diff --git a/astro.config.mjs b/astro.config.mjs
index 03870d1..56b5261 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -44,7 +44,12 @@ export default defineConfig({
   // Inline the (small, ~6KB) global stylesheet into each page's <head> instead
   // of emitting a render-blocking <link>. Pages are SSR'd per request, so there
   // is no shared-CSS-cache benefit to give up, and FCP/LCP improve.
-  build: { inlineStylesheets: "always" },
+  // inlineStylesheets: small global CSS goes inline (no render-blocking <link>).
+  // format "file": prerendered pages emit as `about.html` (served at /about with
+  // no trailing slash) rather than `about/index.html` (which 307-redirects
+  // /about -> /about/). This keeps the prerendered URLs identical to the
+  // existing canonical/sitemap/nav scheme, so no redirect hop is introduced.
+  build: { inlineStylesheets: "always", format: "file" },
   vite: {
     plugins: [tailwindcss()],
     resolve: {
diff --git a/package-lock.json b/package-lock.json
index d31c816..6ded5d8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,8 +13,7 @@
         "jose": "^6.2.3",
         "tailwindcss": "^4.2.1",
         "tw-animate-css": "^1.3.4",
-        "web-vitals": "^5.2.0",
-        "zod": "^3.24.2"
+        "web-vitals": "^5.2.0"
       },
       "devDependencies": {
         "@cloudflare/workers-types": "^4.20260527.1",
@@ -8208,15 +8207,6 @@
         "error-stack-parser-es": "^1.0.5"
       }
     },
-    "node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
     "node_modules/zwitch": {
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/zwitch/-/zwitch-2.0.4.tgz",
diff --git a/package.json b/package.json
index 64bb2cb..9da6b26 100644
--- a/package.json
+++ b/package.json
@@ -17,8 +17,7 @@
     "jose": "^6.2.3",
     "tailwindcss": "^4.2.1",
     "tw-animate-css": "^1.3.4",
-    "web-vitals": "^5.2.0",
-    "zod": "^3.24.2"
+    "web-vitals": "^5.2.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260527.1",
diff --git a/src/components/BriefingForm.astro b/src/components/BriefingForm.astro
index 64ca0d5..38af47c 100644
--- a/src/components/BriefingForm.astro
+++ b/src/components/BriefingForm.astro
@@ -93,7 +93,6 @@ const errorClass = "mt-2 text-xs text-accent font-bold";
 </form>
 
 <script>
-  import { z } from "zod";
   import { ENGAGEMENT_KEYS } from "@/lib/engagements";
 
   // Prod sitekey is locked to decipher.ms; on localhost it errors 110200. Use
@@ -120,18 +119,37 @@ const errorClass = "mt-2 text-xs text-accent font-bold";
     }
   }
 
-  const schema = z.object({
-    name: z.string().trim().min(1, "Required").max(120),
-    email: z.string().trim().email("Invalid email").max(255),
-    role: z.string().trim().max(120).optional().or(z.literal("")),
-    engagementType: z.enum(ENGAGEMENT_KEYS, {
-      errorMap: () => ({ message: "Pick an engagement type" }),
-    }),
-    topic: z.string().trim().min(1, "Required").max(200),
-    details: z.string().trim().min(10, "Add a bit more detail").max(4000),
-  });
+  // Lightweight client-side validation mirroring the server checks in
+  // server/briefing.ts (the authority). Hand-rolled so zod stays out of the
+  // client bundle — this only provides instant inline feedback.
+  type FieldName = "name" | "email" | "role" | "engagementType" | "topic" | "details";
+  type FormValues = Record<FieldName, string>;
 
