diff --git a/haproxy.cfg b/haproxy.cfg
index ac80a7b..43346bd 100644
--- a/haproxy.cfg
+++ b/haproxy.cfg
@@ -136,12 +136,13 @@ frontend fe_http
     # Zabbix: 403 только при неверном IP (fail2ban haproxy-zabbix-403)
     http-request deny deny_status 403 if host_zabbix !src_zabbix_allowed
 
+    http-request deny deny_status 404 if host_ext !path_autodiscover
+    http-request deny deny_status 404 if !host_zabbix !host_autodiscover !host_ext
+
     use_backend be_exchange_http if host_autodiscover
     use_backend be_exchange_http if host_ext path_autodiscover
     use_backend be_zabbix if host_zabbix
 
-    http-request deny deny_status 404 if !host_zabbix !host_autodiscover !(host_ext path_autodiscover)
-
 backend be_exchange_http
     mode http
     option forwardfor
diff --git a/scripts/security/deploy-haproxy-http-fix.sh b/scripts/security/deploy-haproxy-http-fix.sh
new file mode 100644
index 0000000..fb88154
--- /dev/null
+++ b/scripts/security/deploy-haproxy-http-fix.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Deploy fe_http + fail2ban fix on HAProxy host. Preserves stats auth from live config.
+set -euo pipefail
+
+NEW_CFG="${1:-/tmp/haproxy.cfg.new}"
+F2B_FILTER="${2:-/tmp/haproxy-zabbix-403.conf}"
+LIVE_CFG="/etc/haproxy/haproxy.cfg"
+TS="$(date +%Y%m%d-%H%M%S)"
+
+if [[ ! -f "$NEW_CFG" ]]; then
+  echo "Missing $NEW_CFG" >&2
+  exit 1
+fi
+
+STATS_AUTH="$(grep -E '^[[:space:]]+stats auth ' "$LIVE_CFG" | head -1 | sed 's/^[[:space:]]*//')"
+if [[ -z "$STATS_AUTH" ]]; then
+  echo "Could not read stats auth from $LIVE_CFG" >&2
+  exit 1
+fi
+
+MERGED="/tmp/haproxy.cfg.merged-${TS}"
+cp "$NEW_CFG" "$MERGED"
+# Replace placeholder; stats line has no spaces in password
+sed -i "s|stats auth admin:CHANGEME|${STATS_AUTH}|" "$MERGED"
+
+echo "Backup: ${LIVE_CFG}.bak-${TS}"
+cp "$LIVE_CFG" "${LIVE_CFG}.bak-${TS}"
+
+echo "=== merged checks ==="
+grep 'Config version' "$MERGED"
+grep -E 'frontend fe_http|fe_http_zabbix|be_exchange_http' "$MERGED"
+grep -E '^[[:space:]]+stats auth ' "$MERGED"
+
+haproxy -c -f "$MERGED"
+cp "$MERGED" "$LIVE_CFG"
+systemctl reload haproxy
+echo "HAProxy reloaded OK"
+
+if [[ -f "$F2B_FILTER" ]]; then
+  cp "$F2B_FILTER" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
+  systemctl reload fail2ban || fail2ban-client reload
+  echo "fail2ban filter updated"
+fi
+
+for jail in haproxy-zabbix-403 haproxy-reject sshd; do
+  if fail2ban-client status "$jail" >/dev/null 2>&1; then
+    banned="$(fail2ban-client status "$jail" | sed -n 's/.*Banned IP list:[[:space:]]*//p')"
+    if [[ -n "${banned// }" ]]; then
+      for ip in $banned; do
+        fail2ban-client set "$jail" unbanip "$ip"
+        echo "unbanned $ip from $jail"
+      done
+    fi
+  fi
+done
+
+if fail2ban-client unban --all >/dev/null 2>&1; then
+  fail2ban-client unban --all
+  echo "fail2ban-client unban --all done"
+fi
+
+echo "=== final ==="
+grep 'Config version' "$LIVE_CFG"
+fail2ban-client status haproxy-zabbix-403 | grep -E 'Currently banned|Banned IP'
+fail2ban-client status haproxy-reject | grep -E 'Currently banned|Banned IP'