteID, ok := m.peersByAddr[src]
-	m.mu.Unlock()
-	if !ok {
-		return
-	}
-	if err := m.OnDataPathMessage(remoteID, msg); err != nil {
-		m.trace("pqkem: inbound", "peer", remoteID, "err", err)
-	}
-}
-
-// OnDataPathMessage handles a KEM message received over the data path from remoteID
-// and pushes any reply back over the data path.
-func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
-	typ, msg, err := Decode(raw)
-	if err != nil {
-		return fmt.Errorf("decode data-path msg from %s: %w", remoteID, err)
-	}
-	switch typ {
-	case MsgOffer:
-		answer, err := m.processOffer(remoteID, msg.(*OfferMsg))
-		if err != nil {
-			return err
-		}
-		if answer == nil {
-			return nil
-		}
-		return m.pushDataPath(remoteID, answer)
-	case MsgAnswer:
-		return m.processAnswer(remoteID, msg.(*AnswerMsg))
-	default:
-		return fmt.Errorf("unhandled data-path message type %d from %s", typ, remoteID)
-	}
-}
-
-// OnDataPathRekeyed notifies that the peer's data path is up and freshly keyed with
-// the latest PSK (fired on first establishment AND every rekey). If we are the
-// initiator that just derived a PSK, it chains the next exchange: a fresh offer over
-// the data path that acknowledges the just-completed one (its arrival under the new
-// key proves to the responder that the key works).
-// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey.
-// sinceActivity is how long ago the peer last exchanged real user data; when it
-// exceeds rotationActivityWindow the tunnel is treated as idle and rotation is
-// skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
-// traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
-func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {
-	if sinceActivity >= rotationActivityWindow {
-		m.trace("pqkem: peer idle, skipping data-path rotation", "peer", remoteID, "since_activity", sinceActivity)
-		return
-	}
-
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	chain := ex != nil && ex.state == stateAwaitingRekey
-	var ackID ExchangeID
-	if chain {
-		ackID = ex.id
-	}
-	m.mu.Unlock()
-
-	m.trace("pqkem: data-path rekey signal", "peer", remoteID, "chaining", chain)
-	if !chain {
-		return
-	}
-	offer, err := m.startExchange(remoteID, false, ackID)
-	if err != nil {
-		m.logger.Error("pqkem: chain offer failed to start", "peer", remoteID, "err", err)
-		return
-	}
-	if err := m.pushDataPath(remoteID, offer); err != nil {
-		m.logger.Warn("pqkem: send chain offer failed", "peer", remoteID, "err", err)
-		return
-	}
-	m.trace("pqkem: chain offer sent over data path", "peer", remoteID)
-}
-
-// OnDataPathDown notifies that the peer's data path went down. Rotations resume once
-// the host re-bootstraps over signalling on reconnect; in-flight data-path sends will
-// simply fail until then. Reserved as an explicit hook.
-func (m *Manager) OnDataPathDown(remoteID RemoteID) {}
-
-// ---- internals ----
-
-// pushDataPath resolves the peer's endpoint and sends over the data-path transport,
-// erroring if the peer is unknown or no transport is set.
-func (m *Manager) pushDataPath(remoteID RemoteID, msg []byte) error {
-	m.mu.Lock()
-	ep, ok := m.peerAddrs[remoteID]
-	t := m.transport
-	m.mu.Unlock()
-	if !ok {
-		return fmt.Errorf("no data-path endpoint for peer %s", remoteID)
-	}
-	if t == nil {
-		return fmt.Errorf("no data-path transport")
-	}
-	return t.Send(ep, msg)
-}
-
-func (m *Manager) binding(remoteID RemoteID) Binding {
-	return Binding{LocalID: []byte(m.localID), RemoteID: []byte(remoteID)}
-}
-
-func newExchangeID() (ExchangeID, error) {
-	var id ExchangeID
-	if _, err := rand.Read(id[:]); err != nil {
-		return ExchangeID{}, fmt.Errorf("generate exchange id: %w", err)
-	}
-	return id, nil
-}
--- a/client/internal/pqkem/manager_test.go
+++ b/client/internal/pqkem/manager_test.go
@@ -1,193 +0,0 @@
-package pqkem
-
-import (
-	"fmt"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// netSwitch is an in-memory UDP fabric: transports register their endpoint and get
-// datagrams delivered to their inbound handler.
-type netSwitch struct {
-	mu sync.Mutex
-	h  map[netip.AddrPort]func(netip.AddrPort, []byte)
-}
-
-func newSwitch() *netSwitch {
-	return &netSwitch{h: map[netip.AddrPort]func(netip.AddrPort, []byte){}}
-}
-
-func (s *netSwitch) register(ep netip.AddrPort, fn func(netip.AddrPort, []byte)) {
-	s.mu.Lock()
-	s.h[ep] = fn
-	s.mu.Unlock()
-}
-
-func (s *netSwitch) deliver(dst, src netip.AddrPort, msg []byte) error {
-	s.mu.Lock()
-	fn := s.h[dst]
-	s.mu.Unlock()
-	if fn == nil {
-		return fmt.Errorf("no route to %s", dst)
-	}
-	fn(src, msg)
-	return nil
-}
-
-// loopback is an endpoint-based pqkem.Transport over a netSwitch, with a switchable
-// drop flag.
-type loopback struct {
-	ep   netip.AddrPort
-	sw   *netSwitch
-	drop atomic.Bool
-}
-
-func (l *loopback) Send(dst netip.AddrPort, msg []byte) error {
-	if l.drop.Load() {
-		return nil
-	}
-	return l.sw.deliver(dst, l.ep, append([]byte(nil), msg...))
-}
-
-func (l *loopback) LocalPort() int                             { return int(l.ep.Port()) }
-func (l *loopback) Run(onInbound func(netip.AddrPort, []byte)) { l.sw.register(l.ep, onInbound) }
-func (l *loopback) Close() error                               { return nil }
-
-type fakeWG struct {
-	mu     sync.Mutex
-	psks   map[RemoteID]PSK
-	failed []RemoteID
-}
-
-func newFakeWG() *fakeWG { return &fakeWG{psks: map[RemoteID]PSK{}} }
-
-func (f *fakeWG) OnNewPSKReady(remoteID RemoteID, psk PSK) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.psks[remoteID] = psk
-	return nil
-}
-
-func (f *fakeWG) OnRekeyFailed(remoteID RemoteID) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.failed = append(f.failed, remoteID)
-	return nil
-}
-
-func (f *fakeWG) psk(peer RemoteID) PSK {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.psks[peer]
-}
-
-var (
-	epA = netip.MustParseAddrPort("100.64.0.1:51833")
-	epB = netip.MustParseAddrPort("100.64.0.2:51833")
-)
-
-// pair builds two wired managers (B is the initiator, "bbbb" > "aaaa") sharing a
-// netSwitch, with each peer's data-path endpoint registered. lbB is B's loopback
-// (for toggling drop).
-func pair(t *testing.T) (dA, dB *Manager, wgA, wgB *fakeWG, lbB *loopback) {
-	t.Helper()
-	sw := newSwitch()
-	wgA = newFakeWG()
-	wgB = newFakeWG()
-	dA = NewManager("aaaa", wgA, nil)
-	dB = NewManager("bbbb", wgB, nil)
-	dA.Start(&loopback{ep: epA, sw: sw})
-	lbB = &loopback{ep: epB, sw: sw}
-	dB.Start(lbB)
-	dA.AddPeer("bbbb", epB)
-	dB.AddPeer("aaaa", epA)
-	return dA, dB, wgA, wgB, lbB
-}
-
-// bootstrap runs the signalling offer/answer (the test plays the host carrying bytes).
-func bootstrap(t *testing.T, dA, dB *Manager) {
-	t.Helper()
-	offer, err := dB.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-	answer, err := dA.SignalOnOffer("bbbb", offer)
-	require.NoError(t, err)
-	require.NotNil(t, answer)
-	require.NoError(t, dB.SignalOnAnswer("aaaa", answer))
-}
-
-func TestManager_BootstrapDerivesSamePSK(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-
-	pskA := wgA.psk("bbbb")
-	pskB := wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, pskA)
-	require.Equal(t, pskB, pskA, "both sides derive the same PSK from the bootstrap exchange")
-}
-
-func TestManager_ChainRotatesAndAcks(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-	psk1 := wgB.psk("aaaa")
-
-	// Data path up: B (initiator) chains the next offer over the data path, which
-	// rotates both to a fresh PSK and acknowledges A.
-	dA.OnDataPathRekeyed("bbbb", 0)
-	dB.OnDataPathRekeyed("aaaa", 0)
-
-	psk2A := wgA.psk("bbbb")
-	psk2B := wgB.psk("aaaa")
-	require.Equal(t, psk2B, psk2A, "both sides converge on the rotated PSK")
-	require.NotEqual(t, psk1, psk2B, "the chain rotated to a new PSK")
-}
-
-func TestManager_RotationSkippedWhenIdle(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-	psk1 := wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, psk1)
-
-	// Idle: the peer's last real-data activity is older than the window, so a rekey
-	// must NOT clock a rotation.
-	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow)
-	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow)
-	require.Equal(t, psk1, wgB.psk("aaaa"), "idle peer must not rotate the PSK")
-	require.Equal(t, psk1, wgA.psk("bbbb"), "idle peer must not rotate the PSK")
-
-	// Active: activity within the window clocks the rotation as usual.
-	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow-1)
-	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow-1)
-	psk2 := wgB.psk("aaaa")
-	require.NotEqual(t, psk1, psk2, "recent activity must clock a rotation")
-	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides converge on the rotated PSK")
-}
-
-func TestManager_NonInitiatorReturnsNoOffer(t *testing.T) {
-	dA := NewManager("aaaa", newFakeWG(), nil)
-	defer dA.Stop()
-
-	offer, err := dA.SignalOffer("bbbb") // not the initiator vs "bbbb"
-	require.NoError(t, err)
-	require.Nil(t, offer)
-}
-
-func TestManager_StopIsIdempotent(t *testing.T) {
-	dA := NewManager("aaaa", newFakeWG(), nil)
-	dA.Start(&loopback{ep: epA, sw: newSwitch()})
-	dA.Stop()
-	dA.Stop() // must not panic or hang
-}
--- a/client/internal/pqkem/message.go
+++ b/client/internal/pqkem/message.go
@@ -1,121 +0,0 @@
-package pqkem
-
-import (
-	"crypto/mlkem"
-	"fmt"
-)
-
-// Wire framing for the PQ-KEM exchange. Messages are self-contained, versioned,
-// transport-agnostic byte blobs: the same bytes ride the signalling channel
-// (initial bootstrap) or a data-tunnel packet (rekey). The library only ever sees
-// opaque []byte at the transport seam.
-//
-// Layout (all messages): [type:1][version:1][exchangeID:16][payload...]
-//
-// There is no confirm message: an exchange is acknowledged by the NEXT offer, which
-// carries the acked exchange's id (see OfferMsg.AckID) and — riding the data path
-// under the freshly adopted key — proves that key works.
-
-const (
-	// ProtocolVersion is bumped on any wire-incompatible change; a peer rejects
-	// messages it does not understand rather than misparsing them.
-	ProtocolVersion uint8 = 1
-
-	// ExchangeIDSize identifies one exchange so answers/acks correlate and stale
-	// messages are dropped.
-	ExchangeIDSize = 16
-
-	headerSize = 1 + 1 + ExchangeIDSize
-)
-
-// MsgType tags the two message kinds of the exchange.
-type MsgType uint8
-
-const (
-	MsgOffer MsgType = iota + 1
-	MsgAnswer
-)
-
-// ExchangeID is the per-exchange correlator. The zero value means "none" (an offer
-// that acknowledges nothing, i.e. the first exchange of a connection).
-type ExchangeID [ExchangeIDSize]byte
-
-// OfferMsg carries the initiator's public material (X25519 pub ‖ ML-KEM encap key)
-// and AckID, the id of the previous exchange this offer acknowledges (zero if none).
-type OfferMsg struct {
-	ExchangeID ExchangeID
-	AckID      ExchangeID
-	// KEMOffer is the raw Initiator.Offer() blob (OfferSize bytes).
-	KEMOffer []byte
-}
-
-// AnswerMsg carries the responder's reply (ML-KEM ciphertext ‖ X25519 pub) for the
-// round identified by ExchangeID.
-type AnswerMsg struct {
-	ExchangeID ExchangeID
-	// KEMAnswer is the raw Respond() answer blob (AnswerSize bytes).
-	KEMAnswer []byte
-}
-
-// Encode serialises the offer with its framed header (payload = AckID ‖ KEMOffer).
-func (m *OfferMsg) Encode() ([]byte, error) {
-	if len(m.KEMOffer) != OfferSize {
-		return nil, fmt.Errorf("offer payload: got %d, want %d", len(m.KEMOffer), OfferSize)
-	}
-	payload := make([]byte, 0, ExchangeIDSize+OfferSize)
-	payload = append(payload, m.AckID[:]...)
-	payload = append(payload, m.KEMOffer...)
-	return frame(MsgOffer, m.ExchangeID, payload), nil
-}
-
-// Encode serialises the answer with its framed header.
-func (m *AnswerMsg) Encode() ([]byte, error) {
-	if len(m.KEMAnswer) != AnswerSize {
-		return nil, fmt.Errorf("answer payload: got %d, want %d", len(m.KEMAnswer), AnswerSize)
-	}
-	return frame(MsgAnswer, m.ExchangeID, m.KEMAnswer), nil
-}
-
-// Decode parses a framed message into one of *OfferMsg / *AnswerMsg.
-func Decode(buf []byte) (MsgType, any, error) {
-	if len(buf) < headerSize {
-		return 0, nil, fmt.Errorf("message too short: %d bytes", len(buf))
-	}
-	typ := MsgType(buf[0])
-	if ver := buf[1]; ver != ProtocolVersion {
-		return typ, nil, fmt.Errorf("unsupported protocol version %d (want %d)", ver, ProtocolVersion)
-	}
-
-	var id ExchangeID
-	copy(id[:], buf[2:headerSize])
-	payload := buf[headerSize:]
-
-	switch typ {
-	case MsgOffer:
-		if len(payload) != ExchangeIDSize+OfferSize {
-			return typ, nil, fmt.Errorf("offer payload: got %d, want %d", len(payload), ExchangeIDSize+OfferSize)
-		}
-		var ack ExchangeID
-		copy(ack[:], payload[:ExchangeIDSize])
-		return typ, &OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: payload[ExchangeIDSize:]}, nil
-	case MsgAnswer:
-		if len(payload) != AnswerSize {
-			return typ, nil, fmt.Errorf("answer payload: got %d, want %d", len(payload), AnswerSize)
-		}
-		return typ, &AnswerMsg{ExchangeID: id, KEMAnswer: payload}, nil
-	default:
-		return typ, nil, fmt.Errorf("unknown message type %d", typ)
-	}
-}
-
-func frame(typ MsgType, id ExchangeID, payload []byte) []byte {
-	buf := make([]byte, headerSize+len(payload))
-	buf[0] = byte(typ)
-	buf[1] = ProtocolVersion
-	copy(buf[2:], id[:])
-	copy(buf[headerSize:], payload)
-	return buf
-}
-
-// compile-time assurance the KEM blob sizes referenced here stay in sync with kem.go.
-var _ = [1]struct{}{}[OfferSize-(32+mlkem.EncapsulationKeySize768)]
--- a/client/internal/pqkem/message_test.go
+++ b/client/internal/pqkem/message_test.go
@@ -1,57 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestMessageRoundTrip(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	id := ExchangeID{1, 2, 3, 4}
-	ack := ExchangeID{9, 9, 9}
-
-	offBytes, err := (&OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: init.Offer()}).Encode()
-	require.NoError(t, err)
-	typ, decoded, err := Decode(offBytes)
-	require.NoError(t, err)
-	require.Equal(t, MsgOffer, typ)
-	require.Equal(t, id, decoded.(*OfferMsg).ExchangeID)
-	require.Equal(t, ack, decoded.(*OfferMsg).AckID)
-	require.Equal(t, init.Offer(), decoded.(*OfferMsg).KEMOffer)
-
-	ansBytes, err := (&AnswerMsg{ExchangeID: id, KEMAnswer: answer}).Encode()
-	require.NoError(t, err)
-	typ, decoded, err = Decode(ansBytes)
-	require.NoError(t, err)
-	require.Equal(t, MsgAnswer, typ)
-	require.Equal(t, answer, decoded.(*AnswerMsg).KEMAnswer)
-}
-
-func TestDecodeRejects(t *testing.T) {
-	// too short
-	_, _, err := Decode([]byte{1, 1})
-	require.Error(t, err)
-
-	// wrong version
-	bad := make([]byte, headerSize+ExchangeIDSize+OfferSize)
-	bad[0] = byte(MsgOffer)
-	bad[1] = ProtocolVersion + 1
-	_, _, err = Decode(bad)
-	require.Error(t, err)
-
-	// unknown type
-	bad2 := make([]byte, headerSize)
-	bad2[0] = 99
-	bad2[1] = ProtocolVersion
-	_, _, err = Decode(bad2)
-	require.Error(t, err)
-
-	// offer with wrong payload size
-	_, err = (&OfferMsg{KEMOffer: []byte{1, 2, 3}}).Encode()
-	require.Error(t, err)
-}
--- a/client/internal/pqkem_adapter.go
+++ b/client/internal/pqkem_adapter.go
@@ -1,114 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/internal/pqkem"
-)
-
-// pqPresharedKeySetter is the subset of the WireGuard interface the ML-KEM callback
-// needs: programming a peer's preshared key. *iface.WGIface satisfies it.
-type pqPresharedKeySetter interface {
-	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
-}
-
-// pqCallbackHandler programs the derived PQ PSK onto the WireGuard peer. It is the
-// engine-side implementation of pqkem.CallbackHandler.
-type pqCallbackHandler struct {
-	wg pqPresharedKeySetter
-	// reoffer re-bootstraps the KEM over Signal for a peer (a fresh signalling offer)
-	// to recover from a persistent data-path rekey failure. Nil disables recovery.
-	reoffer func(remoteKey string)
-}
-
-// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
-// if the peer is not present, mirroring Rosenpass). remoteID is the peer's WG pubkey.
-func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
-	// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
-	// peer is not configured yet, so this is a no-op there and the PSK is instead
-	// pulled at peer-config time (pqHandshaker.PSK / conn.presharedKey).
-	log.Tracef("pqkem: programming PSK for peer %s", remoteID)
-	return h.wg.SetPresharedKey(string(remoteID), wgtypes.Key(psk), true)
-}
-
-// OnRekeyFailed reports a failed PQ (re)key convergence and re-bootstraps the KEM over
-// Signal to recover: a fresh signalling offer starts a new exchange that overwrites the
-// stalled PSK on both sides, resyncing after a persistent data-path desync. The tunnel
-// stays up on the previous PSK meanwhile (the Signal channel is independent of the
-// broken data path).
-func (h pqCallbackHandler) OnRekeyFailed(remoteID pqkem.RemoteID) error {
-	log.Warnf("pqkem: post-quantum rekey failed for peer %s, re-bootstrapping over signal", remoteID)
-	if h.reoffer != nil {
-		h.reoffer(string(remoteID))
-	}
-	return nil
-}
-
-// pqHandshaker adapts the pqkem manager to peer.PQHandshaker (string peer keys),
-// wiring the host's signalling offers/answers to the KEM exchange.
-type pqHandshaker struct {
-	mgr *pqkem.Manager
-}
-
-func (p pqHandshaker) OfferPayload(remoteKey string) ([]byte, int) {
-	payload, err := p.mgr.SignalOffer(pqkem.RemoteID(remoteKey))
-	if err != nil {
-		log.Warnf("pqkem: build offer for %s: %v", remoteKey, err)
-	}
-	return payload, p.mgr.LocalPort()
-}
-
-func (p pqHandshaker) AnswerPayload(remoteKey string, recvOffer []byte) ([]byte, int) {
-	if len(recvOffer) == 0 {
-		return nil, p.mgr.LocalPort()
-	}
-	payload, err := p.mgr.SignalOnOffer(pqkem.RemoteID(remoteKey), recvOffer)
-	if err != nil {
-		log.Warnf("pqkem: build answer for %s: %v", remoteKey, err)
-	}
-	return payload, p.mgr.LocalPort()
-}
-
-func (p pqHandshaker) OnAnswer(remoteKey string, recvAnswer []byte) {
-	if len(recvAnswer) == 0 {
-		return
-	}
-	if err := p.mgr.SignalOnAnswer(pqkem.RemoteID(remoteKey), recvAnswer); err != nil {
-		log.Warnf("pqkem: process answer from %s: %v", remoteKey, err)
-	}
-}
-
-// PSK exposes the peer's derived PSK for the conn to program at WG peer-config time.
-func (p pqHandshaker) PSK(remoteKey string) (wgtypes.Key, bool) {
-	psk, ok := p.mgr.PSK(pqkem.RemoteID(remoteKey))
-	if !ok {
-		return wgtypes.Key{}, false
-	}
-	return wgtypes.Key(psk), true
-}
-
-// SetRemoteAddr registers the peer's data-path endpoint (overlay IP + pq UDP port)
-// learned from signalling. Sends only ever fire once the tunnel is up (clocked by
-// OnDataPathRekeyed), so registering here is safe even before connection-up.
-func (p pqHandshaker) SetRemoteAddr(remoteKey string, addr netip.AddrPort) {
-	if !addr.IsValid() || addr.Port() == 0 {
-		return
-	}
-	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), addr)
-}
-
-// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh WG handshake.
-// sinceActivity is how long ago the peer last exchanged real user data; the manager
-// skips rotation for idle tunnels.
-func (p pqHandshaker) OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration) {
-	p.mgr.OnDataPathRekeyed(pqkem.RemoteID(remoteKey), sinceActivity)
-}
-
-// OnDataPathDown signals the peer's tunnel went down.
-func (p pqHandshaker) OnDataPathDown(remoteKey string) {
-	p.mgr.OnDataPathDown(pqkem.RemoteID(remoteKey))
-}
--- a/client/internal/pqkem_transport.go
+++ b/client/internal/pqkem_transport.go
@@ -1,72 +0,0 @@
-package internal
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
-// the WG overlay IP. Since each client owns a distinct overlay IP, this port is
-// almost always free, so it need not be announced (peers assume it). A peer only
-// announces Body.mlkemPort when a collision forced it onto a different port.
-const DefaultPort = 51833
-
-// pqTransport is the ML-KEM data-path transport: a dumb UDP socket bound on the WG
-// overlay IP. It implements pqkem.Transport — the manager owns the remoteID<->endpoint
-// routing and drives this socket's lifecycle (Run / Close).
-type pqTransport struct {
-	conn *net.UDPConn
-	port int
-}
-
-// newPQTransport binds a UDP socket on the WG overlay IP, preferring DefaultPort and
-// falling back to an OS-assigned ephemeral port if it is in use. Call it after the WG
-// interface is up so the overlay IP is assigned; when the bound port is not
-// DefaultPort it must be announced to peers via Body.mlkemPort.
-func newPQTransport(overlayIP netip.Addr) (*pqTransport, error) {
-	if !overlayIP.IsValid() {
-		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
-	}
-	ip := net.IP(overlayIP.AsSlice())
-	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: DefaultPort})
-	if err != nil {
-		log.Debugf("pqkem: default port %d unavailable on %s (%v), using an ephemeral port", DefaultPort, overlayIP, err)
-		conn, err = net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
-		if err != nil {
-			return nil, fmt.Errorf("bind pqkem udp on overlay %s: %w", overlayIP, err)
-		}
-	}
-	return &pqTransport{conn: conn, port: conn.LocalAddr().(*net.UDPAddr).Port}, nil
-}
-
-// Send implements pqkem.Transport.
-func (t *pqTransport) Send(endpoint netip.AddrPort, msg []byte) error {
-	_, err := t.conn.WriteToUDPAddrPort(msg, endpoint)
-	return err
-}
-
-// LocalPort implements pqkem.Transport.
-func (t *pqTransport) LocalPort() int { return t.port }
-
-// Run implements pqkem.Transport: the receive loop, delivering each datagram as
-// (source endpoint, msg). Exits when the socket is closed.
-func (t *pqTransport) Run(onInbound func(src netip.AddrPort, msg []byte)) {
-	go func() {
-		buf := make([]byte, 2048)
-		for {
-			n, src, err := t.conn.ReadFromUDPAddrPort(buf)
-			if err != nil {
-				return
-			}
-			msg := make([]byte, n)
-			copy(msg, buf[:n])
-			onInbound(src, msg)
-		}
-	}()
-}
-
-// Close implements pqkem.Transport.
-func (t *pqTransport) Close() error { return t.conn.Close() }
--- a/client/internal/routemanager/dnsinterceptor/handler.go
+++ b/client/internal/routemanager/dnsinterceptor/handler.go
@@ -95,7 +95,7 @@ func (d *DnsInterceptor) RemoveRoute() error {

 			// AllowedIPs should use real IPs
 			if d.currentPeerKey != "" {
-				if _, err := d.allowedIPsRefcounter.Decrement(prefix); err != nil {
+				if _, err := d.allowedIPsRefcounter.Decrement(prefix, d.currentPeerKey); err != nil {
 					merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %v", prefix, err))
 				}
 			}
@@ -172,7 +172,7 @@ func (d *DnsInterceptor) removeAllowedIP(realPrefix netip.Prefix) error {
 	}

 	// AllowedIPs use real IPs
-	if _, err := d.allowedIPsRefcounter.Decrement(realPrefix); err != nil {
+	if _, err := d.allowedIPsRefcounter.Decrement(realPrefix, d.currentPeerKey); err != nil {
 		return fmt.Errorf("remove allowed IP %s: %v", realPrefix, err)
 	}

@@ -205,7 +205,7 @@ func (d *DnsInterceptor) RemoveAllowedIPs() error {
 	for _, prefixes := range d.interceptedDomains {
 		for _, prefix := range prefixes {
 			// AllowedIPs use real IPs
-			if _, err := d.allowedIPsRefcounter.Decrement(prefix); err != nil {
+			if _, err := d.allowedIPsRefcounter.Decrement(prefix, d.currentPeerKey); err != nil {
 				merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %v", prefix, err))
 			}
 		}
--- a/client/internal/routemanager/dynamic/route.go
+++ b/client/internal/routemanager/dynamic/route.go
@@ -135,7 +135,7 @@ func (r *Route) RemoveAllowedIPs() error {
 	var merr *multierror.Error
 	for _, domainPrefixes := range r.dynamicDomains {
 		for _, prefix := range domainPrefixes {
-			if _, err := r.allowedIPsRefcounter.Decrement(prefix); err != nil {
+			if _, err := r.allowedIPsRefcounter.Decrement(prefix, r.currentPeerKey); err != nil {
 				merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %w", prefix, err))
 			}
 		}
@@ -320,7 +320,7 @@ func (r *Route) removeRoutes(prefixes []netip.Prefix) ([]netip.Prefix, error) {
 			merr = multierror.Append(merr, fmt.Errorf("remove dynamic route for IP %s: %w", prefix, err))
 		}
 		if r.currentPeerKey != "" {
-			if _, err := r.allowedIPsRefcounter.Decrement(prefix); err != nil {
+			if _, err := r.allowedIPsRefcounter.Decrement(prefix, r.currentPeerKey); err != nil {
 				merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s: %w", prefix, err))
 			}
 		}
--- a/client/internal/routemanager/manager.go
+++ b/client/internal/routemanager/manager.go
@@ -52,6 +52,10 @@ type Manager interface {
 	UpdateRoutes(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	TriggerSelection(route.HAMap)
+	SelectRoutes(ids []route.NetID, appendRoute bool) error
+	DeselectRoutes(ids []route.NetID) error
+	SelectAllRoutes()
+	DeselectAllRoutes()
 	GetRouteSelector() *routeselector.RouteSelector
 	GetClientRoutes() route.HAMap
 	GetSelectedClientRoutes() route.HAMap
@@ -216,7 +220,7 @@ func (m *DefaultManager) setupRefCounters(useNoop bool) {
 		)
 	}

-	m.allowedIPsRefCounter = refcounter.New(
+	m.allowedIPsRefCounter = refcounter.NewAllowedIPs(
 		func(prefix netip.Prefix, peerKey string) (string, error) {
 			// save peerKey to use it in the remove function
 			return peerKey, m.wgInterface.AddAllowedIP(peerKey, prefix)
@@ -800,7 +804,7 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	var info exitNodeInfo

 	for haID, routes := range clientRoutes {
-		if !m.isExitNodeRoute(routes) {
+		if !isExitNodeRoutes(routes) {
 			continue
 		}

@@ -820,13 +824,6 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	return info
 }

-func (m *DefaultManager) isExitNodeRoute(routes []*route.Route) bool {
-	if len(routes) == 0 {
-		return false
-	}
-	return route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network)
-}
-
 func (m *DefaultManager) categorizeUserSelection(netID route.NetID, info *exitNodeInfo) {
 	if m.routeSelector.IsSelected(netID) {
 		info.userSelected = append(info.userSelected, netID)
--- a/client/internal/routemanager/mock.go
+++ b/client/internal/routemanager/mock.go
@@ -16,6 +16,8 @@ type MockManager struct {
 	ClassifyRoutesFunc           func(routes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	UpdateRoutesFunc             func(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	TriggerSelectionFunc         func(haMap route.HAMap)
+	SelectRoutesFunc             func(ids []route.NetID, appendRoute bool) error
+	DeselectRoutesFunc           func(ids []route.NetID) error
 	GetRouteSelectorFunc         func() *routeselector.RouteSelector
 	GetClientRoutesFunc          func() route.HAMap
 	GetSelectedClientRoutesFunc  func() route.HAMap
@@ -55,6 +57,30 @@ func (m *MockManager) TriggerSelection(networks route.HAMap) {
 	}
 }

+// SelectRoutes mock implementation of SelectRoutes from Manager interface
+func (m *MockManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
+	if m.SelectRoutesFunc != nil {
+		return m.SelectRoutesFunc(ids, appendRoute)
+	}
+	return nil
+}
+
+// DeselectRoutes mock implementation of DeselectRoutes from Manager interface
+func (m *MockManager) DeselectRoutes(ids []route.NetID) error {
+	if m.DeselectRoutesFunc != nil {
+		return m.DeselectRoutesFunc(ids)
+	}
+	return nil
+}
+
+// SelectAllRoutes mock implementation of SelectAllRoutes from Manager interface
+func (m *MockManager) SelectAllRoutes() {
+}
+
+// DeselectAllRoutes mock implementation of DeselectAllRoutes from Manager interface
+func (m *MockManager) DeselectAllRoutes() {
+}
+
 // GetRouteSelector mock implementation of GetRouteSelector from Manager interface
 func (m *MockManager) GetRouteSelector() *routeselector.RouteSelector {
 	if m.GetRouteSelectorFunc != nil {
--- a/client/internal/routemanager/notifier/notifier_ios.go
+++ b/client/internal/routemanager/notifier/notifier_ios.go
@@ -3,7 +3,6 @@
 package notifier

 import (
-	"container/list"
 	"net/netip"
 	"slices"
 	"sort"
@@ -16,20 +15,12 @@ import (

 type Notifier struct {
 	mu              sync.Mutex
-	cond            *sync.Cond
 	currentPrefixes []string
 	listener        listener.NetworkChangeListener
-	queue           *list.List
-	closed          bool
 }

 func NewNotifier() *Notifier {
-	n := &Notifier{
-		queue: list.New(),
-	}
-	n.cond = sync.NewCond(&n.mu)
-	go n.deliverLoop()
-	return n
+	return &Notifier{}
 }

 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
@@ -59,44 +50,19 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	sort.Strings(newNets)

 	n.mu.Lock()
+	defer n.mu.Unlock()
 	if slices.Equal(n.currentPrefixes, newNets) {
-		n.mu.Unlock()
 		return
 	}
 	n.currentPrefixes = newNets
-	routes := strings.Join(n.currentPrefixes, ",")
-	n.queue.PushBack(routes)
-	n.cond.Signal()
-	n.mu.Unlock()
+	if n.listener != nil {
+		n.listener.OnNetworkChanged(strings.Join(n.currentPrefixes, ","))
+	}
 }

 func (n *Notifier) Close() {
-	n.mu.Lock()
-	n.closed = true
-	n.cond.Signal()
-	n.mu.Unlock()
 }

 func (n *Notifier) GetInitialRouteRanges() []string {
 	return nil
 }
-
-func (n *Notifier) deliverLoop() {
-	for {
-		n.mu.Lock()
-		for n.queue.Len() == 0 && !n.closed {
-			n.cond.Wait()
-		}
-		if n.closed && n.queue.Len() == 0 {
-			n.mu.Unlock()
-			return
-		}
-		routes := n.queue.Remove(n.queue.Front()).(string)
-		l := n.listener
-		n.mu.Unlock()
-
-		if l != nil {
-			l.OnNetworkChanged(routes)
-		}
-	}
-}
--- a/client/internal/routemanager/reconcile_test.go
+++ b/client/internal/routemanager/reconcile_test.go
@@ -54,7 +54,7 @@ func (m *reconcileWGMock) GetNet() *netstack.Net                      { return n
 func TestReconcilePeerAllowedIPs(t *testing.T) {
 	wg := &reconcileWGMock{}
 	m := &DefaultManager{wgInterface: wg}
-	m.allowedIPsRefCounter = refcounter.New[netip.Prefix, string, string](
+	m.allowedIPsRefCounter = refcounter.NewAllowedIPs(
 		func(_ netip.Prefix, peerKey string) (string, error) { return peerKey, nil },
 		func(netip.Prefix, string) error { return nil },
 	)
--- a/client/internal/routemanager/refcounter/allowedips.go
+++ b/client/internal/routemanager/refcounter/allowedips.go
@@ -0,0 +1,206 @@
+package refcounter
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"sort"
+	"sync"
+
+	"github.com/hashicorp/go-multierror"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+)
+
+// allowedIPsEntry holds the per-peer reference counts for a single prefix and which peer is
+// currently installed in WireGuard. WireGuard allows a prefix on exactly one peer, so at most
+// one peer is active at a time even when several peers reference the prefix.
+type allowedIPsEntry struct {
+	// peers maps a peerKey to the number of references holding the prefix for that peer.
+	peers map[string]int
+	// active is the peerKey currently installed in WireGuard for this prefix ("" if none).
+	active string
+	// total is the sum of all per-peer reference counts (kept in sync with peers).
+	total int
+}
+
+// AllowedIPsRefCounter is a peer-aware reference counter for WireGuard AllowedIPs.
+//
+// The generic Counter keys only by prefix and remembers a single Out value set by the first
+// caller, which it never changes. That is wrong for AllowedIPs: two independent watchers (or
+// multiple resolved domains) can reference the same prefix through different peers, and when the
+// peer currently installed in WireGuard releases its last reference the prefix must be handed over
+// to a surviving peer instead of being left pointing at the released one.
+//
+// It calls add/remove (which program WireGuard) only on the transitions that matter:
+//   - add on the first reference for a prefix, or when swapping the active peer;
+//   - remove on the last reference for a prefix, or on the old peer during a swap.
+type AllowedIPsRefCounter struct {
+	mu      sync.Mutex
+	entries map[netip.Prefix]*allowedIPsEntry
+	add     AddFunc[netip.Prefix, string, string]
+	remove  RemoveFunc[netip.Prefix, string]
+}
+
+// NewAllowedIPs creates a new peer-aware AllowedIPs reference counter.
+// add programs a prefix on a peer in WireGuard and returns the peerKey to store as the active peer.
+// remove unprograms the prefix from the given peer.
+func NewAllowedIPs(add AddFunc[netip.Prefix, string, string], remove RemoveFunc[netip.Prefix, string]) *AllowedIPsRefCounter {
+	return &AllowedIPsRefCounter{
+		entries: map[netip.Prefix]*allowedIPsEntry{},
+		add:     add,
+		remove:  remove,
+	}
+}
+
+// Increment adds a reference to prefix for peerKey. WireGuard is programmed only for the first
+// reference to a prefix; while a different peer is already installed the prefix is left with it
+// (first peer wins, HA at the WireGuard layer is not possible) and only the reference count is kept.
+func (rm *AllowedIPsRefCounter) Increment(prefix netip.Prefix, peerKey string) (Ref[string], error) {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	e, ok := rm.entries[prefix]
+	if !ok {
+		e = &allowedIPsEntry{peers: map[string]int{}}
+		rm.entries[prefix] = e
+	}
+
+	logCallerF("Increasing allowed IP ref count for prefix %v peer %s [peer %d -> %d, total %d -> %d, active %q]",
+		prefix, peerKey, e.peers[peerKey], e.peers[peerKey]+1, e.total, e.total+1, e.active)
+
+	// Program WireGuard only when nothing is installed yet for this prefix.
+	if e.active == "" {
+		out, err := rm.add(prefix, peerKey)
+		if errors.Is(err, ErrIgnore) {
+			if e.total == 0 {
+				delete(rm.entries, prefix)
+			}
+			return Ref[string]{Count: e.total, Out: e.active}, nil
+		}
+		if err != nil {
+			if e.total == 0 {
+				delete(rm.entries, prefix)
+			}
+			return Ref[string]{}, fmt.Errorf("failed to add allowed IP %v for peer %s: %w", prefix, peerKey, err)
+		}
+		e.active = out
+	}
+
+	e.peers[peerKey]++
+	e.total++
+
+	return Ref[string]{Count: e.total, Out: e.active}, nil
+}
+
+// Decrement removes a reference to prefix for peerKey. When the peer currently installed in
+// WireGuard releases its last reference, the prefix is swapped to a surviving peer if one exists,
+// otherwise it is removed from WireGuard.
+func (rm *AllowedIPsRefCounter) Decrement(prefix netip.Prefix, peerKey string) (Ref[string], error) {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	e, ok := rm.entries[prefix]
+	if !ok {
+		logCallerF("No allowed IP reference found for prefix %v", prefix)
+		return Ref[string]{}, nil
+	}
+
+	if e.peers[peerKey] > 0 {
+		logCallerF("Decreasing allowed IP ref count for prefix %v peer %s [peer %d -> %d, total %d -> %d, active %q]",
+			prefix, peerKey, e.peers[peerKey], e.peers[peerKey]-1, e.total, e.total-1, e.active)
+		e.peers[peerKey]--
+		e.total--
+		if e.peers[peerKey] == 0 {
+			delete(e.peers, peerKey)
+		}
+	} else {
+		logCallerF("No allowed IP reference found for prefix %v peer %s", prefix, peerKey)
+	}
+
+	// If the peer currently installed in WireGuard still holds references, nothing to reprogram.
+	// Keying the check on the active peer (not the one just released) makes this self-healing:
+	// a prior swap whose remove/add failed leaves e.active pointing at a peer with no references,
+	// and this retries the hand-off on the next Decrement instead of getting stuck.
+	if e.active != "" && e.peers[e.active] > 0 {
+		return Ref[string]{Count: e.total, Out: e.active}, nil
+	}
+
+	// Detach the stale/gone active peer from WireGuard before reprogramming.
+	if e.active != "" {
+		if err := rm.remove(prefix, e.active); err != nil {
+			return Ref[string]{Count: e.total, Out: e.active}, fmt.Errorf("remove allowed IP %v for peer %s: %w", prefix, e.active, err)
+		}
+		e.active = ""
+	}
+
+	// Hand the prefix over to a surviving peer, or drop the entry when none remain.
+	if survivor, ok := pickSurvivor(e.peers); ok {
+		out, err := rm.add(prefix, survivor)
+		if err != nil {
+			return Ref[string]{Count: e.total, Out: ""}, fmt.Errorf("swap allowed IP %v to peer %s: %w", prefix, survivor, err)
+		}
+		e.active = out
+		return Ref[string]{Count: e.total, Out: e.active}, nil
+	}
+
+	delete(rm.entries, prefix)
+	return Ref[string]{Count: 0, Out: ""}, nil
+}
+
+// Flush removes all prefixes from WireGuard and clears the counter.
+func (rm *AllowedIPsRefCounter) Flush() error {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	var merr *multierror.Error
+	for prefix, e := range rm.entries {
+		if e.active == "" {
+			continue
+		}
+		logCallerF("Flushing allowed IP for prefix %v peer %s", prefix, e.active)
+		if err := rm.remove(prefix, e.active); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %v for peer %s: %w", prefix, e.active, err))
+		}
+	}
+
+	clear(rm.entries)
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// ReapplyMatching calls apply for every prefix whose currently installed (active) peer satisfies
+// pred, holding the lock for the whole pass. It is used to re-push allowed IPs onto a peer whose
+// WireGuard entry was rebuilt (e.g. a lazy connection cycling idle->wake) without a matching
+// refcounter change, which would otherwise leave the prefix installed in the counter but missing
+// on the device. Only the active peer is considered — a prefix that lost its installed peer to a
+// failed swap is skipped here and reconciled by the next Increment/Decrement.
+func (rm *AllowedIPsRefCounter) ReapplyMatching(pred func(out string) bool, apply func(key netip.Prefix) error) error {
+	rm.mu.Lock()
+	defer rm.mu.Unlock()
+
+	var merr *multierror.Error
+	for prefix, e := range rm.entries {
+		if e.active != "" && pred(e.active) {
+			if err := apply(prefix); err != nil {
+				merr = multierror.Append(merr, err)
+			}
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// pickSurvivor deterministically selects a peer still referencing the prefix. WireGuard cannot do
+// multipath for a single prefix, so any surviving peer is a valid winner; the choice is made stable
+// (lowest peerKey) for predictable behavior and testability.
+func pickSurvivor(peers map[string]int) (string, bool) {
+	if len(peers) == 0 {
+		return "", false
+	}
+	keys := make([]string, 0, len(peers))
+	for k := range peers {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys[0], true
+}
--- a/client/internal/routemanager/refcounter/allowedips_test.go
+++ b/client/internal/routemanager/refcounter/allowedips_test.go
@@ -0,0 +1,241 @@
+package refcounter
+
+import (
+	"errors"
+	"net/netip"
+	"testing"
+)
+
+// fakeWG models WireGuard's cryptokey routing: a prefix can be installed on exactly one peer.
+// failAdd/failRemove make the next add/remove fail once, to exercise the self-healing error paths.
+type fakeWG struct {
+	installed  map[netip.Prefix]string
+	adds       int
+	removes    int
+	failAdd    bool
+	failRemove bool
+}
+
+func newFakeWG() *fakeWG {
+	return &fakeWG{installed: map[netip.Prefix]string{}}
+}
+
+func (f *fakeWG) counter() *AllowedIPsRefCounter {
+	return NewAllowedIPs(
+		func(prefix netip.Prefix, peerKey string) (string, error) {
+			if f.failAdd {
+				f.failAdd = false
+				return "", errors.New("add failed")
+			}
+			f.adds++
+			f.installed[prefix] = peerKey
+			return peerKey, nil
+		},
+		func(prefix netip.Prefix, peerKey string) error {
+			if f.failRemove {
+				f.failRemove = false
+				return errors.New("remove failed")
+			}
+			f.removes++
+			// only clear if this peer is the one installed, mirroring wg semantics
+			if f.installed[prefix] == peerKey {
+				delete(f.installed, prefix)
+			}
+			return nil
+		},
+	)
+}
+
+func mustPrefix(t *testing.T, s string) netip.Prefix {
+	t.Helper()
+	p, err := netip.ParsePrefix(s)
+	if err != nil {
+		t.Fatalf("parse prefix %q: %v", s, err)
+	}
+	return p
+}
+
+func mustIncrement(t *testing.T, c *AllowedIPsRefCounter, p netip.Prefix, peer string) Ref[string] {
+	t.Helper()
+	ref, err := c.Increment(p, peer)
+	if err != nil {
+		t.Fatalf("Increment(%v, %s): %v", p, peer, err)
+	}
+	return ref
+}
+
+func mustDecrement(t *testing.T, c *AllowedIPsRefCounter, p netip.Prefix, peer string) Ref[string] {
+	t.Helper()
+	ref, err := c.Decrement(p, peer)
+	if err != nil {
+		t.Fatalf("Decrement(%v, %s): %v", p, peer, err)
+	}
+	return ref
+}
+
+// TestAllowedIPs_SwapOnActivePeerRemoval reproduces the reported bug: two networks with the same
+// prefix routed by different peers. Removing the network whose peer is installed must hand the
+// prefix over to the surviving peer instead of leaving it on the removed one.
+func TestAllowedIPs_SwapOnActivePeerRemoval(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+	// First peer wins while both are present.
+	if got := f.installed[p]; got != "peerA" {
+		t.Fatalf("expected peerA installed, got %q", got)
+	}
+
+	// Remove the active peer's network -> must swap to peerB.
+	mustDecrement(t, c, p, "peerA")
+	if got := f.installed[p]; got != "peerB" {
+		t.Fatalf("BUG: prefix stuck on removed peer, want peerB got %q", got)
+	}
+
+	// Remove the last one -> prefix gone.
+	mustDecrement(t, c, p, "peerB")
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("expected prefix removed, still installed on %q", f.installed[p])
+	}
+}
+
+// TestAllowedIPs_RemoveNonActivePeer removing a non-installed peer must not touch WireGuard.
+func TestAllowedIPs_RemoveNonActivePeer(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+	removesBefore := f.removes
+
+	mustDecrement(t, c, p, "peerB")
+	if f.installed[p] != "peerA" {
+		t.Fatalf("active peer must stay peerA, got %q", f.installed[p])
+	}
+	if f.removes != removesBefore {
+		t.Fatalf("removing a non-active peer must not call wg remove")
+	}
+}
+
+// TestAllowedIPs_SamePeerMultipleRefs two references via the same peer must keep the prefix until
+// the last reference is released (the reason the per-peer count must be an int, not a set).
+func TestAllowedIPs_SamePeerMultipleRefs(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerA")
+	if f.adds != 1 {
+		t.Fatalf("expected a single wg add for the same peer, got %d", f.adds)
+	}
+
+	mustDecrement(t, c, p, "peerA")
+	if f.installed[p] != "peerA" {
+		t.Fatalf("prefix must stay while a reference remains, got %q", f.installed[p])
+	}
+	if f.removes != 0 {
+		t.Fatalf("no wg remove expected while a reference remains, got %d", f.removes)
+	}
+
+	mustDecrement(t, c, p, "peerA")
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("prefix must be removed after last reference")
+	}
+}
+
+// TestAllowedIPs_RefCountAndActive checks the Ref returned to callers (used for the HA-disabled log).
+func TestAllowedIPs_RefCountAndActive(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	ref := mustIncrement(t, c, p, "peerA")
+	if ref.Count != 1 || ref.Out != "peerA" {
+		t.Fatalf("want {1, peerA}, got {%d, %q}", ref.Count, ref.Out)
+	}
+	ref = mustIncrement(t, c, p, "peerB")
+	if ref.Count != 2 || ref.Out != "peerA" {
+		t.Fatalf("want {2, peerA}, got {%d, %q}", ref.Count, ref.Out)
+	}
+}
+
+// TestAllowedIPs_Flush removes everything installed and clears the counter.
+func TestAllowedIPs_Flush(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p1 := mustPrefix(t, "10.44.8.0/24")
+	p2 := mustPrefix(t, "10.44.9.0/24")
+
+	mustIncrement(t, c, p1, "peerA")
+	mustIncrement(t, c, p2, "peerB")
+
+	if err := c.Flush(); err != nil {
+		t.Fatal(err)
+	}
+	if len(f.installed) != 0 {
+		t.Fatalf("expected all prefixes removed, got %v", f.installed)
+	}
+	// After flush, a fresh increment must add again.
+	mustIncrement(t, c, p1, "peerC")
+	if f.installed[p1] != "peerC" {
+		t.Fatalf("counter not reset after flush")
+	}
+}
+
+// TestAllowedIPs_SelfHealAfterSwapAddError ensures a failed add during a swap does not permanently
+// strand the prefix: the next Decrement (or Increment) must retry and install a surviving peer.
+func TestAllowedIPs_SelfHealAfterSwapAddError(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+	mustIncrement(t, c, p, "peerC")
+
+	// Removing the active peerA triggers a swap to a survivor; make the add fail once.
+	f.failAdd = true
+	if _, err := c.Decrement(p, "peerA"); err == nil {
+		t.Fatalf("expected error from failed swap add")
+	}
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("nothing should be installed after a failed swap add, got %q", f.installed[p])
+	}
+
+	// A later Decrement of a non-active survivor must retry the hand-off (self-heal), not stay stuck.
+	ref := mustDecrement(t, c, p, "peerC")
+	if got := f.installed[p]; got == "" {
+		t.Fatalf("self-heal failed: prefix left unrouted after add recovered")
+	}
+	if ref.Out == "" {
+		t.Fatalf("expected an active peer after self-heal, got empty")
+	}
+}
+
+// TestAllowedIPs_SelfHealAfterRemoveError ensures a failed remove during a swap is retried instead
+// of leaving e.active stuck on a peer that no longer holds references.
+func TestAllowedIPs_SelfHealAfterRemoveError(t *testing.T) {
+	f := newFakeWG()
+	c := f.counter()
+	p := mustPrefix(t, "10.44.8.0/24")
+
+	mustIncrement(t, c, p, "peerA")
+	mustIncrement(t, c, p, "peerB")
+
+	// Releasing active peerA must detach it (remove) then add peerB; fail the remove once.
+	f.failRemove = true
+	if _, err := c.Decrement(p, "peerA"); err == nil {
+		t.Fatalf("expected error from failed remove")
+	}
+
+	// Next Decrement of the non-active survivor retries: removes stale peerA, installs peerB.
+	mustDecrement(t, c, p, "peerB")
+	// peerB had only one ref, so after retry the prefix is fully released.
+	if _, ok := f.installed[p]; ok {
+		t.Fatalf("expected prefix released after self-heal, still on %q", f.installed[p])
+	}
+}
--- a/client/internal/routemanager/refcounter/types.go
+++ b/client/internal/routemanager/refcounter/types.go
@@ -5,5 +5,7 @@ import "net/netip"
 // RouteRefCounter is a Counter for Route, it doesn't take any input on Increment and doesn't use any output on Decrement
 type RouteRefCounter = Counter[netip.Prefix, struct{}, struct{}]

-// AllowedIPsRefCounter is a Counter for AllowedIPs, it takes a peer key on Increment and passes it back to Decrement
-type AllowedIPsRefCounter = Counter[netip.Prefix, string, string]
+// AllowedIPsRefCounter tracks WireGuard AllowedIPs per prefix. Unlike the generic Counter it is peer-aware:
+// a prefix can be claimed by several peers at once and WireGuard allows a given prefix on exactly one peer,
+// so the counter records the per-peer reference count and swaps the installed peer when the active one is released.
+// See allowedips.go.
--- a/client/internal/routemanager/selection.go
+++ b/client/internal/routemanager/selection.go
@@ -0,0 +1,138 @@
+package routemanager
+
+import (
+	"fmt"
+	"slices"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/route"
+)
+
+// SelectRoutes selects the routes with the given network IDs and applies the
+// new selection. V4/v6 exit-node pairs are expanded automatically. Exit nodes
+// are mutually exclusive: if the selection activates an exit node, every other
+// available exit node is deselected so two can't be active at once. With
+// appendRoute=false the previous selection is replaced instead of extended.
+func (m *DefaultManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
+	if err := m.selectRoutes(ids, appendRoute); err != nil {
+		return err
+	}
+	m.TriggerSelection(m.GetClientRoutes())
+	return nil
+}
+
+// DeselectRoutes removes the routes with the given network IDs from the
+// selection and applies the change. V4/v6 exit-node pairs are expanded
+// automatically.
+func (m *DefaultManager) DeselectRoutes(ids []route.NetID) error {
+	if err := m.deselectRoutes(ids); err != nil {
+		return err
+	}
+	m.TriggerSelection(m.GetClientRoutes())
+	return nil
+}
+
+func (m *DefaultManager) deselectRoutes(ids []route.NetID) error {
+	routesMap := m.GetClientRoutesWithNetID()
+	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
+
+	log.Debugf("deselecting routes with ids: %v", routes)
+
+	if err := m.routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
+		return fmt.Errorf("deselect routes: %w", err)
+	}
+
+	return nil
+}
+
+// SelectAllRoutes selects every available route and applies the selection.
+// Exit nodes stay mutually exclusive: at most one remains active.
+func (m *DefaultManager) SelectAllRoutes() {
+	m.selectAllRoutes()
+	m.TriggerSelection(m.GetClientRoutes())
+}
+
+func (m *DefaultManager) selectAllRoutes() {
+	m.routeSelector.SelectAllRoutes()
+
+	// Select-all wipes every explicit selection, so exit nodes fall back to
+	// management's auto-apply flags — which may mark several at once.
+	// Reconcile immediately so at most one exit node stays active instead of
+	// waiting for the next network map to enforce it.
+	m.mux.Lock()
+	defer m.mux.Unlock()
+	m.updateRouteSelectorFromManagement(m.clientRoutes)
+}
+
+// DeselectAllRoutes deselects every route and applies the change.
+func (m *DefaultManager) DeselectAllRoutes() {
+	m.routeSelector.DeselectAllRoutes()
+	m.TriggerSelection(m.GetClientRoutes())
+}
+
+func (m *DefaultManager) selectRoutes(ids []route.NetID, appendRoute bool) error {
+	routesMap := m.GetClientRoutesWithNetID()
+	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
+	allIDs := maps.Keys(routesMap)
+
+	log.Debugf("selecting routes with ids: %v", routes)
+
+	// A partial failure (e.g. an unknown ID in the request) still selects the
+	// valid routes, so exclusivity below must run regardless of the error.
+	var merr *multierror.Error
+	if err := m.routeSelector.SelectRoutes(routes, appendRoute, allIDs); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("select routes: %w", err))
+	}
+
+	// Exit nodes are mutually exclusive: if this selection activates an
+	// exit node, deselect every other available exit node so two can't be
+	// selected at once. Non-exit route selections are left untouched.
+	if requestActivatesExitNode(routes, routesMap) {
+		if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
+			if err := m.routeSelector.DeselectRoutes(others, allIDs); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("deselect sibling exit nodes: %w", err))
+			}
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+func isExitNodeRoutes(routes []*route.Route) bool {
+	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
+}
+
+// requestActivatesExitNode reports whether any requested NetID maps to an exit
+// node (default route) in the current route table.
+func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
+	for _, id := range requested {
+		if isExitNodeRoutes(routesMap[id]) {
+			return true
+		}
+	}
+	return false
+}
+
+// otherExitNodeIDs returns every available exit-node NetID that is not in the
+// requested set — the siblings to deselect so a single exit node stays active.
+func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
+	keep := make(map[route.NetID]struct{}, len(requested))
+	for _, id := range requested {
+		keep[id] = struct{}{}
+	}
+	var others []route.NetID
+	for id, routes := range routesMap {
+		if !isExitNodeRoutes(routes) {
+			continue
+		}
+		if _, ok := keep[id]; ok {
+			continue
+		}
+		others = append(others, id)
+	}
+	return others
+}
--- a/client/internal/routemanager/selection_test.go
+++ b/client/internal/routemanager/selection_test.go
@@ -0,0 +1,129 @@
+package routemanager
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/routeselector"
+	"github.com/netbirdio/netbird/route"
+)
+
+func v6ExitRoute(netID, peer string) *route.Route {
+	return &route.Route{
+		NetID:   route.NetID(netID),
+		Network: netip.MustParsePrefix("::/0"),
+		Peer:    peer,
+	}
+}
+
+func newSelectionTestManager() *DefaultManager {
+	return &DefaultManager{
+		routeSelector: routeselector.NewRouteSelector(),
+		clientRoutes: route.HAMap{
+			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", true)},
+			"exitA-v6|::/0":      {v6ExitRoute("exitA-v6", "p1")},
+			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", true)},
+			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
+		},
+	}
+}
+
+func TestSelectRoutes_ExitNodeExclusivity(t *testing.T) {
+	m := newSelectionTestManager()
+
+	// Selecting an exit node selects its v6 pair and deselects the sibling.
+	require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
+	assert.True(t, m.routeSelector.IsSelected("exitA"), "exitA should be selected")
+	assert.True(t, m.routeSelector.IsSelected("exitA-v6"), "the v6 pair follows its v4 base")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "the sibling exit node must be deselected")
+
+	// Switching to the sibling deselects the previous exit node and its v6 pair.
+	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
+	assert.True(t, m.routeSelector.IsSelected("exitB"), "exitB should now be selected")
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "the previous exit node must be deselected")
+	assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "the previous exit node's v6 pair must be deselected")
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
+
+	// Selecting a non-exit route leaves the active exit node alone.
+	require.NoError(t, m.selectRoutes([]route.NetID{"lan"}, true))
+	assert.True(t, m.routeSelector.IsSelected("exitB"), "selecting a non-exit route keeps the exit node")
+
+	// Deselecting the active exit node turns every exit node off.
+	require.NoError(t, m.deselectRoutes([]route.NetID{"exitB"}))
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "exitB should be deselected")
+	assert.False(t, m.routeSelector.IsSelected("exitA"), "exitA stays deselected")
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
+}
+
+func TestSelectRoutes_PartialErrorStillEnforcesExclusivity(t *testing.T) {
+	// The unknown ID must be reported, but the valid exit node in the same
+	// request is still selected — so its sibling must still be deselected.
+	// Both orderings are covered: processing must continue past the invalid
+	// ID wherever it sits in the request.
+	requests := map[string][]route.NetID{
+		"invalid id first": {"missing", "exitB"},
+		"invalid id last":  {"exitB", "missing"},
+	}
+
+	for name, ids := range requests {
+		t.Run(name, func(t *testing.T) {
+			m := newSelectionTestManager()
+
+			require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
+
+			err := m.selectRoutes(ids, true)
+			assert.Error(t, err, "unknown id must be reported")
+			assert.True(t, m.routeSelector.IsSelected("exitB"), "valid exit node from the request is selected")
+			assert.False(t, m.routeSelector.IsSelected("exitA"), "sibling exit node must be deselected despite the error")
+			assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "sibling's v6 pair must be deselected too")
+		})
+	}
+}
+
+func TestSelectAllRoutes_KeepsSingleExitNode(t *testing.T) {
+	// Both exit nodes are marked for auto-apply by management
+	// (SkipAutoApply=false), the state where select-all could turn on two at
+	// once without the immediate reconciliation.
+	m := &DefaultManager{
+		routeSelector: routeselector.NewRouteSelector(),
+		clientRoutes: route.HAMap{
+			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", false)},
+			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", false)},
+			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
+		},
+	}
+
+	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
+
+	m.selectAllRoutes()
+
+	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit routes are all selected")
+	assert.True(t, m.routeSelector.IsSelected("exitA"), "the deterministic management pick stays active")
+	assert.False(t, m.routeSelector.IsSelected("exitB"), "select-all must not leave a second exit node active")
+}
+
+func TestSelectRoutes_UnknownRoute(t *testing.T) {
+	m := newSelectionTestManager()
+
+	assert.Error(t, m.selectRoutes([]route.NetID{"missing"}, true), "selecting an unavailable route must fail")
+	assert.Error(t, m.deselectRoutes([]route.NetID{"missing"}), "deselecting an unavailable route must fail")
+}
+
+func TestExitNodeSelectionHelpers(t *testing.T) {
+	routesMap := map[route.NetID][]*route.Route{
+		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
+		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
+		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
+	}
+
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
+
+	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
+	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
+}
--- a/client/internal/routemanager/static/route.go
+++ b/client/internal/routemanager/static/route.go
@@ -15,6 +15,11 @@ type Route struct {
 	route                *route.Route
 	routeRefCounter      *refcounter.RouteRefCounter
 	allowedIPsRefcounter *refcounter.AllowedIPsRefCounter
+	// currentPeerKey is the routing peer this watcher currently has the prefix installed on
+	// (the HA winner elected by the watcher). It can differ from route.Peer and change on
+	// failover, so it is recorded on AddAllowedIPs and used on RemoveAllowedIPs to decrement
+	// the exact peer that was incremented.
+	currentPeerKey string
 }

 func NewRoute(params common.HandlerParams) *Route {
@@ -52,12 +57,15 @@ func (r *Route) AddAllowedIPs(peerKey string) error {
 			ref.Out,
 		)
 	}
+	r.currentPeerKey = peerKey
 	return nil
 }

 func (r *Route) RemoveAllowedIPs() error {
-	if _, err := r.allowedIPsRefcounter.Decrement(r.route.Network); err != nil {
-		return err
+	var err error
+	if _, decErr := r.allowedIPsRefcounter.Decrement(r.route.Network, r.currentPeerKey); decErr != nil {
+		err = fmt.Errorf("remove allowed IP %s: %w", r.route.Network, decErr)
 	}
-	return nil
+	r.currentPeerKey = ""
+	return err
 }
--- a/client/internal/routemanager/sysctl/sysctl_linux.go
+++ b/client/internal/routemanager/sysctl/sysctl_linux.go
@@ -20,6 +20,8 @@ const (
 	rpFilterPath          = "net.ipv4.conf.all.rp_filter"
 	rpFilterInterfacePath = "net.ipv4.conf.%s.rp_filter"
 	srcValidMarkPath      = "net.ipv4.conf.all.src_valid_mark"
+	percentEscape         = "%25"
+	dotEscape             = "%2E"
 )

 type iface interface {
@@ -56,7 +58,11 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}

