diff --git a/projects/start-wrt/CHANGELOG.md b/projects/start-wrt/CHANGELOG.md
index 7359db344..7350ff86d 100644
--- a/projects/start-wrt/CHANGELOG.md
+++ b/projects/start-wrt/CHANGELOG.md
@@ -101,8 +101,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   previously could be published to a device without warning, silently cutting
   that router service off from outside your network. Saving such a rule now
   surfaces the conflict in a confirmation dialog; you can still publish the
-  port deliberately, and you're asked once per rule. Detection follows the
-  live configuration (nothing is asked for ports no router service uses) and
+  port deliberately, and you're asked once per rule — again only if you
+  change which port that rule publishes, or its protocol. Detection follows
+  the live configuration (nothing is asked for ports no router service uses) and
   matches transports, so e.g. a UDP-only forward on 443 doesn't warn.
 - The firmware build stamp is now identical everywhere it appears: the
   `startwrt` binary (UI `ETag`, `system.info`, `startwrt verify`) now carries
diff --git a/projects/start-wrt/docs/src/published-ports.md b/projects/start-wrt/docs/src/published-ports.md
index 599ea279b..d0718639f 100644
--- a/projects/start-wrt/docs/src/published-ports.md
+++ b/projects/start-wrt/docs/src/published-ports.md
@@ -30,7 +30,7 @@ Published ports (port forwarding) allow devices on the Internet to reach specifi
 > If the device's [Security Profile](security-profiles.md) routes its traffic through an [Outbound VPN](outbound-vpn.md), creating or re-enabling a rule prompts for confirmation: published ports are reached over your public WAN address, not through the VPN, so the port is exposed on your real public IP.
 
 > [!WARNING]
-> Some ports the router answers on itself. If [Remote Access](settings.md#remote-access) is on — including the default "When behind NAT" mode while the router sits behind another router — the router serves its own web interface, and optionally SSH, on WAN ports 80, 443, and 22; an [Inbound VPN](inbound-vpn.md) listens on its configured port. Publishing one of these ports sends that traffic to your device instead, cutting the router's own service off from outside your network (access from your LAN is unaffected). Saving such a rule therefore prompts for confirmation first — you can override it deliberately, e.g. to run your own web server on 443 when you don't use remote access to the router. You are asked once per rule; editing the rule asks again. When the port's actual holder is a device's [hostname routes](#hostname-routes-shared-ports) rather than a router service, the prompt says so instead, naming the routed hostnames and the device they belong to.
+> Some ports the router answers on itself. If [Remote Access](settings.md#remote-access) is on — including the default "When behind NAT" mode while the router sits behind another router — the router serves its own web interface, and optionally SSH, on WAN ports 80, 443, and 22; an [Inbound VPN](inbound-vpn.md) listens on its configured port. Publishing one of these ports sends that traffic to your device instead, cutting the router's own service off from outside your network (access from your LAN is unaffected). Saving such a rule therefore prompts for confirmation first — you can override it deliberately, e.g. to run your own web server on 443 when you don't use remote access to the router. You are asked once per rule; changing which port that rule publishes, or its protocol, asks again. When the port's actual holder is a device's [hostname routes](#hostname-routes-shared-ports) rather than a router service, the prompt says so instead, naming the routed hostnames and the device they belong to.
 
 ## Editing a Rule
 
diff --git a/projects/start-wrt/web/src/app/routes/published-ports/dialog.ts b/projects/start-wrt/web/src/app/routes/published-ports/dialog.ts
index c27fdbc7b..2c264ec96 100644
--- a/projects/start-wrt/web/src/app/routes/published-ports/dialog.ts
+++ b/projects/start-wrt/web/src/app/routes/published-ports/dialog.ts
@@ -546,6 +546,11 @@ export class PublishPortDialog implements OnInit {
       ipv6,
       ipv4PublicPort,
       source: value.sourceType === 'any' ? 'any' : value.sourceValue || 'any',
+      overrideWanPorts:
+        existing?.overrideWanPorts &&
+        existing.protocol === value.protocol &&
+        (existing.ipv4PublicPort ?? existing.ports) ===
+          (ipv4PublicPort ?? value.ports),
     }
 
     const result: PublishedPortDialogResult = {
diff --git a/projects/start-wrt/web/src/app/routes/published-ports/types.ts b/projects/start-wrt/web/src/app/routes/published-ports/types.ts
index e40615a9d..368e81911 100644
--- a/projects/start-wrt/web/src/app/routes/published-ports/types.ts
+++ b/projects/start-wrt/web/src/app/routes/published-ports/types.ts
@@ -25,7 +25,11 @@ export interface PublishedPort {
   ipv6: boolean
   ipv4PublicPort?: string
   source: 'any' | string
-  /** Preserves prior WAN collision confirmation. */
+  /**
+   * Preserves prior WAN collision confirmation. An edit that changes the
+   * published range or the protocol drops it, re-validating what the user
+   * never confirmed.
+   */
   overrideWanPorts?: boolean
 }