diff --git a/changelog.md b/changelog.md
index 13b8c48..fcf3ce6 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-03-31 - 11.23.5 - fix(config)
+correct VPN mandatory flag default handling in route config manager
+
+- Changes the VPN mandatory check so it only applies when explicitly set to true, matching the updated default behavior of false.
+- Prevents routes from being treated as VPN-mandatory when the setting is omitted.
+
 ## 2026-03-31 - 11.23.4 - fix(deps)
 bump @push.rocks/smartvpn to 1.17.1
 
diff --git a/ts/00_commitinfo_data.ts b/ts/00_commitinfo_data.ts
index 34bf36d..cefdcf4 100644
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '11.23.4',
+  version: '11.23.5',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }
diff --git a/ts/config/classes.route-config-manager.ts b/ts/config/classes.route-config-manager.ts
index 74449ef..d913825 100644
--- a/ts/config/classes.route-config-manager.ts
+++ b/ts/config/classes.route-config-manager.ts
@@ -261,7 +261,7 @@ export class RouteConfigManager {
       const dcRoute = route as IDcRouterRouteConfig;
       if (!dcRoute.vpn?.enabled) return route;
       const allowList = vpnAllowList(dcRoute.vpn.allowedServerDefinedClientTags);
-      const mandatory = dcRoute.vpn.mandatory !== false; // defaults to true
+      const mandatory = dcRoute.vpn.mandatory === true; // defaults to false
       return {
         ...route,
         security: {
diff --git a/ts_web/00_commitinfo_data.ts b/ts_web/00_commitinfo_data.ts
index 34bf36d..cefdcf4 100644
--- a/ts_web/00_commitinfo_data.ts
+++ b/ts_web/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '11.23.4',
+  version: '11.23.5',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }