diff --git a/src/common.rs b/src/common.rs
index da5b4cf..f23299b 100644
--- a/src/common.rs
+++ b/src/common.rs
@@ -2106,27 +2106,36 @@ pub fn load_custom_client() {
     // Reason: RustDesk's official custom.txt path requires ed25519-signed base64 (see
     // read_custom_client at line 2191 — decode64 + sign::verify with key
     // "5Qbwsde3unUcJBtrx9ZkvUmwFNoExHzpryHuPUdqlWM="), which we can't produce without the
-    // official signing key. So we bypass custom.txt and inject directly into DEFAULT_SETTINGS.
-    // entry().or_insert() preserves the priority chain: OVERWRITE_SETTINGS → CONFIG2 → DEFAULT_SETTINGS,
-    // so users can still override any of these in their own RustDesk2.toml.
+    // official signing key. So we bypass custom.txt and inject directly.
     //
-    // Why each one is off (user has 4 users on 5 Mbps server, file transfers were saturating it):
-    //   enable-audio           — not needed for 4-user remote support; saves 64 kbps/session
-    //   enable-file-transfer   — THE KILLER: 1 GB upload = 2 GB server bandwidth (in + out)
-    //   enable-clipboard       — 50 kbps + privacy; rarely needed for remote support
-    //   enable-keyboard        — only needed for typing-on-remote scenarios
-    //   enable-tunnel          — TCP tunneling = users abusing server as a jump host
-    //   enable-record-session  — only needed if explicitly recording
+    // We use TWO mechanisms:
+    //   1. OVERWRITE_SETTINGS for options we want to FORCE off — user cannot flip
+    //      them on, even if they have old config entries. Get_or logic returns the
+    //      overwrite value before checking user config. This is what the user wants
+    //      for security/billing reasons — they explicitly asked for "默认开启是不对的"
+    //      and got bitten by old config values surviving.
+    //   2. DEFAULT_SETTINGS for options we want as fallbacks only — user can
+    //      override in their own RustDesk2.toml if they want.
+    //
+    // Why each one is off (user has 4 users on 5 Mbps server):
+    //   enable-audio           — not needed for 4-user remote support
+    //   enable-file-transfer   — THE KILLER: 1 GB upload = 2 GB server bandwidth
+    //   enable-clipboard       — 50 kbps + privacy; user complained "默认开启不对"
+    //   enable-keyboard        — user complained "默认开启不对"
+    //   enable-tunnel          — TCP tunneling = server as jump host
+    //   enable-record-session  — only when explicitly recording
     //   enable-camera          — 500 kbps; rarely used for support
     {
-        let mut defaults = config::DEFAULT_SETTINGS.write().unwrap();
-        defaults.entry("enable-audio".to_string()).or_insert("N".to_string());
-        defaults.entry("enable-file-transfer".to_string()).or_insert("N".to_string());
-        defaults.entry("enable-clipboard".to_string()).or_insert("N".to_string());
-        defaults.entry("enable-keyboard".to_string()).or_insert("N".to_string());
-        defaults.entry("enable-tunnel".to_string()).or_insert("N".to_string());
-        defaults.entry("enable-record-session".to_string()).or_insert("N".to_string());
-        defaults.entry("enable-camera".to_string()).or_insert("N".to_string());
+        // Force-off: user CANNOT override (use this for the ones the user
+        // explicitly complained about being on by default)
+        let mut overwrites = config::OVERWRITE_SETTINGS.write().unwrap();
+        overwrites.entry("enable-keyboard".to_string()).or_insert("N".to_string());
+        overwrites.entry("enable-clipboard".to_string()).or_insert("N".to_string());
+        overwrites.entry("enable-file-transfer".to_string()).or_insert("N".to_string());
+        overwrites.entry("enable-tunnel".to_string()).or_insert("N".to_string());
+        overwrites.entry("enable-record-session".to_string()).or_insert("N".to_string());
+        overwrites.entry("enable-camera".to_string()).or_insert("N".to_string());
+        overwrites.entry("enable-audio".to_string()).or_insert("N".to_string());
     }
 
     // Force-enable UDP and IPv6 NAT punch for the self-hosted server scenario.