diff --git a/public_html/assets/js/jarvis-app.js b/public_html/assets/js/jarvis-app.js
index 1c075e5..cd1c45f 100644
--- a/public_html/assets/js/jarvis-app.js
+++ b/public_html/assets/js/jarvis-app.js
@@ -1631,11 +1631,18 @@ async function checkAgentStatus() {
     sta.textContent = online.length > 0 ? online.length + ' ONLINE' : 'NONE';
     const cnt = document.getElementById('net-agent-count');
     if (cnt) cnt.textContent = online.length + ' AGENT' + (online.length !== 1 ? 'S' : '') + ' ONLINE';
+    // Fixed 2026-07-07: this used to fall back to "any agent on the same /24
+    // subnet" when the exact IP didn't match, meant to handle NAT — but when
+    // a LAN client hits the dashboard via its external hostname (hairpin NAT,
+    // or through Cloudflare), the server sees the SAME single reflected/proxy
+    // IP for every visitor on the LAN, not each machine's real one. The exact
+    // match then always fails, and the subnet fallback just grabbed whichever
+    // agent happened to be first in the list — showing a *different real
+    // machine* as "yours", not a harmless guess. Exact match only now; if it
+    // fails, the button correctly falls through to "not detected" instead of
+    // reporting someone else's agent as this one.
     const myIp = data.my_ip || '';
-    // Match by exact IP first, then by same /24 subnet (handles NAT behind same router)
-    const mySubnet = myIp.split('.').slice(0,3).join('.');
-    _myAgent = online.find(a => a.ip_address === myIp)
-            || online.find(a => a.ip_address && a.ip_address.startsWith(mySubnet + '.'));
+    _myAgent = online.find(a => a.ip_address === myIp) || null;
     _agentOnline = !!_myAgent;
     if (btn) {
       const isTablet = detectOS() === 'tablet';