diff --git a/src/ZB.MOM.WW.ScadaBridge.Host/ControlPlaneAuthInterceptor.cs b/src/ZB.MOM.WW.ScadaBridge.Host/ControlPlaneAuthInterceptor.cs
index ad8c3487..19445447 100644
--- a/src/ZB.MOM.WW.ScadaBridge.Host/ControlPlaneAuthInterceptor.cs
+++ b/src/ZB.MOM.WW.ScadaBridge.Host/ControlPlaneAuthInterceptor.cs
@@ -62,7 +62,19 @@ public sealed class ControlPlaneAuthInterceptor : Interceptor
     private readonly IOptions<CommunicationOptions> _options;
     private readonly ILogger<ControlPlaneAuthInterceptor> _logger;
 
-    /// <summary>Creates the interceptor gating <see cref="DefaultGatedPrefixes"/>.</summary>
+    /// <summary>
+    /// Creates the interceptor gating <see cref="DefaultGatedPrefixes"/>.
+    /// </summary>
+    /// <remarks>
+    /// <b>This must remain the ONLY public constructor.</b> <c>AddGrpc</c> registers the
+    /// interceptor by type, and <c>Grpc.AspNetCore.Server.InterceptorRegistration.GetFactory()</c>
+    /// throws <c>"Multiple constructors accepting all given argument types have been found"</c>
+    /// when a second one is applicable. That throw happens per call, inside the pipeline, and
+    /// surfaces to the caller as <c>Unknown / "Exception was thrown by handler"</c> — so the gate
+    /// silently stops authorizing anything while still failing every call. A second public
+    /// constructor added here in a later phase reintroduces exactly that. Pinned by
+    /// <c>ControlPlaneAuthInterceptorTests.TheInterceptorHasExactlyOnePublicConstructor</c>.
+    /// </remarks>
     /// <param name="options">Communication options; <c>GrpcPsk</c> is the expected bearer token.</param>
     /// <param name="logger">Logger for denial diagnostics.</param>
     public ControlPlaneAuthInterceptor(
@@ -72,11 +84,16 @@ public sealed class ControlPlaneAuthInterceptor : Interceptor
     {
     }
 
-    /// <summary>Creates the interceptor gating an explicit set of service prefixes.</summary>
+    /// <summary>
+    /// Creates the interceptor gating an explicit set of service prefixes. <b>Internal</b> —
+    /// see the public constructor's remarks for why this cannot be public. Phases that add a
+    /// service to the gate should extend <see cref="DefaultGatedPrefixes"/> rather than reach
+    /// for a second registration shape.
+    /// </summary>
     /// <param name="options">Communication options; <c>GrpcPsk</c> is the expected bearer token.</param>
     /// <param name="logger">Logger for denial diagnostics.</param>
     /// <param name="gatedPrefixes">Method-path prefixes to gate, e.g. <c>/sitestream.SiteStreamService/</c>.</param>
-    public ControlPlaneAuthInterceptor(
+    internal ControlPlaneAuthInterceptor(
         IOptions<CommunicationOptions> options,
         ILogger<ControlPlaneAuthInterceptor> logger,
         IReadOnlyList<string> gatedPrefixes)
diff --git a/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthEndToEndTests.cs b/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthEndToEndTests.cs
index 577fd0a3..58583775 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthEndToEndTests.cs
+++ b/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthEndToEndTests.cs
@@ -47,10 +47,16 @@ public class ControlPlaneAuthEndToEndTests : IAsyncLifetime
                 .UseTestServer()
                 .ConfigureServices(services =>
                 {
+                    // Registered exactly as Program.cs does: by TYPE on AddGrpc, with the
+                    // interceptor itself NOT in DI. That is load-bearing. An earlier version of
+                    // this test added it as a singleton, which let DI hand back the instance and
+                    // bypassed Grpc.AspNetCore's own activation — hiding a defect where the
+                    // interceptor had two public constructors and
+                    // InterceptorRegistration.GetFactory() threw on every single call. The rig
+                    // caught it; this test did not. Do not pre-register it.
                     services.AddGrpc(o => o.Interceptors.Add<ControlPlaneAuthInterceptor>());
                     services.AddSingleton(Options.Create(
                         new CommunicationOptions { GrpcPsk = SiteKey }));
-                    services.AddSingleton<ControlPlaneAuthInterceptor>();
                     services.AddSingleton<EchoSiteStreamService>();
                 })
                 .Configure(app =>
diff --git a/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthInterceptorTests.cs b/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthInterceptorTests.cs
index ceee0e79..6845a32c 100644
--- a/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthInterceptorTests.cs
+++ b/tests/ZB.MOM.WW.ScadaBridge.Host.Tests/ControlPlaneAuthInterceptorTests.cs
@@ -205,6 +205,22 @@ public class ControlPlaneAuthInterceptorTests
         Assert.Equal("ok", await Invoke(interceptor, notGated));
     }
 
+    [Fact]
+    public void TheInterceptorHasExactlyOnePublicConstructor()
+    {
+        // Grpc.AspNetCore registers this interceptor BY TYPE, and
+        // InterceptorRegistration.GetFactory() throws "Multiple constructors accepting all given
+        // argument types have been found" the moment a second public constructor is applicable.
+        // The throw lands inside the pipeline on every call, so the symptom is not a startup
+        // failure but a gate that authorizes nothing and fails everything with
+        // Unknown / "Exception was thrown by handler" — a shape that looks like a handler bug,
+        // not an auth bug. This shipped once and was caught only on the docker rig; the
+        // prefix-set constructor is internal now to keep it from recurring.
+        var publicCtors = typeof(ControlPlaneAuthInterceptor).GetConstructors();
+
+        Assert.Single(publicCtors);
+    }
+
     [Fact]
     public void DefaultGatedPrefixes_MatchTheRealSiteStreamServicePath()
     {