diff --git a/config/cliproxyapi/config.yaml b/config/cliproxyapi/config.template.yaml
similarity index 100%
rename from config/cliproxyapi/config.yaml
rename to config/cliproxyapi/config.template.yaml
diff --git a/config/cliproxyapi/default.nix b/config/cliproxyapi/default.nix
index 76511e697..62018f7de 100644
--- a/config/cliproxyapi/default.nix
+++ b/config/cliproxyapi/default.nix
@@ -2,12 +2,12 @@
 {
   # Template config - the service wrapper injects secrets and writes to config.yaml
   home.file.".cli-proxy-api/config.template.yaml" = {
-    source = config.lib.file.mkOutOfStoreSymlink ./config.yaml;
+    source = config.lib.file.mkOutOfStoreSymlink ./config.template.yaml;
     force = true;
   };
   # Example config - required by cliproxyapi's object-backed config bootstrap
   home.file.".cli-proxy-api/config.example.yaml" = {
-    source = config.lib.file.mkOutOfStoreSymlink ./config.yaml;
+    source = config.lib.file.mkOutOfStoreSymlink ./config.template.yaml;
     force = true;
   };
 }
diff --git a/home-manager/programs/fish/functions/_ocxe_function.fish b/home-manager/programs/fish/functions/_ocxe_function.fish
index f75ff2ab6..7149af254 100644
--- a/home-manager/programs/fish/functions/_ocxe_function.fish
+++ b/home-manager/programs/fish/functions/_ocxe_function.fish
@@ -3,9 +3,9 @@ function _ocxe_function --description "Run OpenCode with GLM-4.7 via OpenRouter"
   # Usage: ocxe [<prompt words...>]
 
   if test (count $argv) -eq 0
-    opencode -m 'cliproxyapi/glm-4-7'
+    opencode -m 'cliproxyapi/glm-4.7'
   else
     set -l prompt (string join " " -- $argv)
-    opencode run "$prompt" -m 'cliproxyapi/glm-4-7'
+    opencode run "$prompt" -m 'cliproxyapi/glm-4.7'
   end
 end
diff --git a/home-manager/programs/fish/functions/_ocxeh_function.fish b/home-manager/programs/fish/functions/_ocxeh_function.fish
index e4748f59b..cecaf8244 100644
--- a/home-manager/programs/fish/functions/_ocxeh_function.fish
+++ b/home-manager/programs/fish/functions/_ocxeh_function.fish
@@ -8,5 +8,5 @@ function _ocxeh_function --description "Run OpenCode headlessly with GLM-4.7"
     return 1
   end
 
-  opencode run "$prompt" -m 'cliproxyapi/glm-4-7'
+  opencode run "$prompt" -m 'cliproxyapi/glm-4.7'
 end
diff --git a/home-manager/services/cliproxyapi/scripts/start.sh b/home-manager/services/cliproxyapi/scripts/start.sh
index ee5ec9566..65fa0584f 100755
--- a/home-manager/services/cliproxyapi/scripts/start.sh
+++ b/home-manager/services/cliproxyapi/scripts/start.sh
@@ -100,6 +100,35 @@ if [ -f "$TEMPLATE" ]; then
   fi
 fi
 
+# Keep objectstore-backed config in sync for management UI
+OBJECTSTORE_CONFIG_DIR="$CONFIG_DIR/objectstore/config"
+OBJECTSTORE_CONFIG="$OBJECTSTORE_CONFIG_DIR/config.yaml"
+BACKUP_CONFIG_DIR="$CONFIG_DIR/backup/config"
+BACKUP_CONFIG="$BACKUP_CONFIG_DIR/config.yaml"
+mkdir -p "$OBJECTSTORE_CONFIG_DIR" "$BACKUP_CONFIG_DIR"
+rm -f "$OBJECTSTORE_CONFIG" "$BACKUP_CONFIG"
+cp "$CONFIG" "$OBJECTSTORE_CONFIG"
+cp "$CONFIG" "$BACKUP_CONFIG"
+
+# Push config to objectstore so remote-backed config doesn't revert locally
+if [ -n "$OBJECTSTORE_ENDPOINT" ] && [ -n "$OBJECTSTORE_ACCESS_KEY" ] && [ -n "$OBJECTSTORE_SECRET_KEY" ]; then
+  AWS_ACCESS_KEY_ID="$OBJECTSTORE_ACCESS_KEY" \
+    AWS_SECRET_ACCESS_KEY="$OBJECTSTORE_SECRET_KEY" \
+    @aws@ s3 sync \
+    --endpoint-url="$OBJECTSTORE_ENDPOINT" \
+    --no-progress \
+    "$OBJECTSTORE_CONFIG_DIR/" \
+    "s3://${OBJECTSTORE_BUCKET}/config/" || true
+
+  AWS_ACCESS_KEY_ID="$OBJECTSTORE_ACCESS_KEY" \
+    AWS_SECRET_ACCESS_KEY="$OBJECTSTORE_SECRET_KEY" \
+    @aws@ s3 sync \
+    --endpoint-url="$OBJECTSTORE_ENDPOINT" \
+    --no-progress \
+    "$BACKUP_CONFIG_DIR/" \
+    "s3://${OBJECTSTORE_BUCKET}/backup/config/" || true
+fi
+
 cd "$CONFIG_DIR"
 
 # Linux: Docker