diff --git a/internal/dnsmasq/config.go b/internal/dnsmasq/config.go
index ea0b396..fa7bdb6 100644
--- a/internal/dnsmasq/config.go
+++ b/internal/dnsmasq/config.go
@@ -303,8 +303,8 @@ log-dhcp
 // SafeApply validates, backs up, writes, restarts, and verifies the dnsmasq config.
 // On restart or verification failure, rolls back to the previous config.
 func (g *Manager) SafeApply(content string) error {
-	// Validate via temp file
-	tmpFile := g.configPath + ".validate"
+	// Validate via temp file (use /tmp to avoid stray files in dnsmasq.d if process crashes)
+	tmpFile := "/tmp/wild-central-dnsmasq-validate.tmp"
 	if err := os.WriteFile(tmpFile, []byte(content), 0644); err != nil {
 		return fmt.Errorf("writing validation file: %w", err)
 	}
@@ -336,6 +336,10 @@ func (g *Manager) SafeApply(content string) error {
 		return fmt.Errorf("health check failed (rolled back): %w", err)
 	}
 
+	// Clean up backup — dnsmasq loads every file in its conf dir,
+	// so stale .bak files cause duplicate/conflicting records.
+	os.Remove(g.configPath + ".bak")
+
 	return nil
 }
 
diff --git a/internal/haproxy/config.go b/internal/haproxy/config.go
index e56e00c..2cceb9a 100644
--- a/internal/haproxy/config.go
+++ b/internal/haproxy/config.go
@@ -576,6 +576,8 @@ func (m *Manager) SafeApply(content string) error {
 		return fmt.Errorf("health check failed (rolled back): %w", err)
 	}
 
+	os.Remove(m.configPath + ".bak")
+
 	return nil
 }