diff --git a/src/main.c b/src/main.c
index 21719b6..b9a4caf 100644
--- a/src/main.c
+++ b/src/main.c
@@ -503,8 +503,8 @@ int socket_name_random(char *out, size_t out_len);
 /* Version information (auto-updated by build/version tooling) */
 #define NSIGNER_VERSION_MAJOR 0
 #define NSIGNER_VERSION_MINOR 0
-#define NSIGNER_VERSION_PATCH 40
-#define NSIGNER_VERSION "v0.0.40"
+#define NSIGNER_VERSION_PATCH 41
+#define NSIGNER_VERSION "v0.0.41"
 
 
 /* NSIGNER_HEADERLESS_DECLS_END */
diff --git a/src/server.c b/src/server.c
index 9b72e09..29d2dc7 100644
--- a/src/server.c
+++ b/src/server.c
@@ -1680,7 +1680,7 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
         response = strdup("{\"id\":\"null\",\"error\":{\"code\":2002,\"message\":\"index_not_allowed\"}}");
         pchk = POLICY_DENY;
         verdict = "DENIED";
-        source_label = "index-whitelist";
+        source_label = "index-not-approved";
         hard_selector_error = -100;  /* sentinel: skip policy_check */
     }
 
@@ -1778,6 +1778,9 @@ int server_handle_one(server_ctx_t *ctx, server_activity_cb cb, void *cb_data) {
         source_label = "session-grant";
     } else if (pchk == POLICY_ALLOW) {
         source_label = "prompt";
+    } else if (hard_selector_error == -100) {
+        /* Index whitelist denial — keep the label set by the whitelist check */
+        /* source_label already set to "index-not-approved" above */
     } else {
         source_label = "no-match";
     }