diff --git a/bun_client/frontend/src/App.tsx b/bun_client/frontend/src/App.tsx
index f159c18..f3e261d 100644
--- a/bun_client/frontend/src/App.tsx
+++ b/bun_client/frontend/src/App.tsx
@@ -2,6 +2,7 @@ import { useState, useEffect } from 'react';
 import PRList from './components/PRList';
 import Review from './components/Review';
 import PluginOutput from './components/PluginOutput';
+import ConfigManager from './components/ConfigManager';
 import { rpcCall } from './api';
 import { useIsMobile } from './hooks/useMediaQuery';
 import {
@@ -29,6 +30,7 @@ function App() {
     const [view, setView] = useState<'LIST' | 'REVIEW' | 'PLUGIN_OUTPUT'>('LIST');
     const [currentPR, setCurrentPR] = useState<PRParams | null>(null);
     const [showPrefs, setShowPrefs] = useState(false);
+    const [prefsTab, setPrefsTab] = useState<'appearance' | 'server'>('appearance');
     const [navigating, setNavigating] = useState(false);
     const isMobile = useIsMobile();
     const [theme, setTheme] = useState<Theme>(() => {
@@ -343,11 +345,51 @@ function App() {
                 isOpen={showPrefs}
                 onClose={() => setShowPrefs(false)}
                 title="Preferences"
-                size="sm"
+                size="lg"
             >
                 <div
                     style={{
                         display: 'flex',
+                        gap: '4px',
+                        borderBottom: '1px solid var(--border)',
+                        marginBottom: '16px',
+                    }}
+                >
+                    {(
+                        [
+                            ['appearance', 'Appearance'],
+                            ['server', 'Server Configuration'],
+                        ] as const
+                    ).map(([tab, label]) => (
+                        <button
+                            key={tab}
+                            onClick={() => setPrefsTab(tab)}
+                            style={{
+                                background: 'transparent',
+                                border: 'none',
+                                borderBottom: `2px solid ${
+                                    prefsTab === tab ? 'var(--accent)' : 'transparent'
+                                }`,
+                                color:
+                                    prefsTab === tab
+                                        ? 'var(--text-primary)'
+                                        : 'var(--text-secondary)',
+                                padding: '8px 12px',
+                                fontSize: '14px',
+                                fontWeight: prefsTab === tab ? 600 : 400,
+                                cursor: 'pointer',
+                            }}
+                        >
+                            {label}
+                        </button>
+                    ))}
+                </div>
+
+                {prefsTab === 'server' && <ConfigManager />}
+
+                <div
+                    style={{
+                        display: prefsTab === 'appearance' ? 'flex' : 'none',
                         flexDirection: 'column',
                         gap: '20px',
                         padding: '10px 0',
diff --git a/bun_client/frontend/src/api.ts b/bun_client/frontend/src/api.ts
index f6eb6ec..c5af1ac 100644
--- a/bun_client/frontend/src/api.ts
+++ b/bun_client/frontend/src/api.ts
@@ -1,3 +1,5 @@
+import type { ConfigReply, WorkflowEntry } from './config_utils';
+
 export const API_BASE =
     typeof window !== 'undefined' &&
     (window.location.port === '5173' || window.location.port === '5174')
@@ -24,6 +26,8 @@ const SPECIALIZED_ENDPOINTS: Record<string, string> = {
     'RPCHandler.GetPluginOutput': '/api/get-plugin-output',
     'RPCHandler.RerunPlugins': '/api/rerun-plugins',
     'RPCHandler.GetHunkContext': '/api/get-hunk-context',
+    'RPCHandler.GetConfig': '/api/get-config',
+    'RPCHandler.UpdateConfig': '/api/update-config',
 };
 
 export interface GetHunkContextArgs {
@@ -53,6 +57,40 @@ export async function getHunkContext(args: GetHunkContextArgs): Promise<GetHunkC
     return rpcCall<GetHunkContextReply>('RPCHandler.GetHunkContext', [args]);
 }
 
