diff --git a/app/src/components/detail/JobFields.tsx b/app/src/components/detail/JobFields.tsx
index df17aae..07f2176 100644
--- a/app/src/components/detail/JobFields.tsx
+++ b/app/src/components/detail/JobFields.tsx
@@ -74,6 +74,7 @@ export function JobFields({ job, onSave, onDelete }: Props) {
         onSave={handleSave}
         onDelete={onDelete ? () => onDelete(job.id) : undefined}
         deleteLabel="Remove job"
+        confirmMessage={`Remove job "${job.id}" from castle.yaml? Run a deploy afterward to tear down its timer.`}
       />
     </div>
   )
diff --git a/app/src/components/detail/ProgramFields.tsx b/app/src/components/detail/ProgramFields.tsx
index 8e2d3bb..f4eb8ff 100644
--- a/app/src/components/detail/ProgramFields.tsx
+++ b/app/src/components/detail/ProgramFields.tsx
@@ -95,6 +95,12 @@ export function ProgramFields({ program, onSave, onDelete }: Props) {
         onSave={handleSave}
         onDelete={onDelete ? () => onDelete(program.id) : undefined}
         deleteLabel="Remove program"
+        confirmMessage={`Remove program "${program.id}" from castle.yaml? (Source on disk is untouched.)`}
+        deleteBlocked={
+          program.services.length + program.jobs.length > 0
+            ? "Programs with active jobs or services cannot be removed — delete those first."
+            : undefined
+        }
       />
     </div>
   )
diff --git a/app/src/components/detail/ServiceFields.tsx b/app/src/components/detail/ServiceFields.tsx
index aa54b51..9185286 100644
--- a/app/src/components/detail/ServiceFields.tsx
+++ b/app/src/components/detail/ServiceFields.tsx
@@ -119,6 +119,7 @@ export function ServiceFields({ service, onSave, onDelete }: Props) {
         onSave={handleSave}
         onDelete={onDelete ? () => onDelete(service.id) : undefined}
         deleteLabel="Remove service"
+        confirmMessage={`Remove service "${service.id}" from castle.yaml? Run a deploy afterward to tear down its unit.`}
       />
     </div>
   )
diff --git a/app/src/components/detail/fields.tsx b/app/src/components/detail/fields.tsx
index ee0ceb6..672a334 100644
--- a/app/src/components/detail/fields.tsx
+++ b/app/src/components/detail/fields.tsx
@@ -122,18 +122,27 @@ export function FormFooter({
   onSave,
   onDelete,
   deleteLabel,
+  confirmMessage,
+  deleteBlocked,
 }: {
   saving: boolean
   saved: boolean
   onSave: () => void
   onDelete?: () => void
   deleteLabel: string
+  confirmMessage?: string
+  /** When set, removal is disallowed and this reason is shown instead of the button. */
+  deleteBlocked?: string
 }) {
   return (
     <div className="flex items-center justify-between pt-3 border-t border-[var(--border)]">
-      {onDelete ? (
+      {deleteBlocked ? (
+        <span className="text-xs text-amber-400">{deleteBlocked}</span>
+      ) : onDelete ? (
         <button
-          onClick={onDelete}
+          onClick={() => {
+            if (window.confirm(confirmMessage ?? `${deleteLabel}?`)) onDelete()
+          }}
           className="flex items-center gap-1.5 text-xs text-red-400 hover:text-red-300"
         >
           <Trash2 size={12} /> {deleteLabel}
diff --git a/castle-api/src/castle_api/config_editor.py b/castle-api/src/castle_api/config_editor.py
index 86c29b5..d6899ec 100644
--- a/castle-api/src/castle_api/config_editor.py
+++ b/castle-api/src/castle_api/config_editor.py
@@ -169,13 +169,27 @@ def save_program(name: str, request: ProgramConfigRequest) -> dict:
 
 @router.delete("/programs/{name}")
 def delete_program(name: str) -> dict:
-    """Remove a program from castle.yaml."""
+    """Remove a program from castle.yaml.
+
+    Refuses if any service or job still references the program — those
+    deployments must be removed first so no dangling `program:` ref is left.
+    """
     config = get_config()
     if name not in config.programs:
         raise HTTPException(
             status_code=status.HTTP_404_NOT_FOUND,
             detail=f"Program '{name}' not found",
         )
+    refs = [s for s, spec in config.services.items() if spec.program == name]
+    refs += [j for j, spec in config.jobs.items() if spec.program == name]
+    if refs:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail=(
+                "Programs with active jobs or services cannot be removed. "
+                f"Delete these first: {', '.join(refs)}"
+            ),
+        )
     del config.programs[name]
     save_config(config)
     return {"ok": True, "program": name, "action": "deleted"}
diff --git a/cli/src/castle_cli/commands/delete.py b/cli/src/castle_cli/commands/delete.py
index 600ca1c..29f14e2 100644
--- a/cli/src/castle_cli/commands/delete.py
+++ b/cli/src/castle_cli/commands/delete.py
@@ -28,6 +28,19 @@ def run_delete(args: argparse.Namespace) -> int:
     where = [s for s, present in
              (("program", in_programs), ("service", in_services), ("job", in_jobs)) if present]
 
+    # A program can't be removed while a deployment still references it. Refs
+    # named the same are removed in this call; any other referencing deployment
+    # would be left dangling, so refuse.
+    if in_programs:
+        dangling = [s for s, spec in config.services.items() if spec.program == name and s != name]
+        dangling += [j for j, spec in config.jobs.items() if spec.program == name and j != name]
+        if dangling:
+            print(
+                "Error: programs with active jobs or services cannot be removed.\n"
+                f"  Delete these first: {', '.join(dangling)}"
+            )
+            return 1
+
     # Resolve source dir (from the program entry) for the optional --source removal.
     source_dir: Path | None = None
     if in_programs and config.programs[name].source: