diff --git a/FORK_PRS.md b/FORK_PRS.md
index 8d3427d..20b91c2 100644
--- a/FORK_PRS.md
+++ b/FORK_PRS.md
@@ -25,7 +25,7 @@ become its own scoped PR. Issue numbers filled in once created.
 | 5 | [#24](https://github.com/fugo101/microlink/issues/24) | [`cplewes/microlink`](https://github.com/cplewes/microlink) | `9f6af750` | Yield 1 tick per peer in `disco_periodic_probes` — prevents starving other same-core tasks on large tailnets | 1 |
 | 6 | [#25](https://github.com/fugo101/microlink/issues/25) | [`cplewes/microlink`](https://github.com/cplewes/microlink) | `b9636816` | DERP TLS session resumption (skip full ECDHE handshake on reconnect, ~7.5s→sub-second), connect timeout 10s→25s, per-peer exponential backoff on direct-path upgrade probes | 1 |
 | 7 | [#26](https://github.com/fugo101/microlink/issues/26) | [`antmanler/microlink`](https://github.com/antmanler/microlink) (branch `duoduo-edge`) | `2a7ba328` | `wg_udp_output_cb` thread-safety bug (raw UDP PCB called from two task contexts, corrupts heap) — same bug class as absorbed upstream PR #20, opposite direction; bundled with WG/DISCO RX queue depth increase (8→32/16) and a handshake-gating bug in `process_disco_pong` that permanently blocked sessions | 1 |
-| 8 | [#27](https://github.com/fugo101/microlink/issues/27) | [`antmanler/microlink`](https://github.com/antmanler/microlink) | `6ef9f5a0` | New `CONFIG_ML_CONFIG_HTTPD` Kconfig toggle to skip the port-80 httpd task (~7-8KB RAM saved); peer-update queue depth fix 400→32 (was allowing an unbounded ~80KB internal-RAM burst) | 1 |
+| 8 | ✅ [#27](https://github.com/fugo101/microlink/issues/27) (done) | [`antmanler/microlink`](https://github.com/antmanler/microlink) | `6ef9f5a0` | New `CONFIG_ML_CONFIG_HTTPD` Kconfig toggle to skip the port-80 httpd task (~7-8KB RAM saved); peer-update queue depth fix 400→32 (was allowing an unbounded ~80KB internal-RAM burst). Not a literal cherry-pick — `git apply` failed on unrelated line drift from PR #47's teardown rewrite, so hand-ported with identical logic/comments. | 1 |
 | 9 | [#28](https://github.com/fugo101/microlink/issues/28) | [`antmanler/microlink`](https://github.com/antmanler/microlink) | `2a7ba328` | WG netif MTU 1420→1280 (Tailscale-standard) — needs verification against our existing `CONFIG_LWIP_IP4_FRAG`/`IP4_REASSEMBLY=y` before deciding it's still needed | 1 |
 | 10 | [#29](https://github.com/fugo101/microlink/issues/29) | [`liestrela/microlink`](https://github.com/liestrela/microlink) | `1649d987` | Gate ESP32 temp-sensor feature behind `CONFIG_SOC_TEMP_SENSOR_SUPPORTED` — `esp_driver_tsens` was an unconditional `REQUIRES`, breaks build on SoC variants without a temp sensor | 1 |
 | 11 | [#30](https://github.com/fugo101/microlink/issues/30) | `cplewes` vs `Csontikka` (conflict) | `cplewes` `83a102be`/`01d51697` vs [`Csontikka/microlink`](https://github.com/Csontikka/microlink) `dd5714c4`→`2e68e546` | `ip_input()` vs `netif->input`/`tcpip_input` threading fix for decrypted WG RX pbufs — cplewes fixes a UAF this way, Csontikka's own branch later reverted the equivalent fix citing a throughput regression (~30pps cap). Needs research, not a blind cherry-pick | 2 |
diff --git a/components/microlink/Kconfig b/components/microlink/Kconfig
index 317cd0b..708d674 100644
--- a/components/microlink/Kconfig
+++ b/components/microlink/Kconfig
@@ -69,6 +69,16 @@ menu "MicroLink V2 Configuration"
             The blob is PSRAM-backed in memory. Ensure your NVS partition is
             large enough for the configured value.
 
+    config ML_CONFIG_HTTPD
+        bool "Start the port-80 config web server"
+        default y
+        help
+            The config module always loads its NVS settings at init; this
+            option only controls the embedded HTTP server (web UI + REST).
+            Disabling saves ~7-8 KB of internal RAM (httpd task stack and
+            bookkeeping) on RAM-tight boards. With it off, provisioning a
+            fresh device needs a build with it on, or direct NVS writes.
+
     config ML_H2_BUFFER_SIZE_KB
         int "HTTP/2 receive buffer size (KB)"
         default 512
diff --git a/components/microlink/include/microlink_internal.h b/components/microlink/include/microlink_internal.h
index 4b670e9..3db2416 100644
--- a/components/microlink/include/microlink_internal.h
+++ b/components/microlink/include/microlink_internal.h
@@ -63,7 +63,10 @@ extern "C" {
 #define ML_WG_RX_QUEUE_DEPTH    8
 #define ML_STUN_RX_QUEUE_DEPTH  4
 #define ML_COORD_CMD_QUEUE_DEPTH 4
-#define ML_PEER_UPDATE_QUEUE_DEPTH 400
+/* Bounds in-flight peer-update payloads (each ~208 B, malloc'd internal by
+ * ml_net_io RX). 400 was underived and allowed a theoretical ~80 KB internal
+ * burst; 32 = 4x the runtime max_peers=8 and caps the burst at ~6.6 KB. */
+#define ML_PEER_UPDATE_QUEUE_DEPTH 32
 
 /* Protocol limits */
 #define ML_MAX_PEERS            CONFIG_ML_MAX_PEERS
diff --git a/components/microlink/src/microlink.c b/components/microlink/src/microlink.c
index 8d1a4b9..74fb44b 100644
--- a/components/microlink/src/microlink.c
+++ b/components/microlink/src/microlink.c
@@ -603,10 +603,15 @@ esp_err_t microlink_start(microlink_t *ml) {
     ml_coord_cmd_t cmd = ML_CMD_CONNECT;
     xQueueSend(ml->coord_cmd_queue, &cmd, 0);
 
-    /* Start HTTP config server (binds port 80, serves config page + REST API) */
+    /* Start HTTP config server (binds port 80, serves config page + REST API).
+     * ML_CONFIG_HTTPD=n skips only the server: ml_config_httpd_init() already
+     * loaded the NVS settings above, so a provisioned device runs normally and
+     * keeps the ~7-8 KB of internal RAM the httpd task would pin. */
+#if CONFIG_ML_CONFIG_HTTPD
     if (ml->config_httpd) {
         ml_config_httpd_start(ml->config_httpd, ml);
     }
+#endif
 
     ESP_LOGI(TAG, "All tasks started");
     return ESP_OK;