diff --git a/services/crowdsec.sh b/services/crowdsec.sh
index c37eaf0..ddaec1c 100644
--- a/services/crowdsec.sh
+++ b/services/crowdsec.sh
@@ -263,8 +263,24 @@ ASTENUM
 
                 # Disable the hub originals so they don't double-process the
                 # same events alongside the ASN-exempt forks written above.
-                sudo cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum 2>/dev/null || true
-                echo "  ✓ Wrote ASN-exempt local forks; disabled the hub originals"
+                # --force is required: these scenarios came in as part of the
+                # crowdsecurity/asterisk collection, and cscli refuses to
+                # remove/disable a collection member without it. Confirmed
+                # live: without --force this failed silently (stderr
+                # suppressed, "|| true" swallowed the non-zero exit), leaving
+                # the un-exempted hub original running side-by-side with the
+                # ASN-exempt fork the entire time — the fork's exemption
+                # never actually took effect for anyone, since the original
+                # scenario kept independently banning the same traffic with
+                # no ASN awareness at all.
+                if sudo cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum --force 2>/dev/null; then
+                    echo "  ✓ Wrote ASN-exempt local forks; disabled the hub originals"
+                else
+                    log_warning "Failed to disable the hub-original asterisk_bf/asterisk_user_enum scenarios —"
+                    log_warning "the ASN exemption below will NOT take effect until this is resolved. Run:"
+                    log_warning "  sudo cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum --force"
+                    log_warning "  sudo systemctl restart crowdsec"
+                fi
                 echo "  ℹ Exempted ASNs: $ASN_LIST — SSH/web/geo-allowlist scenarios are unaffected"
                 echo "  ℹ Edit /etc/crowdsec/scenarios/local-asterisk_*.yaml to add/remove ASNs later"
                 echo "    (then: sudo systemctl restart crowdsec)"
diff --git a/services/security-dashboard.sh b/services/security-dashboard.sh
index aac93f2..eb6767d 100644
--- a/services/security-dashboard.sh
+++ b/services/security-dashboard.sh
@@ -588,6 +588,19 @@ if [[ "$found" != "1" ]]; then
     exit 1
 fi
 
+# Self-healing: the hub-original crowdsecurity/asterisk_bf /
+# asterisk_user_enum scenarios have no ASN awareness at all, so if they're
+# still enabled alongside the exempt forks above, they independently ban
+# the same traffic regardless of anything just written — the exemption
+# above would silently do nothing. crowdsec.sh's original install is
+# supposed to disable them (--force, since they're crowdsecurity/asterisk
+# collection members), but an install from before that fix shipped (or one
+# where that step failed silently) would still have them active. Re-assert
+# it on every save rather than trusting it was ever done correctly once —
+# confirmed live: an install where this step had silently failed kept
+# banning an exempted ASN under the hub-original scenario name.
+cscli scenarios remove crowdsecurity/asterisk_bf crowdsecurity/asterisk_user_enum --force 2>/dev/null || true
+
 if ! systemctl restart crowdsec; then
     echo "Wrote ASN list but failed to restart CrowdSec" >&2
     exit 2