diff --git a/projects/keepkey-vault/package.json b/projects/keepkey-vault/package.json
index 3a7a1bd5..2639b9bb 100644
--- a/projects/keepkey-vault/package.json
+++ b/projects/keepkey-vault/package.json
@@ -1,6 +1,6 @@
 {
   "name": "keepkey-vault",
-  "version": "1.3.5",
+  "version": "1.3.6",
   "description": "KeepKey Vault - Desktop hardware wallet management powered by Electrobun",
   "scripts": {
     "dev": "bun scripts/bundle-backend.ts && vite build && bun scripts/collect-externals.ts && electrobun build && bun scripts/patch-bundle.ts && electrobun dev",
diff --git a/projects/keepkey-vault/src/bun/index.ts b/projects/keepkey-vault/src/bun/index.ts
index 11257718..07c56cc6 100644
--- a/projects/keepkey-vault/src/bun/index.ts
+++ b/projects/keepkey-vault/src/bun/index.ts
@@ -403,7 +403,7 @@ const auth = new AuthStore()
 // Settings loaded lazily after DB init — defaults used until then
 let restApiEnabled = false
 let walletConnectEnabled = false
-let swapsEnabled = true  // default on; only disabled when explicitly set to '0'
+let swapsEnabled = false  // default off; only enabled when explicitly set to '1'
 let bip85Enabled = false
 let zcashPrivacyEnabled = false
 // True after the per-session incremental scan has caught the wallet up to
@@ -423,7 +423,7 @@ let alphaFirmware = false
 function loadSettings() {
 	restApiEnabled = getSetting('rest_api_enabled') === '1'
 	walletConnectEnabled = getSetting('walletconnect_enabled') === '1'
-	swapsEnabled = getSetting('swaps_enabled') !== '0'  // absent → true (opt-out model)
+	swapsEnabled = getSetting('swaps_enabled') === '1'  // absent → false (opt-in model)
 	bip85Enabled = getSetting('bip85_enabled') === '1'
 	zcashPrivacyEnabled = getSetting('zcash_privacy_enabled') === '1'
 	emulatorEnabled = getSetting('emulator_enabled') === '1'