+/**
+ * Fetches the server's TOML configuration along with the workflow type and
+ * filter registries the config editor builds its pickers from.
+ */
+export async function getConfig(): Promise<ConfigReply> {
+    return rpcCall<ConfigReply>('RPCHandler.GetConfig', [{}]);
+}
+
+/**
+ * Saves a partial configuration change. Fields left out keep whatever is on
+ * disk; sending `Workflows` replaces the whole list.
+ *
+ * A config the server rejects comes back as `okay: false` with `errors`
+ * populated rather than as a thrown error — the file is left untouched.
+ */
+export async function updateConfig(args: UpdateConfigArgs): Promise<ConfigReply> {
+    return rpcCall<ConfigReply>('RPCHandler.UpdateConfig', [args]);
+}
+
+export interface UpdateConfigArgs {
+    Repos?: string[];
+    SleepDuration?: number;
+    JiraDomain?: string;
+    GithubUsername?: string;
+    RepoLocation?: string;
+    AutoWorktree?: boolean;
+    DesktopNotifications?: boolean;
+    SectionPriority?: Record<string, number>;
+    SectionSorting?: Record<string, string>;
+    Workflows?: WorkflowEntry[];
+    ExperimentalLLMFileOrdering?: boolean;
+    ExperimentalLLMReviewEase?: boolean;
+}
+
 export async function rpcCall<T>(method: string, params: any[]): Promise<T> {
     const id = Date.now();
     const specializedPath = SPECIALIZED_ENDPOINTS[method];
diff --git a/bun_client/frontend/src/components/ConfigManager.tsx b/bun_client/frontend/src/components/ConfigManager.tsx
new file mode 100644
index 0000000..7bd96a2
--- /dev/null
+++ b/bun_client/frontend/src/components/ConfigManager.tsx
@@ -0,0 +1,841 @@
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import type { MouseEvent, ReactNode } from 'react';
+import { getConfig, updateConfig } from '../api';
+import {
+    cleanDraft,
+    draftFromConfig,
+    emptyWorkflow,
+    joinFilter,
+    joinList,
+    problemsByWorkflow,
+    splitFilter,
+    splitList,
+    validateDraft,
+    NOTIFICATION_OPTIONS,
+    PR_STATE_OPTIONS,
+} from '../config_utils';
+import type {
+    ConfigDraft,
+    ConfigValidationError,
+    FilterInfo,
+    WorkflowEntry,
+    WorkflowTypeInfo,
+} from '../config_utils';
+import {
+    Button,
+    Input,
+    Select,
+    TextArea,
+    colors,
+    spacing,
+    borderRadius,
+    fontSize,
+} from '../design';
+
+/**
+ * Editor for the server's TOML configuration (~/.config/codereviewserver.toml).
+ *
+ * The workflow type and filter pickers are built from the registries the
+ * server sends with the config, so they always offer what this server can
+ * actually run. Validation happens twice: here for immediate feedback, and
+ * again on the server, which refuses to write a config it can't run.
+ */
+export default function ConfigManager() {
+    const [draft, setDraft] = useState<ConfigDraft | null>(null);
+    const [saved, setSaved] = useState<ConfigDraft | null>(null);
+    const [workflowTypes, setWorkflowTypes] = useState<WorkflowTypeInfo[]>([]);
+    const [filters, setFilters] = useState<FilterInfo[]>([]);
+    const [path, setPath] = useState('');
+    const [loading, setLoading] = useState(true);
+    const [saving, setSaving] = useState(false);
+    const [loadError, setLoadError] = useState('');
+    const [serverProblems, setServerProblems] = useState<ConfigValidationError[]>([]);
+    const [status, setStatus] = useState<{ kind: 'ok' | 'error'; text: string } | null>(null);
+    // Validation messages stay hidden until the first save attempt, so a
+    // half-filled new workflow isn't shouting at the user while they type.
+    const [showProblems, setShowProblems] = useState(false);
+    const [expanded, setExpanded] = useState<number | null>(null);
+
+    const load = useCallback(async () => {
+        setLoading(true);
+        setLoadError('');
+        try {
+            const reply = await getConfig();
+            const loaded = draftFromConfig(reply.config);
+            setDraft(loaded);
+            setSaved(loaded);
+            setWorkflowTypes(reply.workflow_types ?? []);
+            setFilters(reply.filters ?? []);
+            setPath(reply.path);
+            setServerProblems([]);
+            setShowProblems(false);
+            setStatus(reply.okay ? null : { kind: 'error', text: reply.message });
+        } catch (e: unknown) {
+            setLoadError(errorMessage(e));
+        } finally {
+            setLoading(false);
+        }
+    }, []);
+
+    useEffect(() => {
+        load();
+    }, [load]);
+
+    const clientProblems = useMemo(
+        () => (draft ? validateDraft(draft, workflowTypes, filters) : []),
+        [draft, workflowTypes, filters]
+    );
+    // Server problems are cleared as soon as the draft changes, so a stale
+    // rejection doesn't linger next to a field the user already fixed.
+    const problems = clientProblems.length > 0 ? clientProblems : serverProblems;
+    const grouped = useMemo(() => problemsByWorkflow(problems), [problems]);
+    const dirty = useMemo(
+        () => !!draft && !!saved && JSON.stringify(draft) !== JSON.stringify(saved),
+        [draft, saved]
+    );
+
+    const updateDraft = (change: Partial<ConfigDraft>) => {
+        setDraft(current => (current ? { ...current, ...change } : current));
+        setServerProblems([]);
+        setStatus(null);
+    };
+
+    const updateWorkflow = (index: number, change: Partial<WorkflowEntry>) => {
+        setDraft(current => {
+            if (!current) return current;
+            const workflows = current.Workflows.map((workflow, i) =>
+                i === index ? { ...workflow, ...change } : workflow
+            );
+            return { ...current, Workflows: workflows };
+        });
+        setServerProblems([]);
+        setStatus(null);
+    };
+
+    const addWorkflow = () => {
+        if (!draft) return;
+        const next = [...draft.Workflows, emptyWorkflow(workflowTypes)];
+        updateDraft({ Workflows: next });
+        setExpanded(next.length - 1);
+    };
+
+    const removeWorkflow = (index: number) => {
+        if (!draft) return;
+        const workflow = draft.Workflows[index];
+        const label = workflow.Name?.trim() || 'this workflow';
+        if (!window.confirm(`Remove ${label}? Its PRs drop out of the list on the next sync.`)) {
+            return;
+        }
+        updateDraft({ Workflows: draft.Workflows.filter((_, i) => i !== index) });
+        setExpanded(null);
+    };
+
+    const moveWorkflow = (index: number, delta: number) => {
+        if (!draft) return;
+        const target = index + delta;
+        if (target < 0 || target >= draft.Workflows.length) return;
+        const workflows = [...draft.Workflows];
+        [workflows[index], workflows[target]] = [workflows[target], workflows[index]];
+        updateDraft({ Workflows: workflows });
+        setExpanded(target);
+    };
+
+    const save = async () => {
+        if (!draft) return;
+        setShowProblems(true);
+        if (clientProblems.length > 0) {
+            setStatus({
+                kind: 'error',
+                text: `Fix ${clientProblems.length} problem${clientProblems.length === 1 ? '' : 's'} before saving.`,
+            });
+            return;
+        }
+
+        setSaving(true);
+        setStatus(null);
+        try {
+            const payload = cleanDraft(draft);
+            const reply = await updateConfig({
+                Repos: payload.Repos,
+                SleepDuration: payload.SleepDuration,
+                GithubUsername: payload.GithubUsername,
+                RepoLocation: payload.RepoLocation,
+                JiraDomain: payload.JiraDomain,
+                AutoWorktree: payload.AutoWorktree,
+                DesktopNotifications: payload.DesktopNotifications,
+                Workflows: payload.Workflows,
+            });
+            if (!reply.okay) {
+                setServerProblems(reply.errors ?? []);
+                setStatus({
+                    kind: 'error',
+                    text: reply.message || 'The server rejected the configuration.',
+                });
+                return;
+            }
+            const applied = draftFromConfig(reply.config);
+            setDraft(applied);
+            setSaved(applied);
+            setServerProblems([]);
+            setPath(reply.path);
+            setStatus({
+                kind: 'ok',
+                text: `${reply.message}. Workflow changes take effect on the next sync.`,
+            });
+        } catch (e: unknown) {
+            setStatus({ kind: 'error', text: errorMessage(e) });
+        } finally {
+            setSaving(false);
+        }
+    };
+
+    if (loading) {
+        return <div style={{ color: colors.textSecondary }}>Loading configuration…</div>;
+    }
+    if (loadError || !draft) {
+        return (
+            <div style={{ display: 'flex', flexDirection: 'column', gap: spacing.md }}>
+                <div style={{ color: colors.textDanger }}>
+                    Could not load the configuration: {loadError}
+                </div>
+                <div>
+                    <Button variant="secondary" size="sm" onClick={load}>
+                        Retry
+                    </Button>
+                </div>
+            </div>
+        );
+    }
+
+    const globalProblems = showProblems ? (grouped.get(-1) ?? []) : [];
+
+    return (
+        <div style={{ display: 'flex', flexDirection: 'column', gap: spacing.xl }}>
+            <div style={{ fontSize: fontSize.sm, color: colors.textTertiary }}>
+                Editing <code>{path}</code>. The previous file is kept alongside it as{' '}
+                <code>.bak</code>; comments in the file are not preserved.
+            </div>
+
+            <section style={{ display: 'flex', flexDirection: 'column', gap: spacing.md }}>
+                <SectionHeading>Global Settings</SectionHeading>
+                <TextArea
+                    label="Repositories (owner/repo, one per line)"
+                    rows={3}
+                    value={joinList(draft.Repos, '\n')}
+                    onChange={e => updateDraft({ Repos: splitList(e.target.value, '\n') })}
+                    placeholder="C-Hipple/code-review-server"
+                />
+                <div style={{ display: 'flex', gap: spacing.md, flexWrap: 'wrap' }}>
+                    <div style={{ flex: '1 1 180px' }}>
+                        <Input
+                            label="GitHub username"
+                            value={draft.GithubUsername}
+                            onChange={e => updateDraft({ GithubUsername: e.target.value })}
+                        />
+                    </div>
+                    <div style={{ flex: '1 1 180px' }}>
+                        <Input
+                            label="Sync interval (minutes)"
+                            type="number"
+                            min={1}
+                            max={1440}
+                            value={String(draft.SleepDuration)}
+                            onChange={e =>
+                                updateDraft({ SleepDuration: parseInt(e.target.value, 10) || 0 })
+                            }
+                        />
+                    </div>
+                </div>
+                <div style={{ display: 'flex', gap: spacing.md, flexWrap: 'wrap' }}>
+                    <div style={{ flex: '1 1 180px' }}>
+                        <Input
+                            label="Local repository location"
+                            value={draft.RepoLocation}
+                            onChange={e => updateDraft({ RepoLocation: e.target.value })}
+                            placeholder="~/"
+                        />
+                    </div>
+                    <div style={{ flex: '1 1 180px' }}>
+                        <Input
+                            label="Jira domain (optional)"
+                            value={draft.JiraDomain}
+                            onChange={e => updateDraft({ JiraDomain: e.target.value })}
+                            placeholder="your-company.atlassian.net"
+                        />
+                    </div>
+                </div>
+                <div style={{ display: 'flex', gap: spacing.xl, flexWrap: 'wrap' }}>
+                    <Checkbox
+                        label="Desktop notifications"
+                        checked={draft.DesktopNotifications}
+                        onChange={value => updateDraft({ DesktopNotifications: value })}
+                    />
+                    <Checkbox
+                        label="Manage git worktrees"
+                        checked={draft.AutoWorktree}
+                        onChange={value => updateDraft({ AutoWorktree: value })}
+                    />
+                </div>
+                <ProblemList problems={globalProblems} />
+            </section>
+
+            <section style={{ display: 'flex', flexDirection: 'column', gap: spacing.md }}>
+                <div
+                    style={{
+                        display: 'flex',
+                        alignItems: 'center',
+                        justifyContent: 'space-between',
+                        gap: spacing.md,
+                    }}
+                >
+                    <SectionHeading>Workflows ({draft.Workflows.length})</SectionHeading>
+                    <Button variant="secondary" size="sm" onClick={addWorkflow}>
+                        + Add workflow
+                    </Button>
+                </div>
+
+                {draft.Workflows.length === 0 && (
+                    <div style={{ fontSize: fontSize.sm, color: colors.textTertiary }}>
+                        No workflows configured — nothing will be synced from GitHub.
+                    </div>
+                )}
+
+                {draft.Workflows.map((workflow, index) => (
+                    <WorkflowCard
+                        key={index}
+                        workflow={workflow}
+                        workflowTypes={workflowTypes}
+                        filters={filters}
+                        expanded={expanded === index}
+                        problems={showProblems ? (grouped.get(index) ?? []) : []}
+                        onToggle={() => setExpanded(expanded === index ? null : index)}
+                        onChange={change => updateWorkflow(index, change)}
+                        onRemove={() => removeWorkflow(index)}
+                        onMove={delta => moveWorkflow(index, delta)}
+                        canMoveUp={index > 0}
+                        canMoveDown={index < draft.Workflows.length - 1}
+                    />
+                ))}
+            </section>
+
+            {status && (
+                <div
+                    style={{
+                        fontSize: fontSize.sm,
+                        color: status.kind === 'ok' ? colors.textSuccess : colors.textDanger,
+                        background: status.kind === 'ok' ? colors.bgSuccessDim : colors.bgDangerDim,
+                        border: `1px solid ${
+                            status.kind === 'ok' ? colors.borderSuccessDim : colors.borderDangerDim
+                        }`,
+                        borderRadius: borderRadius.md,
+                        padding: spacing.md,
+                    }}
+                >
+                    {status.text}
+                </div>
+            )}
+
+            <div
+                style={{
+                    display: 'flex',
+                    gap: spacing.md,
+                    alignItems: 'center',
+                    justifyContent: 'flex-end',
+                }}
+            >
+                {dirty && (
+                    <span style={{ fontSize: fontSize.sm, color: colors.textTertiary }}>
+                        Unsaved changes
+                    </span>
+                )}
+                <Button variant="secondary" size="sm" onClick={load} disabled={saving}>
+                    Reload
+                </Button>
+                <Button size="sm" onClick={save} loading={saving} disabled={saving || !dirty}>
+                    Save configuration
+                </Button>
+            </div>
+        </div>
+    );
+}
+
+/** One workflow entry, collapsed to a summary row until it's opened. */
+function WorkflowCard({
+    workflow,
+    workflowTypes,
+    filters,
+    expanded,
+    problems,
+    onToggle,
+    onChange,
+    onRemove,
+    onMove,
+    canMoveUp,
+    canMoveDown,
+}: {
+    workflow: WorkflowEntry;
+    workflowTypes: WorkflowTypeInfo[];
+    filters: FilterInfo[];
+    expanded: boolean;
+    problems: ConfigValidationError[];
+    onToggle: () => void;
+    onChange: (change: Partial<WorkflowEntry>) => void;
+    onRemove: () => void;
+    onMove: (delta: number) => void;
+    canMoveUp: boolean;
+    canMoveDown: boolean;
+}) {
+    const typeInfo = workflowTypes.find(t => t.name === workflow.WorkflowType);
+    const shows = (field: string) =>
+        !typeInfo ||
+        typeInfo.required_fields.includes(field) ||
+        typeInfo.optional_fields.includes(field);
+
+    return (
+        <div
+            style={{
+                border: `1px solid ${problems.length > 0 ? colors.borderDangerDim : colors.border}`,
+                borderRadius: borderRadius.md,
+                background: colors.bgPrimary,
+            }}
+        >
+            <div
+                style={{
+                    display: 'flex',
+                    alignItems: 'center',
+                    gap: spacing.sm,
+                    padding: spacing.md,
+                    cursor: 'pointer',
+                }}
+                onClick={onToggle}
+            >
+                <span style={{ color: colors.textSecondary, width: '12px' }}>
+                    {expanded ? '▾' : '▸'}
+                </span>
+                <div style={{ flex: 1, minWidth: 0 }}>
+                    <div style={{ fontWeight: 500 }}>
+                        {workflow.Name?.trim() || <em>Unnamed workflow</em>}
+                    </div>
+                    <div
+                        style={{
+                            fontSize: fontSize.sm,
+                            color: colors.textTertiary,
+                            overflow: 'hidden',
+                            textOverflow: 'ellipsis',
+                            whiteSpace: 'nowrap',
+                        }}
+                    >
+                        {workflow.WorkflowType} → {workflow.SectionTitle?.trim() || 'no section'}
+                    </div>
+                </div>
+                {problems.length > 0 && (
+                    <span style={{ color: colors.textDanger, fontSize: fontSize.sm }}>
+                        {problems.length} issue{problems.length === 1 ? '' : 's'}
+                    </span>
+                )}
+                <IconButton
+                    label="Move up"
+                    disabled={!canMoveUp}
+                    onClick={e => {
+                        e.stopPropagation();
+                        onMove(-1);
+                    }}
+                >
+                    ↑
+                </IconButton>
+                <IconButton
+                    label="Move down"
+                    disabled={!canMoveDown}
+                    onClick={e => {
+                        e.stopPropagation();
+                        onMove(1);
+                    }}
+                >
+                    ↓
+                </IconButton>
+                <IconButton
+                    label="Remove workflow"
+                    danger
+                    onClick={e => {
+                        e.stopPropagation();
+                        onRemove();
+                    }}
+                >
+                    ×
+                </IconButton>
+            </div>
+
+            {expanded && (
+                <div
+                    style={{
+                        borderTop: `1px solid ${colors.border}`,
+                        padding: spacing.md,
+                        display: 'flex',
+                        flexDirection: 'column',
+                        gap: spacing.md,
+                    }}
+                >
+                    <div style={{ display: 'flex', gap: spacing.md, flexWrap: 'wrap' }}>
+                        <div style={{ flex: '1 1 200px' }}>
+                            <Input
+                                label="Name"
+                                value={workflow.Name ?? ''}
+                                onChange={e => onChange({ Name: e.target.value })}
+                                placeholder="My Open PRs"
+                            />
+                        </div>
+                        <div style={{ flex: '1 1 200px' }}>
+                            <Input
+                                label="Section title"
+                                value={workflow.SectionTitle ?? ''}
+                                onChange={e => onChange({ SectionTitle: e.target.value })}
+                                placeholder="Needs My Review"
+                            />
+                        </div>
+                    </div>
+
+                    <div>
+                        <Select
+                            label="Workflow type"
+                            value={workflow.WorkflowType}
+                            onChange={e => onChange({ WorkflowType: e.target.value })}
+                            style={{ width: '100%' }}
+                            options={workflowTypes.map(type => ({
+                                value: type.name,
+                                label: type.deprecated ? `${type.name} (deprecated)` : type.name,
+                            }))}
+                        />
+                        {typeInfo && (
+                            <div
+                                style={{
+                                    fontSize: fontSize.sm,
+                                    color: colors.textTertiary,
+                                    marginTop: spacing.xs,
+                                }}
+                            >
+                                {typeInfo.description}
+                                {typeInfo.deprecated && typeInfo.deprecated_by && (
+                                    <> Use {typeInfo.deprecated_by} instead.</>
+                                )}
+                            </div>
+                        )}
+                    </div>
+
+                    {shows('Repo') && (
+                        <Input
+                            label="Repository (owner/repo)"
+                            value={workflow.Repo ?? ''}
+                            onChange={e => onChange({ Repo: e.target.value })}
+                            placeholder="C-Hipple/code-review-server"
+                        />
+                    )}
+
+                    {shows('Repos') && (
+                        <TextArea
+                            label="Repositories (one per line, blank inherits the global list)"
+                            rows={2}
+                            value={joinList(workflow.Repos, '\n')}
+                            onChange={e => onChange({ Repos: splitList(e.target.value, '\n') })}
+                            placeholder="owner/repo"
+                        />
+                    )}
+
+                    {shows('JiraEpic') && (
+                        <Input
+                            label="Jira epic key"
+                            value={workflow.JiraEpic ?? ''}
+                            onChange={e => onChange({ JiraEpic: e.target.value })}
+                            placeholder="BOARD-123"
+                        />
+                    )}
+
+                    {shows('Filters') && (
+                        <FilterEditor
+                            filters={filters}
+                            selected={workflow.Filters ?? []}
+                            onChange={next => onChange({ Filters: next })}
+                        />
+                    )}
+
+                    {shows('Teams') && (
+                        <Input
+                            label="Teams (slugs, comma separated)"
+                            value={joinList(workflow.Teams, ',')}
+                            onChange={e => onChange({ Teams: splitList(e.target.value, ',') })}
+                            placeholder="growth-pod-review,backend-team"
+                        />
+                    )}
+
+                    <div style={{ display: 'flex', gap: spacing.md, flexWrap: 'wrap' }}>
+                        {shows('PRState') && (
+                            <div style={{ flex: '1 1 180px' }}>
+                                <Select
+                                    label="PR state"
+                                    value={workflow.PRState ?? ''}
+                                    onChange={e => onChange({ PRState: e.target.value })}
+                                    style={{ width: '100%' }}
+                                    options={PR_STATE_OPTIONS}
+                                />
+                            </div>
+                        )}
+                        {shows('DesktopNotifications') && (
+                            <div style={{ flex: '1 1 180px' }}>
+                                <Select
+                                    label="Desktop notifications"
+                                    value={notificationValue(workflow.DesktopNotifications)}
+                                    onChange={e =>
+                                        onChange({
+                                            DesktopNotifications: notificationSetting(
+                                                e.target.value
+                                            ),
+                                        })
+                                    }
+                                    style={{ width: '100%' }}
+                                    options={NOTIFICATION_OPTIONS}
+                                />
+                            </div>
+                        )}
+                    </div>
+
+                    {shows('IncludeDiff') && (
+                        <Checkbox
+                            label="Include the full diff in the section body"
+                            checked={!!workflow.IncludeDiff}
+                            onChange={value => onChange({ IncludeDiff: value })}
+                        />
+                    )}
+
+                    <ProblemList problems={problems} />
+                </div>
+            )}
+        </div>
+    );
+}
+
+/** Picker for a workflow's filters, including the ones that take an argument. */
+function FilterEditor({
+    filters,
+    selected,
+    onChange,
+}: {
+    filters: FilterInfo[];
+    selected: string[];
+    onChange: (filters: string[]) => void;
+}) {
+    const infoFor = (name: string) => filters.find(f => f.name === name);
+
+    const replace = (index: number, entry: string) => {
+        onChange(selected.map((existing, i) => (i === index ? entry : existing)));
+    };
+
+    return (
+        <div style={{ display: 'flex', flexDirection: 'column', gap: spacing.xs }}>
+            <label style={{ fontSize: fontSize.sm, color: colors.textSecondary, fontWeight: 500 }}>
+                Filters
+            </label>
+            {selected.length === 0 && (
+                <div style={{ fontSize: fontSize.sm, color: colors.textTertiary }}>
+                    No filters — every pull request in the repositories is included.
+                </div>
+            )}
+            {selected.map((entry, index) => {
+                const { name, arg } = splitFilter(entry);
+                const info = infoFor(name);
+                return (
+                    <div
+                        key={index}
+                        style={{ display: 'flex', gap: spacing.sm, alignItems: 'center' }}
+                    >
+                        <div style={{ flex: '2 1 200px' }}>
+                            <Select
+                                value={name}
+                                onChange={e => replace(index, joinFilter(e.target.value, arg))}
+                                style={{ width: '100%' }}
+                                options={
+                                    info
+                                        ? filters.map(f => ({ value: f.name, label: f.name }))
+                                        : // Keep an unrecognized filter selectable so editing a
+                                          // neighbouring field can't silently drop it.
+                                          [
+                                              { value: name, label: `${name} (unknown)` },
+                                              ...filters.map(f => ({
+                                                  value: f.name,