-  type FieldName = keyof z.infer<typeof schema>;
+  const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+  const validate = (v: FormValues): Partial<Record<FieldName, string>> => {
+    const e: Partial<Record<FieldName, string>> = {};
+    // Validate the trimmed values — that's what gets submitted, and what the
+    // server checks — so leading/trailing whitespace never blocks a valid input.
+    const name = v.name.trim();
+    if (!name) e.name = "Required";
+    else if (name.length > 120) e.name = "Keep this under 120 characters";
+    const email = v.email.trim();
+    if (!email) e.email = "Required";
+    else if (email.length > 255) e.email = "Keep this under 255 characters";
+    else if (!EMAIL_RE.test(email)) e.email = "Invalid email";
+    if (v.role.trim().length > 120) e.role = "Keep this under 120 characters";
+    if (!(ENGAGEMENT_KEYS as readonly string[]).includes(v.engagementType))
+      e.engagementType = "Pick an engagement type";
+    const topic = v.topic.trim();
+    if (!topic) e.topic = "Required";
+    else if (topic.length > 200) e.topic = "Keep this under 200 characters";
+    const details = v.details.trim();
+    if (!details) e.details = "Required";
+    else if (details.length < 10) e.details = "Add a bit more detail";
+    else if (details.length > 4000) e.details = "Keep this under 4000 characters";
+    return e;
+  };
 
   const form = document.getElementById("briefing-form") as HTMLFormElement | null;
   if (form) {
@@ -212,7 +230,7 @@ const errorClass = "mt-2 text-xs text-accent font-bold";
 
     form.addEventListener("submit", async (e) => {
       e.preventDefault();
-      const values = {
+      const values: FormValues = {
         name: (form.elements.namedItem("name") as HTMLInputElement).value,
         email: (form.elements.namedItem("email") as HTMLInputElement).value,
         role: (form.elements.namedItem("role") as HTMLInputElement).value,
@@ -221,12 +239,11 @@ const errorClass = "mt-2 text-xs text-accent font-bold";
         details: (form.elements.namedItem("details") as HTMLTextAreaElement).value,
       };
 
-      const parsed = schema.safeParse(values);
-      if (!parsed.success) {
+      const errors = validate(values);
+      const failed = Object.keys(errors) as FieldName[];
+      if (failed.length > 0) {
         clearFieldErrors();
-        for (const issue of parsed.error.issues) {
-          setFieldError(issue.path[0] as FieldName, issue.message);
-        }
+        for (const field of failed) setFieldError(field, errors[field]!);
         return;
       }
       clearFieldErrors();
@@ -246,12 +263,12 @@ const errorClass = "mt-2 text-xs text-accent font-bold";
           method: "POST",
           headers: { "content-type": "application/json" },
           body: JSON.stringify({
-            name: parsed.data.name,
-            email: parsed.data.email,
-            role: parsed.data.role || null,
-            engagementType: parsed.data.engagementType,
-            topic: parsed.data.topic,
-            details: parsed.data.details,
+            name: values.name.trim(),
+            email: values.email.trim(),
+            role: values.role.trim() || null,
+            engagementType: values.engagementType,
+            topic: values.topic.trim(),
+            details: values.details.trim(),
             turnstileToken: token,
           }),
         });
diff --git a/src/layouts/Layout.astro b/src/layouts/Layout.astro
index 12bddfa..ff5fee9 100644
--- a/src/layouts/Layout.astro
+++ b/src/layouts/Layout.astro
@@ -49,10 +49,6 @@ const websiteLd = {
   name: "decipher.ms",
   url: "https://decipher.ms/",
 };
-
-// Per-request App Insights client config, derived at render time from the
-// connection-string secret + request hostname (see middleware / Telemetry).
-const telemetryConfig = Astro.locals.telemetry?.clientConfig() ?? null;
 ---
 
 <!doctype html>
@@ -91,15 +87,6 @@ const telemetryConfig = Astro.locals.telemetry?.clientConfig() ?? null;
     <script type="application/ld+json" set:html={JSON.stringify(organizationLd)} />
     <script type="application/ld+json" set:html={JSON.stringify(websiteLd)} />
 
-    {
-      telemetryConfig && (
-        <script
-          is:inline
-          set:html={`window.__telemetryConfig=${JSON.stringify(telemetryConfig)}`}
-        />
-      )
-    }
-
     <slot name="head" />
 
     {/* Self-hosted, served from /_astro — no cross-origin render-blocking
diff --git a/src/lib/server/env.ts b/src/lib/server/env.ts
index 5de7c6c..5990b15 100644
--- a/src/lib/server/env.ts
+++ b/src/lib/server/env.ts
@@ -12,5 +12,4 @@ export interface Env {
   OIDC_KID: string;
   OIDC_PRIVATE_KEY: string;
   TURNSTILE_SECRET_KEY: string;
-  APPLICATIONINSIGHTS_CONNECTION_STRING: string;
 }
diff --git a/src/lib/server/telemetry.ts b/src/lib/server/telemetry.ts
index 53845b5..365a5af 100644
--- a/src/lib/server/telemetry.ts
+++ b/src/lib/server/telemetry.ts
@@ -1,5 +1,5 @@
 import type { ExecutionContext } from "@cloudflare/workers-types";
-import type { Env } from "./env";
+import { AI_IKEY, AI_INGESTION_ENDPOINT, resolveEnvironment } from "../telemetry-config";
 
 interface Envelope {
   name: string;
@@ -9,39 +9,8 @@ interface Envelope {
   data: { baseType: string; baseData: Record<string, unknown> };
 }
 
-interface ParsedConnString {
-  iKey: string;
-  ingestionEndpoint: string;
-}
-
 const SDK_VERSION = "decipher-ms:1.0";
 
-function resolveEnvironment(hostname: string): string {
-  if (hostname === "decipher.ms" || hostname === "www.decipher.ms") return "production";
-  const previewMatch = hostname.match(/^([a-z0-9-]+)-decipher-ms\.[^.]+\.workers\.dev$/i);
-  if (previewMatch) return `preview:${previewMatch[1]}`;
-  if (hostname.endsWith(".workers.dev")) return "preview";
-  return "development";
-}
-
-function parseConnString(s: unknown): ParsedConnString {
-  if (typeof s !== "string" || s.length === 0) {
-    throw new Error("APPLICATIONINSIGHTS_CONNECTION_STRING is empty or not a string");
-  }
-  const map: Record<string, string> = {};
-  for (const part of s.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq < 0) continue;
-    map[part.slice(0, eq).trim().toLowerCase()] = part.slice(eq + 1).trim();
-  }
-  const iKey = map["instrumentationkey"];
-  const ingestionEndpoint = (map["ingestionendpoint"] || "").replace(/\/$/, "");
-  if (!iKey || !ingestionEndpoint) {
-    throw new Error("APPLICATIONINSIGHTS_CONNECTION_STRING missing iKey or IngestionEndpoint");
-  }
-  return { iKey, ingestionEndpoint };
-}
-
 function randomHex(bytes: number): string {
   const arr = new Uint8Array(bytes);
   crypto.getRandomValues(arr);
@@ -63,7 +32,6 @@ function formatDuration(ms: number): string {
 
 export class Telemetry {
   private envelopes: Envelope[] = [];
-  private readonly conn: ParsedConnString | null;
   private readonly requestProperties: Record<string, string> = {};
   readonly operationId = randomHex(16);
 
@@ -83,27 +51,11 @@ export class Telemetry {
   private readonly cloudRole: string;
 
   constructor(
-    env: Env,
     private readonly ctx: ExecutionContext,
     hostname: string,
   ) {
     this.environment = resolveEnvironment(hostname);
     this.cloudRole = `decipher-ms-${this.environment}`;
-    try {
-      this.conn = parseConnString(env.APPLICATIONINSIGHTS_CONNECTION_STRING);
-    } catch (err) {
-      console.error("Telemetry disabled:", err);
-      this.conn = null;
-    }
-  }
-
-  clientConfig(): { iKey: string; ingestionEndpoint: string; environment: string } | null {
-    if (!this.conn) return null;
-    return {
-      iKey: this.conn.iKey,
-      ingestionEndpoint: this.conn.ingestionEndpoint,
-      environment: this.environment,
-    };
   }
 
   newSpanId(): string {
@@ -111,7 +63,10 @@ export class Telemetry {
   }
 
   private push(baseType: string, baseData: Record<string, unknown>, parentId?: string): void {
-    if (!this.conn) return;
+    // Don't emit from local dev (no real hostname): keeps localhost preview from
+    // POSTing to the shared App Insights ingestion endpoint, matching the prior
+    // "disabled without a connection string" behavior.
+    if (this.environment === "development") return;
     const tags: Record<string, string> = {
       "ai.operation.id": this.operationId,
       "ai.cloud.role": this.cloudRole,
@@ -121,7 +76,7 @@ export class Telemetry {
     this.envelopes.push({
       name: `Microsoft.ApplicationInsights.${baseType.replace(/Data$/, "")}`,
       time: new Date().toISOString(),
-      iKey: this.conn.iKey,
+      iKey: AI_IKEY,
       tags,
       data: { baseType, baseData: { ver: 2, ...baseData } },
     });
@@ -207,10 +162,10 @@ export class Telemetry {
   }
 
   async flushNow(): Promise<void> {
-    if (!this.conn || this.envelopes.length === 0) return;
+    if (this.envelopes.length === 0) return;
     const payload = this.envelopes.map((e) => JSON.stringify(e)).join("\n");
     this.envelopes = [];
-    const url = `${this.conn.ingestionEndpoint}/v2.1/track`;
+    const url = `${AI_INGESTION_ENDPOINT}/v2.1/track`;
     try {
       const res = await fetch(url, {
         method: "POST",
diff --git a/src/lib/telemetry-config.ts b/src/lib/telemetry-config.ts
new file mode 100644
index 0000000..9a24f41
--- /dev/null
+++ b/src/lib/telemetry-config.ts
@@ -0,0 +1,23 @@
+// App Insights client identifiers, shared by the browser RUM client
+// (telemetry.ts) and the server request tracer (server/telemetry.ts).
+//
+// These are NOT secret: the instrumentation key and ingestion endpoint are
+// shipped to every visitor in the client telemetry payload (visible in
+// view-source), so a "connection string secret" only ever protected public
+// values. Keeping them in source lets prerendered (static) pages configure
+// telemetry with zero per-request server work — no SSR round-trip just to
+// learn an iKey that is already public.
+//
+// The `environment` dimension is resolved from the request/location hostname
+// at runtime (below), so a single build serves production and preview Workers
+// while still tagging telemetry correctly.
+export const AI_IKEY = "b122de9d-24eb-4bdc-adc7-4d0a68490740";
+export const AI_INGESTION_ENDPOINT = "https://westus2-2.in.applicationinsights.azure.com";
+
+export function resolveEnvironment(hostname: string): string {
+  if (hostname === "decipher.ms" || hostname === "www.decipher.ms") return "production";
+  const previewMatch = hostname.match(/^([a-z0-9-]+)-decipher-ms\.[^.]+\.workers\.dev$/i);
+  if (previewMatch) return `preview:${previewMatch[1]}`;
+  if (hostname.endsWith(".workers.dev")) return "preview";
+  return "development";
+}
diff --git a/src/lib/telemetry.ts b/src/lib/telemetry.ts
index f455aac..c92e3fa 100644
--- a/src/lib/telemetry.ts
+++ b/src/lib/telemetry.ts
@@ -10,6 +10,7 @@ import {
   type LCPMetricWithAttribution,
   type TTFBMetricWithAttribution,
 } from "web-vitals/attribution";
+import { AI_IKEY, AI_INGESTION_ENDPOINT, resolveEnvironment } from "./telemetry-config";
 
 type VitalMetric =
   | CLSMetricWithAttribution
@@ -26,12 +27,6 @@ interface TelemetryConfig {
   environment: string;
 }
 
-declare global {
-  interface Window {
-    __telemetryConfig?: TelemetryConfig;
-  }
-}
-
 interface Envelope {
   name: string;
   time: string;
@@ -255,8 +250,18 @@ let initialized = false;
 export function initTelemetry(): void {
   if (initialized) return;
   initialized = true;
-  config = window.__telemetryConfig ?? null;
-  if (!config) return;
+  // Identifiers are public constants; the environment is derived client-side so
+  // prerendered static pages need no per-request server-injected config.
+  const environment = resolveEnvironment(location.hostname);
+  // Stay silent on localhost: historically dev had no injected config and so
+  // never emitted; sending here would pollute the shared App Insights resource
+  // (and fire surprising cross-origin beacons during local work).
+  if (environment === "development") return;
+  config = {
+    iKey: AI_IKEY,
+    ingestionEndpoint: AI_INGESTION_ENDPOINT,
+    environment,
+  };
 
   onCLS(trackVital);
   onINP(trackVital);
diff --git a/src/middleware.ts b/src/middleware.ts
index 1148ce9..cfebbc6 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -1,11 +1,12 @@
 import { defineMiddleware } from "astro:middleware";
-import { env } from "cloudflare:workers";
 import { Telemetry } from "@/lib/server/telemetry";
 
