diff --git a/server/src/cleanup.rs b/server/src/cleanup.rs
index d43021d..7821d4c 100644
--- a/server/src/cleanup.rs
+++ b/server/src/cleanup.rs
@@ -20,13 +20,7 @@ pub async fn cleanup_loop(state: Arc<AppState>) {
 
         // Evict stale rate-limiter entries to prevent unbounded HashMap growth.
         {
-            let window_secs = {
-                if let Ok(config) = state.config.read() {
-                    config.rate_limit_window_secs
-                } else {
-                    10 // fallback default
-                }
-            };
+            let window_secs = state.get_config().rate_limit_window_secs;
             let mut rl = state.rate_limiter.lock().await;
             rl.evict_stale(window_secs);
         }
diff --git a/server/src/routes/heartbeat.rs b/server/src/routes/heartbeat.rs
index 933daee..5a79bcd 100644
--- a/server/src/routes/heartbeat.rs
+++ b/server/src/routes/heartbeat.rs
@@ -10,11 +10,8 @@ pub async fn handler(
     // Rate limiting
     {
         let (limit, window_secs) = {
-            if let Ok(cfg) = state.config.read() {
-                (cfg.rate_limit_count, cfg.rate_limit_window_secs)
-            } else {
-                (5, 10)
-            }
+            let cfg = state.get_config();
+            (cfg.rate_limit_count, cfg.rate_limit_window_secs)
         };
         let mut rl = state.rate_limiter.lock().await;
         if !rl.check(&payload.session_id, limit, window_secs) {
@@ -29,13 +26,7 @@ pub async fn handler(
         }
     }
 
-    let config = {
-        if let Ok(cfg) = state.config.read() {
-            cfg.clone()
-        } else {
-            crate::config::Config::default()
-        }
-    };
+    let config = state.get_config();
     let conn = match state.db_pool.get() {
         Ok(c) => c,
         Err(e) => {
diff --git a/server/src/routes/init.rs b/server/src/routes/init.rs
index abfe818..aa16547 100644
--- a/server/src/routes/init.rs
+++ b/server/src/routes/init.rs
@@ -8,13 +8,7 @@ pub async fn handler(
     State(state): State<Arc<AppState>>,
     Json(payload): Json<InitRequest>,
 ) -> Result<Json<InitResponse>, SessionError> {
-    let config = {
-        if let Ok(cfg) = state.config.read() {
-            cfg.clone()
-        } else {
-            crate::config::Config::default()
-        }
-    };
+    let config = state.get_config();
     let conn = state.db_pool.get()?;
     let resp = crate::session::create_session(&conn, &config, &payload.public_key)?;
     Ok(Json(resp))
diff --git a/server/src/session.rs b/server/src/session.rs
index 83ae657..74ea6de 100644
--- a/server/src/session.rs
+++ b/server/src/session.rs
@@ -4,6 +4,16 @@ pub struct AppState {
     pub config: std::sync::RwLock<crate::config::Config>,
 }
 
+impl AppState {
+    pub fn get_config(&self) -> crate::config::Config {
+        if let Ok(cfg) = self.config.read() {
+            cfg.clone()
+        } else {
+            crate::config::Config::default()
+        }
+    }
+}
+
 use crate::{crypto, fingerprint, storage, trust, vm};
 use rusqlite::params;
 use shared::protocol::{HeartbeatRequest, InitResponse};