-		i := fmt.Sprintf(rpFilterInterfacePath, intf.Name)
+		// Escape '%' and '.' so they survive the dot-to-slash conversion in Set()
+		safeName := strings.ReplaceAll(intf.Name, "%", percentEscape)
+		safeName = strings.ReplaceAll(safeName, ".", dotEscape)
+
+		i := fmt.Sprintf(rpFilterInterfacePath, safeName)
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -70,7 +76,11 @@ func Setup(wgIface iface) (map[string]int, error) {

 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
-	path := fmt.Sprintf("/proc/sys/%s", strings.ReplaceAll(key, ".", "/"))
+	path := strings.ReplaceAll(key, ".", "/")
+	// Unescape interface dots and percent signs
+	path = strings.ReplaceAll(path, dotEscape, ".")
+	path = strings.ReplaceAll(path, percentEscape, "%")
+	path = fmt.Sprintf("/proc/sys/%s", path)
 	currentValue, err := os.ReadFile(path)
 	if err != nil {
 		return -1, fmt.Errorf("read sysctl %s: %w", key, err)
--- a/client/internal/tunnelnotifier/notifier.go
+++ b/client/internal/tunnelnotifier/notifier.go
@@ -0,0 +1,124 @@
+package tunnelnotifier
+
+import (
+	"container/list"
+	"sync"
+
+	"github.com/netbirdio/netbird/client/internal/dns"
+	"github.com/netbirdio/netbird/client/internal/listener"
+)
+
+type eventKind int
+
+const (
+	eventRoutes eventKind = iota
+	eventIfaceIP
+	eventIfaceIPv6
+	eventDNS
+)
+
+var (
+	_ listener.NetworkChangeListener = (*Notifier)(nil)
+	_ dns.IosDnsManager              = (*Notifier)(nil)
+)
+
+type event struct {
+	kind    eventKind
+	payload string
+}
+
+type Notifier struct {
+	mu     sync.Mutex
+	cond   *sync.Cond
+	queue  *list.List
+	closed bool
+	done   chan struct{}
+
+	listener   listener.NetworkChangeListener
+	dnsManager dns.IosDnsManager
+}
+
+func New(l listener.NetworkChangeListener, dm dns.IosDnsManager) *Notifier {
+	n := &Notifier{
+		queue:      list.New(),
+		done:       make(chan struct{}),
+		listener:   l,
+		dnsManager: dm,
+	}
+	n.cond = sync.NewCond(&n.mu)
+	go n.deliverLoop()
+	return n
+}
+
+func (n *Notifier) OnNetworkChanged(routes string) {
+	n.enqueue(event{kind: eventRoutes, payload: routes})
+}
+
+func (n *Notifier) SetInterfaceIP(ip string) {
+	n.enqueue(event{kind: eventIfaceIP, payload: ip})
+}
+
+func (n *Notifier) SetInterfaceIPv6(ip string) {
+	n.enqueue(event{kind: eventIfaceIPv6, payload: ip})
+}
+
+func (n *Notifier) ApplyDns(config string) {
+	n.enqueue(event{kind: eventDNS, payload: config})
+}
+
+// Close stops accepting new events and blocks until the delivery loop has
+// drained all queued events and exited.
+func (n *Notifier) Close() {
+	n.mu.Lock()
+	n.closed = true
+	n.cond.Signal()
+	n.mu.Unlock()
+	<-n.done
+}
+
+func (n *Notifier) enqueue(ev event) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	if n.closed {
+		return
+	}
+	n.queue.PushBack(ev)
+	n.cond.Signal()
+}
+
+func (n *Notifier) deliverLoop() {
+	defer close(n.done)
+	for {
+		n.mu.Lock()
+		for n.queue.Len() == 0 && !n.closed {
+			n.cond.Wait()
+		}
+		if n.closed && n.queue.Len() == 0 {
+			n.mu.Unlock()
+			return
+		}
+		ev := n.queue.Remove(n.queue.Front()).(event)
+		l := n.listener
+		dm := n.dnsManager
+		n.mu.Unlock()
+
+		switch ev.kind {
+		case eventRoutes:
+			if l != nil {
+				l.OnNetworkChanged(ev.payload)
+			}
+		case eventIfaceIP:
+			if l != nil {
+				l.SetInterfaceIP(ev.payload)
+			}
+		case eventIfaceIPv6:
+			if l != nil {
+				l.SetInterfaceIPv6(ev.payload)
+			}
+		case eventDNS:
+			if dm != nil {
+				dm.ApplyDns(ev.payload)
+			}
+		}
+	}
+}
--- a/client/internal/tunnelnotifier/notifier_test.go
+++ b/client/internal/tunnelnotifier/notifier_test.go
@@ -0,0 +1,192 @@
+package tunnelnotifier
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type call struct {
+	kind    string
+	payload string
+}
+
+type recorder struct {
+	mu       sync.Mutex
+	calls    []call
+	inFlight atomic.Int32
+	overlap  atomic.Bool
+	delay    time.Duration
+}
+
+func (r *recorder) record(kind, payload string) {
+	if r.inFlight.Add(1) != 1 {
+		r.overlap.Store(true)
+	}
+	if r.delay > 0 {
+		time.Sleep(r.delay)
+	}
+	r.mu.Lock()
+	r.calls = append(r.calls, call{kind: kind, payload: payload})
+	r.mu.Unlock()
+	r.inFlight.Add(-1)
+}
+
+func (r *recorder) count() int {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return len(r.calls)
+}
+
+func (r *recorder) snapshot() []call {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	out := make([]call, len(r.calls))
+	copy(out, r.calls)
+	return out
+}
+
+type fakeListener struct {
+	rec *recorder
+}
+
+func (f *fakeListener) OnNetworkChanged(routes string) {
+	f.rec.record("routes", routes)
+}
+
+func (f *fakeListener) SetInterfaceIP(ip string) {
+	f.rec.record("ip", ip)
+}
+
+func (f *fakeListener) SetInterfaceIPv6(ip string) {
+	f.rec.record("ipv6", ip)
+}
+
+type fakeDNSManager struct {
+	rec *recorder
+}
+
+func (f *fakeDNSManager) ApplyDns(config string) {
+	f.rec.record("dns", config)
+}
+
+func TestFIFOOrder(t *testing.T) {
+	rec := &recorder{}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+	defer n.Close()
+
+	n.SetInterfaceIP("10.0.0.1")
+	n.SetInterfaceIPv6("fd00::1")
+	n.ApplyDns(`{"domains":[]}`)
+	n.OnNetworkChanged("10.0.0.0/8,192.168.0.0/16")
+	n.ApplyDns(`{"domains":["example.com"]}`)
+
+	require.Eventually(t, func() bool { return rec.count() == 5 }, time.Second, time.Millisecond)
+
+	expected := []call{
+		{kind: "ip", payload: "10.0.0.1"},
+		{kind: "ipv6", payload: "fd00::1"},
+		{kind: "dns", payload: `{"domains":[]}`},
+		{kind: "routes", payload: "10.0.0.0/8,192.168.0.0/16"},
+		{kind: "dns", payload: `{"domains":["example.com"]}`},
+	}
+	assert.Equal(t, expected, rec.snapshot())
+}
+
+func TestNoOverlappingCalls(t *testing.T) {
+	rec := &recorder{delay: 100 * time.Microsecond}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+	defer n.Close()
+
+	const producers = 8
+	const perProducer = 25
+
+	var wg sync.WaitGroup
+	for i := 0; i < producers; i++ {
+		wg.Add(1)
+		go func(id int) {
+			defer wg.Done()
+			for j := 0; j < perProducer; j++ {
+				payload := fmt.Sprintf("%d-%d", id, j)
+				switch j % 4 {
+				case 0:
+					n.OnNetworkChanged(payload)
+				case 1:
+					n.SetInterfaceIP(payload)
+				case 2:
+					n.SetInterfaceIPv6(payload)
+				case 3:
+					n.ApplyDns(payload)
+				}
+			}
+		}(i)
+	}
+	wg.Wait()
+
+	require.Eventually(t, func() bool { return rec.count() == producers*perProducer }, 5*time.Second, time.Millisecond)
+	assert.False(t, rec.overlap.Load())
+}
+
+func TestDNSAndRoutesInterleaved(t *testing.T) {
+	rec := &recorder{delay: 100 * time.Microsecond}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+	defer n.Close()
+
+	const events = 50
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+	go func() {
+		defer wg.Done()
+		for i := 0; i < events; i++ {
+			n.ApplyDns(fmt.Sprintf("dns-%d", i))
+		}
+	}()
+	go func() {
+		defer wg.Done()
+		for i := 0; i < events; i++ {
+			n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
+		}
+	}()
+	wg.Wait()
+
+	require.Eventually(t, func() bool { return rec.count() == 2*events }, 5*time.Second, time.Millisecond)
+	assert.False(t, rec.overlap.Load())
+
+	var dnsSeen, routesSeen int
+	for _, c := range rec.snapshot() {
+		switch c.kind {
+		case "dns":
+			assert.Equal(t, fmt.Sprintf("dns-%d", dnsSeen), c.payload)
+			dnsSeen++
+		case "routes":
+			assert.Equal(t, fmt.Sprintf("routes-%d", routesSeen), c.payload)
+			routesSeen++
+		}
+	}
+	assert.Equal(t, events, dnsSeen)
+	assert.Equal(t, events, routesSeen)
+}
+
+func TestCloseDrainsQueue(t *testing.T) {
+	rec := &recorder{delay: time.Millisecond}
+	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
+
+	const events = 20
+	for i := 0; i < events; i++ {
+		n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
+	}
+	n.Close()
+
+	require.Equal(t, events, rec.count(), "Close must not return before all queued events are delivered")
+
+	n.OnNetworkChanged("after-close")
+	n.ApplyDns("after-close")
+	time.Sleep(50 * time.Millisecond)
+	assert.Equal(t, events, rec.count())
+}
--- a/client/ios/NetBirdSDK/client.go
+++ b/client/ios/NetBirdSDK/client.go
@@ -13,7 +13,6 @@ import (
 	"time"

 	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"

 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
@@ -637,23 +636,18 @@ func (c *Client) SelectRoute(id string) error {
 	}

 	routeManager := engine.GetRouteManager()
-	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("select all routes")
-		routeSelector.SelectAllRoutes()
-	} else {
-		log.Debugf("select route with id: %s", id)
-		routes := toNetIDs([]string{id})
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		if err := routeSelector.SelectRoutes(routes, true, maps.Keys(routesMap)); err != nil {
-			log.Debugf("error when selecting routes: %s", err)
-			return fmt.Errorf("select routes: %w", err)
-		}
+		routeManager.SelectAllRoutes()
+		return nil
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())
-	return nil

+	log.Debugf("select route with id: %s", id)
+	if err := routeManager.SelectRoutes(toNetIDs([]string{id}), true); err != nil {
+		log.Debugf("error when selecting routes: %s", err)
+		return err
+	}
+	return nil
 }

 func (c *Client) DeselectRoute(id string) error {
@@ -667,21 +661,17 @@ func (c *Client) DeselectRoute(id string) error {
 	}

 	routeManager := engine.GetRouteManager()
-	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("deselect all routes")
-		routeSelector.DeselectAllRoutes()
-	} else {
-		log.Debugf("deselect route with id: %s", id)
-		routes := toNetIDs([]string{id})
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		if err := routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
-			log.Debugf("error when deselecting routes: %s", err)
-			return fmt.Errorf("deselect routes: %w", err)
-		}
+		routeManager.DeselectAllRoutes()
+		return nil
+	}
+
+	log.Debugf("deselect route with id: %s", id)
+	if err := routeManager.DeselectRoutes(toNetIDs([]string{id})); err != nil {
+		log.Debugf("error when deselecting routes: %s", err)
+		return err
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 	return nil
 }

--- a/client/server/network.go
+++ b/client/server/network.go
@@ -8,7 +8,6 @@ import (
 	"sort"
 	"strings"

-	"golang.org/x/exp/maps"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"

@@ -161,30 +160,11 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		return nil, fmt.Errorf("no route manager")
 	}

-	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeSelector.SelectAllRoutes()
-	} else {
-		routes := toNetIDs(req.GetNetworkIDs())
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		netIdRoutes := maps.Keys(routesMap)
-		if err := routeSelector.SelectRoutes(routes, req.GetAppend(), netIdRoutes); err != nil {
-			return nil, fmt.Errorf("select routes: %w", err)
-		}
-
-		// Exit nodes are mutually exclusive: if this selection activates an
-		// exit node, deselect every other available exit node so two can't be
-		// selected at once. Non-exit route selections are left untouched.
-		if requestActivatesExitNode(routes, routesMap) {
-			if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
-				if err := routeSelector.DeselectRoutes(others, netIdRoutes); err != nil {
-					return nil, fmt.Errorf("deselect sibling exit nodes: %w", err)
-				}
-			}
-		}
+		routeManager.SelectAllRoutes()
+	} else if err := routeManager.SelectRoutes(toNetIDs(req.GetNetworkIDs()), req.GetAppend()); err != nil {
+		return nil, err
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())

 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -224,19 +204,11 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		return nil, fmt.Errorf("no route manager")
 	}

-	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeSelector.DeselectAllRoutes()
-	} else {
-		routes := toNetIDs(req.GetNetworkIDs())
-		routesMap := routeManager.GetClientRoutesWithNetID()
-		routes = route.ExpandV6ExitPairs(routes, routesMap)
-		netIdRoutes := maps.Keys(routesMap)
-		if err := routeSelector.DeselectRoutes(routes, netIdRoutes); err != nil {
-			return nil, fmt.Errorf("deselect routes: %w", err)
-		}
+		routeManager.DeselectAllRoutes()
+	} else if err := routeManager.DeselectRoutes(toNetIDs(req.GetNetworkIDs())); err != nil {
+		return nil, err
 	}
-	routeManager.TriggerSelection(routeManager.GetClientRoutes())

 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -261,37 +233,3 @@ func toNetIDs(routes []string) []route.NetID {
 	return netIDs
 }

-func isExitNodeRoutes(routes []*route.Route) bool {
-	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
-}
-
-// requestActivatesExitNode reports whether any requested NetID maps to an exit
-// node (default route) in the current route table.
-func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
-	for _, id := range requested {
-		if isExitNodeRoutes(routesMap[id]) {
-			return true
-		}
-	}
-	return false
-}
-
-// otherExitNodeIDs returns every available exit-node NetID that is not in the
-// requested set — the siblings to deselect so a single exit node stays active.
-func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
-	keep := make(map[route.NetID]struct{}, len(requested))
-	for _, id := range requested {
-		keep[id] = struct{}{}
-	}
-	var others []route.NetID
-	for id, routes := range routesMap {
-		if !isExitNodeRoutes(routes) {
-			continue
-		}
-		if _, ok := keep[id]; ok {
-			continue
-		}
-		others = append(others, id)
-	}
-	return others
-}
--- a/client/server/network_exitnode_test.go
+++ b/client/server/network_exitnode_test.go
@@ -1,26 +0,0 @@
-package server
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/netbirdio/netbird/route"
-)
-
-func TestExitNodeSelectionHelpers(t *testing.T) {
-	routesMap := map[route.NetID][]*route.Route{
-		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
-		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
-		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
-	}
-
-	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
-	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
-	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
-	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
-
-	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
-	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
-}
--- a/client/ssh/server/command_execution_windows.go
+++ b/client/ssh/server/command_execution_windows.go
@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi

 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}

-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)

 	req := PtyExecutionRequest{
--- a/client/ssh/server/privileges_other.go
+++ b/client/ssh/server/privileges_other.go
@@ -0,0 +1,15 @@
+//go:build !windows
+
+package server
+
+// isProcessElevated is only meaningful on Windows; other platforms use the
+// effective UID check in isCurrentProcessPrivileged.
+func isProcessElevated() bool {
+	return false
+}
+
+// isWindowsAccountPrivileged is only reachable on Windows. Fail closed if it
+// is ever called on another platform.
+func isWindowsAccountPrivileged(string) bool {
+	return true
+}
--- a/client/ssh/server/privileges_windows.go
+++ b/client/ssh/server/privileges_windows.go
@@ -0,0 +1,223 @@
+//go:build windows
+
+package server
+
+import (
+	"fmt"
+	"strings"
+	"unsafe"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
+	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
+)
+
+const (
+	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
+	// the user belongs to through a global group.
+	lgIncludeIndirect  = 0x1
+	maxPreferredLength = 0xFFFFFFFF
+)
+
+// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
+type localGroupUsersInfo0 struct {
+	name *uint16
+}
+
+// isProcessElevated reports whether the current process token is elevated
+// (TokenElevation): true for elevated administrators, the built-in
+// Administrator, administrators with UAC disabled, and SYSTEM; false for
+// standard users and administrators running with a UAC-filtered token.
+func isProcessElevated() bool {
+	return windows.GetCurrentProcessToken().IsElevated()
+}
+
+// isWindowsAccountPrivileged reports whether the account is privileged on this
+// machine: a well-known service account, a built-in Administrator (RID 500),
+// or a member of the local Administrators group, directly or through nested
+// groups. Evaluation errors count as privileged so policy checks fail closed.
+func isWindowsAccountPrivileged(username string) bool {
+	sid, _, _, err := windows.LookupSID("", username)
+	if err != nil {
+		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
+		return true
+	}
+
+	if isPrivilegedUserSID(sid) {
+		return true
+	}
+
+	member, err := isLocalAdminsMember(username)
+	if err != nil {
+		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
+		return true
+	}
+	return member
+}
+
+// isPrivilegedUserSID reports whether the SID itself identifies a privileged
+// principal, without consulting group membership.
+func isPrivilegedUserSID(sid *windows.SID) bool {
+	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
+		windows.WinLocalSystemSid,
+		windows.WinLocalServiceSid,
+		windows.WinNetworkServiceSid,
+		windows.WinBuiltinAdministratorsSid,
+	}
+	for _, sidType := range wellKnown {
+		if sid.IsWellKnown(sidType) {
+			return true
+		}
+	}
+	return isBuiltinAdministratorSID(sid)
+}
+
+// isBuiltinAdministratorSID reports whether the SID is a machine or domain
+// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
+// that account; it can be renamed but cannot be removed from the
+// Administrators group.
+func isBuiltinAdministratorSID(sid *windows.SID) bool {
+	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
+		return false
+	}
+	count := sid.SubAuthorityCount()
+	if count < 2 || sid.SubAuthority(0) != 21 {
+		return false
+	}
+	return sid.SubAuthority(uint32(count-1)) == 500
+}
+
+// isLocalAdminsMember reports whether the account is a member of the local
+// Administrators group.
+//
+// Local accounts are checked against the local SAM, which is authoritative for
+// them and, unlike a token, cannot under-report: UAC filters the tokens of
+// local administrators, and a filtered token carries Administrators as
+// deny-only, which a membership check on the token would read as "not a
+// member". Domain accounts are exempt from that filtering, so for them an S4U
+// token is preferred because its group list is LSA's transitive expansion and
+// therefore covers nested and universal groups plus the machine's own local
+// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
+// logon, so it serves as the fallback when no token can be obtained.
+func isLocalAdminsMember(username string) (bool, error) {
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	if err != nil {
+		return false, fmt.Errorf("create Administrators SID: %w", err)
+	}
+
+	account, domain := parseUsername(username)
+	if NewPrivilegeDropper().isLocalUser(domain) {
+		return localGroupsContainSID(account, adminSid)
+	}
+
+	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
+	if s4uErr == nil {
+		return member, nil
+	}
+	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
+
+	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
+	if err != nil {
+		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
+	}
+	return member, nil
+}
+
+// s4uTokenIsMember obtains an S4U token for the account and checks whether the
+// given SID is enabled in it.
+func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
+	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
+	if err != nil {
+		return false, err
+	}
+	defer func() {
+		if err := windows.CloseHandle(token); err != nil {
+			log.Debugf("close S4U token: %v", err)
+		}
+	}()
+	return windows.Token(token).IsMember(sid)
+}
+
+// localGroupsContainSID reports whether the wanted group is among the local
+// groups the account belongs to, directly or through a global group.
+//
+// The wanted SID is resolved to its group name once and compared against the
+// enumerated names. Well-known SIDs resolve from a static table, so that lookup
+// needs no domain controller, and it keeps the comparison correct for a renamed
+// or localized group because both sides then carry the new name. Resolving each
+// enumerated name back to a SID instead would add a lookup per group that can
+// block until it times out while a domain controller is unreachable, and cannot
+// change the outcome: the names enumerated here are local groups of this
+// machine, whose names are unique, so a name match identifies the group.
+//
+// A failure to resolve the wanted SID is returned rather than reported as
+// "not a member", so a privilege check built on this fails closed.
+func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
+	wantName, _, _, err := want.LookupAccount("")
+	if err != nil {
+		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
+	}
+
+	groups, err := netUserGetLocalGroups(username)
+	if err != nil {
+		return false, err
+	}
+
+	for _, group := range groups {
+		if strings.EqualFold(group, wantName) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// netUserGetLocalGroups returns the names of the local groups the account is a
+// member of, including indirect membership through global groups.
+func netUserGetLocalGroups(username string) ([]string, error) {
+	name16, err := windows.UTF16PtrFromString(username)
+	if err != nil {
+		return nil, fmt.Errorf("convert username: %w", err)
+	}
+
+	var buf *byte
+	var entriesRead, totalEntries uint32
+	status, _, _ := procNetUserGetLocalGroups.Call(
+		0, // local server
+		uintptr(unsafe.Pointer(name16)),
+		0, // level 0: LOCALGROUP_USERS_INFO_0
+		lgIncludeIndirect,
+		uintptr(unsafe.Pointer(&buf)),
+		maxPreferredLength,
+		uintptr(unsafe.Pointer(&entriesRead)),
+		uintptr(unsafe.Pointer(&totalEntries)),
+	)
+	if status != 0 {
+		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
+	}
+	if buf == nil {
+		return nil, nil
+	}
+	defer func() {
+		if err := windows.NetApiBufferFree(buf); err != nil {
+			log.Debugf("free NetApi buffer: %v", err)
+		}
+	}()
+
+	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
+	// short read is not expected. Report it rather than silently returning a
+	// subset of the account's groups.
+	if entriesRead != totalEntries {
+		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
+	}
+
+	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
+	groups := make([]string, 0, entriesRead)
+	for _, entry := range entries {
+		groups = append(groups, windows.UTF16PtrToString(entry.name))
+	}
+	return groups, nil
+}
--- a/client/ssh/server/privileges_windows_test.go
+++ b/client/ssh/server/privileges_windows_test.go
@@ -0,0 +1,293 @@
+//go:build windows
+
+package server
+
+import (
+	"os/user"
+	"testing"
+	"unsafe"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sys/windows"
+)
+
+// filterNormalAccount limits NetUserEnum to normal user accounts.
+const filterNormalAccount = 0x2
+
+// TOKEN_ELEVATION_TYPE values.
+const (
+	tokenElevationTypeDefault = 1
+	tokenElevationTypeFull    = 2
+	tokenElevationTypeLimited = 3
+)
+
+// tokenElevationType reads TokenElevationType from a token.
+func tokenElevationType(token windows.Token) (uint32, error) {
+	var elevationType, returnedLen uint32
+	err := windows.GetTokenInformation(token, windows.TokenElevationType,
+		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
+	if err != nil {
+		return 0, err
+	}
+	return elevationType, nil
+}
+
+// userInfo0 mirrors USER_INFO_0.
+type userInfo0 struct {
+	name *uint16
+}
+
+func mustParseSID(t *testing.T, s string) *windows.SID {
+	t.Helper()
+	sid, err := windows.StringToSid(s)
+	require.NoError(t, err, "parse SID %s", s)
+	return sid
+}
+
+// localAccountNames returns the names of the local user accounts.
+func localAccountNames(t *testing.T) []string {
+	t.Helper()
+
+	var buf *byte
+	var entriesRead, totalEntries, resume uint32
+	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
+		&entriesRead, &totalEntries, &resume)
+	require.NoError(t, err, "enumerate local users")
+	t.Cleanup(func() {
+		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
+	})
+
+	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
+	names := make([]string, 0, entriesRead)
+	for _, entry := range entries {
+		names = append(names, windows.UTF16PtrToString(entry.name))
+	}
+	return names
+}
+
+// localAccountNameByRID returns the name of the local account carrying the
+// given RID. Accounts such as Administrator and Guest can be renamed and are
+// localized, so tests must not name them literally.
+func localAccountNameByRID(t *testing.T, rid uint32) string {
+	t.Helper()
+
+	for _, name := range localAccountNames(t) {
+		sid, _, _, err := windows.LookupSID("", name)
+		if err != nil {
+			continue
+		}
+		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
+			continue
+		}
+		count := sid.SubAuthorityCount()
+		if count < 2 || sid.SubAuthority(0) != 21 {
+			continue
+		}
+		if sid.SubAuthority(uint32(count-1)) == rid {
+			return name
+		}
+	}
+
+	t.Fatalf("no local account with RID %d", rid)
+	return ""
+}
+
+// wellKnownAccountName resolves a well-known SID to the qualified account name
+// the local system uses for it, which is localized.
+func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
+	t.Helper()
+
+	sid, err := windows.CreateWellKnownSid(sidType)
+	require.NoError(t, err, "create well-known SID")
+	name, domain, _, err := sid.LookupAccount("")
+	require.NoError(t, err, "resolve %s to an account name", sid)
+	if domain == "" {
+		return name
+	}
+	return domain + `\` + name
+}
+
+func TestIsBuiltinAdministratorSID(t *testing.T) {
+	tests := []struct {
+		name string
+		sid  string
+		want bool
+	}{
+		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
+		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
+		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
+		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
+		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
+		{"system", "S-1-5-18", false},
+		{"administrators_group", "S-1-5-32-544", false},
+		{"non_nt_authority", "S-1-1-0", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
+			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
+		})
+	}
+}
+
+func TestIsPrivilegedUserSID(t *testing.T) {
+	tests := []struct {
+		name string
+		sid  string
+		want bool
+	}{
+		{"local_system", "S-1-5-18", true},
+		{"local_service", "S-1-5-19", true},
+		{"network_service", "S-1-5-20", true},
+		{"administrators_group", "S-1-5-32-544", true},
+		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
+		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
+		{"users_group", "S-1-5-32-545", false},
+		{"everyone", "S-1-1-0", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
+			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
+		})
+	}
+}
+
+func TestIsWindowsAccountPrivileged(t *testing.T) {
+	tests := []struct {
+		name     string
+		username string
+		want     bool
+	}{
+		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
+		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
+		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
+		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
+		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
+		// exist on every Windows installation, though they may be disabled.
+		{"builtin_administrator", localAccountNameByRID(t, 500), true},
+		{"guest", localAccountNameByRID(t, 501), false},
+		// Unresolvable accounts fail closed.
+		{"nonexistent_user", "netbird-no-such-user", true},
+		{"empty_username", "", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsAccountPrivileged(tt.username)
+			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
+		})
+	}
+}
+
+func TestIsProcessElevated(t *testing.T) {
+	elevated := isProcessElevated()
+
+	// TokenElevationType is a second, independent view of the same token:
+	// Full means elevated and Limited means a filtered administrator, while
+	// Default covers both a standard user and an administrator with no linked
+	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
+	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
+	require.NoError(t, err, "read token elevation type")
+
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
+	// counts only enabled SIDs, so a filtered administrator reports false here.
+	member, err := windows.Token(0).IsMember(adminSid)
+	require.NoError(t, err, "check own Administrators membership")
+
+	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
+
+	switch elevationType {
+	case tokenElevationTypeFull:
+		assert.True(t, elevated, "a token of elevation type Full must report elevated")
+	case tokenElevationTypeLimited:
+		assert.False(t, elevated, "a filtered administrator token must not report elevated")
+	}
+
+	// Administrators enabled in the token means the token wields administrative
+	// rights, which is what elevation reports.
+	if member {
+		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
+	}
+}
+
+// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
+// for domain accounts. S4U logons need the TCB privilege, so the test runs
+// only as SYSTEM (which is how CI executes the suite). For local accounts the
+// token's Administrators membership must agree with the SAM enumeration.
+func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
+	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
+	require.NoError(t, err, "create SYSTEM SID")
+	current, err := user.Current()
+	require.NoError(t, err, "get current user")
+	if current.Uid != system.String() {
+		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
+	}
+
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	checked := 0
+	for _, name := range localAccountNames(t) {
+		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
+		if err != nil {
+			// Disabled or logon-restricted accounts cannot get an S4U logon.
+			t.Logf("skipping %s: %v", name, err)
+			continue
+		}
+		viaSAM, err := localGroupsContainSID(name, adminSid)
+		require.NoError(t, err, "enumerate local groups for %s", name)
+
+		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
+		checked++
+	}
+	// Ineligible accounts are skipped, so without this the test could report
+	// success while comparing nothing at all.
+	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
+	t.Logf("checked %d local accounts via S4U", checked)
+}
+
+// TestLocalGroupsContainSID_Administrator checks the positive case against the
+// built-in Administrator, a member of Administrators on every installation.
+func TestLocalGroupsContainSID_Administrator(t *testing.T) {
+	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	administrator := localAccountNameByRID(t, 500)
+	member, err := localGroupsContainSID(administrator, adminSid)
+	require.NoError(t, err, "enumerate local groups for %s", administrator)
+	assert.True(t, member, "%s is a member of the Administrators group", administrator)
+}
+
+// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
+// that resolves to no group: the error must surface rather than being reported
+// as "not a member", so the privilege check treats the account as privileged.
+func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
+	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
+
+	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
+	require.Error(t, err, "must report an error when the wanted group cannot be identified")
+}
+
+func TestLocalGroupsContainSID_Guest(t *testing.T) {
+	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
+	require.NoError(t, err, "create Guests SID")
+	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
+	require.NoError(t, err, "create Administrators SID")
+
+	guest := localAccountNameByRID(t, 501)
+
+	inGuests, err := localGroupsContainSID(guest, guestsSid)
+	require.NoError(t, err, "enumerate local groups for %s", guest)
+	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
+
+	inAdmins, err := localGroupsContainSID(guest, adminsSid)
+	require.NoError(t, err, "enumerate local groups for %s", guest)
+	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
+}
--- a/client/ssh/server/server_config_test.go
+++ b/client/ssh/server/server_config_test.go
@@ -420,6 +420,13 @@ func TestServer_PortConflictHandling(t *testing.T) {

 func TestServer_IsPrivilegedUser(t *testing.T) {

+	// Windows classification depends on account SIDs and group membership, and
+	// the accounts involved carry localized, renameable names. It is covered by
+	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
+	if runtime.GOOS == "windows" {
+		t.Skip("covered by TestIsWindowsAccountPrivileged")
+	}
+
 	tests := []struct {
 		username    string
 		expected    bool
@@ -440,39 +447,11 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-	}
-
-	// Add Windows-specific tests
-	if runtime.GOOS == "windows" {
-		tests = append(tests, []struct {
-			username    string
-			expected    bool
-			description string
-		}{
-			{
-				username:    "Administrator",
-				expected:    true,
-				description: "Administrator should be considered privileged on Windows",
-			},
-			{
-				username:    "administrator",
-				expected:    true,
-				description: "administrator should be considered privileged on Windows (case insensitive)",
-			},
-		}...)
-	} else {
-		// On non-Windows systems, Administrator should not be privileged
-		tests = append(tests, []struct {
-			username    string
-			expected    bool
-			description string
-		}{
-			{
-				username:    "Administrator",
-				expected:    false,
-				description: "Administrator should not be privileged on non-Windows systems",
-			},
-		}...)
+		{
+			username:    "Administrator",
+			expected:    false,
+			description: "Administrator should not be privileged on non-Windows systems",
+		},
 	}

 	for _, tt := range tests {
--- a/client/ssh/server/sftp_windows.go
+++ b/client/ssh/server/sftp_windows.go
@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := s.parseUsername(targetUser.Username)
+	username, domain := parseUsername(targetUser.Username)

 	netbirdPath, err := os.Executable()
 	if err != nil {
--- a/client/ssh/server/user_utils.go
+++ b/client/ssh/server/user_utils.go
@@ -16,11 +16,6 @@ var (
 	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
 )

-// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
-func isPlatformUnix() bool {
-	return getCurrentOS() != "windows"
-}
-
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
 	getCurrentUser         = currentUserWithGetent
@@ -29,6 +24,9 @@ var (
 	getIsProcessPrivileged = isCurrentProcessPrivileged

 	getEuid = os.Geteuid
+
+	getProcessElevated          = isProcessElevated
+	getWindowsAccountPrivileged = isWindowsAccountPrivileged
 )

 const (
@@ -65,6 +63,13 @@ type PrivilegeCheckResult struct {
 	RequiresUserSwitching bool
 }

+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
 // CheckPrivileges performs comprehensive privilege checking for all SSH features.
 // This is the single source of truth for privilege decisions across the SSH server.
 func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
@@ -175,6 +180,42 @@ func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, err
 	return u, nil
 }

+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result, err := s.userPrivilegeCheck(username)
+	if err != nil {
+		return nil, err
+	}
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
 // isSameResolvedUser compares two resolved user identities
 func isSameResolvedUser(user1, user2 *user.User) bool {
 	if user1 == nil || user2 == nil {
@@ -183,13 +224,6 @@ func isSameResolvedUser(user1, user2 *user.User) bool {
 	return user1.Uid == user2.Uid
 }

-// privilegeCheckContext holds all context needed for privilege checking
-type privilegeCheckContext struct {
-	currentUser           *user.User
-	currentUserPrivileged bool
-	allowRoot             bool
-}
-
 // isSameUser checks if two usernames refer to the same user
 // SECURITY: This function must be conservative - it should only return true
 // when we're certain both usernames refer to the exact same user identity
@@ -253,159 +287,24 @@ func isWindowsSameUser(requestedUsername, currentUsername string) bool {
 	return strings.EqualFold(reqDomain, curDomain)
 }

-// SetAllowRootLogin configures root login access
-func (s *Server) SetAllowRootLogin(allow bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.allowRootLogin = allow
-}
-
-// userNameLookup performs user lookup with root login permission check
-func (s *Server) userNameLookup(username string) (*user.User, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return nil, result.Error
-	}
-
-	return result.User, nil
-}
-
-// userPrivilegeCheck performs user lookup with full privilege check result
-func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return result, result.Error
-	}
-
-	return result, nil
-}
-
 // isPrivilegedUsername checks if the given username represents a privileged user across platforms.
-// On Unix: root
-// On Windows: Administrator, SYSTEM (case-insensitive)
-// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
+// On Unix: root.
+// On Windows: well-known service accounts, built-in Administrator accounts,
+// and members of the local Administrators group; handles domain-qualified
+// usernames like "DOMAIN\user" or "user@domain.com".
 func isPrivilegedUsername(username string) bool {
 	if getCurrentOS() != "windows" {
 		return username == "root"
 	}
-
-	bareUsername := username
-	// Handle Windows domain format: DOMAIN\username
-	if idx := strings.LastIndex(username, `\`); idx != -1 {
-		bareUsername = username[idx+1:]
-	}
-	// Handle email-style format: username@domain.com
-	if idx := strings.Index(bareUsername, "@"); idx != -1 {
-		bareUsername = bareUsername[:idx]
-	}
-
-	return isWindowsPrivilegedUser(bareUsername)
-}
-
-// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
-func isWindowsPrivilegedUser(bareUsername string) bool {
-	// common privileged usernames (case insensitive)
-	privilegedNames := []string{
-		"administrator",
-		"admin",
-		"root",
-		"system",
-		"localsystem",
-		"networkservice",
-		"localservice",
-	}
-
-	usernameLower := strings.ToLower(bareUsername)
-	for _, privilegedName := range privilegedNames {
-		if usernameLower == privilegedName {
-			return true
-		}
-	}
-
-	// computer accounts (ending with $) are not privileged by themselves
-	// They only gain privileges through group membership or specific SIDs
-
-	if targetUser, err := lookupUser(bareUsername); err == nil {
-		return isWindowsPrivilegedSID(targetUser.Uid)
-	}
-
-	return false
-}
-
-// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
-func isWindowsPrivilegedSID(sid string) bool {
-	privilegedSIDs := []string{
-		"S-1-5-18",     // Local System (SYSTEM)
-		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
-		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
-		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
-		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
-	}
-
-	for _, privilegedSID := range privilegedSIDs {
-		if sid == privilegedSID {
-			return true
-		}
-	}
-
-	// Check for domain administrator accounts (RID 500 in any domain)
-	// Format: S-1-5-21-domain-domain-domain-500
-	// This is reliable as RID 500 is reserved for the domain Administrator account
-	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
-		return true
-	}
-
-	// Check for other well-known privileged RIDs in domain contexts
-	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
-	if strings.HasPrefix(sid, "S-1-5-21-") {
-		if strings.HasSuffix(sid, "-512") || // Domain Admins group
-			strings.HasSuffix(sid, "-516") || // Domain Controllers group
-			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
-			return true
-		}
-	}
-
-	return false
+	return getWindowsAccountPrivileged(username)
 }

 // isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
 // On Unix systems, this means running as root (UID 0).
-// On Windows, this means running as Administrator or SYSTEM.
+// On Windows, this means the process token is elevated (administrators, SYSTEM).
 func isCurrentProcessPrivileged() bool {
 	if getCurrentOS() == "windows" {
-		return isWindowsElevated()
+		return getProcessElevated()
 	}
 	return getEuid() == 0
 }
-
-// isWindowsElevated checks if the current process is running with elevated privileges on Windows
-func isWindowsElevated() bool {
-	currentUser, err := getCurrentUser()
-	if err != nil {
-		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
-		return false
-	}
-
-	if isWindowsPrivilegedSID(currentUser.Uid) {
-		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
-		return true
-	}
-
-	if isPrivilegedUsername(currentUser.Username) {
-		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
-		return true
-	}
-
-	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
-	return false
-}
--- a/client/ssh/server/user_utils_test.go
+++ b/client/ssh/server/user_utils_test.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"os/user"
 	"runtime"
+	"strings"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -27,8 +28,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 	originalLookupUser := lookupUser
 	originalGetCurrentOS := getCurrentOS
 	originalGetEuid := getEuid
-
-	// Reset caches to ensure clean test state
+	originalGetProcessElevated := getProcessElevated
+	originalGetWindowsAccountPrivileged := getWindowsAccountPrivileged

 	// Set test values - inject platform dependencies
 	getCurrentUser = func() (*user.User, error) {
@@ -53,16 +54,31 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		return euid
 	}

-	// Mock privilege detection based on the test user
-	getIsProcessPrivileged = func() bool {
+	// Simulate the Windows token elevation check based on the fixture user:
+	// the built-in Administrator (RID 500) and SYSTEM run elevated.
+	getProcessElevated = func() bool {
 		if currentUser == nil {
 			return false
 		}
-		// Check both username and SID for Windows systems
-		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
+		return currentUser.Uid == "S-1-5-18" || strings.HasSuffix(currentUser.Uid, "-500")
+	}
+
+	// Simulate the Windows account classifier for the fixture accounts.
+	// "root" does not exist on Windows; the real classifier fails closed on
+	// unresolvable accounts, so it counts as privileged here too.
+	getWindowsAccountPrivileged = func(username string) bool {
+		bare := username
+		if idx := strings.LastIndex(bare, `\`); idx != -1 {
+			bare = bare[idx+1:]
+		}
+		if idx := strings.Index(bare, "@"); idx != -1 {
+			bare = bare[:idx]
+		}
+		switch strings.ToLower(bare) {
+		case "administrator", "system", "root":
 			return true
 		}
-		return isPrivilegedUsername(currentUser.Username)
+		return false
 	}

 	// Return cleanup function
@@ -71,10 +87,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		lookupUser = originalLookupUser
 		getCurrentOS = originalGetCurrentOS
 		getEuid = originalGetEuid
-
-		getIsProcessPrivileged = isCurrentProcessPrivileged
-
-		// Reset caches after test
+		getProcessElevated = originalGetProcessElevated
+		getWindowsAccountPrivileged = originalGetWindowsAccountPrivileged
 	}
 }

@@ -421,6 +435,9 @@ func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
 }

 func TestPrivilegedUsernameDetection(t *testing.T) {
+	// Windows classification is syscall-backed (SID resolution, group
+	// membership) and is covered by privileges_windows_test.go; here only the
+	// Unix logic and the platform dispatch are exercised.
 	tests := []struct {
 		name       string
 		username   string
@@ -432,25 +449,9 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 		{"unix_regular_user", "alice", "linux", false},
 		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive

-		// Windows tests
+		// Windows dispatch to the (mocked) account classifier
 		{"windows_administrator", "Administrator", "windows", true},
-		{"windows_system", "SYSTEM", "windows", true},
-		{"windows_admin", "admin", "windows", true},
-		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
-		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
-		{"windows_email_admin", "admin@domain.com", "windows", true},
 		{"windows_regular_user", "alice", "windows", false},
-		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
-		{"windows_localsystem", "localsystem", "windows", true},
-		{"windows_networkservice", "networkservice", "windows", true},
-		{"windows_localservice", "localservice", "windows", true},
-
-		// Computer accounts (these depend on current user context in real implementation)
-		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
-		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
-
-		// Cross-platform
-		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
 	}

 	for _, tt := range tests {
@@ -460,49 +461,7 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 			defer cleanup()

 			result := isPrivilegedUsername(tt.username)
-			assert.Equal(t, tt.privileged, result)
-		})
-	}
-}
-
-func TestWindowsPrivilegedSIDDetection(t *testing.T) {
-	tests := []struct {
-		name        string
-		sid         string
-		privileged  bool
-		description string
-	}{
-		// Well-known system accounts
-		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
-		{"local_service", "S-1-5-19", true, "Local Service"},
-		{"network_service", "S-1-5-20", true, "Network Service"},
-		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
-		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
-
-		// Domain accounts
-		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
-		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
-		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
-		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
-
-		// Regular users
-		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
-		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
-		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
-
-		// Groups that are not privileged
-		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
-		{"power_users", "S-1-5-32-547", false, "Power Users group"},
-
-		// Invalid SIDs
-		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
-		{"empty_sid", "", false, "Empty SID"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsPrivilegedSID(tt.sid)
-			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
+			assert.Equal(t, tt.privileged, result, "privilege classification for %s on %s", tt.username, tt.platform)
 		})
 	}
 }
--- a/client/ssh/server/userswitching_windows.go
+++ b/client/ssh/server/userswitching_windows.go
@@ -91,7 +91,7 @@ func validateUsernameFormat(username string) error {
 func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
 	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)

-	username, _ := s.parseUsername(localUser.Username)
+	username, _ := parseUsername(localUser.Username)
 	if err := validateUsername(username); err != nil {
 		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
 	}
@@ -102,7 +102,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 // createUserSwitchCommand creates a command with Windows user switching.
 // Returns the command and a cleanup function that must be called after starting the process.
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
-	username, domain := s.parseUsername(localUser.Username)
+	username, domain := parseUsername(localUser.Username)

 	shell := getUserShell(localUser.Uid)

@@ -138,7 +138,7 @@ func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session,
 }

 // parseUsername extracts username and domain from a Windows username
-func (s *Server) parseUsername(fullUsername string) (username, domain string) {
+func parseUsername(fullUsername string) (username, domain string) {
 	// Handle DOMAIN\username format
 	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
 		domain = fullUsername[:idx]
--- a/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
+++ b/client/ui/frontend/src/modules/auto-update/UpdateVersionCard.tsx
@@ -2,6 +2,7 @@ import { type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
 import { Browser } from "@wailsio/runtime";
 import { DownloadIcon, NotepadText } from "lucide-react";
+import { Update as UpdateSvc } from "@bindings/services";
 import { Button } from "@/components/buttons/Button";
 import { useClientVersion } from "@/contexts/ClientVersionContext";
 import { cn } from "@/lib/cn";
@@ -14,6 +15,12 @@ function openUrl(url: string) {
    });
 }

+function openInstallerDownload() {
+    UpdateSvc.DownloadURL()
+        .then(openUrl)
+        .catch(() => openUrl(GITHUB_RELEASES));
+}
+
 export function UpdateVersionCard() {
    const { t } = useTranslation();
    const { updateVersion, enforced, triggerUpdate } = useClientVersion();
@@ -37,11 +44,7 @@ export function UpdateVersionCard() {
                        {t("update.card.installNow")}
                    </Button>
                ) : (
-                    <Button
-                        variant={"primary"}
-                        size={"xs"}
-                        onClick={() => openUrl(GITHUB_RELEASES)}
-                    >
+                    <Button variant={"primary"} size={"xs"} onClick={openInstallerDownload}>
                        <DownloadIcon size={14} />
                        {t("update.card.getInstaller")}
                    </Button>
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -281,6 +281,9 @@ func newApplication(onSecondInstance func()) *application.App {
 		Linux: application.LinuxOptions{
 			ProgramName: "netbird",
 		},
+		Windows: application.WindowsOptions{
+			WndProcInterceptor: endSessionInterceptor(),
+		},
 		SingleInstance: &application.SingleInstanceOptions{
 			UniqueID: "io.netbird.ui",
 			OnSecondInstanceLaunch: func(_ application.SecondInstanceData) {
@@ -367,6 +370,9 @@ func newMainWindow(app *application.App, prefStore *preferences.Store) *applicat

 	// Hide instead of quit on close; "really quit" is reached via tray -> Quit.
 	window.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+		if services.ShuttingDown() {
+			return
+		}
 		e.Cancel()
 		window.Hide()
 	})
--- a/client/ui/services/shutdown.go
+++ b/client/ui/services/shutdown.go
@@ -0,0 +1,24 @@
+package services
+
+import "sync/atomic"
+
+var (
+	sessionEnding atomic.Bool
+	quitting      atomic.Bool
+)
+
+func BeginSessionEnd() {
+	sessionEnding.Store(true)
+}
+
+func AbortSessionEnd() {
+	sessionEnding.Store(false)
+}
+
+func BeginShutdown() {
+	quitting.Store(true)
+}
+
+func ShuttingDown() bool {
+	return sessionEnding.Load() || quitting.Load()
+}
--- a/client/ui/services/update.go
+++ b/client/ui/services/update.go
@@ -10,6 +10,7 @@ import (

 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ui/updater"
+	"github.com/netbirdio/netbird/version"
 )

 // UpdateResult mirrors TriggerUpdateResponse.
@@ -33,6 +34,12 @@ func (s *Update) GetState() updater.State {
 	return s.holder.Get()
 }

+// DownloadURL returns the platform-appropriate installer download link for
+// manual (non-enforced) updates.
+func (s *Update) DownloadURL() string {
+	return version.DownloadUrl()
+}
+
 // Quit exits the app. Scheduled off the calling goroutine so the JS caller's
 // response returns before the runtime tears down.
 func (s *Update) Quit() {
--- a/client/ui/services/windowmanager.go
+++ b/client/ui/services/windowmanager.go
@@ -154,6 +154,9 @@ func NewWindowManager(app *application.App, mainWindow *application.WebviewWindo
 	})
 	// Hide (not destroy) on close to keep React state; reset to General for a flash-free reopen.
 	s.settings.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+		if ShuttingDown() {
+			return
+		}
 		e.Cancel()
 		s.app.Event.Emit(EventSettingsOpen, "general")
 		s.settings.Hide()
@@ -393,6 +396,9 @@ func (s *WindowManager) CloseWelcome() {
 // OpenError shows the custom error dialog; title/message are pre-localised and ride in the
 // start URL. A second error replaces the open one via SetURL. Singleton, destroyed on close.
 func (s *WindowManager) OpenError(title, message string) {
+	if ShuttingDown() {
+		return
+	}
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	startURL := errorDialogURL(title, message)
--- a/client/ui/services/windowtheme_windows.go
+++ b/client/ui/services/windowtheme_windows.go
@@ -0,0 +1,14 @@
+package services
+
+import "github.com/wailsapp/wails/v3/pkg/w32"
+
+// Wails assigns w32.AllowDarkModeForWindow only on builds >= 18334 but calls it
+// without a nil check when a window requests the Dark theme, crashing older
+// builds such as Windows Server 2019 (17763). Those builds still get a dark
+// title bar via the pre-20H1 DWM attribute that w32.SetTheme applies, so a
+// no-op stub keeps the Dark theme fully working there.
+func init() {
+	if w32.AllowDarkModeForWindow == nil {
+		w32.AllowDarkModeForWindow = func(w32.HWND, bool) uintptr { return 0 }
+	}
+}
--- a/client/ui/shutdown_other.go
+++ b/client/ui/shutdown_other.go
@@ -0,0 +1,7 @@
+//go:build !windows && !android && !ios && !freebsd && !js
+
+package main
+
+func endSessionInterceptor() func(hwnd uintptr, msg uint32, wParam, lParam uintptr) (uintptr, bool) {
+	return nil
+}
--- a/client/ui/shutdown_windows.go
+++ b/client/ui/shutdown_windows.go
@@ -0,0 +1,36 @@
+//go:build windows
+
+package main
+
+import (
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+const (
+	wmQueryEndSession = 0x0011
+	wmEndSession      = 0x0016
+)
+
+func endSessionInterceptor() func(hwnd uintptr, msg uint32, wParam, lParam uintptr) (uintptr, bool) {
+	return func(_ uintptr, msg uint32, wParam, _ uintptr) (uintptr, bool) {
+		switch msg {
+		case wmQueryEndSession:
+			services.BeginSessionEnd()
+			return 1, true
+		case wmEndSession:
+			if wParam == 0 {
+				services.AbortSessionEnd()
+				return 0, true
+			}
+			log.Info("windows session is ending; exiting immediately")
+			os.Exit(0)
+			return 0, true
+		default:
+			return 0, false
+		}
+	}
+}
--- a/client/ui/tray.go
+++ b/client/ui/tray.go
@@ -32,9 +32,8 @@ const (

 	quitDownTimeout = 5 * time.Second

-	urlGitHubRepo     = "https://github.com/netbirdio/netbird"
-	urlGitHubReleases = "https://github.com/netbirdio/netbird/releases/latest"
-	urlDocs           = "https://docs.netbird.io"
+	urlGitHubRepo = "https://github.com/netbirdio/netbird"
+	urlDocs       = "https://docs.netbird.io"
 )

 // TrayServices bundles the services the tray menu needs, grouped so NewTray
@@ -453,6 +452,7 @@ func (t *Tray) buildMenu() *application.Menu {
 }

 func (t *Tray) handleQuit() {
+	services.BeginShutdown()
 	t.profileMu.Lock()
 	if t.switchCancel != nil {
 		t.switchCancel()
--- a/client/ui/tray_notify.go
+++ b/client/ui/tray_notify.go
@@ -25,6 +25,9 @@ type sendFn func(notifications.NotificationOptions) error
 // event-dispatch goroutine that panic is fatal process-wide; recover() turns
 // it into a logged no-op.
 func safeSendNotification(send sendFn, what string, opts notifications.NotificationOptions) (err error) {
+	if services.ShuttingDown() {
+		return nil
+	}
 	defer func() {
 		if r := recover(); r != nil {
 			log.Errorf("notify %s: recovered from panic (notification bus unavailable): %v", what, r)
--- a/client/ui/tray_update.go
+++ b/client/ui/tray_update.go
@@ -13,6 +13,7 @@ import (

 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/client/ui/updater"
+	"github.com/netbirdio/netbird/version"
 )

 // trayUpdater owns the tray UI that reacts to auto-update. Composed inside Tray.
@@ -76,15 +77,15 @@ func (u *trayUpdater) applyLanguage() {
 	u.refreshMenuItem(state)
 }

-// handleClick opens the GitHub releases page when not Enforced, otherwise shows
-// the progress page and asks the daemon to start the installer.
+// handleClick opens the installer download link when not Enforced, otherwise
+// shows the progress page and asks the daemon to start the installer.
 func (u *trayUpdater) handleClick() {
 	u.mu.Lock()
 	state := u.state
 	u.mu.Unlock()

 	if !state.Enforced {
-		_ = u.app.Browser.OpenURL(urlGitHubReleases)
+		_ = u.app.Browser.OpenURL(version.DownloadUrl())
 		return
 	}

--- a/docs/agent-networks/01-end-to-end-flows.md
+++ b/docs/agent-networks/01-end-to-end-flows.md
@@ -109,7 +109,7 @@ sequenceDiagram
        Chk->>Inj: continue
        Inj->>Inj: inject NetBird identity headers per provider config
        Inj->>Grd: continue
-        Grd->>Grd: enforce model allowlist
+        Grd->>Grd: enforce per-provider allowlist (fail-closed backstop)
        Grd->>Up: forward (over WireGuard)
        Up-->>Resp: response (JSON or SSE stream)
        Resp->>Resp: parse usage tokens, completion
@@ -135,6 +135,21 @@ sequenceDiagram
  (`redact_pii = settings.RedactPii`). Phones, emails, credit cards,
  PII names — see `redact.go` for the full set. See
  [`modules/31-proxy-middleware-builtin.md`](modules/31-proxy-middleware-builtin.md).
+- The model allowlist is enforced in TWO places. `CheckLLMPolicyLimits`
+  is authoritative: it resolves the policy that governs this
+  (provider, caller-groups) and denies (`deny_code = llm_policy.model_blocked`)
+  when no applicable policy permits the model — so an allowlist scoped to
+  one group/provider never leaks to another, and an un-guardrailed policy
+  is genuinely unrestricted. `llm_guardrail` is a per-provider fail-closed
+  backstop: it only carries an allowlist for a provider every authorising
+  policy restricts, and blocks unknown/undetermined models even when
+  management is unreachable. Because that backstop allowlist is the UNION
+  of every restricting policy's models, per-group narrowing lives only in
+  the authoritative check: during a `CheckLLMPolicyLimits` outage
+  `llm_limit_check` fails open, so a caller can reach any model in the
+  provider's union — a group scoped to model A could reach model B if
+  another group restricts the same provider to B. This is the documented
+  fail-open trade-off; a future flag may switch it to fail-closed.
 - SSE streaming requires special handling on the response side; the
  parser must handle partial chunks without buffering the whole
  stream. See [`modules/32-proxy-llm-parsers.md`](modules/32-proxy-llm-parsers.md).
--- a/docs/agent-networks/modules/21-management-agentnetwork.md
+++ b/docs/agent-networks/modules/21-management-agentnetwork.md
@@ -122,7 +122,7 @@ At request time the path is independent: the proxy calls `SelectPolicyForRequest
  | on_request | 1 | `llm_router` | `{"providers":[{id, models[], upstream_*, auth_header_*, allowed_group_ids[]}]}` | **true** |
  | on_request | 2 | `llm_limit_check` | `{}` | – |
  | on_request | 3 | `llm_identity_inject` | `{"providers":[{provider_id, header_pair?, json_metadata?, extra_headers?}]}` | **true** |
-  | on_request | 4 | `llm_guardrail` | `{"model_allowlist"?, "prompt_capture":{enabled,redact_pii}}` | – |
+  | on_request | 4 | `llm_guardrail` | `{"provider_allowlists"?: {providerID: []model}, "prompt_capture":{enabled,redact_pii}}` | – |
  | on_response | 5 | `llm_limit_record` | `{}` (runs LAST at runtime) | – |
  | on_response | 6 | `cost_meter` | `{}` | – |
  | on_response | 7 | `llm_response_parser` | `{"capture_completion": <bool>, "redact_pii"?: true}` | – |
--- a/docs/agent-networks/modules/31-proxy-middleware-builtin.md
+++ b/docs/agent-networks/modules/31-proxy-middleware-builtin.md
@@ -244,7 +244,7 @@ no mocks. Tests: `TestChain_AllowPath_StampsAttributionAndRecordsCounter`
 | `llm_router` | `{providers: [{id, models, upstream_scheme, upstream_host, upstream_path?, auth_header_name, auth_header_value, allowed_group_ids}]}` |
 | `llm_limit_check` | `{}` — pulls `MgmtClient` from `FactoryContext` |
 | `llm_identity_inject` | `{providers: [{provider_id, header_pair?|json_metadata?, extra_headers?}]}` |
-| `llm_guardrail` | `{model_allowlist: []string, prompt_capture: {enabled, redact_pii}}` |
+| `llm_guardrail` | `{provider_allowlists: {providerID: []string}, prompt_capture: {enabled, redact_pii}}` — allowlist keyed by resolved provider id; a provider absent from the map is unrestricted (fail-closed backstop; authoritative per-policy/group check is management's `CheckLLMPolicyLimits`) |
 | `llm_response_parser` | `{redact_pii?, capture_completion?: *bool}` |
 | `cost_meter` | `{pricing_path?}` (basename inside data-dir; defaults `pricing.yaml`) |
 | `llm_limit_record` | `{}` — same pattern as `llm_limit_check` |
--- a/e2e/agentnetwork/guardrail_block_test.go
+++ b/e2e/agentnetwork/guardrail_block_test.go
@@ -0,0 +1,209 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// pathRoutedGuardrailCase is one provider's self-contained scenario: its own
+// provider, its own guardrail whose allowlist holds ONLY that provider's
+// allowed model, and its own policy. Each case runs in isolation (its own
+// proxy + client), so the guardrail the proxy enforces contains exactly this
+// provider's model — never a mixed cross-provider list.
+type pathRoutedGuardrailCase struct {
+	name       string
+	catalogID  string // agent-network catalog provider id
+	wire       string // harness.WireVertex | harness.WireBedrock
+	allowEntry string // the single model id put on the guardrail allowlist
+	allowModel string // model id sent that MUST be served (200)
+	blockModel string // model id sent that MUST be denied (403 model_blocked)
+}
+
+// TestGuardrailBlocksUnselectedModel_PathRouted is the end-to-end regression
+// guard for the customer report that a model-allowlist guardrail attached to a
+// policy has no effect for PATH-ROUTED providers — where the model travels in
+// the URL, not the JSON body: Google Vertex (…/models/{model}:rawPredict) and
+// AWS Bedrock (/model/{id}/invoke).
+//
+// Each provider is tested in isolation with a guardrail allowlisting a single
+// model of its own: the allowed model (in the URL path) is served (200) and an
+// unselected model (in the URL path) is denied 403 by the guardrail
+// (llm_policy.model_blocked) before the upstream. The Vertex case mirrors the
+// customer verbatim — allow Sonnet, and the unselected model is the exact
+// claude-opus-4-6 they reported reaching the model unblocked. The Bedrock case
+// sends a region-prefixed, versioned inference-profile id so URL-path model
+// normalization is exercised too.
+//
+// The provider is catch-all (no models), so the router forwards any model and a
+// 403 can only come from the guardrail, never model_not_routable. Only the
+// upstream LLM is mocked (the vLLM nginx answers any path with 200); management
+// synth/reconcile, the proxy middleware chain (URL-path model extraction,
+// router, guardrail) and the tunnel are all real, and the guardrail denies
+// before the upstream is dialed so the mock cannot influence the block. A
+// static bearer api key is used so the router injects a static Authorization
+// header instead of minting a GCP token — the only reason path-routed providers
+// normally need live credentials — so the test runs with none and is always on.
+func TestGuardrailBlocksUnselectedModel_PathRouted(t *testing.T) {
+	cases := []pathRoutedGuardrailCase{
+		{
+			name:       "vertex",
+			catalogID:  "vertex_ai_api",
+			wire:       harness.WireVertex,
+			allowEntry: "claude-sonnet-4-5",
+			allowModel: "claude-sonnet-4-5",
+			blockModel: "claude-opus-4-6", // the customer-reported model
+		},
+		{
+			name:       "bedrock",
+			catalogID:  "bedrock_api",
+			wire:       harness.WireBedrock,
+			allowEntry: "anthropic.claude-sonnet-4-5", // normalized catalog id
+			allowModel: "us.anthropic.claude-sonnet-4-5-v1:0",
+			blockModel: "us.anthropic.claude-opus-4-8-v1:0",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			runPathRoutedGuardrailCase(t, tc)
+		})
+	}
+}
+
+func runPathRoutedGuardrailCase(t *testing.T, tc pathRoutedGuardrailCase) {
+	t.Helper()
+
+	const (
+		vertexProject = "e2e-project"
+		vertexRegion  = "global"
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grp, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-guardrail-" + tc.name})
+	require.NoError(t, err, "create group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grp.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-guardrail-" + tc.name + "-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grp.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	// Catch-all provider (no models) so the router forwards any model; a static
+	// bearer key means the router injects a static auth header instead of minting
+	// a GCP token. Bootstraps the cluster if it isn't already.
+	staticKey := "static-e2e-token"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:             tc.name,
+		ProviderId:       tc.catalogID,
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+	})
+	require.NoError(t, err, "create %s provider", tc.name)
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	// Guardrail allowlisting ONLY this provider's allowed model.
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = "e2e-guardrail-" + tc.name
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{tc.allowEntry}
+	guard, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail")
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), guard.Id) })
+
+	enabled := true
+	pol, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-" + tc.name,
+		Enabled:                &enabled,
+		SourceGroups:           []string{grp.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{guard.Id},
+	})
+	require.NoError(t, err, "create policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), pol.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-guardrail-"+tc.name+"-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	// Probe first: the GET resolves the endpoint and its first packet wakes the
+	// lazy proxy peer, so WaitProxyPeer then observes it connected.
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		var code int
+		var body string
+		var cerr error
+		switch tc.wire {
+		case harness.WireVertex:
+			code, body, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, vertexProject, vertexRegion, model, "Reply with exactly: pong", "")
+		case harness.WireBedrock:
+			code, body, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, model, "Reply with exactly: pong", "")
+		default:
+			t.Fatalf("unsupported wire %q", tc.wire)
+		}
+		require.NoError(t, cerr, "request must reach the proxy for %s", tc.name)
+		return code, body
+	}
+
+	// Allowed model (in the URL path) is served. Retry to absorb tunnel/DNS
+	// jitter on the first call over the freshly warmed tunnel.
+	var code int
+	var body string
+	deadline := time.Now().Add(90 * time.Second)
+	for time.Now().Before(deadline) {
+		code, body = send(tc.allowModel)
+		if code == 200 {
+			break
+		}
+		time.Sleep(5 * time.Second)
+	}
+	assert.Equal(t, 200, code,
+		"allowed %s model (URL path) must be served; body: %s\n=== proxy logs ===\n%s", tc.name, body, px.Logs(context.Background()))
+
+	// Unselected model (in the URL path) must be blocked by the guardrail.
+	code, body = send(tc.blockModel)
+	assert.Equal(t, 403, code,
+		"unselected %s model (URL path) must be denied, not served; body: %s\n=== proxy logs ===\n%s", tc.name, body, px.Logs(context.Background()))
+	assert.Contains(t, body, "llm_policy.model_blocked",
+		"%s denial must come from the guardrail allowlist, not routing; body: %s", tc.name, body)
+}
--- a/e2e/agentnetwork/guardrail_groupswitch_test.go
+++ b/e2e/agentnetwork/guardrail_groupswitch_test.go
@@ -0,0 +1,205 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestGuardrailGroupSwitchTakesEffectAfterTTL proves that moving a peer between
+// groups flips its model-allowlist decision once the proxy's tunnel-peer cache
+// expires. The peer's groups reach the guardrail via ValidateTunnelPeer, which
+// the proxy caches; the switch is invisible until that cache expires. The proxy
+// runs with a short NB_PROXY_TUNNEL_CACHE_TTL so the flip happens in seconds
+// instead of the 5-minute default.
+//
+// Setup: one catch-all provider declaring modelA + modelB; polA (grpA -> allow
+// modelA) and polB (grpB -> allow modelB). The client starts in grpA. modelA is
+// served and modelB denied; after switching the client grpA -> grpB, modelB is
+// served and modelA denied. The cross-group deny comes from management's
+// per-policy/group CheckLLMPolicyLimits (the proxy backstop carries the union).
+func TestGuardrailGroupSwitchTakesEffectAfterTTL(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		modelA = "e2e-model-a"
+		modelB = "e2e-model-b"
+		// Short tunnel-cache TTL so a group switch propagates in seconds.
+		// Exercises the NB_PROXY_TUNNEL_CACHE_TTL override.
+		cacheTTL = 3 * time.Second
+	)
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpA, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gswitch-a"})
+	require.NoError(t, err, "create group A")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpA.Id) })
+
+	grpB, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-gswitch-b"})
+	require.NoError(t, err, "create group B")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpB.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-gswitch-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grpA.Id}, // client starts in group A
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "gswitch",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models: &[]api.AgentNetworkProviderModel{
+			{Id: modelA, InputPer1k: 0.001, OutputPer1k: 0.001},
+			{Id: modelB, InputPer1k: 0.001, OutputPer1k: 0.001},
+		},
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+	})
+	require.NoError(t, err, "create provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+	mkGuard := func(name, model string) api.AgentNetworkGuardrail {
+		var gr api.AgentNetworkGuardrailRequest
+		gr.Name = name
+		gr.Checks.ModelAllowlist.Enabled = true
+		gr.Checks.ModelAllowlist.Models = []string{model}
+		g, gerr := srv.CreateGuardrail(ctx, gr)
+		require.NoError(t, gerr, "create guardrail %s", name)
+		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+		return g
+	}
+	gA := mkGuard("e2e-gswitch-a", modelA)
+	gB := mkGuard("e2e-gswitch-b", modelB)
+
+	enabled := true
+	polA, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gswitch-a",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpA.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{gA.Id},
+	})
+	require.NoError(t, err, "create policy A")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polA.Id) })
+
+	polB, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-gswitch-b",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpB.Id},
+		DestinationProviderIds: []string{prov.Id},
+		GuardrailIds:           &[]string{gB.Id},
+	})
+	require.NoError(t, err, "create policy B")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polB.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-gswitch-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken, map[string]string{
+		"NB_PROXY_TUNNEL_CACHE_TTL": cacheTTL.String(),
+	})
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		code, body, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, model, "Reply with exactly: pong", "")
+		require.NoError(t, cerr, "request must reach the proxy")
+		return code, body
+	}
+	sendUntil := func(model string, want int, timeout time.Duration) (int, string) {
+		var code int
+		var body string
+		deadline := time.Now().Add(timeout)
+		for time.Now().Before(deadline) {
+			code, body = send(model)
+			if code == want {
+				return code, body
+			}
+			time.Sleep(2 * time.Second)
+		}
+		return code, body
+	}
+
+	// Phase 1 — client is in group A: modelA served, modelB denied.
+	code, body := sendUntil(modelA, 200, 90*time.Second)
+	assert.Equal(t, 200, code,
+		"group-A model must be served while the client is in group A; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	code, body = send(modelB)
+	assert.Equal(t, 403, code,
+		"group-B model must be denied while the client is in group A; body: %s", body)
+	assert.Contains(t, body, "llm_policy.model_blocked")
+
+	// Switch the client peer from group A to group B.
+	peerID := clientPeerInGroup(t, ctx, grpA.Id)
+	_, err = srv.API().Groups.Update(ctx, grpB.Id, api.PutApiGroupsGroupIdJSONRequestBody{
+		Name:  grpB.Name,
+		Peers: &[]string{peerID},
+	})
+	require.NoError(t, err, "add peer to group B")
+	_, err = srv.API().Groups.Update(ctx, grpA.Id, api.PutApiGroupsGroupIdJSONRequestBody{
+		Name:  grpA.Name,
+		Peers: &[]string{},
+	})
+	require.NoError(t, err, "remove peer from group A")
+
+	// Phase 2 — after the short TTL expires the proxy re-validates the peer,
+	// sees group B, and the decision flips. Poll to absorb TTL + re-validation.
+	code, body = sendUntil(modelB, 200, 60*time.Second)
+	assert.Equal(t, 200, code,
+		"after the group switch + TTL, the group-B model must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	code, body = send(modelA)
+	assert.Equal(t, 403, code,
+		"after the switch, the old group-A model must be denied; body: %s", body)
+	assert.Contains(t, body, "llm_policy.model_blocked")
+}
+
+// clientPeerInGroup returns the id of the single peer that is a member of the
+// given group — the test client. The proxy peer is never added to test groups.
+func clientPeerInGroup(t *testing.T, ctx context.Context, groupID string) string {
+	t.Helper()
+	peers, err := srv.API().Peers.List(ctx)
+	require.NoError(t, err, "list peers")
+	for _, p := range peers {
+		for _, g := range p.Groups {
+			if g.Id == groupID {
+				return p.Id
+			}
+		}
+	}
+	t.Fatalf("no peer found in group %s", groupID)
+	return ""
+}
--- a/e2e/agentnetwork/guardrail_multipolicy_test.go
+++ b/e2e/agentnetwork/guardrail_multipolicy_test.go
@@ -0,0 +1,201 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestGuardrailMultiPolicyModelAllowlist: modelSelected served (200), grpOther's
+// modelOther denied for the grpMain client (403 model_blocked, no cross-group
+// leak), and openModel on the un-guardrailed policy's provider served (200).
+func TestGuardrailMultiPolicyModelAllowlist(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		modelSelected = "e2e-selected"
+		modelOther    = "e2e-other"
+		openModel     = "e2e-open"
+	)
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpMain, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-guardrail-mp-main"})
+	require.NoError(t, err, "create main group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpMain.Id) })
+
+	grpOther, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-guardrail-mp-other"})
+	require.NoError(t, err, "create other group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpOther.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-guardrail-mp-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grpMain.Id}, // client joins grpMain only
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	models := func(ids ...string) *[]api.AgentNetworkProviderModel {
+		out := make([]api.AgentNetworkProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.001})
+		}
+		return &out
+	}
+
+	// pRestricted declares the two guardrailed models so routing is deterministic
+	// (model -> provider). Created first, so it carries the bootstrap cluster.
+	pRestricted, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:             "restricted",
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		Models:           models(modelSelected, modelOther),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+	})
+	require.NoError(t, err, "create restricted provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), pRestricted.Id) })
+
+	pOpen, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "open",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models:      models(openModel),
+	})
+	require.NoError(t, err, "create open provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), pOpen.Id) })
+
+	mkGuardrail := func(name, model string) api.AgentNetworkGuardrail {
+		var gr api.AgentNetworkGuardrailRequest
+		gr.Name = name
+		gr.Checks.ModelAllowlist.Enabled = true
+		gr.Checks.ModelAllowlist.Models = []string{model}
+		g, gerr := srv.CreateGuardrail(ctx, gr)
+		require.NoError(t, gerr, "create guardrail %s", name)
+		t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+		return g
+	}
+	gMain := mkGuardrail("e2e-guardrail-mp-main", modelSelected)
+	gOther := mkGuardrail("e2e-guardrail-mp-other", modelOther)
+
+	enabled := true
+	// polMain: grpMain restricted to modelSelected on pRestricted.
+	polMain, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-mp-main",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpMain.Id},
+		DestinationProviderIds: []string{pRestricted.Id},
+		GuardrailIds:           &[]string{gMain.Id},
+	})
+	require.NoError(t, err, "create main policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMain.Id) })
+
+	// polOther: grpOther restricted to modelOther on the SAME provider. The
+	// client is not in grpOther, so modelOther must never be usable by it.
+	polOther, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-mp-other",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpOther.Id},
+		DestinationProviderIds: []string{pRestricted.Id},
+		GuardrailIds:           &[]string{gOther.Id},
+	})
+	require.NoError(t, err, "create other policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOther.Id) })
+
+	// polOpen: grpMain on pOpen with NO guardrail — unrestricted.
+	polOpen, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-guardrail-mp-open",
+		Enabled:                &enabled,
+		SourceGroups:           []string{grpMain.Id},
+		DestinationProviderIds: []string{pOpen.Id},
+	})
+	require.NoError(t, err, "create open policy")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOpen.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-guardrail-mp-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		code, body, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, model, "Reply with exactly: pong", "")
+		require.NoError(t, cerr, "request must reach the proxy")
+		return code, body
+	}
+	// sendUntil200 absorbs first-call tunnel/DNS jitter on the freshly warmed tunnel.
+	sendUntil200 := func(model string) (int, string) {
+		var code int
+		var body string
+		deadline := time.Now().Add(90 * time.Second)
+		for time.Now().Before(deadline) {
+			code, body = send(model)
+			if code == 200 {
+				break
+			}
+			time.Sleep(5 * time.Second)
+		}
+		return code, body
+	}
+
+	t.Run("selected model allowed for its group", func(t *testing.T) {
+		code, body := sendUntil200(modelSelected)
+		assert.Equal(t, 200, code,
+			"grpMain's allowlisted model must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	})
+
+	t.Run("other group's model does not leak", func(t *testing.T) {
+		// modelOther is allowlisted only for grpOther. The grpMain client must be
+		// denied by management's per-policy/group check — not waved through by an
+		// account-wide union. This is the security-critical wrong-ALLOW guard.
+		code, body := send(modelOther)
+		assert.Equal(t, 403, code,
+			"another group's allowlisted model must be denied for this caller; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+		assert.Contains(t, body, "llm_policy.model_blocked",
+			"denial must be a model-allowlist decision; body: %s", body)
+	})
+
+	t.Run("unguarded policy leaves its provider unrestricted", func(t *testing.T) {
+		// polOpen carries no guardrail, so pOpen is unrestricted for grpMain. The
+		// old account-wide union would have blocked openModel (it is on no
+		// allowlist); it must now be served — the false-DENY guard.
+		code, body := sendUntil200(openModel)
+		assert.Equal(t, 200, code,
+			"an un-guardrailed policy's provider must not be blocked by another policy's allowlist; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	})
+}
--- a/e2e/agentnetwork/guardrail_pergroup_providers_test.go
+++ b/e2e/agentnetwork/guardrail_pergroup_providers_test.go
@@ -0,0 +1,422 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// pergroupCase describes one provider surface for the per-group allowlist matrix.
+// selectedReq/otherReq are the model identifiers as they travel in the request
+// (URL path for Bedrock/Vertex, body "model" for chat/messages). selectedAllow/
+// otherAllow are the (normalized) forms the guardrail allowlist holds — for
+// Bedrock these differ from the request form so path normalization is exercised.
+type pergroupCase struct {
+	name          string
+	catalogID     string
+	wire          string // "chat", "messages", "vertex", "bedrock"
+	models        *[]api.AgentNetworkProviderModel
+	selectedReq   string
+	selectedAllow string
+	otherReq      string
+	otherAllow    string
+
+	providerID string // filled during setup
+}
+
+// TestGuardrailPerGroupAllowlist_AllProviders proves the per-policy/group model
+// allowlist end to end across every always-on provider surface, including the
+// path-routed ones (Vertex, Bedrock) where the model travels in the URL.
+//
+// For each provider two policies target it: grpMain (the client) is allowed only
+// selectedReq; grpOther (which the client is NOT in) is allowed only otherReq.
+// The client must get selectedReq served (200) and otherReq denied (403,
+// llm_policy.model_blocked) — the cross-group no-leak property. The deny is the
+// authoritative per-policy/group decision from management (the proxy per-provider
+// backstop carries the union of both models), so this also confirms management
+// receives the correct normalized model for path-routed providers.
+func TestGuardrailPerGroupAllowlist_AllProviders(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	const (
+		vertexProject = "e2e-project"
+		vertexRegion  = "global"
+	)
+
+	priced := func(ids ...string) *[]api.AgentNetworkProviderModel {
+		out := make([]api.AgentNetworkProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.001})
+		}
+		return &out
+	}
+
+	cases := []*pergroupCase{
+		{
+			name: "openai", catalogID: "openai_api", wire: harness.WireChat,
+			models:      priced("oai-model-a", "oai-model-b"),
+			selectedReq: "oai-model-a", selectedAllow: "oai-model-a",
+			otherReq: "oai-model-b", otherAllow: "oai-model-b",
+		},
+		{
+			name: "anthropic", catalogID: "anthropic_api", wire: harness.WireMessages,
+			models:      priced("ant-model-a", "ant-model-b"),
+			selectedReq: "ant-model-a", selectedAllow: "ant-model-a",
+			otherReq: "ant-model-b", otherAllow: "ant-model-b",
+		},
+		{
+			// Vertex catalog ids travel bare in the rawPredict path.
+			name: "vertex", catalogID: "vertex_ai_api", wire: "vertex",
+			selectedReq: "claude-sonnet-4-5", selectedAllow: "claude-sonnet-4-5",
+			otherReq: "claude-opus-4-6", otherAllow: "claude-opus-4-6",
+		},
+		{
+			// Bedrock request ids are region-prefixed/versioned; the parser
+			// normalizes them to the catalog key the allowlist holds.
+			name: "bedrock", catalogID: "bedrock_api", wire: "bedrock",
+			selectedReq: "us.anthropic.claude-sonnet-4-5-v1:0", selectedAllow: "anthropic.claude-sonnet-4-5",
+			otherReq: "us.anthropic.claude-opus-4-8-v1:0", otherAllow: "anthropic.claude-opus-4-8",
+		},
+	}
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	grpMain, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-pergroup-main"})
+	require.NoError(t, err, "create main group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpMain.Id) })
+
+	grpOther, err := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: "e2e-pergroup-other"})
+	require.NoError(t, err, "create other group")
+	t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), grpOther.Id) })
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-pergroup-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{grpMain.Id},
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	enabled := true
+
+	for i, c := range cases {
+		req := api.AgentNetworkProviderRequest{
+			Name:        "e2e-pergroup-" + c.name,
+			ProviderId:  c.catalogID,
+			UpstreamUrl: vllm.URL,
+			ApiKey:      &staticKey,
+			Enabled:     ptr(true),
+			Models:      c.models,
+		}
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
+		prov, perr := srv.CreateProvider(ctx, req)
+		require.NoError(t, perr, "create provider %s", c.name)
+		c.providerID = prov.Id
+		t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
+
+		gSel := mkAllowGuardrail(t, ctx, "e2e-pergroup-"+c.name+"-sel", c.selectedAllow)
+		gOth := mkAllowGuardrail(t, ctx, "e2e-pergroup-"+c.name+"-oth", c.otherAllow)
+
+		polMain, merr := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+			Name:                   "e2e-pergroup-" + c.name + "-main",
+			Enabled:                &enabled,
+			SourceGroups:           []string{grpMain.Id},
+			DestinationProviderIds: []string{prov.Id},
+			GuardrailIds:           &[]string{gSel.Id},
+		})
+		require.NoError(t, merr, "create main policy %s", c.name)
+		t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMain.Id) })
+
+		polOther, oerr := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+			Name:                   "e2e-pergroup-" + c.name + "-other",
+			Enabled:                &enabled,
+			SourceGroups:           []string{grpOther.Id},
+			DestinationProviderIds: []string{prov.Id},
+			GuardrailIds:           &[]string{gOth.Id},
+		})
+		require.NoError(t, oerr, "create other policy %s", c.name)
+		t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polOther.Id) })
+	}
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-pergroup-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(c *pergroupCase, model string) (int, string) {
+		var code int
+		var body string
+		var cerr error
+		switch c.wire {
+		case "vertex":
+			code, body, cerr = cl.Vertex(ctx, settings.Endpoint, proxyIP, vertexProject, vertexRegion, model, "Reply with exactly: pong", "")
+		case "bedrock":
+			code, body, cerr = cl.Bedrock(ctx, settings.Endpoint, proxyIP, model, "Reply with exactly: pong", "")
+		default:
+			code, body, cerr = cl.Chat(ctx, settings.Endpoint, proxyIP, c.wire, model, "Reply with exactly: pong", "")
+		}
+		require.NoError(t, cerr, "request must reach the proxy for %s", c.name)
+		return code, body
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			// grpMain's own model is served. Retry to absorb tunnel/DNS jitter on
+			// the first call over the freshly warmed tunnel.
+			var code int
+			var body string
+			deadline := time.Now().Add(90 * time.Second)
+			for time.Now().Before(deadline) {
+				code, body = send(c, c.selectedReq)
+				if code == 200 {
+					break
+				}
+				time.Sleep(5 * time.Second)
+			}
+			assert.Equal(t, 200, code,
+				"%s: grpMain's allowlisted model must be served; body: %s\n=== proxy logs ===\n%s", c.name, body, px.Logs(context.Background()))
+
+			// grpOther's model must NOT leak to the grpMain client.
+			code, body = send(c, c.otherReq)
+			assert.Equal(t, 403, code,
+				"%s: another group's allowlisted model must be denied for this caller; body: %s\n=== proxy logs ===\n%s", c.name, body, px.Logs(context.Background()))
+			assert.Contains(t, body, "llm_policy.model_blocked",
+				"%s: denial must be a model-allowlist decision, not routing; body: %s", c.name, body)
+		})
+	}
+}
+
+// TestGuardrailMultiGroupUser proves the per-policy/group decision for a caller
+// that belongs to MULTIPLE groups at once. Two scenarios, one shared stack:
+//
+//   - union across the user's groups: the client is in gUX and gUY, each with
+//     its own policy+guardrail on provider P1 (gUX->union-a, gUY->union-b). The
+//     client may use BOTH models (the union of its groups' allowlists) while a
+//     third, un-allowlisted model is denied.
+//   - an un-guardrailed group lifts the restriction: the client is in gMP and
+//     gMQ on provider P2, where gMP restricts to mix-a but gMQ's policy carries
+//     NO guardrail. Because one applicable policy is unrestricted, the client may
+//     use a model on no allowlist (mix-z) as well as mix-a.
+func TestGuardrailMultiGroupUser(t *testing.T) {
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Minute)
+	defer cancel()
+
+	const (
+		unionA = "mg-union-a"
+		unionB = "mg-union-b"
+		unionC = "mg-union-c" // allowlisted by neither group
+		mixA   = "mg-mix-a"
+		mixZ   = "mg-mix-z" // on no allowlist; reachable only via the un-guardrailed policy
+	)
+
+	priced := func(ids ...string) *[]api.AgentNetworkProviderModel {
+		out := make([]api.AgentNetworkProviderModel, 0, len(ids))
+		for _, id := range ids {
+			out = append(out, api.AgentNetworkProviderModel{Id: id, InputPer1k: 0.001, OutputPer1k: 0.001})
+		}
+		return &out
+	}
+
+	vllm, err := harness.StartVLLM(ctx, srv)
+	require.NoError(t, err, "start mock upstream")
+	t.Cleanup(func() { _ = vllm.Terminate(context.Background()) })
+
+	mkGroup := func(name string) *api.Group {
+		g, gerr := srv.API().Groups.Create(ctx, api.PostApiGroupsJSONRequestBody{Name: name})
+		require.NoError(t, gerr, "create group %s", name)
+		t.Cleanup(func() { _ = srv.API().Groups.Delete(context.Background(), g.Id) })
+		return g
+	}
+	gUX := mkGroup("e2e-mg-union-x")
+	gUY := mkGroup("e2e-mg-union-y")
+	gMP := mkGroup("e2e-mg-mix-p")
+	gMQ := mkGroup("e2e-mg-mix-q")
+
+	ephemeral := false
+	sk, err := srv.API().SetupKeys.Create(ctx, api.PostApiSetupKeysJSONRequestBody{
+		Name:       "e2e-mg-client",
+		Type:       "reusable",
+		ExpiresIn:  86400,
+		UsageLimit: 0,
+		AutoGroups: []string{gUX.Id, gUY.Id, gMP.Id, gMQ.Id}, // client in all four groups
+		Ephemeral:  &ephemeral,
+	})
+	require.NoError(t, err, "mint setup key")
+	require.NotEmpty(t, sk.Key, "setup key plaintext")
+
+	staticKey := "static-e2e-token"
+	enabled := true
+
+	// P1 — union scenario: two restricting policies, one per group.
+	p1, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:             "e2e-mg-union",
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		Models:           priced(unionA, unionB, unionC),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+	})
+	require.NoError(t, err, "create union provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), p1.Id) })
+
+	polUX, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-union-x",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gUX.Id},
+		DestinationProviderIds: []string{p1.Id},
+		GuardrailIds:           &[]string{mkAllowGuardrail(t, ctx, "e2e-mg-union-x", unionA).Id},
+	})
+	require.NoError(t, err, "create union policy X")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polUX.Id) })
+
+	polUY, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-union-y",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gUY.Id},
+		DestinationProviderIds: []string{p1.Id},
+		GuardrailIds:           &[]string{mkAllowGuardrail(t, ctx, "e2e-mg-union-y", unionB).Id},
+	})
+	require.NoError(t, err, "create union policy Y")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polUY.Id) })
+
+	// P2 — mixed scenario: one restricting policy + one un-guardrailed policy.
+	p2, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
+		Name:        "e2e-mg-mix",
+		ProviderId:  "openai_api",
+		UpstreamUrl: vllm.URL,
+		ApiKey:      &staticKey,
+		Enabled:     ptr(true),
+		Models:      priced(mixA, mixZ),
+	})
+	require.NoError(t, err, "create mix provider")
+	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), p2.Id) })
+
+	polMP, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-mix-p",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gMP.Id},
+		DestinationProviderIds: []string{p2.Id},
+		GuardrailIds:           &[]string{mkAllowGuardrail(t, ctx, "e2e-mg-mix-p", mixA).Id},
+	})
+	require.NoError(t, err, "create mix policy P")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMP.Id) })
+
+	polMQ, err := srv.CreatePolicy(ctx, api.AgentNetworkPolicyRequest{
+		Name:                   "e2e-mg-mix-q",
+		Enabled:                &enabled,
+		SourceGroups:           []string{gMQ.Id},
+		DestinationProviderIds: []string{p2.Id}, // NO guardrail -> unrestricted
+	})
+	require.NoError(t, err, "create mix policy Q")
+	t.Cleanup(func() { _ = srv.DeletePolicy(context.Background(), polMQ.Id) })
+
+	settings, err := srv.GetSettings(ctx)
+	require.NoError(t, err, "read settings")
+	require.NotEmpty(t, settings.Endpoint, "endpoint must be assigned")
+
+	proxyToken, err := srv.CreateProxyTokenCLI(ctx, "e2e-mg-proxy")
+	require.NoError(t, err, "mint proxy token")
+	px, err := harness.StartProxy(ctx, srv, proxyToken)
+	require.NoError(t, err, "start proxy")
+	t.Cleanup(func() { _ = px.Terminate(context.Background()) })
+
+	cl, err := harness.StartClient(ctx, srv, sk.Key)
+	require.NoError(t, err, "start client")
+	t.Cleanup(func() { _ = cl.Terminate(context.Background()) })
+
+	require.NoError(t, cl.WaitConnected(ctx, 90*time.Second), "client must connect to management")
+	proxyIP, err := cl.ResolveProxyIP(ctx, settings.Endpoint)
+	require.NoError(t, err, "resolve endpoint to proxy IP")
+	if err := cl.WaitProxyPeer(ctx, 180*time.Second); err != nil {
+		t.Fatalf("client did not see the proxy peer: %v\n=== proxy logs ===\n%s", err, px.Logs(context.Background()))
+	}
+
+	send := func(model string) (int, string) {
+		code, body, cerr := cl.Chat(ctx, settings.Endpoint, proxyIP, harness.WireChat, model, "Reply with exactly: pong", "")
+		require.NoError(t, cerr, "request must reach the proxy")
+		return code, body
+	}
+	sendUntil200 := func(model string) (int, string) {
+		var code int
+		var body string
+		deadline := time.Now().Add(90 * time.Second)
+		for time.Now().Before(deadline) {
+			code, body = send(model)
+			if code == 200 {
+				break
+			}
+			time.Sleep(5 * time.Second)
+		}
+		return code, body
+	}
+
+	t.Run("union across the user's groups", func(t *testing.T) {
+		code, body := sendUntil200(unionA)
+		assert.Equal(t, 200, code, "model allowed by group X must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+
+		code, body = sendUntil200(unionB)
+		assert.Equal(t, 200, code, "model allowed by group Y must also be served (union across the user's groups); body: %s", body)
+
+		code, body = send(unionC)
+		assert.Equal(t, 403, code, "a model on neither group's allowlist must be denied; body: %s", body)
+		assert.Contains(t, body, "llm_policy.model_blocked")
+	})
+
+	t.Run("an un-guardrailed group lifts the restriction", func(t *testing.T) {
+		code, body := sendUntil200(mixA)
+		assert.Equal(t, 200, code, "the restricted group's model must be served; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+
+		code, body = sendUntil200(mixZ)
+		assert.Equal(t, 200, code,
+			"a non-allowlisted model must be served because the user is also in a group whose policy has no guardrail; body: %s\n=== proxy logs ===\n%s", body, px.Logs(context.Background()))
+	})
+}
+
+// mkAllowGuardrail creates a guardrail whose model allowlist is enabled and holds
+// exactly the given model, registering cleanup.
+func mkAllowGuardrail(t *testing.T, ctx context.Context, name, model string) api.AgentNetworkGuardrail {
+	t.Helper()
+	var gr api.AgentNetworkGuardrailRequest
+	gr.Name = name
+	gr.Checks.ModelAllowlist.Enabled = true
+	gr.Checks.ModelAllowlist.Models = []string{model}
+	g, err := srv.CreateGuardrail(ctx, gr)
+	require.NoError(t, err, "create guardrail %s", name)
+	t.Cleanup(func() { _ = srv.DeleteGuardrail(context.Background(), g.Id) })
+	return g
+}
--- a/e2e/harness/proxy.go
+++ b/e2e/harness/proxy.go
@@ -38,7 +38,11 @@ type Proxy struct {
 // network, registered via the given account proxy token and serving the
 // AgentNetworkCluster over a self-signed wildcard cert. It does not wait for
 // peer connectivity — callers poll management for the proxy peer.
-func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, error) {
+// StartProxy launches the reverse-proxy container. Optional envOverrides are
+// merged into the container environment after the defaults, so callers can set
+// or override any NB_PROXY_* var (e.g. NB_PROXY_TUNNEL_CACHE_TTL for tests that
+// need a short authorization-cache window).
+func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverrides ...map[string]string) (*Proxy, error) {
 	root, err := repoRoot()
 	if err != nil {
 		return nil, err
@@ -93,6 +97,12 @@ func StartProxy(ctx context.Context, c *Combined, proxyToken string) (*Proxy, er
 		WaitingFor: wait.ForLog("Initial mapping sync complete").WithStartupTimeout(90 * time.Second),
 	}

+	for _, ov := range envOverrides {
+		for k, v := range ov {
+			req.Env[k] = v
+		}
+	}
+
 	ctr, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
 		ContainerRequest: req,
 		Started:          true,
--- a/infrastructure_files/getting-started-with-dex.sh
+++ b/infrastructure_files/getting-started-with-dex.sh
@@ -1,557 +1,19 @@
-#!/bin/bash
+#!/usr/bin/env bash

-set -e
+cat >&2 <<'EOF'
+ERROR: This legacy installation script has been retired and no longer runs.

