diff --git a/src/main/main.js b/src/main/main.js
index 3063a95..1353857 100644
--- a/src/main/main.js
+++ b/src/main/main.js
@@ -19,6 +19,7 @@ const {
   createLogger,
   createStores,
   registerBaseHandlers,
+  validateWgConfig,
 } = require('@gatecontrol/client-core');
 
 const { i18n } = require('@gatecontrol/client-core');
@@ -306,15 +307,30 @@ async function connectTunnel() {
 		const apiKey = store.get('server.apiKey');
 
 		if (serverUrl && apiKey) {
+			let fetchedConfig = null;
 			try {
-				const config = await apiClient.fetchConfig();
-				if (config) {
-					await wgService.writeConfig(WG_CONFIG_FILE, config);
-					log.info('Konfiguration vom Server aktualisiert');
-				}
+				fetchedConfig = await apiClient.fetchConfig();
 			} catch (err) {
 				log.warn('Config-Abruf fehlgeschlagen, nutze lokale Config:', err.message);
 			}
+			if (fetchedConfig) {
+				// Fail-closed: validate before overwriting the existing config.
+				// A bad fetch must NOT clobber a good local config; abort the connect.
+				const validation = validateWgConfig(fetchedConfig);
+				if (!validation.ok) {
+					const msg = 'Invalid WireGuard config: ' + validation.errors.join(', ');
+					log.error('Config-Update abgelehnt, behalte lokale Config: ' + msg);
+					updateTray('disconnected');
+					broadcastState('error', msg);
+					showNotification(t('notify.connectionError'), msg);
+					return;
+				}
+				if (validation.warnings && validation.warnings.length > 0) {
+					log.warn('Config-Warnungen: ' + validation.warnings.join(', '));
+				}
+				await wgService.writeConfig(WG_CONFIG_FILE, fetchedConfig);
+				log.info('Konfiguration vom Server aktualisiert');
+			}
 		}
 
 		if (store.get('tunnel.killSwitch', false)) {
@@ -720,10 +736,14 @@ app.whenReady().then(async () => {
 			try {
 				const newConfig = await apiClient.checkConfigUpdate();
 				if (newConfig) {
-					// Validate before applying — reject empty or malformed configs
-					if (!newConfig.includes('[Interface]') || !newConfig.includes('PrivateKey')) {
-						log.warn('Config update rejected: missing [Interface] or PrivateKey');
+					// Validate before applying — fail-closed via shared validator.
+					const validation = validateWgConfig(newConfig);
+					if (!validation.ok) {
+						log.warn('Config update rejected: ' + validation.errors.join(', '));
 					} else {
+						if (validation.warnings && validation.warnings.length > 0) {
+							log.warn('Config update warnings: ' + validation.warnings.join(', '));
+						}
 						log.info('Neue Konfiguration vom Server erhalten');
 						await wgService.writeConfig(WG_CONFIG_FILE, newConfig);
 						if (tunnelState.connected) {