diff --git a/extension/dashboard.js b/extension/dashboard.js
index fda535e..4037d5e 100644
--- a/extension/dashboard.js
+++ b/extension/dashboard.js
@@ -1,6 +1,10 @@
 /**
  * Holesail Dashboard - UI logic
+ * Guard: only run when loaded as the actual dashboard page.
  */
+if (!document.getElementById('page-dashboard') && !document.querySelector('.sidebar-logo')) {
+  throw new Error('dashboard.js loaded outside dashboard context — aborting');
+}
 
 const SETTINGS_DEFAULTS = {
   proxyPort: 8443,
diff --git a/extension/manifest.json b/extension/manifest.json
index 94b58d8..60bf8ff 100644
--- a/extension/manifest.json
+++ b/extension/manifest.json
@@ -24,6 +24,10 @@
       "matches": [
         "<all_urls>"
       ],
+      "exclude_matches": [
+        "chrome-extension://*/*",
+        "moz-extension://*/*"
+      ],
       "js": [
         "content.js"
       ],
@@ -33,8 +37,6 @@
   "web_accessible_resources": [
     {
       "resources": [
-        "dashboard.html",
-        "dashboard.js",
         "vendor/xterm.js",
         "vendor/xterm-addon-fit.js",
         "vendor/xterm.css",