diff --git a/package.json b/package.json
index 1e90a17..0cf5ddd 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "site-gateway",
-  "version": "0.11.89",
+  "version": "0.11.90",
   "private": true,
   "description": "Site Gateway: simple self-hosted website publishing, reverse proxying, and automatic HTTPS.",
   "type": "module",
diff --git a/src/server.js b/src/server.js
index 27907bc..ef330d4 100644
--- a/src/server.js
+++ b/src/server.js
@@ -328,7 +328,12 @@ function caddySiteAddress(item) {
 }
 
 function caddyQuote(value) {
-  return `"${String(value).replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", " ")}"`;
+  // Caddy's Caddyfile lexer only special-cases \" inside a quoted string — it does NOT
+  // collapse \\ into a single backslash (confirmed in caddyconfig/caddyfile/lexer.go: "all is
+  // literal in quoted area, so only escape quotes"). Doubling backslashes here, as this used to,
+  // corrupts any value that legitimately contains one (e.g. a regex like eval\( becomes eval\\(,
+  // which Caddy then reads as an escaped backslash followed by an unclosed real group).
+  return `"${String(value).replaceAll('"', '\\"').replaceAll("\n", " ")}"`;
 }
 
 function accessDirectives(accessListId) {