diff --git a/CHANGELOG.md b/CHANGELOG.md
index 14e0719b..c3568ce9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - Calendar: 
   - Uppercase `MAILTO` calendar addresses become invalid SMTP recipients.
   - Scheduling invitations on a shared, non-owned calendar fail with `MAIL FROM unauthorized`.
+- HTTP: Disable `allowedEndpoints` expression in recovery mode.
 
 ## [0.16.13] - 2026-07-12
 
diff --git a/crates/common/src/config/network.rs b/crates/common/src/config/network.rs
index 4097971c..964e8dd0 100644
--- a/crates/common/src/config/network.rs
+++ b/crates/common/src/config/network.rs
@@ -17,7 +17,7 @@ use crate::{
 };
 use registry::schema::{
     enums::{AcmeChallengeType, ClusterTaskType, ProviderInfo, ServiceProtocol},
-    prelude::ObjectType,
+    prelude::{ObjectType, Property},
     structs::{
         self, AcmeProvider, Asn, ClusterTaskGroup, HttpForm, MailExchanger, Rate, Service,
         SystemSettings, TaskManager,
@@ -443,8 +443,11 @@ impl Http {
             } else {
                 String::new()
             },
-            allowed_endpoint: bp
-                .compile_expr(ObjectType::Http.singleton(), &http.ctx_allowed_endpoints()),
+            allowed_endpoint: if bp.registry.is_recovery_mode() {
+                IfBlock::empty(ObjectType::Http.singleton(), Property::AllowedEndpoints)
+            } else {
+                bp.compile_expr(ObjectType::Http.singleton(), &http.ctx_allowed_endpoints())
+            },
             rate_authenticated: if bp.registry.is_recovery_mode() {
                 None
             } else {