 // Server-side request telemetry, ported from the old worker entrypoint. Runs
-// for every on-demand route (static assets are served by the platform and
-// never reach here). The Telemetry instance is stashed on locals so endpoints
-// and the Layout can attach spans / read the client config for the same span.
+// for every on-demand route (prerendered pages and static assets are served by
+// the platform and never reach here). The Telemetry instance is stashed on
+// locals so endpoints can attach spans/exceptions to the same request span; the
+// per-request client config injection is gone — the browser RUM client now
+// self-configures from public constants (see lib/telemetry.ts).
 export const onRequest = defineMiddleware(async (context, next) => {
   const { request, url, locals } = context;
   const ctx = locals.cfContext;
@@ -14,7 +15,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
     return next();
   }
 
-  const tel = new Telemetry(env, ctx, url.hostname);
+  const tel = new Telemetry(ctx, url.hostname);
   const requestId = tel.newSpanId();
   locals.telemetry = tel;
   locals.requestId = requestId;
diff --git a/src/pages/404.astro b/src/pages/404.astro
index 6f91dba..14efcbb 100644
--- a/src/pages/404.astro
+++ b/src/pages/404.astro
@@ -1,4 +1,5 @@
 ---
+export const prerender = true; // static content — CDN-served HTML, no per-request render
 import Layout from "@/layouts/Layout.astro";
 ---
 
diff --git a/src/pages/about.astro b/src/pages/about.astro
index ee67fd0..7b41b39 100644
--- a/src/pages/about.astro
+++ b/src/pages/about.astro
@@ -1,4 +1,5 @@
 ---
+export const prerender = true; // static content — CDN-served HTML, no per-request render
 import Layout from "@/layouts/Layout.astro";
 import Nav from "@/components/Nav.astro";
 import Footer from "@/components/Footer.astro";
diff --git a/src/pages/briefs/advanced-dataverse-and-dynamics-365-security-model.astro b/src/pages/briefs/advanced-dataverse-and-dynamics-365-security-model.astro
index 0ef771d..ef8d53e 100644
--- a/src/pages/briefs/advanced-dataverse-and-dynamics-365-security-model.astro
+++ b/src/pages/briefs/advanced-dataverse-and-dynamics-365-security-model.astro
@@ -1,4 +1,5 @@
 ---
+export const prerender = true; // static content — CDN-served HTML, no per-request render
 import Layout from "@/layouts/Layout.astro";
 import Nav from "@/components/Nav.astro";
 import Footer from "@/components/Footer.astro";
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 0edd77a..bc24429 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -1,4 +1,8 @@
 ---
+// Static content — prerendered to an HTML file served from the CDN edge with no
+// per-request Worker render. Telemetry self-configures client-side, so no SSR
+// config injection is needed here.
+export const prerender = true;
 import Layout from "@/layouts/Layout.astro";
 import Nav from "@/components/Nav.astro";
 import Footer from "@/components/Footer.astro";
diff --git a/src/pages/legal.astro b/src/pages/legal.astro
index 9461c22..1488684 100644
--- a/src/pages/legal.astro
+++ b/src/pages/legal.astro
@@ -1,4 +1,5 @@
 ---
+export const prerender = true; // static content — CDN-served HTML, no per-request render
 import Layout from "@/layouts/Layout.astro";
 import Nav from "@/components/Nav.astro";
 import Footer from "@/components/Footer.astro";
diff --git a/src/pages/privacy.astro b/src/pages/privacy.astro
index 86419fc..d11140a 100644
--- a/src/pages/privacy.astro
+++ b/src/pages/privacy.astro
@@ -1,4 +1,5 @@
 ---
+export const prerender = true; // static content — CDN-served HTML, no per-request render
 import Layout from "@/layouts/Layout.astro";
 import Nav from "@/components/Nav.astro";
 import Footer from "@/components/Footer.astro";
diff --git a/src/pages/work.astro b/src/pages/work.astro
index b8b7f2c..da52f31 100644
--- a/src/pages/work.astro
+++ b/src/pages/work.astro
@@ -1,4 +1,5 @@
 ---
+export const prerender = true; // static content — CDN-served HTML, no per-request render
 import Layout from "@/layouts/Layout.astro";
 import Nav from "@/components/Nav.astro";
 import Footer from "@/components/Footer.astro";
