diff --git a/CHANGELOG.md b/CHANGELOG.md
index afe1cf7..443e85a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,11 @@ All notable changes to Collie are recorded here. The format follows
 `version` in `herdr-plugin.toml`, `package.json`, and `web/package.json` (enforced by
 `scripts/check-version.sh`). See [`CLAUDE.md`](./CLAUDE.md) → *Versioning* for the bump policy.
 
+## [0.16.1] - 2026-07-27
+
+### Fixed
+- `/api/config` is now gated like every other endpoint — it was the one route that skipped the same-origin check and `COLLIE_PUBLIC_HOSTS`, noted by @Optic00 in #32 (a54afd9)
+
 ## [0.16.0] - 2026-07-27
 
 ### Added
diff --git a/bridge/server.ts b/bridge/server.ts
index 11a6b99..f1b9674 100644
--- a/bridge/server.ts
+++ b/bridge/server.ts
@@ -215,6 +215,14 @@ export function startServer(opts: {
 
       // ── Misc API ─────────────────────────────────────────────────────────
       if (pathname === "/api/config") {
+        // Read-level, like the other non-terminal endpoints. Nothing here is secret — the VAPID
+        // public key is handed to every browser by design — but this was the one route that skipped
+        // checkAccess entirely, so COLLIE_PUBLIC_HOSTS didn't cover it and a rebound DNS name could
+        // still read the build id. The client only ever calls this same-origin, and a refusal can't
+        // be mistaken for an outage: ConnectionBanner short-circuits to AuthErrorBanner before its
+        // red-state probe runs. Noted in #32.
+        const denied = guard(req, cfg, "read");
+        if (denied) return denied;
         return json({
           push: push.enabled,
           vapidPublicKey: push.publicKey,
diff --git a/herdr-plugin.toml b/herdr-plugin.toml
index 9b0cc1f..bf1aebb 100644
--- a/herdr-plugin.toml
+++ b/herdr-plugin.toml
@@ -1,6 +1,6 @@
 id = "herdr.collie"
 name = "Collie"
-version = "0.16.0"
+version = "0.16.1"
 min_herdr_version = "0.7.0"
 description = "Mobile web UI to monitor and reply to your agent herd, served over Tailscale"
 platforms = ["linux", "macos"]
diff --git a/package.json b/package.json
index 88b2c6a..5093583 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "collie",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "private": true,
   "license": "MIT",
   "description": "Collie — a mobile web UI to monitor and reply to your Herdr agent herd over Tailscale",
diff --git a/web/package.json b/web/package.json
index 1fab2eb..8058c05 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,6 +1,6 @@
 {
   "name": "collie-web",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "private": true,
   "license": "MIT",
   "type": "module",