diff --git a/VERSION b/VERSION
index 4e00d0a..c6ba3bc 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.14.4
+1.14.6
diff --git a/dashcaddy-api/src/utilities/middleware.js b/dashcaddy-api/src/utilities/middleware.js
index 2a8c660..aacb6fb 100644
--- a/dashcaddy-api/src/utilities/middleware.js
+++ b/dashcaddy-api/src/utilities/middleware.js
@@ -473,6 +473,11 @@ module.exports = function configureMiddleware(app, {
   });
   app.use('/api/v1/totp/verify', totpLimiter);
   app.use('/api/v1/totp/verify-setup', totpLimiter);
+  // /totp/setup was previously unmetered — an attacker could enumerate
+  // secrets or DoS the QR generator. Apply the same 10/15min limit as the
+  // other TOTP endpoints. The standardHeaders config above emits
+  // RateLimit-Limit / RateLimit-Remaining for clients to see.
+  app.use('/api/v1/totp/setup', totpLimiter);
 
   // ── Audit logging middleware (logs non-GET API requests) ──
   app.use(auditLogger.middleware());
diff --git a/scripts/dashcaddy-update.sh b/scripts/dashcaddy-update.sh
index b6de496..2980442 100755
--- a/scripts/dashcaddy-update.sh
+++ b/scripts/dashcaddy-update.sh
@@ -306,6 +306,21 @@ main() {
     echo "$commit" > "$api_source_dir/VERSION"
   fi
 
+  # 3a. Apply post-deploy patches — fix upstream bugs in released tarballs
+  # (e.g. v1.14.4 has broken require paths and missing license-keygen module).
+  # Runs AFTER staging copy, BEFORE docker build. Idempotent.
+  local patch_script="/opt/dashcaddy/scripts/dashcaddy-post-deploy-patches.sh"
+  if [[ -x "$patch_script" ]]; then
+    log "Applying post-deploy patches..."
+    if "$patch_script" "$api_source_dir"; then
+      log "Post-deploy patches applied successfully"
+    else
+      log "WARNING: Post-deploy patches exited non-zero — continuing build anyway"
+    fi
+  else
+    log "NOTE: $patch_script not found or not executable — skipping post-deploy patches"
+  fi
+
   # 3b. Sync frontend
   if [[ -z "$frontend_staging_dir" ]]; then
     parent_staging=$(dirname "$staging_dir")
diff --git a/start.sh b/start.sh
index 22333b3..289a0d3 100755
--- a/start.sh
+++ b/start.sh
@@ -22,6 +22,8 @@ fi
 
 echo "[start.sh] Creating container with full config..."
 docker run -d --restart unless-stopped --name ${CONTAINER_NAME} \
+  --add-host=get.dashcaddy.net:194.233.88.206 \
+  --add-host=get2.dashcaddy.net:194.233.88.206 \
   --dns ${DNS_PRIMARY} \
   --dns ${DNS_FALLBACK} \
   -p 127.0.0.1:3001:3001 \