diff --git a/internal/server/web/embed.go b/internal/server/web/embed.go
index b3d6a1da16bda6789ec0343d288fe90d3e54aab6..52236e76006b23cd8bc9bc2a3f43e63296a01801 100644
--- a/internal/server/web/embed.go
+++ b/internal/server/web/embed.go
@@ -136,8 +136,16 @@ 		http.Error(w, "internal server error: marshal config", http.StatusInternalServerError)
 		return
 	}
 
+	original := buf.Bytes()
 	script := []byte("<script>window.__LETHE_CONFIG__=" + string(cfgJSON) + ";</script></head>")
-	injected := bytes.Replace(buf.Bytes(), []byte("</head>"), script, 1)
+	injected := bytes.Replace(original, []byte("</head>"), script, 1)
+	if bytes.Equal(injected, original) {
+		// </head> is required for config injection. Failing loud beats serving
+		// uninjected HTML and letting the SPA render its "auth-config missing"
+		// card with no server-side diagnostic.
+		http.Error(w, "internal server error: index.html missing </head> for config injection", http.StatusInternalServerError)
+		return
+	}
 
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	w.WriteHeader(http.StatusOK)