-# NetBird Getting Started with Dex IDP
-# This script sets up NetBird with Dex as the identity provider
+Dex support is not deprecated. For new deployments, use getting-started.sh:

-# Sed pattern to strip base64 padding characters
-SED_STRIP_PADDING='s/=//g'
+https://docs.netbird.io/selfhosted/selfhosted-quickstart

-check_docker_compose() {
-  if command -v docker-compose &> /dev/null
-  then
-      echo "docker-compose"
-      return
-  fi
-  if docker compose --help &> /dev/null
-  then
-      echo "docker compose"
-      return
-  fi
+The current installer includes NetBird's embedded Dex-based identity provider.
+Local users and external identity providers can be managed through the
+NetBird Dashboard:

-  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
-  exit 1
-}
+https://docs.netbird.io/selfhosted/identity-providers/local

-check_jq() {
-  if ! command -v jq &> /dev/null
-  then
-    echo "jq is not installed or not in PATH, please install with your package manager. e.g. sudo apt install jq" > /dev/stderr
-    exit 1
-  fi
-  return 0
-}
-
-get_main_ip_address() {
-  if [[ "$OSTYPE" == "darwin"* ]]; then
-    interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
-    ip_address=$(ifconfig "$interface" | grep 'inet ' | awk '{print $2}')
-  else
-    interface=$(ip route | grep default | awk '{print $5}' | head -n 1)
-    ip_address=$(ip addr show "$interface" | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)
-  fi
-
-  echo "$ip_address"
-  return 0
-}
-
-check_nb_domain() {
-  DOMAIN=$1
-  if [[ "$DOMAIN-x" == "-x" ]]; then
-    echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
-    return 1
-  fi
-
-  if [[ "$DOMAIN" == "netbird.example.com" ]]; then
-    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
-    return 1
-  fi
-  return 0
-}
-
-read_nb_domain() {
-  READ_NETBIRD_DOMAIN=""
-  echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
-  read -r READ_NETBIRD_DOMAIN < /dev/tty
-  if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
-    read_nb_domain
-  fi
-  echo "$READ_NETBIRD_DOMAIN"
-  return 0
-}
-
-get_turn_external_ip() {
-  TURN_EXTERNAL_IP_CONFIG="#external-ip="
-  IP=$(curl -s -4 https://jsonip.com | jq -r '.ip')
-  if [[ "x-$IP" != "x-" ]]; then
-    TURN_EXTERNAL_IP_CONFIG="external-ip=$IP"
-  fi
-  echo "$TURN_EXTERNAL_IP_CONFIG"
-  return 0
-}
-
-wait_dex() {
-  set +e
-  echo -n "Waiting for Dex to become ready (via $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN)"
-  counter=1
-  while true; do
-    # Check Dex through Caddy proxy (also validates TLS is working)
-    if curl -sk -f -o /dev/null "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration" 2>/dev/null; then
-      break
-    fi
-    if [[ $counter -eq 60 ]]; then
-      echo ""
-      echo "Taking too long. Checking logs..."
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 caddy
-      $DOCKER_COMPOSE_COMMAND logs --tail=20 dex
-    fi
-    echo -n " ."
-    sleep 2
-    counter=$((counter + 1))
-  done
-  echo " done"
-  set -e
-  return 0
-}
-
-init_environment() {
-  CADDY_SECURE_DOMAIN=""
-  NETBIRD_PORT=80
-  NETBIRD_HTTP_PROTOCOL="http"
-  NETBIRD_RELAY_PROTO="rel"
-  TURN_USER="self"
-  TURN_PASSWORD=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-  TURN_MIN_PORT=49152
-  TURN_MAX_PORT=65535
-  TURN_EXTERNAL_IP_CONFIG=$(get_turn_external_ip)
-
-  # Generate secrets for Dex
-  DEX_DASHBOARD_CLIENT_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
-
-  # Generate admin password
-  NETBIRD_ADMIN_PASSWORD=$(openssl rand -base64 16 | sed "$SED_STRIP_PADDING")
-
-  if ! check_nb_domain "$NETBIRD_DOMAIN"; then
-    NETBIRD_DOMAIN=$(read_nb_domain)
-  fi
-
-  if [[ "$NETBIRD_DOMAIN" == "use-ip" ]]; then
-    NETBIRD_DOMAIN=$(get_main_ip_address)
-  else
-    NETBIRD_PORT=443
-    CADDY_SECURE_DOMAIN=", $NETBIRD_DOMAIN:$NETBIRD_PORT"
-    NETBIRD_HTTP_PROTOCOL="https"
-    NETBIRD_RELAY_PROTO="rels"
-  fi
-
-  check_jq
-
-  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
-
-  if [[ -f dex.yaml ]]; then
-    echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
-    echo "You can use the following commands:"
-    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml Caddyfile dex.yaml dashboard.env turnserver.conf management.json relay.env"
-    echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
-    exit 1
-  fi
-
-  echo Rendering initial files...
-  render_docker_compose > docker-compose.yml
-  render_caddyfile > Caddyfile
-  render_dex_config > dex.yaml
-  render_dashboard_env > dashboard.env
-  render_management_json > management.json
-  render_turn_server_conf > turnserver.conf
-  render_relay_env > relay.env
-
-  echo -e "\nStarting Dex IDP\n"
-  $DOCKER_COMPOSE_COMMAND up -d caddy dex
-
-  # Wait for Dex to be ready (through caddy proxy)
-  sleep 3
-  wait_dex
-
-  echo -e "\nStarting NetBird services\n"
-  $DOCKER_COMPOSE_COMMAND up -d
-
-  echo -e "\nDone!\n"
-  echo "You can access the NetBird dashboard at $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
-  echo ""
-  echo "Login with the following credentials:"
-  install -m 600 /dev/null .env
-  printf 'Email: admin@%s\nPassword: %s\n' \
-      "$NETBIRD_DOMAIN" "$NETBIRD_ADMIN_PASSWORD" >> .env
-  echo "Email: admin@$NETBIRD_DOMAIN"
-  echo "Password: $NETBIRD_ADMIN_PASSWORD"
-  echo ""
-  echo "Dex admin UI is not available (Dex has no built-in UI)."
-  echo "To add more users, edit dex.yaml and restart: $DOCKER_COMPOSE_COMMAND restart dex"
-  return 0
-}
-
-render_caddyfile() {
-  cat <<EOF
-{
-  debug
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80${CADDY_SECURE_DOMAIN} {
-    import security_headers
-    # Relay
-    reverse_proxy /relay* relay:80
-    # Signal
-    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
-    # Management
-    reverse_proxy /api/* management:80
-    reverse_proxy /management.ManagementService/* h2c://management:80
-    # Dex
-    reverse_proxy /dex/* dex:5556
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+This compatibility notice will be removed in NetBird v0.80.
 EOF
-  return 0
-}

-render_dex_config() {
-  # Generate bcrypt hash of the admin password
-  # Using a simple approach - htpasswd or python if available
-  ADMIN_PASSWORD_HASH=""
-  if command -v htpasswd &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(htpasswd -bnBC 10 "" "$NETBIRD_ADMIN_PASSWORD" | tr -d ':\n')
-  elif command -v python3 &> /dev/null; then
-    ADMIN_PASSWORD_HASH=$(python3 -c "import bcrypt; print(bcrypt.hashpw('$NETBIRD_ADMIN_PASSWORD'.encode(), bcrypt.gensalt(rounds=10)).decode())" 2>/dev/null || echo "")
-  fi
-
-  # Fallback to a known hash if we can't generate one
-  if [[ -z "$ADMIN_PASSWORD_HASH" ]]; then
-    # This is hash of "password" - user should change it
-    ADMIN_PASSWORD_HASH='$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W'
-    NETBIRD_ADMIN_PASSWORD="password"
-    echo "Warning: Could not generate password hash. Using default password: password. Please change it in dex.yaml" > /dev/stderr
-  fi
-
-  cat <<EOF
-# Dex configuration for NetBird
-# Generated by getting-started-with-dex.sh
-
-issuer: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-
-storage:
-  type: sqlite3
-  config:
-    file: /var/dex/dex.db
-
-web:
-  http: 0.0.0.0:5556
-
-# gRPC API for user management (used by NetBird IDP manager)
-grpc:
-  addr: 0.0.0.0:5557
-
-oauth2:
-  skipApprovalScreen: true
-
-# Static OAuth2 clients for NetBird
-staticClients:
-  # Dashboard client
-  - id: netbird-dashboard
-    name: NetBird Dashboard
-    secret: $DEX_DASHBOARD_CLIENT_SECRET
-    redirectURIs:
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth
-      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth
-
-  # CLI client (public - uses PKCE)
-  - id: netbird-cli
-    name: NetBird CLI
-    public: true
-    redirectURIs:
-      - http://localhost:53000/
-      - http://localhost:54000/
-
-# Enable password database for static users
-enablePasswordDB: true
-
-# Static users - add more users here as needed
-staticPasswords:
-  - email: "admin@$NETBIRD_DOMAIN"
-    hash: "$ADMIN_PASSWORD_HASH"
-    username: "admin"
-    userID: "$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "admin-user-id-001")"
-
-# Optional: Add external identity provider connectors
-# connectors:
-#   - type: github
-#     id: github
-#     name: GitHub
-#     config:
-#       clientID: \$GITHUB_CLIENT_ID
-#       clientSecret: \$GITHUB_CLIENT_SECRET
-#       redirectURI: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/callback
-#
-#   - type: ldap
-#     id: ldap
-#     name: LDAP
-#     config:
-#       host: ldap.example.com:636
-#       insecureNoSSL: false
-#       bindDN: cn=admin,dc=example,dc=com
-#       bindPW: admin
-#       userSearch:
-#         baseDN: ou=users,dc=example,dc=com
-#         filter: "(objectClass=person)"
-#         username: uid
-#         idAttr: uid
-#         emailAttr: mail
-#         nameAttr: cn
-EOF
-  return 0
-}
-
-render_turn_server_conf() {
-  cat <<EOF
-listening-port=3478
-$TURN_EXTERNAL_IP_CONFIG
-tls-listening-port=5349
-min-port=$TURN_MIN_PORT
-max-port=$TURN_MAX_PORT
-fingerprint
-lt-cred-mech
-user=$TURN_USER:$TURN_PASSWORD
-realm=wiretrustee.com
-cert=/etc/coturn/certs/cert.pem
-pkey=/etc/coturn/private/privkey.pem
-log-file=stdout
-no-software-attribute
-pidfile="/var/tmp/turnserver.pid"
-no-cli
-EOF
-  return 0
-}
-
-render_management_json() {
-  cat <<EOF
-{
-    "Stuns": [
-        {
-            "Proto": "udp",
-            "URI": "stun:$NETBIRD_DOMAIN:3478"
-        }
-    ],
-    "Relay": {
-        "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
-        "CredentialsTTL": "24h",
-        "Secret": "$NETBIRD_RELAY_AUTH_SECRET"
-    },
-    "Signal": {
-        "Proto": "$NETBIRD_HTTP_PROTOCOL",
-        "URI": "$NETBIRD_DOMAIN:$NETBIRD_PORT"
-    },
-    "HttpConfig": {
-        "AuthIssuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex",
-        "AuthAudience": "netbird-dashboard",
-        "OIDCConfigEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration"
-    },
-    "IdpManagerConfig": {
-        "ManagerType": "dex",
-        "ClientConfig": {
-            "Issuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex"
-        },
-        "ExtraConfig": {
-            "GRPCAddr": "dex:5557"
-        }
-    },
-    "DeviceAuthorizationFlow": {
-        "Provider": "hosted",
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "DeviceAuthEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/device/code",
-            "TokenEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/token"
-        }
-    },
-    "PKCEAuthorizationFlow": {
-        "ProviderConfig": {
-            "Audience": "netbird-cli",
-            "ClientID": "netbird-cli",
-            "Scope": "openid profile email offline_access",
-            "RedirectURLs": ["http://localhost:53000/", "http://localhost:54000/"]
-        }
-    }
-}
-EOF
-  return 0
-}
-
-render_dashboard_env() {
-  cat <<EOF
-# Endpoints
-NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-NETBIRD_MGMT_GRPC_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
-# OIDC
-AUTH_AUDIENCE=netbird-dashboard
-AUTH_CLIENT_ID=netbird-dashboard
-AUTH_CLIENT_SECRET=$DEX_DASHBOARD_CLIENT_SECRET
-AUTH_AUTHORITY=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
-USE_AUTH0=false
-AUTH_SUPPORTED_SCOPES=openid profile email offline_access
-AUTH_REDIRECT_URI=/nb-auth
-AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
-# SSL
-NGINX_SSL_PORT=443
-# Letsencrypt
-LETSENCRYPT_DOMAIN=none
-EOF
-  return 0
-}
-
-render_relay_env() {
-  cat <<EOF
-NB_LOG_LEVEL=info
-NB_LISTEN_ADDRESS=:80
-NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT
-NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
-EOF
-  return 0
-}
-
-render_docker_compose() {
-  cat <<EOF
-services:
-  # Caddy reverse proxy
-  caddy:
-    image: caddy
-    container_name: netbird-caddy
-    restart: unless-stopped
-    networks: [netbird]
-    ports:
-      - '443:443'
-      - '443:443/udp'
-      - '80:80'
-    volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Dex - identity provider
-  dex:
-    image: ghcr.io/dexidp/dex:v2.38.0
-    container_name: netbird-dex
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - ./dex.yaml:/etc/dex/config.docker.yaml:ro
-      - netbird_dex_data:/var/dex
-    command: ["dex", "serve", "/etc/dex/config.docker.yaml"]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # UI dashboard
-  dashboard:
-    image: netbirdio/dashboard:latest
-    container_name: netbird-dashboard
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./dashboard.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Signal
-  signal:
-    image: netbirdio/signal:latest
-    container_name: netbird-signal
-    restart: unless-stopped
-    networks: [netbird]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Relay
-  relay:
-    image: netbirdio/relay:latest
-    container_name: netbird-relay
-    restart: unless-stopped
-    networks: [netbird]
-    env_file:
-      - ./relay.env
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Management
-  management:
-    image: netbirdio/management:latest
-    container_name: netbird-management
-    restart: unless-stopped
-    networks: [netbird]
-    volumes:
-      - netbird_management:/var/lib/netbird
-      - ./management.json:/etc/netbird/management.json
-    command: [
-      "--port", "80",
-      "--log-file", "console",
-      "--log-level", "info",
-      "--disable-anonymous-metrics=false",
-      "--single-account-mode-domain=netbird.selfhosted",
-      "--dns-domain=netbird.selfhosted",
-      "--idp-sign-key-refresh-enabled",
-    ]
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-  # Coturn, AKA TURN server
-  coturn:
-    image: coturn/coturn
-    container_name: netbird-coturn
-    restart: unless-stopped
-    volumes:
-      - ./turnserver.conf:/etc/turnserver.conf:ro
-    network_mode: host
-    command:
-      - -c /etc/turnserver.conf
-    logging:
-      driver: "json-file"
-      options:
-        max-size: "500m"
-        max-file: "2"
-
-volumes:
-  netbird_caddy_data:
-  netbird_dex_data:
-  netbird_management:
-
-networks:
-  netbird:
-EOF
-  return 0
-}
-
-init_environment
+exit 1
--- a/infrastructure_files/getting-started-with-zitadel.sh
+++ b/infrastructure_files/getting-started-with-zitadel.sh
--- a/management/internals/modules/agentnetwork/manager.go
+++ b/management/internals/modules/agentnetwork/manager.go
@@ -86,12 +86,17 @@ type Manager interface {

 // PolicySelectionInput is the per-request selection envelope. The
 // proxy populates it from CapturedData (account, user, groups) plus
-// the provider llm_router resolved.
+// the provider llm_router resolved and the model it extracted.
 type PolicySelectionInput struct {
 	AccountID  string
 	UserID     string
 	GroupIDs   []string
 	ProviderID string
+	// Model is the already-normalised upstream model id the proxy extracted
+	// (parser strips Bedrock region/version, Vertex @version), so a
+	// case-insensitive compare suffices. Empty = undetermined → not permitted
+	// (fail closed).
+	Model string
 }

 // PolicySelectionResult names the policy that "pays" for this request
--- a/management/internals/modules/agentnetwork/policyselect.go
+++ b/management/internals/modules/agentnetwork/policyselect.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"math"
 	"sort"
+	"strings"
 	"time"

 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
@@ -35,6 +36,10 @@ const (
 	denyCodeAccountTokenCapExceeded = "llm_account.token_cap_exceeded"
 	//nolint:gosec // account deny code label, not a credential
 	denyCodeAccountBudgetCapExceeded = "llm_account.budget_cap_exceeded"
+	// denyCodeModelBlocked is returned when policies govern the request's
+	// (provider, caller-groups) but none permits the model. Matches the proxy
+	// guardrail's code so both layers surface the same label.
+	denyCodeModelBlocked = "llm_policy.model_blocked"
 )

 // consumptionCache holds the consumption counters prefetched for one
@@ -159,6 +164,25 @@ func (m *managerImpl) SelectPolicyForRequest(ctx context.Context, in PolicySelec
 	}
 	candidates := filterApplicablePolicies(policies, in)

+	// Model-allowlist gate scoped to the matched policies: keep candidates whose
+	// guardrails permit the model (none enabled = unrestricted), deny when
+	// policies apply but none permits it. Skip the load when none has a guardrail.
+	if len(candidates) > 0 && anyPolicyHasGuardrails(candidates) {
+		guardrailsByID, gErr := m.loadGuardrailsByID(ctx, in.AccountID)
+		if gErr != nil {
+			return nil, gErr
+		}
+		permitted := filterModelPermittedPolicies(candidates, guardrailsByID, in.Model)
+		if len(permitted) == 0 {
+			return &PolicySelectionResult{
+				Allow:      false,
+				DenyCode:   denyCodeModelBlocked,
+				DenyReason: modelBlockedReason(in.Model),
+			}, nil
+		}
+		candidates = permitted
+	}
+
 	// Prefetch every consumption counter the ceiling + candidate policies will
 	// read, in a single store round-trip, then score against the cache.
 	cache, err := m.prefetchConsumption(ctx, in, rules, candidates, now)
@@ -250,6 +274,90 @@ func filterApplicablePolicies(policies []*types.Policy, in PolicySelectionInput)
 	return out
 }

+// anyPolicyHasGuardrails reports whether any policy references at least one
+// guardrail, so the selector can skip loading guardrails when none do.
+func anyPolicyHasGuardrails(policies []*types.Policy) bool {
+	for _, p := range policies {
+		if p != nil && len(p.GuardrailIDs) > 0 {
+			return true
+		}
+	}
+	return false
+}
+
+// loadGuardrailsByID loads the account's guardrails indexed by ID. Used by the
+// model-allowlist gate to resolve each candidate policy's attached guardrails.
+func (m *managerImpl) loadGuardrailsByID(ctx context.Context, accountID string) (map[string]*types.Guardrail, error) {
+	guardrails, err := m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		return nil, fmt.Errorf("list account guardrails: %w", err)
+	}
+	byID := make(map[string]*types.Guardrail, len(guardrails))
+	for _, g := range guardrails {
+		if g != nil {
+			byID[g.ID] = g
+		}
+	}
+	return byID, nil
+}
+
+// filterModelPermittedPolicies returns the subset of policies whose guardrails
+// permit the model. Order is preserved so downstream scoring is unaffected.
+func filterModelPermittedPolicies(policies []*types.Policy, byID map[string]*types.Guardrail, model string) []*types.Policy {
+	out := make([]*types.Policy, 0, len(policies))
+	for _, p := range policies {
+		if policyPermitsModel(p, byID, model) {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+// policyPermitsModel reports whether a policy permits the model. No
+// allowlist-enabled guardrail = unrestricted (permits any, incl. empty);
+// otherwise the model must be in the union of its allowlists, so an
+// empty/undetermined model fails closed.
+func policyPermitsModel(p *types.Policy, byID map[string]*types.Guardrail, model string) bool {
+	if p == nil {
+		return false
+	}
+	wanted := normaliseModelID(model)
+	restricted := false
+	for _, gID := range p.GuardrailIDs {
+		g, ok := byID[gID]
+		if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
+			continue
+		}
+		restricted = true
+		if wanted == "" {
+			continue
+		}
+		for _, allowed := range g.Checks.ModelAllowlist.Models {
+			if normaliseModelID(allowed) == wanted {
+				return true
+			}
+		}
+	}
+	return !restricted
+}
+
+// normaliseModelID lowercases and trims a model identifier so the allowlist
+// compare is case-insensitive and trim-tolerant. Mirrors the proxy guardrail's
+// normaliseModel so both layers agree on what "same model" means.
+func normaliseModelID(model string) string {
+	return strings.ToLower(strings.TrimSpace(model))
+}
+
+// modelBlockedReason builds the human-readable deny reason for a model-allowlist
+// rejection. The model is quoted when known; an undetermined model is reported
+// as such so the access log distinguishes "wrong model" from "no model".
+func modelBlockedReason(model string) string {
+	if normaliseModelID(model) == "" {
+		return "request model could not be determined for the policy allowlist"
+	}
+	return fmt.Sprintf("model %q is not permitted by any applicable policy allowlist", model)
+}
+
 // candidate is the per-policy intermediate the selector ranks. A
 // policy that's been exhausted on any enabled cap never makes it
 // into this slice; the selector's deny envelope carries the latest
--- a/management/internals/modules/agentnetwork/policyselect_model_test.go
+++ b/management/internals/modules/agentnetwork/policyselect_model_test.go
@@ -0,0 +1,329 @@
+package agentnetwork
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/store"
+)
+
+// guardedPolicy builds an enabled, uncapped policy that authorises sourceGroups
+// to reach providerID under the given guardrails. Uncapped keeps the selector's
+// headroom scoring trivial so these tests isolate the model-allowlist gate.
+func guardedPolicy(id, account string, sourceGroups []string, providerID string, guardrailIDs ...string) *types.Policy {
+	return &types.Policy{
+		ID:                     id,
+		AccountID:              account,
+		Enabled:                true,
+		SourceGroups:           sourceGroups,
+		DestinationProviderIDs: []string{providerID},
+		GuardrailIDs:           guardrailIDs,
+		CreatedAt:              time.Now().UTC(),
+	}
+}
+
+// allowlistGuardrail builds a guardrail whose model allowlist is enabled and
+// carries the given models.
+func allowlistGuardrail(id, account string, models ...string) *types.Guardrail {
+	return &types.Guardrail{
+		ID:        id,
+		AccountID: account,
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
+		},
+	}
+}
+
+func expectPolicies(mockStore *store.MockStore, account string, policies ...*types.Policy) {
+	mockStore.EXPECT().
+		GetAccountAgentNetworkPolicies(gomock.Any(), gomock.Any(), account).
+		Return(policies, nil)
+}
+
+func expectGuardrails(mockStore *store.MockStore, account string, guardrails ...*types.Guardrail) {
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(gomock.Any(), gomock.Any(), account).
+		Return(guardrails, nil)
+}
+
+// TestSelectPolicy_ModelBlockedByAllowlist proves the authoritative allowlist
+// decision: a policy authorises the (provider, group) but restricts the model,
+// and the requested model isn't on the list, so the request is denied.
+func TestSelectPolicy_ModelBlockedByAllowlist(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "a model outside the only applicable policy's allowlist must be denied")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode, "deny code must be model_blocked")
+	assert.NotEmpty(t, res.DenyReason, "deny reason must be populated")
+}
+
+// TestSelectPolicy_ModelAllowedByAllowlist is the allow counterpart: the model
+// is on the applicable policy's allowlist, so selection proceeds normally.
+func TestSelectPolicy_ModelAllowedByAllowlist(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o", "claude-opus-4"))
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		UserID:     "user-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "a model on the applicable policy's allowlist must be allowed")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_CaseInsensitiveModelMatch proves the compare tolerates case
+// and surrounding whitespace, matching the proxy guardrail's normalisation.
+func TestSelectPolicy_CaseInsensitiveModelMatch(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "  GPT-4o  "))
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "case/whitespace variants must match the allowlist entry")
+}
+
+// TestSelectPolicy_UnguardedPolicyIsUnrestricted is the false-deny fix: when two
+// policies authorise the same (provider, group) and one has no guardrail, that
+// policy makes the request unrestricted — not caught by the other's allowlist.
+func TestSelectPolicy_UnguardedPolicyIsUnrestricted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	restricted := guardedPolicy("pol-restricted", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	open := guardedPolicy("pol-open", "acc-1", []string{"grp-eng"}, "prov-1") // no guardrail
+	expectPolicies(mockStore, "acc-1", restricted, open)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "an un-guardrailed policy for the same (provider, group) must leave the request unrestricted")
+	assert.Equal(t, "pol-open", res.SelectedPolicyID, "the unrestricted policy must be the one that pays")
+}
+
+// TestSelectPolicy_AllowlistDoesNotLeakAcrossGroups is the false-allow fix: a
+// model allowlisted only for grp-b must not be usable by a grp-a caller. The
+// selector considers only policies applicable to the caller's groups.
+func TestSelectPolicy_AllowlistDoesNotLeakAcrossGroups(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	polA := guardedPolicy("pol-a", "acc-1", []string{"grp-a"}, "prov-1", "g-a")
+	polB := guardedPolicy("pol-b", "acc-1", []string{"grp-b"}, "prov-1", "g-b")
+	expectPolicies(mockStore, "acc-1", polA, polB)
+	expectGuardrails(mockStore, "acc-1",
+		allowlistGuardrail("g-a", "acc-1", "gpt-4o"),
+		allowlistGuardrail("g-b", "acc-1", "claude-opus-4"),
+	)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-a"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4", // only allowed for grp-b
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "grp-b's allowlisted model must not leak to a grp-a caller")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+}
+
+// TestSelectPolicy_UndeterminedModelFailsClosed proves the fail-closed contract
+// mirrors the proxy: with a restricted applicable policy and an empty model
+// (e.g. a path-routed shape the parser couldn't map), the request is denied.
+func TestSelectPolicy_UndeterminedModelFailsClosed(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", allowlistGuardrail("g-1", "acc-1", "gpt-4o"))
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "", // undetermined
+	})
+	require.NoError(t, err)
+	assert.False(t, res.Allow, "an undetermined model must fail closed against a restricted policy")
+	assert.Equal(t, denyCodeModelBlocked, res.DenyCode)
+}
+
+// TestSelectPolicy_DisabledAllowlistDoesNotRestrict proves a guardrail whose
+// model allowlist is disabled imposes no model restriction, even though the
+// policy references it.
+func TestSelectPolicy_DisabledAllowlistDoesNotRestrict(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	disabled := &types.Guardrail{
+		ID:        "g-1",
+		AccountID: "acc-1",
+		Checks: types.GuardrailChecks{
+			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}},
+		},
+	}
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1", disabled)
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "anything-goes",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "a disabled allowlist must not restrict the model")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_UnionAcrossPolicyGuardrails proves a policy with multiple
+// allowlist guardrails permits the union of their models (not just the first).
+func TestSelectPolicy_UnionAcrossPolicyGuardrails(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1", "g-2")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1",
+		allowlistGuardrail("g-1", "acc-1", "gpt-4o"),
+		allowlistGuardrail("g-2", "acc-1", "claude-opus-4"),
+	)
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4", // only in the second guardrail's list
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "a model in any of the policy's allowlist guardrails must be permitted")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_GuardrailLookupErrorPropagates proves a store failure while
+// resolving the candidate policies' guardrails surfaces as an error, not a
+// silent allow/deny.
+func TestSelectPolicy_GuardrailLookupErrorPropagates(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-1")
+	expectPolicies(mockStore, "acc-1", policy)
+	mockStore.EXPECT().
+		GetAccountAgentNetworkGuardrails(gomock.Any(), gomock.Any(), "acc-1").
+		Return(nil, errors.New("store unavailable"))
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.Error(t, err, "a guardrail-lookup failure must surface as an error")
+	assert.Nil(t, res)
+}
+
+// TestSelectPolicy_MissingGuardrailReferenceTreatedAsUnrestricted proves a
+// policy referencing a guardrail ID absent from the account's set (a stale
+// reference) imposes no model restriction — same as no guardrail.
+func TestSelectPolicy_MissingGuardrailReferenceTreatedAsUnrestricted(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	policy := guardedPolicy("pol-A", "acc-1", []string{"grp-eng"}, "prov-1", "g-missing")
+	expectPolicies(mockStore, "acc-1", policy)
+	expectGuardrails(mockStore, "acc-1")
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "anything-goes",
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow, "an orphaned guardrail reference must not restrict the model")
+	assert.Equal(t, "pol-A", res.SelectedPolicyID)
+}
+
+// TestSelectPolicy_PartialCandidatesPermittedAfterModelFilter proves the model
+// gate narrows candidates before cap scoring: the permitting policy is selected
+// even though the blocked one has a larger, more attractive cap.
+func TestSelectPolicy_PartialCandidatesPermittedAfterModelFilter(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	mgr, mockStore := newSelectorMgr(t, ctrl)
+
+	polBig := guardedPolicy("pol-big", "acc-1", []string{"grp-eng"}, "prov-1", "g-restrict")
+	polBig.Limits = types.PolicyLimits{
+		TokenLimit: types.PolicyTokenLimit{Enabled: true, GroupCap: 1_000_000, WindowSeconds: 3600},
+	}
+	polSmall := guardedPolicy("pol-small", "acc-1", []string{"grp-eng"}, "prov-1", "g-permit")
+	polSmall.Limits = types.PolicyLimits{
+		TokenLimit: types.PolicyTokenLimit{Enabled: true, GroupCap: 100, WindowSeconds: 3600},
+	}
+	expectPolicies(mockStore, "acc-1", polBig, polSmall)
+	expectGuardrails(mockStore, "acc-1",
+		allowlistGuardrail("g-restrict", "acc-1", "gpt-4o"),
+		allowlistGuardrail("g-permit", "acc-1", "claude-opus-4"),
+	)
+	expectConsumptionBatch(mockStore, nil)
+
+	res, err := mgr.SelectPolicyForRequest(context.Background(), PolicySelectionInput{
+		AccountID:  "acc-1",
+		GroupIDs:   []string{"grp-eng"},
+		ProviderID: "prov-1",
+		Model:      "claude-opus-4", // only pol-small's guardrail permits this
+	})
+	require.NoError(t, err)
+	assert.True(t, res.Allow)
+	assert.Equal(t, "pol-small", res.SelectedPolicyID,
+		"the model filter must exclude pol-big before cap scoring")
+}
--- a/management/internals/modules/agentnetwork/synthesizer.go
+++ b/management/internals/modules/agentnetwork/synthesizer.go
@@ -235,7 +235,12 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([

 	mergedGuardrails := mergeGuardrails(enabledPolicies, guardrailsByID)
 	applyAccountCollectionControls(&mergedGuardrails, settings)
-	guardrailJSON, err := marshalGuardrailConfig(mergedGuardrails)
+	// The proxy guardrail is a per-provider fail-closed backstop; the
+	// authoritative per-policy/group decision is management's
+	// SelectPolicyForRequest. A provider lands in this map only when every
+	// authorising policy restricts models.
+	providerAllowlists := buildProviderAllowlists(enabledPolicies, guardrailsByID)
+	guardrailJSON, err := marshalGuardrailConfig(providerAllowlists, mergedGuardrails.PromptCapture)
 	if err != nil {
 		return nil, err
 	}
@@ -780,10 +785,12 @@ func buildMiddlewareChain(routerCfgJSON, identityInjectJSON, guardrailJSON []byt

