diff --git a/app.go b/app.go
index dd3f429..f536610 100644
--- a/app.go
+++ b/app.go
@@ -986,17 +986,12 @@ func (a *App) startup(ctx context.Context) {
 	}
 	a.settings.SetProfile(active.ID)
 	a.settingsScoped.Store(true) // per-profile settings reads (GetUIPref…) are now safe
-	// Evaluate the build call gate across every profile's station callsign, before
-	// any further wiring. A denied call exits here, silently.
-	{
-		gate := []string{active.Callsign}
-		if list, lerr := a.profiles.List(a.ctx); lerr == nil {
-			for _, p := range list {
-				gate = append(gate, p.Callsign)
-			}
-		}
-		enforceCallGate(gate...)
-	}
+	// Evaluate the build call gate on the ACTIVE profile's station callsign, before
+	// any further wiring. A denied call exits here, silently. Only the active
+	// profile is checked (not every profile) so that "--profile <other>" is always
+	// a way back in — a blocked call is otherwise unrecoverable, since the process
+	// quits before the operator can change it.
+	enforceCallGate(active.Callsign)
 	// US county resolver — its own local SQLite (data/uls.db), populated on demand
 	// by DownloadULSCounties. Opening (creating an empty store) is cheap and never
 	// fatal: county resolution simply stays inert until the operator downloads it.