diff --git a/config.go b/config.go
index 4b7dc82..f47781b 100644
--- a/config.go
+++ b/config.go
@@ -4,18 +4,26 @@ import (
 	"encoding/json"
 	"log"
 	"os"
+	"path/filepath"
 	"sync"
 )
 
-// Config holds all WAF plugin settings, persisted as JSON.
+// Config holds all Firewall plugin settings, persisted as JSON.
 type Config struct {
-	Enabled   bool   `json:"enabled"`
-	NodeURL   string `json:"node_url"`   // e.g. http://192.168.1.50:8080
-	ReturnPort int   `json:"return_port"` // port for inspection endpoint async callbacks
-	TimeoutMs int    `json:"timeout_ms"`  // inspection timeout in milliseconds
+	Enabled    bool   `json:"enabled"`
+	NodeURL    string `json:"node_url"`    // e.g. http://192.168.1.50:8080
+	ReturnPort int   `json:"return_port"` // port for async callbacks
+	TimeoutMs  int    `json:"timeout_ms"`  // inspection timeout in milliseconds
 }
 
-const configFile = "waf_config.json"
+// configPath resolves to the config file next to the plugin binary.
+func configPath() string {
+	exe, err := os.Executable()
+	if err != nil {
+		return "/opt/zoraxy/plugins/zoraxy-waf/waf_config.json"
+	}
+	return filepath.Join(filepath.Dir(exe), "waf_config.json")
+}
 
 var (
 	cfg   Config
@@ -35,7 +43,7 @@ func loadConfig() {
 	cfgMu.Lock()
 	defer cfgMu.Unlock()
 
-	f, err := os.Open(configFile)
+	f, err := os.Open(configPath())
 	if err != nil {
 		cfg = defaultConfig()
 		return
@@ -55,7 +63,7 @@ func saveConfig() error {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(configFile, data, 0644)
+	return os.WriteFile(configPath(), data, 0644)
 }
 
 func getConfig() Config {