 // guardrailConfig is the JSON shape the proxy-side llm_guardrail
 // middleware expects. Mirrors the proxy registration documented in
-// the management→proxy contract.
+// the management→proxy contract. provider_allowlists is keyed by the
+// resolved provider id llm_router stamps; a provider absent from the map is
+// unrestricted at the proxy layer.
 type guardrailConfig struct {
-	ModelAllowlist []string               `json:"model_allowlist,omitempty"`
-	PromptCapture  guardrailPromptCapture `json:"prompt_capture"`
+	ProviderAllowlists map[string][]string    `json:"provider_allowlists,omitempty"`
+	PromptCapture      guardrailPromptCapture `json:"prompt_capture"`
 }

 type guardrailPromptCapture struct {
@@ -828,13 +835,10 @@ func applyAccountCollectionControls(merged *MergedGuardrails, settings *types.Se
 	merged.PromptCapture.RedactPii = settings.RedactPii || merged.PromptCapture.RedactPii
 }

-func marshalGuardrailConfig(merged MergedGuardrails) ([]byte, error) {
+func marshalGuardrailConfig(providerAllowlists map[string][]string, capture MergedPromptCapture) ([]byte, error) {
 	cfg := guardrailConfig{
-		ModelAllowlist: merged.ModelAllowlist,
-		PromptCapture: guardrailPromptCapture{
-			Enabled:   merged.PromptCapture.Enabled,
-			RedactPii: merged.PromptCapture.RedactPii,
-		},
+		ProviderAllowlists: providerAllowlists,
+		PromptCapture:      guardrailPromptCapture(capture),
 	}
 	out, err := json.Marshal(cfg)
 	if err != nil {
@@ -843,6 +847,74 @@ func marshalGuardrailConfig(merged MergedGuardrails) ([]byte, error) {
 	return out, nil
 }

+// buildProviderAllowlists returns the proxy's per-provider backstop: a provider
+// is included only when every authorising policy restricts models (their union);
+// if any leaves it unrestricted it is omitted, so management decides per group.
+func buildProviderAllowlists(policies []*types.Policy, byID map[string]*types.Guardrail) map[string][]string {
+	type providerAcc struct {
+		models          map[string]struct{}
+		anyUnrestricted bool
+	}
+	accs := make(map[string]*providerAcc)
+	for _, p := range policies {
+		if p == nil {
+			continue
+		}
+		restricted, models := policyModelAllowlist(p, byID)
+		for _, providerID := range p.DestinationProviderIDs {
+			if providerID == "" {
+				continue
+			}
+			acc, ok := accs[providerID]
+			if !ok {
+				acc = &providerAcc{models: make(map[string]struct{})}
+				accs[providerID] = acc
+			}
+			if !restricted {
+				acc.anyUnrestricted = true
+				continue
+			}
+			for _, m := range models {
+				acc.models[m] = struct{}{}
+			}
+		}
+	}
+	out := make(map[string][]string, len(accs))
+	for providerID, acc := range accs {
+		if acc.anyUnrestricted {
+			continue
+		}
+		models := make([]string, 0, len(acc.models))
+		for m := range acc.models {
+			models = append(models, m)
+		}
+		sort.Strings(models)
+		out[providerID] = models
+	}
+	return out
+}
+
+// policyModelAllowlist reports whether a policy restricts models (has an
+// allowlist-enabled guardrail) and the union of allowed models. Models are
+// verbatim; the proxy factory lowercases/trims them at decode time.
+func policyModelAllowlist(p *types.Policy, byID map[string]*types.Guardrail) (bool, []string) {
+	restricted := false
+	var models []string
+	for _, gID := range p.GuardrailIDs {
+		g, ok := byID[gID]
+		if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
+			continue
+		}
+		restricted = true
+		for _, m := range g.Checks.ModelAllowlist.Models {
+			if m != "" {
+				models = append(models, m)
+			}
+		}
+	}
+	return restricted, models
+}
+
 // buildAccountService composes the per-account gateway Service. The
 // target carries the noop placeholder URL — the router middleware
 // rewrites every request to the matched provider's upstream before the
@@ -986,38 +1058,11 @@ func unionSourceGroups(policies []*types.Policy) []string {
 	return out
 }

-// MergedGuardrails is the JSON shape passed to the proxy via the
-// guardrail middleware's config_json. Mirrors the proxy-side
-// expectations and is intentionally distinct from
-// types.GuardrailChecks so we can evolve either side independently.
+// MergedGuardrails is the synthesiser's fold target. Only prompt capture is
+// merged here — the model allowlist is emitted per-provider, and
+// token/budget/retention moved onto Policy.Limits and account Settings.
 type MergedGuardrails struct {
-	ModelAllowlist []string            `json:"model_allowlist,omitempty"`
-	TokenLimits    MergedTokenLimits   `json:"token_limits"`
-	Budget         MergedBudget        `json:"budget"`
-	PromptCapture  MergedPromptCapture `json:"prompt_capture"`
-	Retention      MergedRetention     `json:"retention"`
-}
-
-type MergedTokenLimits struct {
-	Hourly  *MergedTokenWindow `json:"hourly,omitempty"`
-	Daily   *MergedTokenWindow `json:"daily,omitempty"`
-	Monthly *MergedTokenWindow `json:"monthly,omitempty"`
-}
-
-type MergedTokenWindow struct {
-	MaxInputTokens  int `json:"max_input_tokens,omitempty"`
-	MaxOutputTokens int `json:"max_output_tokens,omitempty"`
-}
-
-type MergedBudget struct {
-	Hourly  *MergedBudgetWindow `json:"hourly,omitempty"`
-	Daily   *MergedBudgetWindow `json:"daily,omitempty"`
-	Monthly *MergedBudgetWindow `json:"monthly,omitempty"`
-}
-
-type MergedBudgetWindow struct {
-	SoftCapUSD float64 `json:"soft_cap_usd,omitempty"`
-	HardCapUSD float64 `json:"hard_cap_usd,omitempty"`
+	PromptCapture MergedPromptCapture
 }

 type MergedPromptCapture struct {
@@ -1025,64 +1070,31 @@ type MergedPromptCapture struct {
 	RedactPii bool `json:"redact_pii"`
 }

-type MergedRetention struct {
-	Enabled bool `json:"enabled"`
-	Days    int  `json:"days"`
-}
-
-// mergeGuardrails computes the effective guardrail spec applied at the
-// proxy, given the referencing policies and the account's guardrail
-// catalogue. Policy enabled-ness is the caller's responsibility — only
-// enabled policies should be passed in.
+// mergeGuardrails folds the referencing policies' guardrails into the
+// prompt-capture decision only. The model allowlist is enforced per-policy/group
+// in management and shipped per-provider; token/budget/retention live off
+// guardrails now.
 //
-// Merge rules:
-//   - Model allowlist:   union of allowlists across policies that enable it.
-//   - Token / Budget:    most-restrictive (min of non-zero caps) per window.
-//   - Prompt capture:    enabled if any policy enables it; redact_pii sticks
-//     if any enabling policy turns it on.
-//   - Retention:         enabled if any enables it; smallest non-zero days wins.
+// Merge rule — prompt capture: enabled if any policy enables it; redact_pii
+// sticks if any enabling policy turns it on.
 func mergeGuardrails(policies []*types.Policy, byID map[string]*types.Guardrail) MergedGuardrails {
 	merged := MergedGuardrails{}
-	allowlist := make(map[string]struct{})
-	allowlistEnabled := false
-
 	for _, policy := range policies {
 		for _, gID := range policy.GuardrailIDs {
 			g, ok := byID[gID]
 			if !ok || g == nil {
 				continue
 			}
-			mergeGuardrail(g, &merged, allowlist, &allowlistEnabled)
+			mergeGuardrail(g, &merged)
 		}
 	}
-
-	if allowlistEnabled {
-		merged.ModelAllowlist = make([]string, 0, len(allowlist))
-		for m := range allowlist {
-			merged.ModelAllowlist = append(merged.ModelAllowlist, m)
-		}
-		sort.Strings(merged.ModelAllowlist)
-	}
 	return merged
 }

-// mergeGuardrail folds a single guardrail's enabled checks into the
-// running merge: model-allowlist models join the shared set (and flip
-// allowlistEnabled), and prompt-capture / redact-pii stick once any
-// enabling guardrail turns them on.
-//
-// TokenLimits, Budget, and Retention have moved off guardrails — token
-// and budget caps now live on the Policy itself (Policy.Limits) and
-// retention moves to account-level Settings — so they are not merged here.
-func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails, allowlist map[string]struct{}, allowlistEnabled *bool) {
-	if g.Checks.ModelAllowlist.Enabled {
-		*allowlistEnabled = true
-		for _, m := range g.Checks.ModelAllowlist.Models {
-			if m != "" {
-				allowlist[m] = struct{}{}
-			}
-		}
-	}
+// mergeGuardrail folds a single guardrail's prompt-capture settings into the
+// running merge: enabled / redact-pii stick once any enabling guardrail turns
+// them on.
+func mergeGuardrail(g *types.Guardrail, merged *MergedGuardrails) {
 	if g.Checks.PromptCapture.Enabled {
 		merged.PromptCapture.Enabled = true
 		if g.Checks.PromptCapture.RedactPii {
--- a/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_guardrail_realstore_test.go
@@ -81,8 +81,8 @@ func TestSynthesizeServices_RealStore_PromptCaptureAccountIsSoleControl(t *testi
 	require.Len(t, services, 1)

 	cfg := decodeServiceGuardrailConfig(t, services[0])
-	assert.Equal(t, []string{"gpt-5.4"}, cfg.ModelAllowlist,
-		"model allowlist is a pure policy guardrail and must always reach the config")
+	assert.Equal(t, map[string][]string{"prov-1": {"gpt-5.4"}}, cfg.ProviderAllowlists,
+		"model allowlist is a pure policy guardrail and must reach the per-provider config")
 	assert.False(t, cfg.PromptCapture.Enabled,
 		"prompt capture must be off when the account toggle is off, even with a capture-enabled guardrail")
 }
@@ -172,7 +172,7 @@ func TestSynthesizeServices_RealStore_NoGuardrail_CaptureOff(t *testing.T) {
 	require.Len(t, services, 1, "exactly one synth service expected")

 	cfg := decodeServiceGuardrailConfig(t, services[0])
-	assert.Empty(t, cfg.ModelAllowlist, "no guardrail → no allowlist")
+	assert.Empty(t, cfg.ProviderAllowlists, "no guardrail → provider unrestricted (absent from map)")
 	assert.False(t, cfg.PromptCapture.Enabled, "no guardrail → prompt capture off by default")
 	assert.False(t, cfg.PromptCapture.RedactPii, "no guardrail → redact off by default")
 }
--- a/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_provider_allowlist_test.go
@@ -0,0 +1,95 @@
+package agentnetwork
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+)
+
+// policyForProviders builds an enabled policy authorising the given providers
+// under the given guardrails (both optional). Groups are irrelevant to
+// buildProviderAllowlists, which keys purely on destination provider.
+func policyForProviders(id string, guardrailIDs []string, providerIDs ...string) *types.Policy {
+	return &types.Policy{
+		ID:                     id,
+		Enabled:                true,
+		DestinationProviderIDs: providerIDs,
+		GuardrailIDs:           guardrailIDs,
+	}
+}
+
+func TestBuildProviderAllowlists(t *testing.T) {
+	byID := map[string]*types.Guardrail{
+		"g-4o":       allowlistGuardrail("g-4o", "acc-1", "gpt-4o"),
+		"g-opus":     allowlistGuardrail("g-opus", "acc-1", "claude-opus-4"),
+		"g-disabled": {ID: "g-disabled", Checks: types.GuardrailChecks{ModelAllowlist: types.GuardrailModelAllowlist{Enabled: false, Models: []string{"gpt-4o"}}}},
+	}
+
+	t.Run("all authorising policies restrict yields per-provider union", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x"),
+			policyForProviders("p2", []string{"g-opus"}, "prov-x"),
+		}
+		got := buildProviderAllowlists(policies, byID)
+		assert.Equal(t, map[string][]string{"prov-x": {"claude-opus-4", "gpt-4o"}}, got,
+			"a provider every policy restricts carries the sorted union of their models")
+	})
+
+	t.Run("any un-guardrailed policy leaves the provider unrestricted (omitted)", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x"),
+			policyForProviders("p2", nil, "prov-x"), // no guardrail
+		}
+		got := buildProviderAllowlists(policies, byID)
+		assert.NotContains(t, got, "prov-x",
+			"a provider reachable by an un-guardrailed policy must be omitted so the proxy treats it as unrestricted")
+	})
+
+	t.Run("a disabled allowlist counts as unrestricted", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-disabled"}, "prov-x"),
+		}
+		got := buildProviderAllowlists(policies, byID)
+		assert.NotContains(t, got, "prov-x",
+			"a policy whose only guardrail has a disabled allowlist is unrestricted")
+	})
+
+	t.Run("providers are isolated from one another", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x"),
+			policyForProviders("p2", []string{"g-opus"}, "prov-y"),
+		}
+		got := buildProviderAllowlists(policies, byID)
+		assert.Equal(t, []string{"gpt-4o"}, got["prov-x"], "prov-x keeps only its own model")
+		assert.Equal(t, []string{"claude-opus-4"}, got["prov-y"], "prov-y keeps only its own model")
+	})
+
+	t.Run("one policy authorising two providers restricts both", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o"}, "prov-x", "prov-y"),
+		}
+		got := buildProviderAllowlists(policies, byID)
+		assert.Equal(t, []string{"gpt-4o"}, got["prov-x"])
+		assert.Equal(t, []string{"gpt-4o"}, got["prov-y"])
+	})
+
+	t.Run("union across a single policy's guardrails", func(t *testing.T) {
+		policies := []*types.Policy{
+			policyForProviders("p1", []string{"g-4o", "g-opus"}, "prov-x"),
+		}
+		got := buildProviderAllowlists(policies, byID)
+		assert.ElementsMatch(t, []string{"claude-opus-4", "gpt-4o"}, got["prov-x"],
+			"a policy's own multiple allowlist guardrails union together")
+	})
+
+	t.Run("an enabled allowlist with no models denies everything", func(t *testing.T) {
+		empty := map[string]*types.Guardrail{"g-empty": allowlistGuardrail("g-empty", "acc-1")}
+		got := buildProviderAllowlists([]*types.Policy{
+			policyForProviders("p1", []string{"g-empty"}, "prov-x"),
+		}, empty)
+		assert.Equal(t, map[string][]string{"prov-x": {}}, got,
+			"an enabled-but-empty allowlist is restricted with an empty set, not unrestricted")
+	})
+}
--- a/management/internals/modules/agentnetwork/synthesizer_test.go
+++ b/management/internals/modules/agentnetwork/synthesizer_test.go
@@ -1031,8 +1031,12 @@ func TestSynthesizeServices_GuardrailMerge_AllowlistUnion_LimitsRestrictive(t *t

 	var cfg guardrailConfig
 	require.NoError(t, json.Unmarshal(guardrailJSON, &cfg), "guardrail config must unmarshal cleanly")
-	assert.ElementsMatch(t, []string{"gpt-5.4-mini", "gpt-5.4-pro"}, cfg.ModelAllowlist,
-		"model allowlist union must keep both models")
+	// Both policies restrict the same provider, so the per-provider backstop
+	// carries the union of their models — a coarse gate that management's
+	// per-policy/group check narrows; it only blocks models outside the union
+	// when management is down.
+	assert.ElementsMatch(t, []string{"gpt-5.4-mini", "gpt-5.4-pro"}, cfg.ProviderAllowlists["prov-1"],
+		"per-provider allowlist union must keep both models")
 }

 func TestSynthesizeServices_BackfillsMissingSessionKeys(t *testing.T) {
--- a/management/internals/shared/grpc/components_envelope_response.go
+++ b/management/internals/shared/grpc/components_envelope_response.go
@@ -50,7 +50,7 @@ func ToComponentSyncResponse(
 	// TODO (dmitri) consider using invariants?
 	//
 	enableSSH := computeSSHEnabledForPeer(components, peer)
-	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH)
+	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution)

 	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
 	useSourcePrefixes := peer.SupportsSourcePrefixes()
--- a/management/internals/shared/grpc/conversion.go
+++ b/management/internals/shared/grpc/conversion.go
@@ -119,7 +119,7 @@ func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken
 	return nbConfig
 }

-func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool) *proto.PeerConfig {
+func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool, forceRoutingPeerDNS bool) *proto.PeerConfig {
 	netmask, _ := network.Net.Mask.Size()
 	fqdn := peer.FQDN(dnsName)

@@ -135,7 +135,7 @@ func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, set
 		Address:                         fmt.Sprintf("%s/%d", peer.IP.String(), netmask),
 		SshConfig:                       sshConfig,
 		Fqdn:                            fqdn,
-		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled,
+		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled || peer.ProxyMeta.Embedded || forceRoutingPeerDNS,
 		LazyConnectionEnabled:           settings.LazyConnectionEnabled,
 		AutoUpdate: &proto.AutoUpdateSettings{
 			Version:      settings.AutoUpdateVersion,
@@ -162,12 +162,12 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	useSourcePrefixes := peer.SupportsSourcePrefixes()

 	response := &proto.SyncResponse{
-		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
+		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
 		NetworkMap: &proto.NetworkMap{
 			Serial:     networkMap.Network.CurrentSerial(),
 			Routes:     networkmap.ToProtocolRoutes(networkMap.Routes),
 			DNSConfig:  networkmap.ToProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
-			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
+			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
 		},
 		Checks: toProtocolChecks(ctx, checks),
 	}
--- a/management/internals/shared/grpc/conversion_test.go
+++ b/management/internals/shared/grpc/conversion_test.go
@@ -2,6 +2,7 @@ package grpc

 import (
 	"fmt"
+	"net"
 	"net/netip"
 	"reflect"
 	"testing"
@@ -14,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
 )
@@ -301,3 +303,35 @@ func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
 		assert.True(t, nbCfg.Metrics.Enabled, "metrics flag should carry the settings value")
 	})
 }
+
+func TestToPeerConfig_RoutingPeerDNSResolution(t *testing.T) {
+	network := &types.Network{Net: net.IPNet{IP: net.IPv4(100, 0, 0, 0), Mask: net.CIDRMask(8, 32)}}
+
+	newPeer := func(embedded bool) *nbpeer.Peer {
+		p := &nbpeer.Peer{IP: netip.MustParseAddr("100.0.0.1")}
+		p.ProxyMeta.Embedded = embedded
+		return p
+	}
+
+	tests := []struct {
+		name        string
+		globalFlag  bool
+		embedded    bool
+		forceParam  bool
+		wantEnabled bool
+	}{
+		{name: "global off, regular peer, no force", wantEnabled: false},
+		{name: "global on wins", globalFlag: true, wantEnabled: true},
+		{name: "embedded proxy peer forced", embedded: true, wantEnabled: true},
+		{name: "routing peer forced via param", forceParam: true, wantEnabled: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			settings := &types.Settings{RoutingPeerDNSResolutionEnabled: tt.globalFlag}
+			cfg := toPeerConfig(newPeer(tt.embedded), network, "netbird.selfhosted", settings, nil, nil, false, tt.forceParam)
+			assert.Equal(t, tt.wantEnabled, cfg.RoutingPeerDnsResolutionEnabled,
+				"RoutingPeerDnsResolutionEnabled should reflect global || embedded || forced")
+		})
+	}
+}
--- a/management/internals/shared/grpc/proxy.go
+++ b/management/internals/shared/grpc/proxy.go
@@ -285,6 +285,7 @@ func (s *ProxyServiceServer) CheckLLMPolicyLimits(ctx context.Context, req *prot
 		UserID:     req.GetUserId(),
 		GroupIDs:   req.GetGroupIds(),
 		ProviderID: req.GetProviderId(),
+		Model:      req.GetModel(),
 	})
 	if err != nil {
 		log.WithContext(ctx).Errorf("select policy for request: %v", err)
--- a/management/internals/shared/grpc/proxy_llm_policy_limits_test.go
+++ b/management/internals/shared/grpc/proxy_llm_policy_limits_test.go
@@ -0,0 +1,138 @@
+package grpc
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	grpcstatus "google.golang.org/grpc/status"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+// fakeAgentNetworkLimits records the PolicySelectionInput it was invoked with
+// and returns a pre-programmed result, so tests can assert what the handler
+// forwards to the selector.
+type fakeAgentNetworkLimits struct {
+	gotInput agentnetwork.PolicySelectionInput
+	result   *agentnetwork.PolicySelectionResult
+	err      error
+}
+
+func (f *fakeAgentNetworkLimits) SelectPolicyForRequest(_ context.Context, in agentnetwork.PolicySelectionInput) (*agentnetwork.PolicySelectionResult, error) {
+	f.gotInput = in
+	if f.err != nil {
+		return nil, f.err
+	}
+	return f.result, nil
+}
+
+func (f *fakeAgentNetworkLimits) RecordUsage(_ context.Context, _ agentnetwork.RecordUsageInput) error {
+	return nil
+}
+
+// TestCheckLLMPolicyLimits_ForwardsModelToSelector proves the wiring added here:
+// the model the proxy extracted must reach the selector's Model unchanged,
+// alongside the account/user/group/provider fields.
+func TestCheckLLMPolicyLimits_ForwardsModelToSelector(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{Allow: true, SelectedPolicyID: "pol-1"}}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	req := &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		UserId:     "user-1",
+		GroupIds:   []string{"grp-a", "grp-b"},
+		ProviderId: "prov-1",
+		Model:      "claude-opus-4",
+	}
+
+	resp, err := s.CheckLLMPolicyLimits(context.Background(), req)
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+
+	assert.Equal(t, "acc-1", fake.gotInput.AccountID)
+	assert.Equal(t, "user-1", fake.gotInput.UserID)
+	assert.Equal(t, []string{"grp-a", "grp-b"}, fake.gotInput.GroupIDs)
+	assert.Equal(t, "prov-1", fake.gotInput.ProviderID)
+	assert.Equal(t, "claude-opus-4", fake.gotInput.Model,
+		"the request's model must be forwarded to the selector")
+}
+
+// TestCheckLLMPolicyLimits_EmptyModelForwardedAsEmpty proves an undetermined
+// model (empty string) is forwarded as-is; the selector decides how to treat it.
+func TestCheckLLMPolicyLimits_EmptyModelForwardedAsEmpty(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{Allow: true}}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	req := &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+	}
+
+	_, err := s.CheckLLMPolicyLimits(context.Background(), req)
+	require.NoError(t, err)
+	assert.Equal(t, "", fake.gotInput.Model, "an absent model must be forwarded as empty, not fabricated")
+}
+
+// TestCheckLLMPolicyLimits_DenyResponseCarriesModelBlockedCode proves the deny
+// envelope surfaces the model-allowlist deny code + reason through the response.
+func TestCheckLLMPolicyLimits_DenyResponseCarriesModelBlockedCode(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{result: &agentnetwork.PolicySelectionResult{
+		Allow:      false,
+		DenyCode:   "llm_policy.model_blocked",
+		DenyReason: `model "claude-opus-4" is not permitted by any applicable policy allowlist`,
+	}}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	resp, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+		Model:      "claude-opus-4",
+	})
+	require.NoError(t, err)
+	require.NotNil(t, resp)
+	assert.Equal(t, "deny", resp.Decision)
+	assert.Equal(t, "llm_policy.model_blocked", resp.DenyCode)
+	assert.NotEmpty(t, resp.DenyReason)
+	assert.Empty(t, resp.SelectedPolicyId, "a denied request must carry no selected policy")
+}
+
+// TestCheckLLMPolicyLimits_SelectorErrorSurfacesAsInternal proves a selector
+// failure surfaces as an Internal gRPC error rather than a silent allow.
+func TestCheckLLMPolicyLimits_SelectorErrorSurfacesAsInternal(t *testing.T) {
+	fake := &fakeAgentNetworkLimits{err: errors.New("boom")}
+	s := &ProxyServiceServer{}
+	s.SetAgentNetworkLimitsService(fake)
+
+	_, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+		Model:      "gpt-4o",
+	})
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.Internal, st.Code(), "selector errors must never fail open on the hot path")
+}
+
+// TestCheckLLMPolicyLimits_UnconfiguredServiceReturnsUnimplemented locks the
+// fallback: with no limits service wired the RPC returns Unimplemented.
+func TestCheckLLMPolicyLimits_UnconfiguredServiceReturnsUnimplemented(t *testing.T) {
+	s := &ProxyServiceServer{}
+
+	_, err := s.CheckLLMPolicyLimits(context.Background(), &proto.CheckLLMPolicyLimitsRequest{
+		AccountId:  "acc-1",
+		ProviderId: "prov-1",
+	})
+	require.Error(t, err)
+	st, ok := grpcstatus.FromError(err)
+	require.True(t, ok)
+	assert.Equal(t, codes.Unimplemented, st.Code())
+}
--- a/management/internals/shared/grpc/server.go
+++ b/management/internals/shared/grpc/server.go
@@ -921,7 +921,7 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 	// if peer has reached this point then it has logged in
 	loginResp := &proto.LoginResponse{
 		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, settings),
-		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
+		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH, false),
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}

--- a/management/server/store/sql_store.go
+++ b/management/server/store/sql_store.go
@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"math"
 	"net"
 	"net/netip"
 	"net/url"
@@ -2258,117 +2259,30 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 	return checks, nil
 }

-func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
-		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
-		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
-		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
-		private, access_groups
-		FROM services WHERE account_id = $1`
+// serviceSelectColumns and targetSelectColumns are the column lists the Postgres
+// pgx read path scans. They must stay in sync with the rpservice.Service and
+// rpservice.Target gorm models; TestPgxServiceColumnsMatchGorm enforces this.
+const serviceSelectColumns = `id, account_id, name, domain, enabled, auth, restrictions,
+	meta_created_at, meta_certificate_issued_at, meta_last_renewed_at, meta_status, proxy_cluster,
+	pass_host_header, rewrite_redirects, session_private_key, session_public_key,
+	mode, listen_port, port_auto_assigned, source, source_peer, terminated,
+	private, access_groups`

-	const targetsQuery = `SELECT id, account_id, service_id, path, host, port, protocol,
-		target_id, target_type, enabled
-		FROM targets WHERE service_id = ANY($1)`
+const targetSelectColumns = `id, account_id, service_id, path, host, port, protocol,
+	target_id, target_type, enabled, proxy_protocol,
+	skip_tls_verify, request_timeout, session_idle_timeout, path_rewrite, custom_headers,
+	direct_upstream, middlewares, capture_max_request_bytes, capture_max_response_bytes,
+	capture_content_types, agent_network, disable_access_log`
+
+func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
+	const serviceQuery = `SELECT ` + serviceSelectColumns + ` FROM services WHERE account_id = $1`

 	serviceRows, err := s.pool.Query(ctx, serviceQuery, accountID)
 	if err != nil {
 		return nil, err
 	}

