diff --git a/src/ZB.MOM.WW.MxGateway.Server/Configuration/GatewayConfigurationProvider.cs b/src/ZB.MOM.WW.MxGateway.Server/Configuration/GatewayConfigurationProvider.cs
index 0b30aa0..169769a 100644
--- a/src/ZB.MOM.WW.MxGateway.Server/Configuration/GatewayConfigurationProvider.cs
+++ b/src/ZB.MOM.WW.MxGateway.Server/Configuration/GatewayConfigurationProvider.cs
@@ -64,12 +64,13 @@ public sealed class GatewayConfigurationProvider(IOptions<GatewayOptions> option
                 ShowTagValues: value.Dashboard.ShowTagValues,
                 GroupToRole: value.Dashboard.GroupToRole,
                 // Rebuilt rather than passed through because the value type widens from string[]
-                // to IReadOnlyList<string>; the comparer is carried over so the projected map
-                // still matches LDAP group names in whatever case the directory returns them.
+                // to IReadOnlyList<string>; the source dictionary's own comparer is carried over
+                // (case-insensitive by default) so the projected map still matches LDAP group
+                // names in whatever case the directory returns them.
                 GroupToTag: value.Dashboard.GroupToTag.ToDictionary(
                     pair => pair.Key,
                     pair => (IReadOnlyList<string>)pair.Value,
-                    StringComparer.OrdinalIgnoreCase),
+                    value.Dashboard.GroupToTag.Comparer),
                 UntaggedSessionVisibility: value.Dashboard.UntaggedSessionVisibility),
             Protocol: new EffectiveProtocolConfiguration(
                 value.Protocol.WorkerProtocolVersion,