diff --git a/src/ddns_service/app.py b/src/ddns_service/app.py
index d0fd583..62f7591 100644
--- a/src/ddns_service/app.py
+++ b/src/ddns_service/app.py
@@ -27,7 +27,8 @@ class Application:
             config: Configuration dictionary from TOML file.
             config_path: Path to configuration file (for reload).
         """
-        self.config = config
+        self._config = config
+        self._config_lock = threading.RLock()
         self.config_path = config_path
         self.password_hasher = argon2.PasswordHasher()
         self.shutdown_event = threading.Event()
@@ -38,6 +39,12 @@ class Application:
         self.good_limiter = None
         self.bad_limiter = None
 
+    @property
+    def config(self):
+        """Thread-safe config access."""
+        with self._config_lock:
+            return self._config
+
     def init_database(self):
         """Initialize database connection and run migrations."""
         init_database(self.config)
@@ -68,12 +75,13 @@ class Application:
         """
         new_config = load_config(self.config_path)
 
-        # Preserve DB and bind settings
-        new_config["database"] = self.config["database"]
-        new_config["daemon"]["host"] = self.config["daemon"]["host"]
-        new_config["daemon"]["port"] = self.config["daemon"]["port"]
+        with self._config_lock:
+            # Preserve DB and bind settings
+            new_config["database"] = self._config["database"]
+            new_config["daemon"]["host"] = self._config["daemon"]["host"]
+            new_config["daemon"]["port"] = self._config["daemon"]["port"]
 
-        self.config = new_config
+            self._config = new_config
 
         # Reconfigure logging
         setup_logging(