-	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
-		var s rpservice.Service
-		var auth []byte
-		var accessGroups []byte
-		var createdAt, certIssuedAt sql.NullTime
-		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
-		var mode, source, sourcePeer sql.NullString
-		var terminated, portAutoAssigned, private sql.NullBool
-		var listenPort sql.NullInt64
-		err := row.Scan(
-			&s.ID,
-			&s.AccountID,
-			&s.Name,
-			&s.Domain,
-			&s.Enabled,
-			&auth,
-			&createdAt,
-			&certIssuedAt,
-			&status,
-			&proxyCluster,
-			&s.PassHostHeader,
-			&s.RewriteRedirects,
-			&sessionPrivateKey,
-			&sessionPublicKey,
-			&mode,
-			&listenPort,
-			&portAutoAssigned,
-			&source,
-			&sourcePeer,
-			&terminated,
-			&private,
-			&accessGroups,
-		)
-		if err != nil {
-			return nil, err
-		}
-
-		if auth != nil {
-			if err := json.Unmarshal(auth, &s.Auth); err != nil {
-				return nil, err
-			}
-		}
-
-		if len(accessGroups) > 0 {
-			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
-				return nil, fmt.Errorf("unmarshal access_groups: %w", err)
-			}
-		}
-
-		if private.Valid {
-			s.Private = private.Bool
-		}
-
-		s.Meta = rpservice.Meta{}
-		if createdAt.Valid {
-			s.Meta.CreatedAt = createdAt.Time
-		}
-		if certIssuedAt.Valid {
-			t := certIssuedAt.Time
-			s.Meta.CertificateIssuedAt = &t
-		}
-		if status.Valid {
-			s.Meta.Status = status.String
-		}
-		if proxyCluster.Valid {
-			s.ProxyCluster = proxyCluster.String
-		}
-		if sessionPrivateKey.Valid {
-			s.SessionPrivateKey = sessionPrivateKey.String
-		}
-		if sessionPublicKey.Valid {
-			s.SessionPublicKey = sessionPublicKey.String
-		}
-		if mode.Valid {
-			s.Mode = mode.String
-		}
-		if source.Valid {
-			s.Source = source.String
-		}
-		if sourcePeer.Valid {
-			s.SourcePeer = sourcePeer.String
-		}
-		if terminated.Valid {
-			s.Terminated = terminated.Bool
-		}
-		if portAutoAssigned.Valid {
-			s.PortAutoAssigned = portAutoAssigned.Bool
-		}
-		if listenPort.Valid {
-			s.ListenPort = uint16(listenPort.Int64)
-		}
-		s.Targets = []*rpservice.Target{}
-		return &s, nil
-	})
+	services, err := pgx.CollectRows(serviceRows, scanService)
 	if err != nil {
 		return nil, err
 	}
@@ -2379,39 +2293,12 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv

 	serviceIDs := make([]string, len(services))
 	serviceMap := make(map[string]*rpservice.Service)
-	for i, s := range services {
-		serviceIDs[i] = s.ID
-		serviceMap[s.ID] = s
+	for i, svc := range services {
+		serviceIDs[i] = svc.ID
+		serviceMap[svc.ID] = svc
 	}

-	targetRows, err := s.pool.Query(ctx, targetsQuery, serviceIDs)
-	if err != nil {
-		return nil, err
-	}
-
-	targets, err := pgx.CollectRows(targetRows, func(row pgx.CollectableRow) (*rpservice.Target, error) {
-		var t rpservice.Target
-		var path sql.NullString
-		err := row.Scan(
-			&t.ID,
-			&t.AccountID,
-			&t.ServiceID,
-			&path,
-			&t.Host,
-			&t.Port,
-			&t.Protocol,
-			&t.TargetId,
-			&t.TargetType,
-			&t.Enabled,
-		)
-		if err != nil {
-			return nil, err
-		}
-		if path.Valid {
-			t.Path = &path.String
-		}
-		return &t, nil
-	})
+	targets, err := s.getServiceTargets(ctx, serviceIDs)
 	if err != nil {
 		return nil, err
 	}
@@ -2425,6 +2312,201 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 	return services, nil
 }

+func scanService(row pgx.CollectableRow) (*rpservice.Service, error) {
+	var s rpservice.Service
+	var auth []byte
+	var restrictions []byte
+	var accessGroups []byte
+	var createdAt, certIssuedAt, lastRenewedAt sql.NullTime
+	var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
+	var mode, source, sourcePeer sql.NullString
+	var terminated, portAutoAssigned, private sql.NullBool
+	var listenPort sql.NullInt64
+	err := row.Scan(
+		&s.ID,
+		&s.AccountID,
+		&s.Name,
+		&s.Domain,
+		&s.Enabled,
+		&auth,
+		&restrictions,
+		&createdAt,
+		&certIssuedAt,
+		&lastRenewedAt,
+		&status,
+		&proxyCluster,
+		&s.PassHostHeader,
+		&s.RewriteRedirects,
+		&sessionPrivateKey,
+		&sessionPublicKey,
+		&mode,
+		&listenPort,
+		&portAutoAssigned,
+		&source,
+		&sourcePeer,
+		&terminated,
+		&private,
+		&accessGroups,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	if auth != nil {
+		if err := json.Unmarshal(auth, &s.Auth); err != nil {
+			return nil, err
+		}
+	}
+
+	if len(restrictions) > 0 {
+		if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
+			return nil, fmt.Errorf("unmarshal restrictions: %w", err)
+		}
+	}
+
+	if len(accessGroups) > 0 {
+		if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
+			return nil, fmt.Errorf("unmarshal access_groups: %w", err)
+		}
+	}
+
+	if private.Valid {
+		s.Private = private.Bool
+	}
+
+	s.Meta = serviceMetaFromRow(createdAt, certIssuedAt, lastRenewedAt, status)
+	if proxyCluster.Valid {
+		s.ProxyCluster = proxyCluster.String
+	}
+	if sessionPrivateKey.Valid {
+		s.SessionPrivateKey = sessionPrivateKey.String
+	}
+	if sessionPublicKey.Valid {
+		s.SessionPublicKey = sessionPublicKey.String
+	}
+	if mode.Valid {
+		s.Mode = mode.String
+	}
+	if source.Valid {
+		s.Source = source.String
+	}
+	if sourcePeer.Valid {
+		s.SourcePeer = sourcePeer.String
+	}
+	if terminated.Valid {
+		s.Terminated = terminated.Bool
+	}
+	if portAutoAssigned.Valid {
+		s.PortAutoAssigned = portAutoAssigned.Bool
+	}
+	if listenPort.Valid {
+		if listenPort.Int64 < 0 || listenPort.Int64 > math.MaxUint16 {
+			return nil, fmt.Errorf("listen_port %d out of range", listenPort.Int64)
+		}
+		s.ListenPort = uint16(listenPort.Int64)
+	}
+	s.Targets = []*rpservice.Target{}
+	return &s, nil
+}
+
+func serviceMetaFromRow(createdAt, certIssuedAt, lastRenewedAt sql.NullTime, status sql.NullString) rpservice.Meta {
+	meta := rpservice.Meta{}
+	if createdAt.Valid {
+		meta.CreatedAt = createdAt.Time
+	}
+	if certIssuedAt.Valid {
+		t := certIssuedAt.Time
+		meta.CertificateIssuedAt = &t
+	}
+	if lastRenewedAt.Valid {
+		t := lastRenewedAt.Time
+		meta.LastRenewedAt = &t
+	}
+	if status.Valid {
+		meta.Status = status.String
+	}
+	return meta
+}
+
+func (s *SqlStore) getServiceTargets(ctx context.Context, serviceIDs []string) ([]*rpservice.Target, error) {
+	const targetsQuery = `SELECT ` + targetSelectColumns + ` FROM targets WHERE service_id = ANY($1)`
+
+	rows, err := s.pool.Query(ctx, targetsQuery, serviceIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	return pgx.CollectRows(rows, scanTarget)
+}
+
+func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
+	var t rpservice.Target
+	var path sql.NullString
+	var pathRewrite sql.NullString
+	var proxyProtocol, skipTLSVerify, directUpstream, agentNetwork, disableAccessLog sql.NullBool
+	var requestTimeout, sessionIdleTimeout, captureMaxRequestBytes, captureMaxResponseBytes sql.NullInt64
+	var customHeaders, middlewares, captureContentTypes []byte
+	err := row.Scan(
+		&t.ID,
+		&t.AccountID,
+		&t.ServiceID,
+		&path,
+		&t.Host,
+		&t.Port,
+		&t.Protocol,
+		&t.TargetId,
+		&t.TargetType,
+		&t.Enabled,
+		&proxyProtocol,
+		&skipTLSVerify,
+		&requestTimeout,
+		&sessionIdleTimeout,
+		&pathRewrite,
+		&customHeaders,
+		&directUpstream,
+		&middlewares,
+		&captureMaxRequestBytes,
+		&captureMaxResponseBytes,
+		&captureContentTypes,
+		&agentNetwork,
+		&disableAccessLog,
+	)
+	if err != nil {
+		return nil, err
+	}
+	if path.Valid {
+		t.Path = &path.String
+	}
+
+	t.ProxyProtocol = proxyProtocol.Bool
+	t.Options.SkipTLSVerify = skipTLSVerify.Bool
+	t.Options.RequestTimeout = time.Duration(requestTimeout.Int64)
+	t.Options.SessionIdleTimeout = time.Duration(sessionIdleTimeout.Int64)
+	t.Options.PathRewrite = rpservice.PathRewriteMode(pathRewrite.String)
+	t.Options.DirectUpstream = directUpstream.Bool
+	t.Options.CaptureMaxRequestBytes = captureMaxRequestBytes.Int64
+	t.Options.CaptureMaxResponseBytes = captureMaxResponseBytes.Int64
+	t.Options.AgentNetwork = agentNetwork.Bool
+	t.Options.DisableAccessLog = disableAccessLog.Bool
+
+	if len(customHeaders) > 0 {
+		if err := json.Unmarshal(customHeaders, &t.Options.CustomHeaders); err != nil {
+			return nil, fmt.Errorf("unmarshal custom_headers: %w", err)
+		}
+	}
+	if len(middlewares) > 0 {
+		if err := json.Unmarshal(middlewares, &t.Options.Middlewares); err != nil {
+			return nil, fmt.Errorf("unmarshal middlewares: %w", err)
+		}
+	}
+	if len(captureContentTypes) > 0 {
+		if err := json.Unmarshal(captureContentTypes, &t.Options.CaptureContentTypes); err != nil {
+			return nil, fmt.Errorf("unmarshal capture_content_types: %w", err)
+		}
+	}
+	return &t, nil
+}
+
 func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networkTypes.Network, error) {
 	const query = `SELECT id, account_id, public_id, name, description FROM networks WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)
--- a/management/server/store/sql_store_pgx_parity_test.go
+++ b/management/server/store/sql_store_pgx_parity_test.go
@@ -0,0 +1,74 @@
+package store
+
+import (
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm/schema"
+
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
+)
+
+// TestPgxServiceColumnsMatchGorm guards the Postgres pgx read path against
+// drifting from the gorm model. The SQLite/MySQL gorm path loads rows by struct,
+// so a new column on a model is picked up automatically, but the hand-written
+// pgx SELECT in sql_store.go must be updated by hand. This test fails when a
+// gorm column is missing from the pgx column list, which otherwise silently
+// returns zero-valued on Postgres with no compile error.
+func TestPgxServiceColumnsMatchGorm(t *testing.T) {
+	tests := []struct {
+		name          string
+		model         any
+		selectColumns string
+		// excluded lists gorm columns intentionally not loaded by the pgx path.
+		excluded map[string]struct{}
+	}{
+		{
+			name:          "service",
+			model:         &rpservice.Service{},
+			selectColumns: serviceSelectColumns,
+		},
+		{
+			name:          "target",
+			model:         &rpservice.Target{},
+			selectColumns: targetSelectColumns,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			selected := parseColumnList(tc.selectColumns)
+			for _, col := range gormColumnNames(t, tc.model) {
+				if _, ok := tc.excluded[col]; ok {
+					continue
+				}
+				_, ok := selected[col]
+				assert.Truef(t, ok,
+					"gorm column %q is not read by the Postgres pgx SELECT; add it to %sSelectColumns in sql_store.go (or to the test's excluded set if it is intentionally not loaded)",
+					col, tc.name)
+			}
+		})
+	}
+}
+
+func parseColumnList(cols string) map[string]struct{} {
+	set := make(map[string]struct{})
+	for _, c := range strings.Split(cols, ",") {
+		if c = strings.TrimSpace(c); c != "" {
+			set[c] = struct{}{}
+		}
+	}
+	return set
+}
+
+// gormColumnNames returns the DB column names gorm would migrate for the model,
+// using the same default naming strategy the store configures.
+func gormColumnNames(t *testing.T, model any) []string {
+	t.Helper()
+	sch, err := schema.Parse(model, &sync.Map{}, schema.NamingStrategy{})
+	require.NoError(t, err)
+	return sch.DBNames
+}
--- a/management/server/store/sql_store_service_test.go
+++ b/management/server/store/sql_store_service_test.go
@@ -5,6 +5,7 @@ import (
 	"os"
 	"runtime"
 	"testing"
+	"time"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -44,3 +45,91 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
+
+// TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip guards the Postgres pgx
+// read path (getServices) against silently dropping columns present on the gorm
+// model. Before the fix these fields loaded correctly on SQLite but came back
+// zero-valued on Postgres because the hand-written SELECT and scan omitted them.
+func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		account := newAccountWithId(ctx, "account_svc_opts", "testuser", "")
+		require.NoError(t, store.SaveAccount(ctx, account))
+
+		renewedAt := time.Now().UTC().Truncate(time.Second)
+		targetPath := "/api"
+		svc := &rpservice.Service{
+			ID:        "svc-opts",
+			AccountID: account.Id,
+			Name:      "opts-svc",
+			Domain:    "opts.example",
+			Enabled:   true,
+			Mode:      rpservice.ModeHTTP,
+			Restrictions: rpservice.AccessRestrictions{
+				AllowedCIDRs:     []string{"10.0.0.0/8"},
+				BlockedCountries: []string{"XX"},
+				CrowdSecMode:     "block",
+			},
+			Meta: rpservice.Meta{
+				LastRenewedAt: &renewedAt,
+			},
+			Targets: []*rpservice.Target{
+				{
+					AccountID:     account.Id,
+					ServiceID:     "svc-opts",
+					Path:          &targetPath,
+					Host:          "backend.internal",
+					Port:          8080,
+					Protocol:      "http",
+					TargetId:      "tgt-1",
+					Enabled:       true,
+					ProxyProtocol: true,
+					Options: rpservice.TargetOptions{
+						SkipTLSVerify:           true,
+						RequestTimeout:          30 * time.Second,
+						SessionIdleTimeout:      5 * time.Minute,
+						PathRewrite:             rpservice.PathRewritePreserve,
+						CustomHeaders:           map[string]string{"X-Foo": "bar"},
+						DirectUpstream:          true,
+						CaptureMaxRequestBytes:  1024,
+						CaptureMaxResponseBytes: 2048,
+						CaptureContentTypes:     []string{"application/json"},
+						AgentNetwork:            true,
+						DisableAccessLog:        true,
+					},
+				},
+			},
+		}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		loaded, err := store.GetAccount(ctx, account.Id)
+		require.NoError(t, err)
+		require.Len(t, loaded.Services, 1)
+
+		got := loaded.Services[0]
+		assert.Equal(t, []string{"10.0.0.0/8"}, got.Restrictions.AllowedCIDRs, "restrictions allowed CIDRs")
+		assert.Equal(t, []string{"XX"}, got.Restrictions.BlockedCountries, "restrictions blocked countries")
+		assert.Equal(t, "block", got.Restrictions.CrowdSecMode, "restrictions crowdsec mode")
+		require.NotNil(t, got.Meta.LastRenewedAt, "meta last renewed at")
+		assert.WithinDuration(t, renewedAt, *got.Meta.LastRenewedAt, time.Second, "meta last renewed at")
+
+		require.Len(t, got.Targets, 1)
+		tg := got.Targets[0]
+		assert.True(t, tg.ProxyProtocol, "target proxy protocol")
+		assert.True(t, tg.Options.SkipTLSVerify, "options skip TLS verify")
+		assert.Equal(t, 30*time.Second, tg.Options.RequestTimeout, "options request timeout")
+		assert.Equal(t, 5*time.Minute, tg.Options.SessionIdleTimeout, "options session idle timeout")
+		assert.Equal(t, rpservice.PathRewritePreserve, tg.Options.PathRewrite, "options path rewrite")
+		assert.Equal(t, map[string]string{"X-Foo": "bar"}, tg.Options.CustomHeaders, "options custom headers")
+		assert.True(t, tg.Options.DirectUpstream, "options direct upstream")
+		assert.Equal(t, int64(1024), tg.Options.CaptureMaxRequestBytes, "options capture max request bytes")
+		assert.Equal(t, int64(2048), tg.Options.CaptureMaxResponseBytes, "options capture max response bytes")
+		assert.Equal(t, []string{"application/json"}, tg.Options.CaptureContentTypes, "options capture content types")
+		assert.True(t, tg.Options.AgentNetwork, "options agent network")
+		assert.True(t, tg.Options.DisableAccessLog, "options disable access log")
+	})
+}
--- a/management/server/types/account.go
+++ b/management/server/types/account.go
@@ -1517,6 +1517,54 @@ func (a *Account) GetResourceRoutersMap() map[string]map[string]*routerTypes.Net
 	return routers
 }

+// forcesRoutingPeerDNSResolution reports whether the given peer must run
+// routing-peer DNS resolution regardless of the account-global
+// RoutingPeerDNSResolutionEnabled setting. It returns true when the peer is a
+// router for a domain network resource that is targeted by an enabled
+// reverse-proxy service, so the peer's DNS forwarder starts and can resolve
+// the target for the embedded proxy peers. Embedded proxy peers themselves are
+// handled at PeerConfig build time.
+func (a *Account) forcesRoutingPeerDNSResolution(peerID string, routers map[string]map[string]*routerTypes.NetworkRouter) bool {
+	targeted := a.proxyTargetedDomainResourceIDs()
+	if len(targeted) == 0 {
+		return false
+	}
+
+	for _, resource := range a.NetworkResources {
+		if resource == nil || !resource.Enabled || resource.Type != resourceTypes.Domain {
+			continue
+		}
+		if _, ok := targeted[resource.ID]; !ok {
+			continue
+		}
+		if _, isRouter := routers[resource.NetworkID][peerID]; isRouter {
+			return true
+		}
+	}
+
+	return false
+}
+
+// proxyTargetedDomainResourceIDs returns the set of domain network resource IDs
+// targeted by an enabled, non-terminated reverse-proxy service.
+func (a *Account) proxyTargetedDomainResourceIDs() map[string]struct{} {
+	ids := make(map[string]struct{})
+	for _, svc := range a.Services {
+		if svc == nil || !svc.Enabled || svc.Terminated {
+			continue
+		}
+		for _, target := range svc.Targets {
+			if target == nil || !target.Enabled {
+				continue
+			}
+			if target.TargetType == service.TargetTypeDomain {
+				ids[target.TargetId] = struct{}{}
+			}
+		}
+	}
+	return ids
+}
+
 // getPoliciesSourcePeers collects all unique peers from the source groups defined in the given policies.
 func getPoliciesSourcePeers(policies []*Policy, groups map[string]*Group) map[string]struct{} {
 	sourcePeers := make(map[string]struct{})
--- a/management/server/types/account_components.go
+++ b/management/server/types/account_components.go
@@ -140,6 +140,8 @@ func (a *Account) GetPeerNetworkMapComponents(
 		RouterPeers:               make(map[string]*ComponentPeer),
 		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
 		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
+
+		ForceRoutingPeerDNSResolution: a.forcesRoutingPeerDNSResolution(peerID, routers),
 	}
 	for _, n := range a.Networks {
 		if n != nil {
--- a/management/server/types/account_test.go
+++ b/management/server/types/account_test.go
@@ -1751,3 +1751,71 @@ func hasPrivateAccessPolicy(account *Account, serviceID string) bool {
 	}
 	return false
 }
+
+func TestForcesRoutingPeerDNSResolution(t *testing.T) {
+	buildAccountRes := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType, resType resourceTypes.NetworkResourceType) *Account {
+		return &Account{
+			Id: "accountID",
+			Groups: map[string]*Group{
+				"router-group": {ID: "router-group", Peers: []string{"router-peer-grp"}},
+			},
+			NetworkRouters: []*routerTypes.NetworkRouter{
+				{ID: "r1", NetworkID: "net-1", AccountID: "accountID", Peer: "router-peer", Enabled: true},
+				{ID: "r2", NetworkID: "net-1", AccountID: "accountID", PeerGroups: []string{"router-group"}, Enabled: true},
+			},
+			NetworkResources: []*resourceTypes.NetworkResource{
+				{ID: "res-domain", AccountID: "accountID", NetworkID: "net-1", Type: resType, Domain: "example.org", Enabled: resourceEnabled},
+			},
+			Services: []*service.Service{
+				{
+					ID: "svc-1", AccountID: "accountID", Enabled: serviceEnabled,
+					Targets: []*service.Target{
+						{TargetId: "res-domain", TargetType: targetType, Enabled: targetEnabled},
+					},
+				},
+			},
+		}
+	}
+
+	buildAccount := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType) *Account {
+		return buildAccountRes(serviceEnabled, targetEnabled, resourceEnabled, targetType, resourceTypes.Domain)
+	}
+
+	t.Run("router peer for RP-targeted domain resource is forced", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypeDomain)
+		routers := account.GetResourceRoutersMap()
+		assert.True(t, account.forcesRoutingPeerDNSResolution("router-peer", routers), "direct router peer should be forced")
+		assert.True(t, account.forcesRoutingPeerDNSResolution("router-peer-grp", routers), "group-member router peer should be forced")
+	})
+
+	t.Run("non-router peer is not forced", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("other-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when service disabled", func(t *testing.T) {
+		account := buildAccount(false, true, true, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when target disabled", func(t *testing.T) {
+		account := buildAccount(true, false, true, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when resource disabled", func(t *testing.T) {
+		account := buildAccount(true, true, false, service.TargetTypeDomain)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced for non-domain target type", func(t *testing.T) {
+		account := buildAccount(true, true, true, service.TargetTypePeer)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
+	})
+
+	t.Run("not forced when targeted resource is not a domain", func(t *testing.T) {
+		account := buildAccountRes(true, true, true, service.TargetTypeDomain, resourceTypes.Host)
+		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()),
+			"a domain target pointing at a non-domain resource must not force resolution")
+	})
+}
--- a/management/server/user.go
+++ b/management/server/user.go
@@ -321,6 +321,10 @@ func (am *DefaultAccountManager) DeleteUser(ctx context.Context, accountID, init
 		return err
 	}

+	if targetUser.AccountID != accountID {
+		return status.NewUserNotFoundError(targetUserID)
+	}
+
 	if targetUser.Role == types.UserRoleOwner {
 		return status.NewOwnerDeletePermissionError()
 	}
--- a/management/server/user_test.go
+++ b/management/server/user_test.go
@@ -802,6 +802,52 @@ func TestUser_DeleteUser_SelfDelete(t *testing.T) {
 	}
 }

+func TestUser_DeleteUser_OtherAccount(t *testing.T) {
+	testStore, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	if err != nil {
+		t.Fatalf("Error when creating store: %s", err)
+	}
+	t.Cleanup(cleanup)
+
+	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
+	if err = testStore.SaveAccount(context.Background(), account); err != nil {
+		t.Fatalf("Error when saving account: %s", err)
+	}
+
+	otherAccount := newAccountWithId(context.Background(), "otherAccount", "otherOwner", "", "", "", false)
+	otherAccount.Users["otherRegularUser"] = &types.User{
+		Id:        "otherRegularUser",
+		AccountID: "otherAccount",
+		Role:      types.UserRoleUser,
+	}
+	otherAccount.Users["otherServiceUser"] = &types.User{
+		Id:              "otherServiceUser",
+		AccountID:       "otherAccount",
+		Role:            types.UserRoleUser,
+		IsServiceUser:   true,
+		ServiceUserName: "otherServiceUser",
+	}
+	if err = testStore.SaveAccount(context.Background(), otherAccount); err != nil {
+		t.Fatalf("Error when saving other account: %s", err)
+	}
+
+	am := DefaultAccountManager{
+		Store:              testStore,
+		eventStore:         &activity.InMemoryEventStore{},
+		permissionsManager: permissions.NewManager(testStore),
+	}
+
+	for _, targetUserID := range []string{"otherRegularUser", "otherServiceUser"} {
+		t.Run(targetUserID, func(t *testing.T) {
+			err := am.DeleteUser(context.Background(), mockAccountID, mockUserID, targetUserID)
+			assert.Equal(t, status.NewUserNotFoundError(targetUserID), err)
+
+			_, err = testStore.GetUserByUserID(context.Background(), store.LockingStrengthNone, targetUserID)
+			assert.NoError(t, err, "user of another account must not be deleted")
+		})
+	}
+}
+
 func TestUser_DeleteUser_regularUser(t *testing.T) {
 	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
 	if err != nil {
--- a/proxy/internal/auth/tunnel_cache.go
+++ b/proxy/internal/auth/tunnel_cache.go
@@ -3,20 +3,30 @@ package auth
 import (
 	"context"
 	"net/netip"
+	"os"
+	"strings"
 	"sync"
 	"time"

+	log "github.com/sirupsen/logrus"
 	"golang.org/x/sync/singleflight"

 	"github.com/netbirdio/netbird/proxy/internal/types"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )

-// tunnelCacheTTL caps how long a positive ValidateTunnelPeer result is
-// reused before re-fetching from management. 5 minutes balances freshness
-// against management load on busy mesh networks.
+// tunnelCacheTTL is the default cap on how long a positive ValidateTunnelPeer
+// result is reused before re-fetching from management. 5 minutes balances
+// freshness against management load on busy mesh networks. Override it with
+// envTunnelCacheTTL when an account needs authorization changes to take effect
+// sooner (at the cost of more ValidateTunnelPeer RPCs).
 const tunnelCacheTTL = 300 * time.Second

+// envTunnelCacheTTL overrides tunnelCacheTTL. The value is a Go duration string
+// (e.g. "30s", "2m"); an unset, unparseable, or non-positive value keeps the
+// default.
+const envTunnelCacheTTL = "NB_PROXY_TUNNEL_CACHE_TTL"
+
 // tunnelCachePerAccount caps the number of cached identities per account.
 // Bounded eviction avoids memory growth in pathological cases (huge peer
 // roster, brief request bursts) while staying generous for normal use.
@@ -60,16 +70,35 @@ type accountBucket struct {
 	order []tunnelCacheKey
 }

-// newTunnelValidationCache constructs a cache with default TTL and bounds.
+// newTunnelValidationCache constructs a cache with the configured TTL
+// (envTunnelCacheTTL override or default) and default bounds.
 func newTunnelValidationCache() *tunnelValidationCache {
 	return &tunnelValidationCache{
 		entries: make(map[types.AccountID]*accountBucket),
-		ttl:     tunnelCacheTTL,
+		ttl:     tunnelCacheTTLFromEnv(),
 		maxSize: tunnelCachePerAccount,
 		now:     time.Now,
 	}
 }

+// tunnelCacheTTLFromEnv returns the tunnel-cache TTL, honoring the
+// envTunnelCacheTTL override. The override must be a positive Go duration
+// string (e.g. "30s", "2m"); anything unset, unparseable, or non-positive
+// falls back to tunnelCacheTTL.
+func tunnelCacheTTLFromEnv() time.Duration {
+	raw := strings.TrimSpace(os.Getenv(envTunnelCacheTTL))
+	if raw == "" {
+		return tunnelCacheTTL
+	}
+	d, err := time.ParseDuration(raw)
+	if err != nil || d <= 0 {
+		log.Warnf("ignoring invalid %s=%q (want a positive Go duration like 30s or 2m); using default %s",
+			envTunnelCacheTTL, raw, tunnelCacheTTL)
+		return tunnelCacheTTL
+	}
+	return d
+}
+
 // get returns a cached response for the key, or nil when missing or
 // expired. Expired entries are evicted lazily on read.
 func (c *tunnelValidationCache) get(key tunnelCacheKey) *proto.ValidateTunnelPeerResponse {
--- a/proxy/internal/auth/tunnel_cache_test.go
+++ b/proxy/internal/auth/tunnel_cache_test.go
@@ -169,3 +169,32 @@ func TestTunnelCache_BoundedSizeEvictsOldest(t *testing.T) {
 	assert.NotNil(t, cache.get(keys[1]), "second-newest must remain cached")
 	assert.NotNil(t, cache.get(keys[2]), "newest must remain cached")
 }
+
+func TestTunnelCacheTTLFromEnv(t *testing.T) {
+	t.Run("unset uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("valid duration overrides", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "45s")
+		assert.Equal(t, 45*time.Second, tunnelCacheTTLFromEnv())
+	})
+	t.Run("whitespace trimmed", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "  2m ")
+		assert.Equal(t, 2*time.Minute, tunnelCacheTTLFromEnv())
+	})
+	t.Run("unparseable uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "nonsense")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("non-positive uses default", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "0s")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+		t.Setenv(envTunnelCacheTTL, "-30s")
+		assert.Equal(t, tunnelCacheTTL, tunnelCacheTTLFromEnv())
+	})
+	t.Run("constructor honors override", func(t *testing.T) {
+		t.Setenv(envTunnelCacheTTL, "90s")
+		assert.Equal(t, 90*time.Second, newTunnelValidationCache().ttl)
+	})
+}
--- a/Show More
+++ b/Show More