diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/ModbusDriverForm.razor b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/ModbusDriverForm.razor
index da9036ba..f0959d1a 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/ModbusDriverForm.razor
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/ModbusDriverForm.razor
@@ -3,6 +3,7 @@
    ModbusDriverPage and by DriverConfigModal. Exposes GetConfigJson() for the parent to pull at save +
    Test-connect time, and fires DriverConfigJsonChanged for @bind support. *@
 @using System.Text.Json
+@using System.Text.Json.Nodes
 @using System.Text.Json.Serialization
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
 @using ZB.MOM.WW.OtOpcUa.Driver.Modbus
@@ -241,10 +242,20 @@
         }
     }
 
-    /// <summary>Serializes the current channel/protocol config to camelCase JSON (endpoint excluded from the UI,
-    /// carried at harmless defaults; the device's DeviceConfig merges its endpoint up at deploy/probe time).</summary>
+    // v3: the endpoint lives on the Device (DeviceConfig), not the driver. Strip the endpoint keys from
+    // the serialized channel config so DeviceConfig is the SOLE endpoint source — otherwise a stale
+    // driver-level default (host=127.0.0.1) is carried in DriverConfig and shadows the device on any
+    // driver that reads a single top-level Host, silently, as soon as a 2nd device exists (reviewer H1).
+    private static readonly string[] EndpointKeys = ["host", "port", "unitId"];
+
+    /// <summary>Serializes the current channel/protocol config to camelCase JSON, with the endpoint keys
+    /// removed (the device's DeviceConfig is the sole endpoint source, merged up at deploy/probe time).</summary>
     public string GetConfigJson()
-        => JsonSerializer.Serialize(_form.ToOptions(), _jsonOpts);
+    {
+        var node = JsonSerializer.SerializeToNode(_form.ToOptions(), _jsonOpts)!.AsObject();
+        foreach (var key in EndpointKeys) node.Remove(key);
+        return node.ToJsonString(_jsonOpts);
+    }
 
     private async Task EmitAsync()
     {
diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/OpcUaClientDriverForm.razor b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/OpcUaClientDriverForm.razor
index 53f0611c..1dace2bb 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/OpcUaClientDriverForm.razor
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/OpcUaClientDriverForm.razor
@@ -2,6 +2,7 @@
    OpcUaClientDeviceForm (Device.DeviceConfig) in v3; the EndpointUrls FAILOVER LIST stays here (it is a
    driver-level policy). Hosted by the routed page + DriverConfigModal. *@
 @using System.Text.Json
+@using System.Text.Json.Nodes
 @using System.Text.Json.Serialization
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
 @using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient
@@ -232,7 +233,15 @@
     }
 
     public string GetConfigJson()
-        => JsonSerializer.Serialize(_form.OpcUa.ToRecord(_endpoints.Select(r => r.ToUrl()).ToList()), _jsonOpts);
+    {
+        // v3 (reviewer H1): the convenience scalar endpoint lives on the Device (DeviceConfig). Strip the
+        // scalar "endpointUrl" so the device is its sole source; the "endpointUrls" failover list stays
+        // here (it is a driver-level policy and wins over the scalar at runtime when populated).
+        var node = JsonSerializer.SerializeToNode(
+            _form.OpcUa.ToRecord(_endpoints.Select(r => r.ToUrl()).ToList()), _jsonOpts)!.AsObject();
+        node.Remove("endpointUrl");
+        return node.ToJsonString(_jsonOpts);
+    }
 
     private async Task EmitAsync()
     {
diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/S7DriverForm.razor b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/S7DriverForm.razor
index d450f73b..da936e66 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/S7DriverForm.razor
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/S7DriverForm.razor
@@ -3,6 +3,7 @@
    S7DriverPage and by DriverConfigModal. Exposes GetConfigJson() for the parent to pull at save +
    Test-connect time, and fires DriverConfigJsonChanged for @bind support. *@
 @using System.Text.Json
+@using System.Text.Json.Nodes
 @using System.Text.Json.Serialization
 @using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
 @using ZB.MOM.WW.OtOpcUa.Driver.S7
@@ -98,10 +99,19 @@
         }
     }
 
-    /// <summary>Serializes the current protocol config to camelCase JSON (endpoint excluded from the UI,
-    /// carried at harmless defaults; the device's DeviceConfig merges its endpoint up at deploy/probe time).</summary>
+    // v3: the endpoint lives on the Device (DeviceConfig). Strip the endpoint keys so DeviceConfig is the
+    // sole endpoint source — a stale driver-level default would otherwise shadow the device on the
+    // single-top-level-Host read path as soon as a 2nd device exists (reviewer H1).
+    private static readonly string[] EndpointKeys = ["host", "port", "rack", "slot"];
+
+    /// <summary>Serializes the current protocol config to camelCase JSON, with the endpoint keys removed
+    /// (the device's DeviceConfig is the sole endpoint source, merged up at deploy/probe time).</summary>
     public string GetConfigJson()
-        => JsonSerializer.Serialize(_form.ToOptions(), _jsonOpts);
+    {
+        var node = JsonSerializer.SerializeToNode(_form.ToOptions(), _jsonOpts)!.AsObject();
+        foreach (var key in EndpointKeys) node.Remove(key);
+        return node.ToJsonString(_jsonOpts);
+    }
 
     private async Task EmitAsync()
     {