diff --git a/plugins/geenforce/frontend/routes.js b/plugins/geenforce/frontend/routes.js
index 52c575e..2c18f0d 100644
--- a/plugins/geenforce/frontend/routes.js
+++ b/plugins/geenforce/frontend/routes.js
@@ -24,13 +24,15 @@ export default [
         name: 'geenforce-reports',
         component: () => import('./views/EnforcementReports.vue'),
         meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
-      },
-      {
-        path: 'settings',
-        name: 'geenforce-settings',
-        component: () => import('./views/GeEnforceSettings.vue'),
-        meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
       }
     ]
+  },
+  {
+    // Config lives in the Settings rail (contributed via get_settings_cards),
+    // not inside the GE-Enforce section tabs.
+    path: 'settings/geenforce',
+    name: 'settings-geenforce',
+    component: () => import('./views/GeEnforceSettings.vue'),
+    meta: { requiresAuth: true, requiresAdmin: true, plugin: 'geenforce' }
   }
 ]
diff --git a/plugins/geenforce/frontend/views/GeEnforceLayout.vue b/plugins/geenforce/frontend/views/GeEnforceLayout.vue
index c06db07..b5c74af 100644
--- a/plugins/geenforce/frontend/views/GeEnforceLayout.vue
+++ b/plugins/geenforce/frontend/views/GeEnforceLayout.vue
@@ -7,7 +7,6 @@
     <nav class="section-tabs">
       <router-link to="/geenforce/manifests" class="tab">Manifests</router-link>
       <router-link to="/geenforce/reports" class="tab">Enforcement Reports</router-link>
-      <router-link to="/geenforce/settings" class="tab">Settings</router-link>
     </nav>
     <router-view />
   </div>
diff --git a/plugins/geenforce/plugin.py b/plugins/geenforce/plugin.py
index eca23c9..030672c 100644
--- a/plugins/geenforce/plugin.py
+++ b/plugins/geenforce/plugin.py
@@ -91,6 +91,19 @@ class GeEnforcePlugin(BasePlugin):
             },
         ]
 
+    def get_settings_cards(self) -> List[Dict]:
+        """Admin config for GE-Enforce lives in the Settings rail."""
+        return [
+            {
+                'group': 'GE-Enforce',
+                'to': '/settings/geenforce',
+                'icon': 'shield',
+                'title': 'GE-Enforce Settings',
+                'description': 'Client IP allowlist for token-less fleet access',
+                'position': 46,
+            },
+        ]
+
     def init_app(self, app: Flask, db_instance) -> None:
         logger.info(f"GE-Enforce plugin initialized (v{self.meta.version})")