diff --git a/tofu/cloudflare.tf b/tofu/cloudflare.tf
index 278e7cd..77ba8be 100644
--- a/tofu/cloudflare.tf
+++ b/tofu/cloudflare.tf
@@ -327,10 +327,10 @@ resource "cloudflare_dns_record" "caa" {
   ttl     = 86400
 
   data = {
-      flags = 0
-      tag   = "issue"
-      value = each.value.ca
-    }
+    flags = 0
+    tag   = "issue"
+    value = each.value.ca
+  }
 }
 
 # =============================================================================
@@ -349,11 +349,11 @@ resource "cloudflare_dns_record" "towerops_srv_autodiscover" {
   ttl     = 86400
 
   data = {
-      priority = 0
-      weight   = 0
-      port     = 443
-      target   = "mail.mcintire.me"
-    }
+    priority = 0
+    weight   = 0
+    port     = 443
+    target   = "mail.mcintire.me"
+  }
 }
 
 # =============================================================================
@@ -383,7 +383,7 @@ resource "cloudflare_zone_setting" "aprs_me_tls_1_3" {
 
 resource "cloudflare_zone_setting" "aprs_me_zero_rtt" {
   zone_id    = cloudflare_zone.zones["aprs.me"].id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -396,7 +396,7 @@ resource "cloudflare_zone_setting" "aprs_me_ssl" {
 resource "cloudflare_zone_setting" "aprs_me_security_header" {
   zone_id    = cloudflare_zone.zones["aprs.me"].id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -404,7 +404,7 @@ resource "cloudflare_zone_setting" "aprs_me_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
 
 # towerops.net
@@ -428,7 +428,7 @@ resource "cloudflare_zone_setting" "towerops_net_tls_1_3" {
 
 resource "cloudflare_zone_setting" "towerops_net_zero_rtt" {
   zone_id    = cloudflare_zone.zones["towerops.net"].id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -441,7 +441,7 @@ resource "cloudflare_zone_setting" "towerops_net_ssl" {
 resource "cloudflare_zone_setting" "towerops_net_security_header" {
   zone_id    = cloudflare_zone.zones["towerops.net"].id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -449,7 +449,7 @@ resource "cloudflare_zone_setting" "towerops_net_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
 
 # gridmap.org
@@ -473,7 +473,7 @@ resource "cloudflare_zone_setting" "gridmap_org_tls_1_3" {
 
 resource "cloudflare_zone_setting" "gridmap_org_zero_rtt" {
   zone_id    = cloudflare_zone.zones["gridmap.org"].id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -486,7 +486,7 @@ resource "cloudflare_zone_setting" "gridmap_org_ssl" {
 resource "cloudflare_zone_setting" "gridmap_org_security_header" {
   zone_id    = cloudflare_zone.zones["gridmap.org"].id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -494,8 +494,34 @@ resource "cloudflare_zone_setting" "gridmap_org_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
+
+# =============================================================================
+# Bot Management - disable Cloudflare managed robots.txt
+#
+# Each app repo ships its own robots.txt. Turning off the managed robots.txt
+# feature ("Instruct AI bot traffic with robots.txt") stops Cloudflare from
+# prepending/serving its own robots.txt at the zone edge, so the origin's file
+# is returned unchanged. All other bot_management fields are Optional+Computed,
+# so omitting them preserves their current values (e.g. Super Bot Fight Mode).
+#
+# NOTE: requires CLOUDFLARE_API_TOKEN to include the "Bot Management Write"
+# permission for these zones; the DNS-scoped token cannot apply this.
+# =============================================================================
+
+resource "cloudflare_bot_management" "zones" {
+  for_each = cloudflare_zone.zones
+
+  zone_id               = each.value.id
+  is_robots_txt_managed = false
+}
+
+resource "cloudflare_bot_management" "w5isp_com" {
+  zone_id               = cloudflare_zone.w5isp_com.id
+  is_robots_txt_managed = false
+}
+
 # =============================================================================
 # Firewall - custom rules (applied to all zones)
 # =============================================================================
@@ -514,7 +540,7 @@ locals {
     "(http.request.uri.path contains \"/.git\")",
     "(http.request.uri.path contains \"/phpmyadmin\")",
     "(http.request.uri.path contains \"/cgi-bin\")",
-    "(not http.request.user_agent exists)",
+    "(not http.user_agent ne \"\")",
   ])
 }
 
@@ -581,13 +607,13 @@ resource "cloudflare_ruleset" "towerops_firewall" {
     logging = {
       enabled = false
     }
-  },
+    },
 
-  {
-    action      = "block"
-    expression  = local.firewall_expression
-    description = "block abusers"
-    enabled     = true
+    {
+      action      = "block"
+      expression  = local.firewall_expression
+      description = "block abusers"
+      enabled     = true
   }]
 }
 import {
@@ -1017,11 +1043,11 @@ resource "cloudflare_dns_record" "w5isp_srv_autodiscover" {
   ttl     = 86400
 
   data = {
-      priority = 0
-      weight   = 0
-      port     = 443
-      target   = "mail.w5isp.com"
-    }
+    priority = 0
+    weight   = 0
+    port     = 443
+    target   = "mail.w5isp.com"
+  }
 }
 
 # =============================================================================
@@ -1048,7 +1074,7 @@ resource "cloudflare_zone_setting" "w5isp_com_tls_1_3" {
 
 resource "cloudflare_zone_setting" "w5isp_com_zero_rtt" {
   zone_id    = cloudflare_zone.w5isp_com.id
-  setting_id = "zero_rtt"
+  setting_id = "0rtt"
   value      = "on"
 }
 
@@ -1061,7 +1087,7 @@ resource "cloudflare_zone_setting" "w5isp_com_ssl" {
 resource "cloudflare_zone_setting" "w5isp_com_security_header" {
   zone_id    = cloudflare_zone.w5isp_com.id
   setting_id = "security_header"
-  value = jsonencode({
+  value = {
     strict_transport_security = {
       enabled            = true
       max_age            = 15552000
@@ -1069,7 +1095,7 @@ resource "cloudflare_zone_setting" "w5isp_com_security_header" {
       preload            = true
       nosniff            = true
     }
-  })
+  }
 }
 
 # =============================================================================
@@ -1096,13 +1122,13 @@ resource "cloudflare_ruleset" "w5isp_firewall" {
     logging = {
       enabled = false
     }
-  },
+    },
 
-  {
-    action      = "block"
-    expression  = local.firewall_expression
-    description = "block abusers"
-    enabled     = true
+    {
+      action      = "block"
+      expression  = local.firewall_expression
+      description = "block abusers"
+      enabled     = true
   }]
 }
 # =============================================================================
@@ -1118,10 +1144,10 @@ resource "cloudflare_dns_record" "w5isp_caa" {
   ttl     = 86400
 
   data = {
-      flags = 0
-      tag   = "issue"
-      value = each.value
-    }
+    flags = 0
+    tag   = "issue"
+    value = each.value
+  }
 }
 
 resource "cloudflare_zero_trust_tunnel_cloudflared_config" "towerops_dev" {