diff --git a/gitnexus-desktop/build/icon.png b/gitnexus-desktop/build/icon.png
index 3455d799a..9b388fa39 100644
Binary files a/gitnexus-desktop/build/icon.png and b/gitnexus-desktop/build/icon.png differ
diff --git a/gitnexus/src/server/validation.ts b/gitnexus/src/server/validation.ts
index bae6a9ad0..83fa6922a 100644
--- a/gitnexus/src/server/validation.ts
+++ b/gitnexus/src/server/validation.ts
@@ -19,7 +19,7 @@
  */
 
 import path from 'node:path';
-import rateLimit, { type RateLimitRequestHandler, ipKeyGenerator } from 'express-rate-limit';
+import rateLimit, { ipKeyGenerator, type RateLimitRequestHandler } from 'express-rate-limit';
 import type { Request } from 'express';
 
 /**
@@ -138,9 +138,6 @@ export interface RouteLimiterOverrides {
  *   - keyGenerator: req.ip with a socket.remoteAddress fallback so abruptly
  *     closed connections do not trigger ERR_ERL_UNDEFINED_IP_ADDRESS
  *     (which would 500 the request via Express's default error handler).
- *     The IP is passed through `ipKeyGenerator` so IPv6 addresses are
- *     normalised to their /56 subnet — without this, each IPv6 address
- *     gets its own counter and the limit is trivially bypassed (#1360).
  *     Caller must wire `app.set('trust proxy', ...)` correctly — see
  *     createServer in api.ts.
  *
@@ -154,10 +151,7 @@ export function createRouteLimiter(opts?: RouteLimiterOverrides): RateLimitReque
     standardHeaders: 'draft-7',
     legacyHeaders: false,
     passOnStoreError: true,
-    keyGenerator: (req: Request) => {
-      const ip = req.ip ?? req.socket?.remoteAddress;
-      return ip ? ipKeyGenerator(ip) : 'unknown';
-    },
+    keyGenerator: (req: Request) => ipKeyGenerator(req.ip ?? req.socket?.remoteAddress ?? ''),
     message: { error: 'Too many requests, please try again later.' },
     ...opts,
   });