diff --git a/main.go b/main.go
index 9a3e0ad..e649b8e 100644
--- a/main.go
+++ b/main.go
@@ -83,8 +83,13 @@ func main() {
 		if app.go2rtc != nil { app.go2rtc.Stop() }
 		if app.snapshots != nil { app.snapshots.StopAll() }
 		if app.recorder != nil { app.recorder.StopAll() }
+
+		// Read config under lock to get latest state.
+		app.server.mu.RLock()
+		liveCfg := *app.server.appConfig // copy, not pointer
+		app.server.mu.RUnlock()
+
 		// Handle viewer server toggle.
-		liveCfg := app.server.appConfig
 		if liveCfg.Auth.Viewer.Enabled && app.viewerSrv == nil {
 			go func() {
 				v, err := app.server.StartViewerServer()