diff --git a/nodejs/package.json b/nodejs/package.json
index eda17e2..ef27671 100644
--- a/nodejs/package.json
+++ b/nodejs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "t42-jump-host",
-  "version": "1.17.1",
+  "version": "1.17.2",
   "description": "SSH jump host for the theta42 stack — LDAP-authenticated, directory-driven host bridging with audit and metrics",
   "author": [
     {
diff --git a/nodejs/utils/access.js b/nodejs/utils/access.js
index 6033d9d..451c56e 100644
--- a/nodejs/utils/access.js
+++ b/nodejs/utils/access.js
@@ -46,9 +46,19 @@ if (conf.standalone && conf.standalone.enabled) {
 
 	// Every host in the inventory, unfiltered — for admins (the web UI's own
 	// account is already gated by requireAdmin before this is ever called).
+	function isManagedHost(r) {
+		if (!r || r.kind !== 'host') return false;
+		// If managed attribute is present, require it to be true/truthy
+		if (r.metadata && r.metadata.managed !== undefined) {
+			return r.metadata.managed === true || r.metadata.managed === 'true';
+		}
+		// Default to true for manually created hosts that lack explicit managed metadata
+		return true;
+	}
+
 	async function allHosts({ fetchImpl = fetch } = {}) {
 		const resources = await directoryClient({ fetchImpl }).getResourcesByGroup(undefined, { kind: 'host' });
-		return resources.filter(r => r.kind === 'host');
+		return resources.filter(isManagedHost);
 	}
 
 	async function accessibleHosts(user, { fetchImpl = fetch } = {}) {
@@ -62,7 +72,7 @@ if (conf.standalone && conf.standalone.enabled) {
 			console.error(`[access] ${error.message}`);
 		}
 
-		const hosts = resources.filter(r => r.kind === 'host');
+		const hosts = resources.filter(isManagedHost);
 		cache.set(user.uid, { at: Date.now(), hosts });
 		return hosts;
 	}