+                                                  label: f.name,
+                                              })),
+                                          ]
+                                }
+                            />
+                        </div>
+                        {info?.requires_arg && (
+                            <div style={{ flex: '1 1 140px' }}>
+                                <Input
+                                    value={arg}
+                                    onChange={e => replace(index, joinFilter(name, e.target.value))}
+                                    placeholder={info.arg_label || 'value'}
+                                />
+                            </div>
+                        )}
+                        <IconButton
+                            label="Remove filter"
+                            danger
+                            onClick={() => onChange(selected.filter((_, i) => i !== index))}
+                        >
+                            ×
+                        </IconButton>
+                    </div>
+                );
+            })}
+            {selected.length > 0 && (
+                <div style={{ fontSize: fontSize.sm, color: colors.textTertiary }}>
+                    {infoFor(splitFilter(selected[selected.length - 1]).name)?.description}
+                </div>
+            )}
+            <div>
+                <Button
+                    variant="secondary"
+                    size="sm"
+                    disabled={filters.length === 0}
+                    onClick={() => {
+                        const unused = filters.find(
+                            f => !selected.some(entry => splitFilter(entry).name === f.name)
+                        );
+                        const next = unused ?? filters[0];
+                        if (next) onChange([...selected, next.name]);
+                    }}
+                >
+                    + Add filter
+                </Button>
+            </div>
+        </div>
+    );
+}
+
+function SectionHeading({ children }: { children: ReactNode }) {
+    return (
+        <div
+            style={{
+                fontSize: fontSize.sm,
+                fontWeight: 600,
+                color: colors.textSecondary,
+                textTransform: 'uppercase',
+                letterSpacing: '0.5px',
+            }}
+        >
+            {children}
+        </div>
+    );
+}
+
+function ProblemList({ problems }: { problems: ConfigValidationError[] }) {
+    if (problems.length === 0) return null;
+    return (
+        <ul
+            style={{
+                margin: 0,
+                paddingLeft: spacing.xl,
+                color: colors.textDanger,
+                fontSize: fontSize.sm,
+            }}
+        >
+            {problems.map((problem, i) => (
+                <li key={i}>
+                    <strong>{problem.field}</strong> {problem.message}
+                </li>
+            ))}
+        </ul>
+    );
+}
+
+function Checkbox({
+    label,
+    checked,
+    onChange,
+}: {
+    label: string;
+    checked: boolean;
+    onChange: (checked: boolean) => void;
+}) {
+    return (
+        <label
+            style={{
+                display: 'flex',
+                alignItems: 'center',
+                gap: spacing.sm,
+                fontSize: fontSize.base,
+                color: colors.textSecondary,
+                cursor: 'pointer',
+            }}
+        >
+            <input
+                type="checkbox"
+                checked={checked}
+                onChange={e => onChange(e.target.checked)}
+                style={{ cursor: 'pointer' }}
+            />
+            {label}
+        </label>
+    );
+}
+
+function IconButton({
+    children,
+    label,
+    danger = false,
+    disabled = false,
+    onClick,
+}: {
+    children: ReactNode;
+    label: string;
+    danger?: boolean;
+    disabled?: boolean;
+    onClick: (e: MouseEvent) => void;
+}) {
+    return (
+        <button
+            type="button"
+            title={label}
+            aria-label={label}
+            disabled={disabled}
+            onClick={onClick}
+            style={{
+                background: 'transparent',
+                border: `1px solid ${colors.border}`,
+                borderRadius: borderRadius.sm,
+                color: danger ? colors.textDanger : colors.textSecondary,
+                cursor: disabled ? 'not-allowed' : 'pointer',
+                opacity: disabled ? 0.4 : 1,
+                width: '24px',
+                height: '24px',
+                lineHeight: 1,
+                padding: 0,
+                flexShrink: 0,
+            }}
+        >
+            {children}
+        </button>
+    );
+}
+
+/** Maps the tri-state per-workflow notification override to a select value. */
+function notificationValue(setting: boolean | null | undefined): string {
+    if (setting === true) return 'on';
+    if (setting === false) return 'off';
+    return 'inherit';
+}
+
+function notificationSetting(value: string): boolean | null {
+    if (value === 'on') return true;
+    if (value === 'off') return false;
+    return null;
+}
+
+function errorMessage(e: unknown): string {
+    const raw = e instanceof Error ? e.message : String(e);
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed === 'string') return parsed;
+        return parsed?.message ?? raw;
+    } catch {
+        return raw;
+    }
+}
diff --git a/bun_client/frontend/src/config_utils.test.ts b/bun_client/frontend/src/config_utils.test.ts
new file mode 100644
index 0000000..878511b
--- /dev/null
+++ b/bun_client/frontend/src/config_utils.test.ts
@@ -0,0 +1,303 @@
+import { expect, test, describe } from 'bun:test';
+import {
+    cleanDraft,
+    cleanList,
+    draftFromConfig,
+    emptyWorkflow,
+    isValidRepo,
+    joinFilter,
+    joinList,
+    problemsByWorkflow,
+    splitFilter,
+    splitList,
+    validateDraft,
+} from './config_utils';
+import type { ConfigDraft, FilterInfo, ServerConfig, WorkflowTypeInfo } from './config_utils';
+
+const workflowTypes: WorkflowTypeInfo[] = [
+    {
+        name: 'SyncReviewRequestsWorkflow',
+        description: '',
+        deprecated: false,
+        required_fields: [],
+        optional_fields: [],
+    },
+    {
+        name: 'SingleRepoSyncReviewRequestsWorkflow',
+        description: '',
+        deprecated: true,
+        required_fields: ['Repo'],
+        optional_fields: [],
+    },
+    {
+        name: 'ProjectListWorkflow',
+        description: '',
+        deprecated: false,
+        required_fields: ['JiraEpic'],
+        optional_fields: [],
+    },
+];
+
+const filters: FilterInfo[] = [
+    { name: 'FilterNotDraft', description: '', requires_arg: false },
+    { name: 'FilterByLabel', description: '', requires_arg: true, arg_label: 'label' },
+];
+
+const baseDraft = (overrides: Partial<ConfigDraft> = {}): ConfigDraft => ({
+    Repos: ['owner/repo'],
+    SleepDuration: 10,
+    GithubUsername: 'me',
+    RepoLocation: '~/',
+    JiraDomain: '',
+    AutoWorktree: false,
+    DesktopNotifications: false,
+    Workflows: [
+        {
+            WorkflowType: 'SyncReviewRequestsWorkflow',
+            Name: 'My Open PRs',
+            SectionTitle: 'My PRs',
+            Filters: ['FilterNotDraft'],
+        },
+    ],
+    ...overrides,
+});
+
+const validate = (draft: ConfigDraft) => validateDraft(draft, workflowTypes, filters);
+
+describe('list helpers', () => {
+    test('splitList keeps what the user typed, separators and all', () => {
+        // Trimming or dropping here would eat the newline as it's typed.
+        expect(splitList('owner/one\n', '\n')).toEqual(['owner/one', '']);
+        expect(splitList('a, b', ',')).toEqual(['a', ' b']);
+    });
+
+    test('joinList round-trips splitList exactly', () => {
+        const typed = 'owner/one\n\nowner/two ';
+        expect(joinList(splitList(typed, '\n'), '\n')).toBe(typed);
+    });
+
+    test('joinList handles null', () => {
+        expect(joinList(null, '\n')).toBe('');
+    });
+
+    test('cleanList trims entries and drops the blank ones', () => {
+        expect(cleanList([' owner/one ', '', '  ', 'owner/two'])).toEqual([
+            'owner/one',
+            'owner/two',
+        ]);
+    });
+});
+
+describe('cleanDraft', () => {
+    test('tidies the values that get sent to the server', () => {
+        const draft = baseDraft({ Repos: ['owner/repo ', ''], GithubUsername: ' me ' });
+        draft.Workflows[0] = {
+            ...draft.Workflows[0],
+            Name: ' My Open PRs ',
+            SectionTitle: ' My PRs ',
+            Repos: ['owner/other ', ''],
+            Teams: [' team-a', ''],
+            Filters: ['FilterByLabel: needs review '],
+        };
+
+        const cleaned = cleanDraft(draft);
+        expect(cleaned.Repos).toEqual(['owner/repo']);
+        expect(cleaned.GithubUsername).toBe('me');
+        expect(cleaned.Workflows[0].Name).toBe('My Open PRs');
+        expect(cleaned.Workflows[0].SectionTitle).toBe('My PRs');
+        expect(cleaned.Workflows[0].Repos).toEqual(['owner/other']);
+        expect(cleaned.Workflows[0].Teams).toEqual(['team-a']);
+        expect(cleaned.Workflows[0].Filters).toEqual(['FilterByLabel:needs review']);
+    });
+
+    test('leaves the original draft alone', () => {
+        const draft = baseDraft({ Repos: ['owner/repo '] });
+        cleanDraft(draft);
+        expect(draft.Repos).toEqual(['owner/repo ']);
+    });
+});
+
+describe('filter helpers', () => {
+    test('splitFilter separates the argument', () => {
+        expect(splitFilter('FilterByLabel:needs review')).toEqual({
+            name: 'FilterByLabel',
+            arg: 'needs review',
+        });
+    });
+
+    test('splitFilter leaves argument-free filters alone', () => {
+        expect(splitFilter('FilterNotDraft')).toEqual({ name: 'FilterNotDraft', arg: '' });
+    });
+
+    test('joinFilter omits an empty argument', () => {
+        expect(joinFilter('FilterNotDraft', '')).toBe('FilterNotDraft');
+        expect(joinFilter('FilterByLabel', 'bug')).toBe('FilterByLabel:bug');
+    });
+
+    test('joinFilter keeps an argument mid-edit intact', () => {
+        // "needs " must survive so the user can go on to type "review".
+        expect(joinFilter('FilterByLabel', 'needs ')).toBe('FilterByLabel:needs ');
+    });
+});
+
+describe('isValidRepo', () => {
+    test('accepts owner/repo', () => {
+        expect(isValidRepo('C-Hipple/code-review-server')).toBe(true);
+    });
+
+    test('rejects anything else', () => {
+        expect(isValidRepo('code-review-server')).toBe(false);
+        expect(isValidRepo('a/b/c')).toBe(false);
+        expect(isValidRepo('/repo')).toBe(false);
+        expect(isValidRepo('')).toBe(false);
+    });
+});
+
+describe('draftFromConfig', () => {
+    test('copies workflows so edits do not mutate the fetched config', () => {
+        const config = {
+            Repos: ['owner/repo'],
+            SleepDuration: 5,
+            JiraDomain: '',
+            GithubUsername: 'me',
+            RepoLocation: '~/',
+            AutoWorktree: false,
+            DesktopNotifications: true,
+            SectionPriority: {},
+            SectionSorting: {},
+            Workflows: [
+                { WorkflowType: 'SyncReviewRequestsWorkflow', Name: 'A', SectionTitle: 'Sec' },
+            ],
+            Plugins: [],
+            ExperimentalLLMFileOrdering: false,
+            ExperimentalLLMReviewEase: false,
+        } as ServerConfig;
+
+        const draft = draftFromConfig(config);
+        draft.Workflows[0].Name = 'B';
+        draft.Repos.push('other/repo');
+
+        expect(config.Workflows[0].Name).toBe('A');
+        expect(config.Repos).toEqual(['owner/repo']);
+    });
+});
+
+describe('emptyWorkflow', () => {
+    test('defaults to the first non-deprecated type', () => {
+        expect(emptyWorkflow(workflowTypes).WorkflowType).toBe('SyncReviewRequestsWorkflow');
+    });
+
+    test('falls back when the server sent no types', () => {
+        expect(emptyWorkflow([]).WorkflowType).toBe('SyncReviewRequestsWorkflow');
+    });
+});
+
+describe('validateDraft', () => {
+    test('accepts a workable config', () => {
+        expect(validate(baseDraft())).toEqual([]);
+    });
+
+    test('requires a positive sleep duration', () => {
+        const problems = validate(baseDraft({ SleepDuration: 0 }));
+        expect(problems).toHaveLength(1);
+        expect(problems[0].field).toBe('SleepDuration');
+        expect(problems[0].workflow).toBe(-1);
+    });
+
+    test('rejects an absurd sleep duration', () => {
+        expect(validate(baseDraft({ SleepDuration: 5000 }))[0].field).toBe('SleepDuration');
+    });
+
+    test('rejects malformed global repos', () => {
+        const problems = validate(baseDraft({ Repos: ['not-a-repo'] }));
+        expect(problems.some(p => p.field === 'Repos' && p.workflow === -1)).toBe(true);
+    });
+
+    test('requires a workflow name and section title', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].Name = '   ';
+        draft.Workflows[0].SectionTitle = '';
+        const fields = validate(draft).map(p => p.field);
+        expect(fields).toContain('Name');
+        expect(fields).toContain('SectionTitle');
+    });
+
+    test('rejects duplicate workflow names', () => {
+        const draft = baseDraft();
+        draft.Workflows.push({ ...draft.Workflows[0] });
+        const problems = validate(draft);
+        expect(problems).toHaveLength(1);
+        expect(problems[0].workflow).toBe(1);
+        expect(problems[0].message).toContain('duplicates');
+    });
+
+    test('rejects unknown workflow types', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].WorkflowType = 'MagicWorkflow';
+        expect(validate(draft)[0].field).toBe('WorkflowType');
+    });
+
+    test('requires an argument for filters that take one', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].Filters = ['FilterByLabel'];
+        const problems = validate(draft);
+        expect(problems).toHaveLength(1);
+        expect(problems[0].message).toContain('label');
+    });
+
+    test('accepts a filter with its argument', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].Filters = ['FilterByLabel:bug'];
+        expect(validate(draft)).toEqual([]);
+    });
+
+    test('rejects unknown filters', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].Filters = ['FilterNope'];
+        expect(validate(draft)[0].message).toContain('unknown filter');
+    });
+
+    test('requires repos somewhere', () => {
+        const draft = baseDraft({ Repos: [] });
+        const problems = validate(draft);
+        expect(problems.some(p => p.field === 'Repos' && p.workflow === 0)).toBe(true);
+    });
+
+    test('accepts a workflow-level repo list when the global one is empty', () => {
+        const draft = baseDraft({ Repos: [] });
+        draft.Workflows[0].Repos = ['owner/repo'];
+        expect(validate(draft)).toEqual([]);
+    });
+
+    test('requires a Jira epic for project list workflows', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].WorkflowType = 'ProjectListWorkflow';
+        expect(validate(draft)[0].field).toBe('JiraEpic');
+    });
+
+    test('requires a repo for the single repo workflow', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].WorkflowType = 'SingleRepoSyncReviewRequestsWorkflow';
+        expect(validate(draft)[0].field).toBe('Repo');
+    });
+
+    test('skips type checks when the server sent no registries', () => {
+        const draft = baseDraft();
+        draft.Workflows[0].WorkflowType = 'SomethingNew';
+        draft.Workflows[0].Filters = ['FilterUnknown'];
+        expect(validateDraft(draft, [], [])).toEqual([]);
+    });
+});
+
+describe('problemsByWorkflow', () => {
+    test('groups problems by their workflow index', () => {
+        const grouped = problemsByWorkflow([
+            { workflow: -1, field: 'Repos', message: 'bad' },
+            { workflow: 0, field: 'Name', message: 'is required' },
+            { workflow: 0, field: 'SectionTitle', message: 'is required' },
+        ]);
+        expect(grouped.get(-1)).toHaveLength(1);
+        expect(grouped.get(0)).toHaveLength(2);
+        expect(grouped.get(1)).toBeUndefined();
+    });
+});
diff --git a/bun_client/frontend/src/config_utils.ts b/bun_client/frontend/src/config_utils.ts
new file mode 100644
index 0000000..30a73a2
--- /dev/null
+++ b/bun_client/frontend/src/config_utils.ts
@@ -0,0 +1,352 @@
+/**
+ * Types and pure helpers for the server configuration editor.
+ *
+ * The shapes mirror the `RPCHandler.GetConfig` / `RPCHandler.UpdateConfig`
+ * replies. Validation here is a client-side convenience so the user gets
+ * feedback before a round trip; the server validates again before it writes
+ * anything, and its errors are reported in the same shape.
+ */
+
+export interface WorkflowEntry {
+    WorkflowType: string;
+    Name: string;
+    Owner?: string;
+    Repo?: string;
+    Repos?: string[] | null;
+    JiraEpic?: string;
+    Filters?: string[] | null;
+    SectionTitle: string;
+    PRState?: string;
+    GithubUsername?: string;
+    IncludeDiff?: boolean;
+    Teams?: string[] | null;
+    /** null / undefined means "inherit the global setting". */
+    DesktopNotifications?: boolean | null;
+}
+
+export interface PluginEntry {
+    Name: string;
+    Command: string;
+    IncludeDiff?: boolean;
+    IncludeHeaders?: boolean;
+    IncludeComments?: boolean;
+    IncludeBranch?: boolean;
+    OnlyOnDemand?: boolean;
+}
+
+export interface ServerConfig {
+    Repos: string[];
+    /** Minutes between workflow syncs. */
+    SleepDuration: number;
+    JiraDomain: string;
+    GithubUsername: string;
+    RepoLocation: string;
+    AutoWorktree: boolean;
+    DesktopNotifications: boolean;
+    SectionPriority: Record<string, number>;
+    SectionSorting: Record<string, string>;
+    Workflows: WorkflowEntry[];
+    Plugins: PluginEntry[];
+    ExperimentalLLMFileOrdering: boolean;
+    ExperimentalLLMReviewEase: boolean;
+}
+
+export interface WorkflowTypeInfo {
+    name: string;
+    description: string;
+    deprecated: boolean;
+    deprecated_by?: string;
+    required_fields: string[];
+    optional_fields: string[];
+}
+
+export interface FilterInfo {
+    name: string;
+    description: string;
+    requires_arg: boolean;
+    arg_label?: string;
+}
+
+/** A single problem with a configuration. `workflow` is -1 for global settings. */
+export interface ConfigValidationError {
+    workflow: number;
+    field: string;
+    message: string;
+}
+
+export interface ConfigReply {
+    okay: boolean;
+    message: string;
+    path: string;
+    config: ServerConfig;
+    workflow_types: WorkflowTypeInfo[];
+    filters: FilterInfo[];
+    /** Only present on UpdateConfig replies. */
+    errors?: ConfigValidationError[];
+}
+
+/** Fields the config editor can change. Everything else is left to the server. */
+export interface ConfigDraft {
+    Repos: string[];
+    SleepDuration: number;
+    GithubUsername: string;
+    RepoLocation: string;
+    JiraDomain: string;
+    AutoWorktree: boolean;
+    DesktopNotifications: boolean;
+    Workflows: WorkflowEntry[];
+}
+
+export const PR_STATE_OPTIONS = [
+    { value: '', label: 'Default (open)' },
+    { value: 'open', label: 'Open' },
+    { value: 'closed', label: 'Closed' },
+    { value: 'all', label: 'All' },
+];
+
+export const NOTIFICATION_OPTIONS = [
+    { value: 'inherit', label: 'Inherit global setting' },
+    { value: 'on', label: 'Always notify' },
+    { value: 'off', label: 'Never notify' },
+];
+
+/** Builds the editable draft from a config fetched from the server. */
+export function draftFromConfig(config: ServerConfig): ConfigDraft {
+    return {
+        Repos: [...(config.Repos ?? [])],
+        SleepDuration: config.SleepDuration,
+        GithubUsername: config.GithubUsername ?? '',
+        RepoLocation: config.RepoLocation ?? '',
+        JiraDomain: config.JiraDomain ?? '',
+        AutoWorktree: !!config.AutoWorktree,
+        DesktopNotifications: !!config.DesktopNotifications,
+        Workflows: (config.Workflows ?? []).map(w => ({ ...w })),
+    };
+}
+
+/** A blank workflow, pre-filled with the first non-deprecated type. */
+export function emptyWorkflow(workflowTypes: WorkflowTypeInfo[]): WorkflowEntry {
+    const preferred = workflowTypes.find(t => !t.deprecated) ?? workflowTypes[0];
+    return {
+        WorkflowType: preferred?.name ?? 'SyncReviewRequestsWorkflow',
+        Name: '',
+        SectionTitle: '',
+        Filters: [],
+        Repos: [],
+        Teams: [],
+        IncludeDiff: false,
+        PRState: '',
+    };
+}
+
+/**
+ * Splits an edited text field into list entries.
+ *
+ * Nothing is trimmed or dropped here: the field is rendered straight back from
+ * what this returns, so tidying up mid-edit would delete the separator or space
+ * the moment the user typed it. `cleanDraft` does the tidying at save time.
+ */
+export function splitList(text: string, separator: string): string[] {
+    return text.split(separator);
+}
+
+/** Renders list entries into a text field. Must use splitList's separator. */
+export function joinList(values: string[] | null | undefined, separator: string): string {
+    return (values ?? []).join(separator);
+}
+
+/** Trims list entries and drops the blank ones. */
+export function cleanList(values: string[] | null | undefined): string[] {
+    return (values ?? []).map(entry => entry.trim()).filter(entry => entry.length > 0);
+}
+
+/** Splits a configured filter into its name and optional argument. */
+export function splitFilter(entry: string): { name: string; arg: string } {
+    const idx = entry.indexOf(':');
+    if (idx === -1) return { name: entry, arg: '' };
+    return { name: entry.slice(0, idx), arg: entry.slice(idx + 1) };
+}
+
+/** Joins a filter name and argument into its config form. */
+export function joinFilter(name: string, arg: string): string {
+    return arg ? `${name}:${arg}` : name;
+}
+
+/**
+ * Normalizes a draft into what actually gets validated and sent: trimmed
+ * strings, no blank list entries, no stray spaces around a filter's argument.
+ */
+export function cleanDraft(draft: ConfigDraft): ConfigDraft {
+    return {
+        ...draft,
+        Repos: cleanList(draft.Repos),
+        GithubUsername: draft.GithubUsername.trim(),
+        RepoLocation: draft.RepoLocation.trim(),
+        JiraDomain: draft.JiraDomain.trim(),
+        Workflows: draft.Workflows.map(workflow => ({
+            ...workflow,
+            Name: workflow.Name?.trim() ?? '',
+            SectionTitle: workflow.SectionTitle?.trim() ?? '',
+            Repo: workflow.Repo?.trim(),
+            JiraEpic: workflow.JiraEpic?.trim(),
+            Repos: cleanList(workflow.Repos),
+            Teams: cleanList(workflow.Teams),
+            Filters: cleanList(workflow.Filters).map(entry => {
+                const { name, arg } = splitFilter(entry);
+                return joinFilter(name.trim(), arg.trim());
+            }),
+        })),
+    };
+}
+
+/** Reports whether a repository entry is in "owner/repo" form. */
+export function isValidRepo(entry: string): boolean {
+    const parts = entry.trim().split('/');
+    return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;
+}
+
+function globalError(field: string, message: string): ConfigValidationError {
+    return { workflow: -1, field, message };
+}
+
+function workflowError(workflow: number, field: string, message: string): ConfigValidationError {
+    return { workflow, field, message };
+}
+
+/**
+ * Validates a draft the same way the server does, so obvious mistakes are
+ * caught before saving. Returns an empty array when the draft looks good.
+ *
+ * The draft is cleaned first, so a half-typed "owner/repo, " isn't reported as
+ * an empty repository — the server would drop that blank entry too.
+ */
+export function validateDraft(
+    rawDraft: ConfigDraft,
+    workflowTypes: WorkflowTypeInfo[],
+    filters: FilterInfo[]
+): ConfigValidationError[] {
+    const draft = cleanDraft(rawDraft);
+    const problems: ConfigValidationError[] = [];
+
+    if (!Number.isFinite(draft.SleepDuration) || draft.SleepDuration <= 0) {
+        problems.push(globalError('SleepDuration', 'must be a positive number of minutes'));
+    } else if (draft.SleepDuration > 1440) {
+        problems.push(globalError('SleepDuration', 'must be at most 1440 minutes (24 hours)'));
+    }
+
+    draft.Repos.forEach(repo => {
+        if (!isValidRepo(repo)) {
+            problems.push(globalError('Repos', `"${repo}" is not in "owner/repo" form`));
+        }
+    });
+
+    const knownTypes = new Set(workflowTypes.map(t => t.name));
+    const filtersByName = new Map(filters.map(f => [f.name, f]));
+    const seenNames = new Map<string, number>();
+
+    draft.Workflows.forEach((workflow, index) => {
+        const name = workflow.Name?.trim() ?? '';
+        if (!name) {
+            problems.push(workflowError(index, 'Name', 'is required'));
+        } else if (seenNames.has(name)) {
+            problems.push(
+                workflowError(
+                    index,
+                    'Name',
+                    `duplicates the name of workflow ${(seenNames.get(name) as number) + 1}; names must be unique`
+                )
+            );
+        } else {
+            seenNames.set(name, index);
+        }
+
+        if (!workflow.SectionTitle?.trim()) {
+            problems.push(workflowError(index, 'SectionTitle', 'is required'));
+        }
+
+        if (!workflow.WorkflowType) {
+            problems.push(workflowError(index, 'WorkflowType', 'is required'));
+        } else if (knownTypes.size > 0 && !knownTypes.has(workflow.WorkflowType)) {
+            problems.push(
+                workflowError(
+                    index,
+                    'WorkflowType',
+                    `unknown workflow type "${workflow.WorkflowType}"`
+                )
+            );
+        }
+
+        (workflow.Repos ?? []).forEach(repo => {
+            if (!isValidRepo(repo)) {
+                problems.push(
+                    workflowError(index, 'Repos', `"${repo}" is not in "owner/repo" form`)
+                );
+            }
+        });
+
+        if (
+            (workflow.Repos ?? []).length === 0 &&
+            draft.Repos.length === 0 &&
+            workflow.WorkflowType !== 'SingleRepoSyncReviewRequestsWorkflow'
+        ) {
+            problems.push(
+                workflowError(index, 'Repos', 'is required when no global repository list is set')
+            );
+        }
+
+        (workflow.Filters ?? []).forEach(entry => {
+            const { name: filterName, arg } = splitFilter(entry);
+            const info = filtersByName.get(filterName);
+            if (!info) {
+                if (filtersByName.size > 0) {
+                    problems.push(
+                        workflowError(index, 'Filters', `unknown filter "${filterName}"`)
+                    );
+                }
+                return;
+            }
+            if (info.requires_arg && !arg.trim()) {
+                problems.push(
+                    workflowError(
+                        index,
+                        'Filters',
+                        `${filterName} requires a ${info.arg_label || 'value'}`
+                    )
+                );
+            }
+        });
+
+        if (workflow.WorkflowType === 'ProjectListWorkflow' && !workflow.JiraEpic?.trim()) {
+            problems.push(
+                workflowError(index, 'JiraEpic', 'is required (the Jira epic key, e.g. BOARD-123)')
+            );
+        }
+
+        if (
+            workflow.WorkflowType === 'SingleRepoSyncReviewRequestsWorkflow' &&
+            !isValidRepo(workflow.Repo ?? '')
+        ) {
+            problems.push(
+                workflowError(index, 'Repo', 'is required and must be in "owner/repo" form')
+            );
+        }
+    });
+
+    return problems;
+}
+
+/** Groups problems by workflow index so each editor card can show its own. */
+export function problemsByWorkflow(
+    problems: ConfigValidationError[]
+): Map<number, ConfigValidationError[]> {
+    const grouped = new Map<number, ConfigValidationError[]>();
+    problems.forEach(problem => {
+        const existing = grouped.get(problem.workflow);
+        if (existing) {
+            existing.push(problem);
+        } else {
+            grouped.set(problem.workflow, [problem]);
+        }
+    });
+    return grouped;
+}
diff --git a/bun_client/server.ts b/bun_client/server.ts
index 1265302..f6d9967 100644
--- a/bun_client/server.ts
+++ b/bun_client/server.ts
@@ -294,6 +294,15 @@ Bun.serve<{
             return handleRpc('RPCHandler.RerunPlugins', [body]);
         }
 
+        if (url.pathname === '/api/get-config' && (req.method === 'POST' || req.method === 'GET')) {
+            return handleRpc('RPCHandler.GetConfig', [{}]);
+        }
+
+        if (url.pathname === '/api/update-config' && req.method === 'POST') {
+            const body = await req.json();
+            return handleRpc('RPCHandler.UpdateConfig', [body]);
+        }
+
         if (url.pathname === '/api/check-lsp' && req.method === 'GET') {
             return new Response(JSON.stringify({ available: !!DIFF_LSP_PATH }), {
                 headers: { ...CORS_HEADERS, 'Content-Type': 'application/json' },
diff --git a/config/config.go b/config/config.go
index 0477165..4b78545 100644
--- a/config/config.go
+++ b/config/config.go
@@ -13,22 +13,27 @@ import (
 )
 
 // This struct implements all possible values a workflow can define, then they're written as-needed.
+//
+// The toml tags only matter when the server writes the config back out (see
+// Update.Render): omitempty keeps a workflow's unused fields out of the file
+// so a round-trip through the config RPCs doesn't litter it with empty
+// strings and false booleans.
 type RawWorkflow struct {
-	WorkflowType        string
-	Name                string
-	Owner               string
-	Repo                string
-	Repos               []string
-	JiraEpic            string
-	Filters             []string
-	SectionTitle        string
-	PRState             string
-	GithubUsername      string
-	IncludeDiff         bool
-	Teams               []string // Teams to filter PRs by when using FilterTeamRequested
+	WorkflowType   string   `toml:"WorkflowType"`
+	Name           string   `toml:"Name"`
+	Owner          string   `toml:"Owner,omitempty"`
+	Repo           string   `toml:"Repo,omitempty"`
+	Repos          []string `toml:"Repos,omitempty"`
+	JiraEpic       string   `toml:"JiraEpic,omitempty"`
+	Filters        []string `toml:"Filters,omitempty"`
+	SectionTitle   string   `toml:"SectionTitle"`
+	PRState        string   `toml:"PRState,omitempty"`
+	GithubUsername string   `toml:"GithubUsername,omitempty"`
+	IncludeDiff    bool     `toml:"IncludeDiff,omitempty"`
+	Teams          []string `toml:"Teams,omitempty"` // Teams to filter PRs by when using FilterTeamRequested
 	// DesktopNotifications overrides the global DesktopNotifications setting
 	// for this workflow only. If nil, the global setting is used.
-	DesktopNotifications *bool
+	DesktopNotifications *bool `toml:"DesktopNotifications,omitempty"`
 }
 
 // RepoConfig holds per-repository configuration settings.
@@ -49,18 +54,18 @@ type Plugin struct {
 
 // Define your classes
 type Config struct {
-	Repos          []string // List of repositories in "owner/repo" format. Workflows can override this.
-	RawWorkflows   []RawWorkflow
-	SleepDuration  time.Duration
-	JiraDomain     string
-	GithubUsername string
-	RepoLocation   string
+	Repos                []string // List of repositories in "owner/repo" format. Workflows can override this.
+	RawWorkflows         []RawWorkflow
+	SleepDuration        time.Duration
+	JiraDomain           string
+	GithubUsername       string
+	RepoLocation         string
 	AutoWorktree         bool
 	DesktopNotifications bool              // Send desktop notifications when a PR is added to a section
-	SectionPriority map[string]int    // Map of section title to priority (lower is better)
-	SectionSorting  map[string]string // Map of section title to sorting method (e.g. "newest_first", "oldest_first")
-	Plugins         []Plugin
-	RepoConfigs     map[string]RepoConfig // Keyed by "owner/repo"
+	SectionPriority      map[string]int    // Map of section title to priority (lower is better)
+	SectionSorting       map[string]string // Map of section title to sorting method (e.g. "newest_first", "oldest_first")
+	Plugins              []Plugin
+	RepoConfigs          map[string]RepoConfig // Keyed by "owner/repo"
 	// ExperimentalLLMFileOrdering, when true, orders the files in a PR diff via
 	// an LLM (integration first, then implementation, then styling, then tests)
 	// instead of the default test-files-last sort. Off by default.
@@ -70,7 +75,7 @@ type Config struct {
 	// file ordering. The rating is exposed as the review_ease field in PR
 	// metadata and review list items. Off by default; requires GEMINI_API_KEY.
 	ExperimentalLLMReviewEase bool
-	DB              *database.DB
+	DB                        *database.DB
 }
 
 var (
@@ -138,18 +143,18 @@ func ParseConfigForTest(data []byte) (*Config, error) {
 // It does NOT initialize the database.
 func parseConfig(data []byte) (*Config, error) {
 	var intermediate_config struct {
-		Repos               []string
-		JiraDomain          string
-		SleepDuration       int64
-		Workflows           []RawWorkflow
-		GithubUsername      string
-		RepoLocation        string
-		AutoWorktree         bool
-		DesktopNotifications bool
-		SectionPriority      map[string]int
-		SectionSorting      map[string]string
-		Plugins             []Plugin
-		RepoConfigs         map[string]RepoConfig
+		Repos                       []string
+		JiraDomain                  string
+		SleepDuration               int64
+		Workflows                   []RawWorkflow
+		GithubUsername              string
+		RepoLocation                string
+		AutoWorktree                bool
+		DesktopNotifications        bool
+		SectionPriority             map[string]int
+		SectionSorting              map[string]string
+		Plugins                     []Plugin
+		RepoConfigs                 map[string]RepoConfig
 		ExperimentalLLMFileOrdering bool
 		ExperimentalLLMReviewEase   bool
 	}
@@ -189,18 +194,18 @@ func parseConfig(data []byte) (*Config, error) {
 	}
 
 	return &Config{
-		Repos:              intermediate_config.Repos,
-		RawWorkflows:       intermediate_config.Workflows,
-		SleepDuration:      parsed_sleep_duration,
-		JiraDomain:         intermediate_config.JiraDomain,
-		GithubUsername:     intermediate_config.GithubUsername,
-		RepoLocation:       repoLocation,
-		AutoWorktree:         intermediate_config.AutoWorktree,
-		DesktopNotifications: intermediate_config.DesktopNotifications,
-		SectionPriority:    intermediate_config.SectionPriority,
-		SectionSorting:     intermediate_config.SectionSorting,
-		Plugins:            intermediate_config.Plugins,
-		RepoConfigs:        repoConfigs,
+		Repos:                       intermediate_config.Repos,
+		RawWorkflows:                intermediate_config.Workflows,
+		SleepDuration:               parsed_sleep_duration,
+		JiraDomain:                  intermediate_config.JiraDomain,
+		GithubUsername:              intermediate_config.GithubUsername,
+		RepoLocation:                repoLocation,
+		AutoWorktree:                intermediate_config.AutoWorktree,
+		DesktopNotifications:        intermediate_config.DesktopNotifications,
+		SectionPriority:             intermediate_config.SectionPriority,
+		SectionSorting:              intermediate_config.SectionSorting,
+		Plugins:                     intermediate_config.Plugins,
+		RepoConfigs:                 repoConfigs,
 		ExperimentalLLMFileOrdering: intermediate_config.ExperimentalLLMFileOrdering,
 		ExperimentalLLMReviewEase:   intermediate_config.ExperimentalLLMReviewEase,
 	}, nil
@@ -209,12 +214,11 @@ func parseConfig(data []byte) (*Config, error) {
 // Initialize loads the configuration from the config file and initializes the database.
 // This should be called from main() to allow proper error handling.
 func loadConfig() (*Config, error) {
-	configHome, err := getXDGConfigHome()
+	configPath, err := ConfigPath()
 	if err != nil {
-		return nil, fmt.Errorf("failed to get config home: %w", err)
+		return nil, err
 	}
 
-	configPath := filepath.Join(configHome, "codereviewserver.toml")
 	the_bytes, err := os.ReadFile(configPath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read config file at %s: %w", configPath, err)
diff --git a/config/file.go b/config/file.go
new file mode 100644
index 0000000..10d8f9a
--- /dev/null
+++ b/config/file.go
@@ -0,0 +1,210 @@
+package config
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/pelletier/go-toml/v2"
+)
+
+// configFileName is the name of the TOML file inside the XDG config home.
+const configFileName = "codereviewserver.toml"
+
+// writeMu serializes read-modify-write cycles on the config file so two
+// concurrent Apply calls can't clobber each other's changes.
+var writeMu sync.Mutex
+
+// ConfigPath returns the absolute path of the TOML config file.
+func ConfigPath() (string, error) {
+	configHome, err := getXDGConfigHome()
+	if err != nil {
+		return "", fmt.Errorf("failed to get config home: %w", err)
+	}
+	return filepath.Join(configHome, configFileName), nil
+}
+
+// Update is a partial change to the config file. A nil field is left as it is
+// on disk, so a client can send only the settings it means to change.
+type Update struct {
+	Repos                       *[]string
+	SleepDuration               *int // minutes
+	JiraDomain                  *string
+	GithubUsername              *string
+	RepoLocation                *string
+	AutoWorktree                *bool
+	DesktopNotifications        *bool
+	SectionPriority             *map[string]int
+	SectionSorting              *map[string]string
+	Workflows                   *[]RawWorkflow
+	ExperimentalLLMFileOrdering *bool
+	ExperimentalLLMReviewEase   *bool
+}
+
+// IsEmpty reports whether the update carries no changes at all.
+func (u Update) IsEmpty() bool {
+	return u.Repos == nil && u.SleepDuration == nil && u.JiraDomain == nil &&
+		u.GithubUsername == nil && u.RepoLocation == nil && u.AutoWorktree == nil &&
+		u.DesktopNotifications == nil && u.SectionPriority == nil && u.SectionSorting == nil &&
+		u.Workflows == nil && u.ExperimentalLLMFileOrdering == nil && u.ExperimentalLLMReviewEase == nil
+}
+
+// setKey writes v into the TOML document when the update supplies it.
+func setKey[T any](doc map[string]any, key string, v *T) {
+	if v != nil {
+		doc[key] = *v
+	}
+}
+
+// Render merges the update into the config file currently on disk and returns
+// the TOML bytes that would replace it along with the Config those bytes parse
+// into. Keys the server does not model (and any settings the update leaves
+// alone) are carried over untouched; comments and the original key ordering are
+// not preserved, which is why save keeps a .bak copy.
+//
+// Nothing is written here — callers validate the returned Config first and then
+// hand the bytes to save. Apply does both under one lock.
+func (u Update) Render() ([]byte, *Config, error) {
+	path, err := ConfigPath()
+	if err != nil {
+		return nil, nil, err
+	}
+
+	doc := map[string]any{}
+	existing, err := os.ReadFile(path)
+	if err != nil && !os.IsNotExist(err) {
+		return nil, nil, fmt.Errorf("failed to read config file at %s: %w", path, err)
+	}
+	if err == nil {
+		if err := toml.Unmarshal(existing, &doc); err != nil {
+			return nil, nil, fmt.Errorf("failed to parse config file at %s: %w", path, err)
+		}
+		if doc == nil {
+			doc = map[string]any{}
+		}
+	}
+
+	setKey(doc, "Repos", u.Repos)
+	setKey(doc, "SleepDuration", u.SleepDuration)
+	setKey(doc, "JiraDomain", u.JiraDomain)
+	setKey(doc, "GithubUsername", u.GithubUsername)
+	setKey(doc, "RepoLocation", u.RepoLocation)
+	setKey(doc, "AutoWorktree", u.AutoWorktree)
+	setKey(doc, "DesktopNotifications", u.DesktopNotifications)
+	setKey(doc, "SectionPriority", u.SectionPriority)
+	setKey(doc, "SectionSorting", u.SectionSorting)
+	setKey(doc, "ExperimentalLLMFileOrdering", u.ExperimentalLLMFileOrdering)
+	setKey(doc, "ExperimentalLLMReviewEase", u.ExperimentalLLMReviewEase)
+	if u.Workflows != nil {
+		doc["Workflows"] = stripInheritedUsernames(*u.Workflows, docString(doc, "GithubUsername"))
+	}
+
+	data, err := toml.Marshal(doc)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to serialize config: %w", err)
+	}
+
+	cfg, err := parseConfig(data)
+	if err != nil {
+		return nil, nil, err
+	}
+	return data, cfg, nil
+}
+
+// docString reads a string key out of a decoded TOML document.
+func docString(doc map[string]any, key string) string {
+	if s, ok := doc[key].(string); ok {
+		return s
+	}
+	return ""
+}
+
+// stripInheritedUsernames drops each workflow's GithubUsername when it merely
+// repeats the root-level one. parseConfig copies the root value into every
+// workflow that omits it, so without this a client that reads the config and
+// writes it straight back would bake that inherited value into the file.
+func stripInheritedUsernames(wfs []RawWorkflow, rootUsername string) []RawWorkflow {
+	out := make([]RawWorkflow, len(wfs))
+	copy(out, wfs)
+	if rootUsername == "" {
+		return out
+	}
+	for i := range out {
+		if out[i].GithubUsername == rootUsername {
+			out[i].GithubUsername = ""
+		}
+	}
+	return out
+}
+
+// save atomically replaces the config file with data, keeping the previous
+// contents in <path>.bak. Callers go through Apply, which holds writeMu across
+// the whole read-modify-write.
+func save(data []byte) error {
+	path, err := ConfigPath()
+	if err != nil {
+		return err
+	}
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return fmt.Errorf("failed to create config directory %s: %w", dir, err)
+	}
+
+	if existing, err := os.ReadFile(path); err == nil {
+		if err := os.WriteFile(path+".bak", existing, 0o644); err != nil {
+			slog.Warn("Failed to write config backup", "path", path+".bak", "error", err)
+		}
+	}
+
+	tmp, err := os.CreateTemp(dir, configFileName+".tmp*")
+	if err != nil {
+		return fmt.Errorf("failed to create temp config file in %s: %w", dir, err)
+	}
+	tmpPath := tmp.Name()
+	defer os.Remove(tmpPath) // no-op once the rename below succeeds
+
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return fmt.Errorf("failed to write temp config file: %w", err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("failed to close temp config file: %w", err)
+	}
+	if err := os.Chmod(tmpPath, 0o644); err != nil {
+		slog.Warn("Failed to set config file permissions", "path", tmpPath, "error", err)
+	}
+	if err := os.Rename(tmpPath, path); err != nil {
+		return fmt.Errorf("failed to replace config file at %s: %w", path, err)
+	}
+	slog.Info("Wrote configuration file", "path", path)
+	return nil
+}
+
+// Apply renders an update, runs validate against the configuration it produces,
+// and — only when validation reports nothing — writes the file and reloads the
+// in-memory config. The whole cycle holds writeMu so concurrent callers can't
+// interleave.
+//
+// A non-empty []ValidationError means the config was rejected and the file on
+// disk is untouched. A non-nil error means rendering, writing, or reloading
+// failed. validate may be nil.
+func Apply(u Update, validate func(*Config) []ValidationError) ([]ValidationError, error) {
+	writeMu.Lock()
+	defer writeMu.Unlock()
+
+	data, cfg, err := u.Render()
+	if err != nil {
+		return nil, err
+	}
+	if validate != nil {
+		if problems := validate(cfg); len(problems) > 0 {
+			return problems, nil
+		}
+	}
+	if err := save(data); err != nil {
+		return nil, err
+	}
+	return nil, Reload()
+}
diff --git a/config/file_test.go b/config/file_test.go
new file mode 100644
index 0000000..e9ab1eb
--- /dev/null
+++ b/config/file_test.go
@@ -0,0 +1,191 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+// useTempConfig points the config package at a throwaway config file and
+// returns its path.
+func useTempConfig(t *testing.T, contents string) string {
+	t.Helper()
+	tempDir := t.TempDir()
+	t.Setenv("XDG_CONFIG_HOME", tempDir)
+	oldUserHomeDir := UserHomeDir
+	t.Cleanup(func() { UserHomeDir = oldUserHomeDir })
+	UserHomeDir = func() (string, error) { return tempDir, nil }
+
+	path := filepath.Join(tempDir, configFileName)
+	if contents != "" {
+		if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
+			t.Fatalf("failed to write test config: %v", err)
+		}
+	}
+	return path
+}
+
+const sampleConfig = `
+Repos = ["owner/repo"]
+SleepDuration = 5
+GithubUsername = "me"
+UnknownFutureKey = "keep me"
+
+[SectionPriority]
+"My PRs" = 10
+
+[[Plugins]]
+Name = "Summarize"
+Command = "summarize_diff"
+IncludeDiff = true
+
+[[Workflows]]
+WorkflowType = "SyncReviewRequestsWorkflow"
+Name = "My Open PRs"
+Filters = ["FilterNotDraft"]
+SectionTitle = "My PRs"
+`
+
+func TestUpdateRenderReplacesWorkflowsAndKeepsEverythingElse(t *testing.T) {
+	useTempConfig(t, sampleConfig)
+
+	newWorkflows := []RawWorkflow{{
+		WorkflowType: "SyncReviewRequestsWorkflow",
+		Name:         "Team Reviews",
+		SectionTitle: "Needs Review",
+		Filters:      []string{"FilterNotDraft", "FilterByLabel:bug"},
+		Teams:        []string{"my-team"},
+	}}
+	data, cfg, err := Update{Workflows: &newWorkflows}.Render()
+	if err != nil {
+		t.Fatalf("Render() error = %v", err)
+	}
+
+	if len(cfg.RawWorkflows) != 1 || cfg.RawWorkflows[0].Name != "Team Reviews" {
+		t.Errorf("expected the rendered config to hold only the new workflow, got %+v", cfg.RawWorkflows)
+	}
+	if len(cfg.Repos) != 1 || cfg.Repos[0] != "owner/repo" {
+		t.Errorf("Repos should be untouched, got %v", cfg.Repos)
+	}
+	if cfg.SleepDuration != 5*time.Minute {
+		t.Errorf("SleepDuration should be untouched, got %v", cfg.SleepDuration)
+	}
+	if len(cfg.Plugins) != 1 || cfg.Plugins[0].Name != "Summarize" {
+		t.Errorf("Plugins should be untouched, got %+v", cfg.Plugins)
+	}
+	if cfg.SectionPriority["My PRs"] != 10 {
+		t.Errorf("SectionPriority should be untouched, got %v", cfg.SectionPriority)
+	}
+	if !strings.Contains(string(data), "UnknownFutureKey") {
+		t.Errorf("keys the server doesn't model should survive a write, got:\n%s", data)
+	}
+	// Unset workflow fields shouldn't be written out as empty values.
+	if strings.Contains(string(data), "JiraEpic") {
+		t.Errorf("empty workflow fields should be omitted, got:\n%s", data)
+	}
+}
+
+func TestUpdateRenderDropsInheritedGithubUsername(t *testing.T) {
+	useTempConfig(t, sampleConfig)
+
+	// parseConfig copies the root GithubUsername into every workflow, which is
+	// what a client reads back before submitting an edit.
+	parsed, err := loadConfig()
+	if err != nil {
+		t.Fatalf("loadConfig() error = %v", err)
+	}
+	if parsed.RawWorkflows[0].GithubUsername != "me" {
+		t.Fatalf("expected the parsed workflow to inherit the root username, got %q", parsed.RawWorkflows[0].GithubUsername)
+	}
+
+	data, _, err := Update{Workflows: &parsed.RawWorkflows}.Render()
+	if err != nil {
+		t.Fatalf("Render() error = %v", err)
+	}
+	if strings.Count(string(data), "GithubUsername") != 1 {
+		t.Errorf("the inherited username should not be written onto the workflow, got:\n%s", data)
+	}
+}
+
+func TestUpdateRenderCreatesMissingConfigFile(t *testing.T) {
+	useTempConfig(t, "")
+
+	repos := []string{"owner/repo"}
+	_, cfg, err := Update{Repos: &repos}.Render()
+	if err != nil {
+		t.Fatalf("Render() error = %v", err)
+	}
+	if len(cfg.Repos) != 1 || cfg.Repos[0] != "owner/repo" {
+		t.Errorf("expected the new config to hold the submitted repos, got %v", cfg.Repos)
+	}
+}
+
+func TestApplyWritesReloadsAndBacksUp(t *testing.T) {
+	path := useTempConfig(t, sampleConfig)
+	if err := Reload(); err != nil {
+		t.Fatalf("Reload() error = %v", err)
+	}
+
+	sleep := 30
+	problems, err := Apply(Update{SleepDuration: &sleep}, nil)
+	if err != nil {
+		t.Fatalf("Apply() error = %v", err)
+	}
+	if len(problems) != 0 {
+		t.Fatalf("expected no validation problems, got %v", problems)
+	}
+
+	if C().SleepDuration != 30*time.Minute {
+		t.Errorf("Apply should reload the running config, got %v", C().SleepDuration)
+	}
+	written, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read written config: %v", err)
+	}
+	if !strings.Contains(string(written), "SleepDuration = 30") {
+		t.Errorf("expected the new SleepDuration on disk, got:\n%s", written)
+	}
+	backup, err := os.ReadFile(path + ".bak")
+	if err != nil {
+		t.Fatalf("expected a backup of the previous config: %v", err)
+	}
+	if !strings.Contains(string(backup), "SleepDuration = 5") {
+		t.Errorf("expected the backup to hold the previous config, got:\n%s", backup)
+	}
+}
+
+func TestApplyLeavesFileAloneWhenValidationFails(t *testing.T) {
+	path := useTempConfig(t, sampleConfig)
+
+	bad := []RawWorkflow{{WorkflowType: "SyncReviewRequestsWorkflow", SectionTitle: "Section"}}
+	problems, err := Apply(Update{Workflows: &bad}, Validate)
+	if err != nil {
+		t.Fatalf("Apply() error = %v", err)
+	}
+	if len(problems) == 0 {
+		t.Fatal("expected the nameless workflow to be rejected")
+	}
+
+	after, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read config: %v", err)
+	}
+	if string(after) != sampleConfig {
+		t.Errorf("a rejected update must not touch the file, got:\n%s", after)
+	}
+	if _, err := os.Stat(path + ".bak"); !os.IsNotExist(err) {
+		t.Errorf("a rejected update must not write a backup either")
+	}
+}
+
+func TestUpdateIsEmpty(t *testing.T) {
+	if !(Update{}).IsEmpty() {
+		t.Error("an update with no fields set should be empty")
+	}
+	repos := []string{}
+	if (Update{Repos: &repos}).IsEmpty() {
+		t.Error("clearing a list is still a change")
+	}
+}
diff --git a/config/validate.go b/config/validate.go
new file mode 100644
index 0000000..a11c2fb
--- /dev/null
+++ b/config/validate.go
@@ -0,0 +1,111 @@
+package config
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ValidationError describes one problem with a proposed configuration.
+// Workflow is the index of the offending [[Workflows]] entry, or -1 when the
+// problem is with a root-level setting.
+type ValidationError struct {
+	Workflow int    `json:"workflow"`
+	Field    string `json:"field"`
+	Message  string `json:"message"`
+}
+
+func (e ValidationError) Error() string {
+	if e.Workflow >= 0 {
+		return fmt.Sprintf("Workflows[%d].%s: %s", e.Workflow, e.Field, e.Message)
+	}
+	if e.Field == "" {
+		return e.Message
+	}
+	return fmt.Sprintf("%s: %s", e.Field, e.Message)
+}
+
+// rootError builds a ValidationError for a root-level setting.
+func rootError(field, format string, args ...any) ValidationError {
+	return ValidationError{Workflow: -1, Field: field, Message: fmt.Sprintf(format, args...)}
+}
+
+// workflowError builds a ValidationError for a single workflow entry.
+func workflowError(index int, field, format string, args ...any) ValidationError {
+	return ValidationError{Workflow: index, Field: field, Message: fmt.Sprintf(format, args...)}
+}
+
+// maxSleepDuration caps how long a workflow cycle may sleep. A day between
+// syncs is already far past useful; anything larger is a typo (e.g. minutes
+// entered as seconds).
+const maxSleepDuration = 24 * time.Hour
+
+// validSectionSorting lists the sorting methods the renderer understands.
+var validSectionSorting = map[string]bool{"newest_first": true, "oldest_first": true}
+
+// Validate checks the parts of a configuration that don't depend on the
+// workflow registry: root-level settings plus the fields every workflow needs
+// regardless of its type. Workflow types and filters are validated by
+// workflows.ValidateWorkflows, which owns those registries; server-side callers
+// run both.
+func Validate(cfg *Config) []ValidationError {
+	problems := []ValidationError{}
+	if cfg == nil {
+		return append(problems, rootError("", "configuration is empty"))
+	}
+
+	if cfg.SleepDuration <= 0 {
+		problems = append(problems, rootError("SleepDuration", "must be a positive number of minutes"))
+	} else if cfg.SleepDuration > maxSleepDuration {
+		problems = append(problems, rootError("SleepDuration", "must be at most %d minutes (24 hours)", int(maxSleepDuration.Minutes())))
+	}
+
+	for i, repo := range cfg.Repos {
+		if err := ValidateRepoEntry(repo); err != nil {
+			problems = append(problems, rootError("Repos", "entry %d: %v", i, err))
+		}
+	}
+
+	for section, sorting := range cfg.SectionSorting {
+		if !validSectionSorting[sorting] {
+			problems = append(problems, rootError("SectionSorting",
+				"section %q has unknown sorting %q (expected \"newest_first\" or \"oldest_first\")", section, sorting))
+		}
+	}
+
+	seenNames := make(map[string]int, len(cfg.RawWorkflows))
+	for i, wf := range cfg.RawWorkflows {
+		if strings.TrimSpace(wf.Name) == "" {
+			problems = append(problems, workflowError(i, "Name", "is required"))
+		} else if first, dup := seenNames[wf.Name]; dup {
+			problems = append(problems, workflowError(i, "Name",
+				"duplicates the name of workflow %d; workflow names identify which workflow owns an item and must be unique", first))
+		} else {
+			seenNames[wf.Name] = i
+		}
+
+		if strings.TrimSpace(wf.WorkflowType) == "" {
+			problems = append(problems, workflowError(i, "WorkflowType", "is required"))
+		}
+		if strings.TrimSpace(wf.SectionTitle) == "" {
+			problems = append(problems, workflowError(i, "SectionTitle", "is required"))
+		}
+	}
+
+	return problems
+}
+
+// ValidateRepoEntry checks that a repository entry is in "owner/repo" form.
+// git_tools.ParseRepoName does the same check at run time, but it imports this
+// package, so the rule is duplicated here rather than inverted.
+func ValidateRepoEntry(entry string) error {
+	trimmed := strings.TrimSpace(entry)
+	if trimmed == "" {
+		return fmt.Errorf("repository entry is empty")
+	}
+	parts := strings.Split(trimmed, "/")
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return fmt.Errorf("%q is not in \"owner/repo\" form", entry)
+	}
+	return nil
+}
diff --git a/config/validate_test.go b/config/validate_test.go
new file mode 100644
index 0000000..a358fa5
--- /dev/null
+++ b/config/validate_test.go
@@ -0,0 +1,117 @@
+package config
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// validConfig is the baseline each test case perturbs.
+func validConfig() *Config {
+	return &Config{
+		Repos:         []string{"owner/repo"},
+		SleepDuration: 10 * time.Minute,
+		RawWorkflows: []RawWorkflow{{
+			WorkflowType: "SyncReviewRequestsWorkflow",
+			Name:         "My Open PRs",
+			SectionTitle: "My PRs",
+		}},
+	}
+}
+
+func TestValidateAcceptsAWorkingConfig(t *testing.T) {
+	if problems := Validate(validConfig()); len(problems) != 0 {
+		t.Errorf("expected no problems, got %v", problems)
+	}
+}
+
+func TestValidate(t *testing.T) {
+	tests := []struct {
+		name        string
+		mutate      func(*Config)
+		wantField   string
+		wantMessage string // substring
+	}{
+		{
+			name:        "zero sleep duration",
+			mutate:      func(c *Config) { c.SleepDuration = 0 },
+			wantField:   "SleepDuration",
+			wantMessage: "positive",
+		},
+		{
+			name:        "absurd sleep duration",
+			mutate:      func(c *Config) { c.SleepDuration = 48 * time.Hour },
+			wantField:   "SleepDuration",
+			wantMessage: "at most",
+		},
+		{
+			name:        "repo missing owner",
+			mutate:      func(c *Config) { c.Repos = []string{"repo"} },
+			wantField:   "Repos",
+			wantMessage: "owner/repo",
+		},
+		{
+			name:        "unknown section sorting",
+			mutate:      func(c *Config) { c.SectionSorting = map[string]string{"My PRs": "alphabetical"} },
+			wantField:   "SectionSorting",
+			wantMessage: "newest_first",
+		},
+		{
+			name:        "workflow without a name",
+			mutate:      func(c *Config) { c.RawWorkflows[0].Name = "  " },
+			wantField:   "Name",
+			wantMessage: "required",
+		},
+		{
+			name:        "workflow without a section title",
+			mutate:      func(c *Config) { c.RawWorkflows[0].SectionTitle = "" },
+			wantField:   "SectionTitle",
+			wantMessage: "required",
+		},
+		{
+			name:        "workflow without a type",
+			mutate:      func(c *Config) { c.RawWorkflows[0].WorkflowType = "" },
+			wantField:   "WorkflowType",
+			wantMessage: "required",
+		},
+		{
+			name: "duplicate workflow names",
+			mutate: func(c *Config) {
+				c.RawWorkflows = append(c.RawWorkflows, c.RawWorkflows[0])
+			},
+			wantField:   "Name",
+			wantMessage: "duplicates",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := validConfig()
+			tt.mutate(cfg)
+			problems := Validate(cfg)
+			if len(problems) == 0 {
+				t.Fatalf("expected a validation problem, got none")
+			}
+			found := false
+			for _, p := range problems {
+				if p.Field == tt.wantField && strings.Contains(p.Message, tt.wantMessage) {
+					found = true
+				}
+			}
+			if !found {
+				t.Errorf("expected a %s problem mentioning %q, got %v", tt.wantField, tt.wantMessage, problems)
+			}
+		})
+	}
+}
+
+func TestValidationErrorMessage(t *testing.T) {
+	wf := ValidationError{Workflow: 2, Field: "Name", Message: "is required"}
+	if got := wf.Error(); got != "Workflows[2].Name: is required" {
+		t.Errorf("unexpected workflow error text: %q", got)
+	}
+	root := ValidationError{Workflow: -1, Field: "SleepDuration", Message: "must be positive"}
+	if got := root.Error(); got != "SleepDuration: must be positive" {
+		t.Errorf("unexpected root error text: %q", got)
+	}
+}
diff --git a/docs/building_clients.md b/docs/building_clients.md
index f4560d5..470b10c 100644
--- a/docs/building_clients.md
+++ b/docs/building_clients.md
@@ -5,3 +5,11 @@ Code Review Server is designed to be client-agnostic. It communicates via standa
 If you want to build a new client (e.g. for VS Code, Vim, or a TUI), you should refer to the [Protocol Documentation](protocol.md).
 
 The server binary `codereviewserver` should be spawned as a child process by your client. Your client send requests to the server's `stdin` and reads responses from `stdout`.
+
+## Offering Configuration Editing
+
+A client can let users manage the server's config without touching TOML by hand, via `RPCHandler.GetConfig` and `RPCHandler.UpdateConfig`.
+
+Build the pickers from the reply rather than hard-coding lists: `GetConfig` returns `workflow_types` and `filters` describing exactly what the running server supports, including which filters need an argument and which fields each workflow type uses. A client written against those registries keeps working when the server gains a new workflow type or filter.
+
+`UpdateConfig` reports a configuration it won't accept as `okay: false` with an `errors` list rather than as an RPC error. Each entry names the workflow index and field it belongs to, so surface them next to the offending input instead of as one opaque failure. See [Protocol](protocol.md#rpchandlergetconfig) for the full shapes.
diff --git a/docs/clients.md b/docs/clients.md
index 437cbe0..e1290ed 100644
--- a/docs/clients.md
+++ b/docs/clients.md
@@ -12,6 +12,17 @@ The web client is packaged with bun, and has a bun backend with a react frontend
 2. `bun install && bun run build`
 3. `bun start`
 
+### Preferences
+
+The gear icon next to the header opens Preferences, which has two tabs:
+
+- **Appearance** — theme, preferred review location, and diff font size. These are client-side settings stored in the browser's local storage.
+- **Server Configuration** — an editor for the server's TOML config (`~/.config/codereviewserver.toml`), covering the global settings and the workflow list.
+
+In the Server Configuration tab, each workflow is a collapsible card you can expand to edit, reorder with the arrow buttons, or delete. **+ Add workflow** appends a new one. The workflow type and filter dropdowns are populated from the registries the server sends with the config, so they always offer what the running server supports; filters that need an argument (`FilterByLabel` and friends) get an extra input for it, and fields that don't apply to the selected workflow type are hidden.
+
+The editor validates as you go and blocks a save while anything is wrong — a missing section title, a duplicate workflow name, a repository that isn't in `owner/repo` form. The server validates again before writing and reports anything the client missed against the field that caused it, so a config that can't run never reaches disk. See [Configuration](configuration.md#editing-the-config-from-a-client) for what saving does to the file and when the changes take effect.
+
 ## TUI Client
 
 The TUI client (`tui_client/`) is a fast, keyboard-driven terminal interface built in Rust. It's well-suited for quick access to your review queue from any terminal.
diff --git a/docs/configuration.md b/docs/configuration.md
index f6b9b7e..3f07e93 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -27,6 +27,39 @@ SectionSorting: map[string]string [optional]
 - **RepoLocation**: The directory where you keep your git repositories. It defaults to "~/" if not defined. This is used for LSP integration or other lookup tools which need to read the code of the repo you're reviewing.
 - **DesktopNotifications**: When `true`, sends a desktop notification each time a PR is newly added to a section. Defaults to `false`. Currently only macOS is supported (via `osascript`); enabling this on other operating systems will log an error.
 
+## Editing the Config from a Client
+
+The config file is the source of truth, but you don't have to edit it by hand. Clients can read and write it over the RPC API with `RPCHandler.GetConfig` and `RPCHandler.UpdateConfig` (see [Protocol](protocol.md)). The web client exposes this as the **Server Configuration** tab behind the gear icon (see [Clients](clients.md)).
+
+Things worth knowing before editing the config from a client:
+
+- **Updates are partial.** A client sends only the settings it means to change; everything else in the file — including keys the server doesn't know about — is left as it is. Sending `Workflows` replaces the whole workflow list, which is how entries are added, removed, or reordered.
+- **Nothing is written unless it validates.** The server checks the configuration the update would produce and refuses to write one it can't run, reporting each problem against the field that caused it. The rules are listed below.
+- **The previous file is kept as `codereviewserver.toml.bak`.** Comments and the original key ordering are **not** preserved when the server rewrites the file, so keep your own copy if a hand-written config has comments you care about.
+- **Changes apply on the next sync.** The background workflow manager reloads the config at the start of each cycle (`SleepDuration` minutes apart), so a saved workflow starts collecting PRs on the following sync rather than instantly.
+- **Removed workflows leave their PRs behind until the next sync**, at which point items no longer claimed by any workflow are pruned. The section itself stays in the database even when nothing feeds it.
+
+### Validation Rules
+
+A configuration is rejected when any of the following is true:
+
+Root level:
+
+- `SleepDuration` is not a positive number of minutes, or is greater than 1440 (24 hours).
+- A `Repos` entry is not in `owner/repo` form.
+- A `SectionSorting` value is not `newest_first` or `oldest_first`.
+
+Per workflow:
+
+- `Name`, `WorkflowType`, or `SectionTitle` is missing.
+- Two workflows share a `Name` — names identify which workflow owns an item, so they must be unique.
+- `WorkflowType` is not one of the types listed below.
+- A filter is not one this server knows, an argument-taking filter (`FilterByLabel`, `FilterByAuthor`, `FilterExcludeAuthor`) is missing its argument, or an argument is given to a filter that takes none.
+- A `Repos` entry is not in `owner/repo` form, or a `Teams` entry is empty.
+- `PRState` is set to something other than `open`, `closed`, or `all`.
+- The workflow has no repositories to work with: neither its own `Repos` nor a root-level `Repos` list.
+- `ProjectListWorkflow` is missing `JiraEpic`, or `SingleRepoSyncReviewRequestsWorkflow` is missing a valid `Repo`.
+
 ## Workflows
 
 A list of tables called `[[Workflows]]` configures each workflow.
diff --git a/docs/protocol.md b/docs/protocol.md
index 844d7bb..918afd2 100644
--- a/docs/protocol.md
+++ b/docs/protocol.md
@@ -508,6 +508,175 @@ Retrieves the output and status of all plugins for a specific pull request.
 
 ---
 
+### `RPCHandler.GetConfig`
+
+Returns the server's configuration file, re-read from disk so the client sees edits made outside the server. The reply also carries the workflow type and filter registries, so a client can build its pickers from what this server actually supports instead of hard-coding the lists.
+
+**Arguments** (`GetConfigArgs`):
+```json
+{}
+```
+
+**Reply** (`GetConfigReply`):
+| Field            | Type               | Description                                                        |
+|------------------|--------------------|--------------------------------------------------------------------|
+| `okay`           | bool               | `true` if the configuration was read successfully                  |
+| `message`        | string             | Empty on success; explains the problem when the file can't be read |
+| `path`           | string             | Absolute path of the TOML file being read and written              |
+| `config`         | Config             | The current configuration (see below)                              |
+| `workflow_types` | []WorkflowTypeInfo | Workflow types this server can run                                 |
+| `filters`        | []FilterInfo       | Filters a workflow may use                                         |
+
+If the file on disk no longer parses, `okay` is `false` and `config` describes the configuration still running in memory.
+
+#### `Config` Object
+
+Field names match the TOML keys. See [Configuration](configuration.md) for what each one does.
+
+| Field                         | Type              | Description                                                     |
+|-------------------------------|-------------------|------------------------------------------------------------------|
+| `Repos`                       | []string          | Repositories in `owner/repo` form                               |
+| `SleepDuration`               | int               | Minutes between workflow syncs                                   |
+| `JiraDomain`                  | string            | Jira domain used by `ProjectListWorkflow`                        |
+| `GithubUsername`              | string            | Login used by the "me" filters                                   |
+| `RepoLocation`                | string            | Directory holding local clones                                   |
+| `AutoWorktree`                | bool              | Whether the server manages git worktrees                         |
+| `DesktopNotifications`        | bool              | Global desktop notification setting                              |
+| `SectionPriority`             | map[string]int    | Section title → priority (lower sorts first)                     |
+| `SectionSorting`              | map[string]string | Section title → `newest_first` / `oldest_first`                  |
+| `Workflows`                   | []Workflow        | Configured workflows                                             |
+| `Plugins`                     | []Plugin          | Configured plugins (read-only; `UpdateConfig` does not set them) |
+| `ExperimentalLLMFileOrdering` | bool              | LLM diff file ordering                                           |
+| `ExperimentalLLMReviewEase`   | bool              | LLM review-ease rating                                           |
+
+#### `Workflow` Object
+
+| Field                  | Type      | Description                                                              |
+|------------------------|-----------|---------------------------------------------------------------------------|
+| `WorkflowType`         | string    | One of the names in `workflow_types`                                      |
+| `Name`                 | string    | Unique workflow name; identifies which workflow owns an item              |
+| `SectionTitle`         | string    | Section the workflow's PRs land in                                        |
+| `Repos`                | []string  | Repositories for this workflow; empty inherits the root-level `Repos`      |
+| `Repo`                 | string    | Single repository (`SingleRepoSyncReviewRequestsWorkflow`)                |
+| `Owner`                | string    | Repository owner, for configs using the singular `Owner`/`Repo` form      |
+| `Filters`              | []string  | Filter names, argument-taking ones written as `FilterByLabel:bug`         |
+| `Teams`                | []string  | Team slugs whose review requests should match                             |
+| `JiraEpic`             | string    | Epic key (`ProjectListWorkflow`)                                          |
+| `PRState`              | string    | `open`, `closed`, or `all`; empty means `open`                            |
+| `IncludeDiff`          | bool      | Include the full diff in the section body                                 |
+| `GithubUsername`       | string    | Per-workflow username; inherits the root-level one when empty             |
+| `DesktopNotifications` | bool/null | Per-workflow override; `null` inherits the global setting                 |
+
+#### `WorkflowTypeInfo` Object
+
+| Field             | Type     | Description                                                       |
+|-------------------|----------|--------------------------------------------------------------------|
+| `name`            | string   | Value to put in a workflow's `WorkflowType`                        |
+| `description`     | string   | What the workflow type does                                        |
+| `deprecated`      | bool     | Whether the type still works but shouldn't be used for new configs |
+| `deprecated_by`   | string   | What to use instead (deprecated types only)                        |
+| `required_fields` | []string | Type-specific fields the workflow must set                         |
+| `optional_fields` | []string | Type-specific fields the workflow may set                          |
+
+`Name`, `WorkflowType`, and `SectionTitle` are required by every type and are not repeated in `required_fields`. Clients can use these two lists to decide which fields to show for the selected type.
+
+#### `FilterInfo` Object
+
+| Field          | Type   | Description                                                   |
+|----------------|--------|----------------------------------------------------------------|
+| `name`         | string | Filter name as written in `Filters`                            |
+| `description`  | string | What the filter matches                                        |
+| `requires_arg` | bool   | Whether the filter must be written as `Name:argument`          |
+| `arg_label`    | string | What the argument means (e.g. `label`, `username`)             |
+
+---
+
+### `RPCHandler.UpdateConfig`
+
+Writes a **partial** change to the configuration file and reloads the running config. Every argument is optional: a field that is omitted (or `null`) keeps whatever is on disk, as do settings the server doesn't model. Sending `Workflows` replaces the entire list, which is how a client adds, removes, or reorders entries.
+
+The new configuration is validated **before** anything is written. If it fails, the file is untouched and the reply comes back with `okay: false` and a populated `errors` list — a rejected configuration is not an RPC error, so clients can attach each message to the field that caused it.
+
+On success the file is replaced atomically and the previous contents are kept alongside it as `<path>.bak`. Comments and the original key ordering in the file are **not** preserved.
+
+The background workflow manager re-derives its workflows from the config at the start of every sync cycle, so a saved change takes effect on the next sync rather than immediately.
+
+**Arguments** (`UpdateConfigArgs`): any subset of the `Config` fields listed under `GetConfig`, except `Plugins` (which the server never rewrites).
+
+| Field                         | Type              | Required | Description                                      |
+|-------------------------------|-------------------|----------|--------------------------------------------------|
+| `Repos`                       | []string          | No       | Replaces the root-level repository list          |
+| `SleepDuration`               | int               | No       | Minutes between syncs                            |
+| `JiraDomain`                  | string            | No       | Jira domain                                      |
+| `GithubUsername`              | string            | No       | GitHub login                                     |
+| `RepoLocation`                | string            | No       | Local clone directory                            |
+| `AutoWorktree`                | bool              | No       | Worktree management                              |
+| `DesktopNotifications`        | bool              | No       | Global notification setting                      |
+| `SectionPriority`             | map[string]int    | No       | Replaces the section priority map                |
+| `SectionSorting`              | map[string]string | No       | Replaces the section sorting map                 |
+| `Workflows`                   | []Workflow        | No       | Replaces the whole workflow list                 |
+| `ExperimentalLLMFileOrdering` | bool              | No       | LLM diff file ordering                           |
+| `ExperimentalLLMReviewEase`   | bool              | No       | LLM review-ease rating                           |
+
+**Reply** (`UpdateConfigReply`):
+
+All fields from `GetConfigReply`, plus:
+
+| Field    | Type               | Description                                              |
+|----------|--------------------|-----------------------------------------------------------|
+| `errors` | []ValidationError  | Problems that caused the update to be rejected (empty on success) |
+
+`config` always describes the configuration that is actually in effect: the newly saved one after a successful update, or the unchanged one after a rejection.
+
+#### `ValidationError` Object
+
+| Field      | Type   | Description                                                              |
+|------------|--------|---------------------------------------------------------------------------|
+| `workflow` | int    | Index into `Workflows` the problem belongs to, or `-1` for a root setting |
+| `field`    | string | Field name the problem is about (e.g. `SectionTitle`, `Filters`)          |
+| `message`  | string | Human-readable description of the problem                                 |
+
+**Example Request** (replace the workflow list):
+```json
+{
+  "method": "RPCHandler.UpdateConfig",
+  "params": [{
+    "Workflows": [
+      {
+        "WorkflowType": "SyncReviewRequestsWorkflow",
+        "Name": "Team Reviews",
+        "SectionTitle": "Needs My Team's Review",
+        "Filters": ["FilterNotDraft", "FilterByLabel:bug"],
+        "Teams": ["my-team"]
+      }
+    ]
+  }],
+  "id": 8
+}
+```
+
+**Example Response** (rejected):
+```json
+{
+  "result": {
+    "okay": false,
+    "message": "Configuration not saved: found 2 problems",
+    "path": "/home/user/.config/codereviewserver.toml",
+    "errors": [
+      {"workflow": 0, "field": "SectionTitle", "message": "is required"},
+      {"workflow": 0, "field": "Filters", "message": "FilterByLabel requires an argument (e.g. FilterByLabel:<label>)"}
+    ],
+    "config": { "...": "the unchanged configuration" },
+    "workflow_types": [{ "...": "as in GetConfig" }],
+    "filters": [{ "...": "as in GetConfig" }]
+  },
+  "error": null,
+  "id": 8
+}
+```
+
+---
+
 ### `RPCHandler.GetRateLimitStatus`
 
 Returns the current GitHub API rate limit status, including remaining quota, reset time, and usage metrics.
diff --git a/server/config_rpc_test.go b/server/config_rpc_test.go
new file mode 100644
index 0000000..c91080a
--- /dev/null
+++ b/server/config_rpc_test.go
@@ -0,0 +1,241 @@
+package server
+
+import (
+	"crs/config"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+const testConfigTOML = `
+Repos = ["owner/repo"]
+SleepDuration = 5
+
+[[Workflows]]
+WorkflowType = "SyncReviewRequestsWorkflow"
+Name = "My Open PRs"
+Filters = ["FilterNotDraft"]
+SectionTitle = "My PRs"
+`
+
+// useTempConfig points the config package at a throwaway config file and
+// returns its path.
+func useTempConfig(t *testing.T, contents string) string {
+	t.Helper()
+	tempDir := t.TempDir()
+	t.Setenv("XDG_CONFIG_HOME", tempDir)
+	oldUserHomeDir := config.UserHomeDir
+	t.Cleanup(func() { config.UserHomeDir = oldUserHomeDir })
+	config.UserHomeDir = func() (string, error) { return tempDir, nil }
+
+	path := filepath.Join(tempDir, "codereviewserver.toml")
+	if err := os.WriteFile(path, []byte(contents), 0o644); err != nil {
+		t.Fatalf("failed to write test config: %v", err)
+	}
+	// Load it as the running config, the way a client's GetConfig call would,
+	// so tests don't inherit whatever a previous test left in the global.
+	if err := config.Reload(); err != nil {
+		t.Fatalf("failed to load test config: %v", err)
+	}
+	return path
+}
+
+func TestGetConfigReturnsConfigAndRegistries(t *testing.T) {
+	path := useTempConfig(t, testConfigTOML)
+
+	h := &RPCHandler{}
+	reply := &GetConfigReply{}
+	if err := h.GetConfig(&GetConfigArgs{}, reply); err != nil {
+		t.Fatalf("GetConfig() error = %v", err)
+	}
+
+	if !reply.Okay {
+		t.Errorf("expected okay, got message %q", reply.Message)
+	}
+	if reply.Path != path {
+		t.Errorf("expected config path %q, got %q", path, reply.Path)
+	}
+	if len(reply.Config.Workflows) != 1 || reply.Config.Workflows[0].Name != "My Open PRs" {
+		t.Errorf("unexpected workflows in reply: %+v", reply.Config.Workflows)
+	}
+	if reply.Config.SleepDuration != 5 {
+		t.Errorf("expected SleepDuration in minutes, got %d", reply.Config.SleepDuration)
+	}
+	if len(reply.WorkflowTypes) == 0 || len(reply.Filters) == 0 {
+		t.Error("expected the workflow type and filter registries to be included for client pickers")
+	}
+}
+
+func TestUpdateConfigSavesValidWorkflows(t *testing.T) {
+	path := useTempConfig(t, testConfigTOML)
+
+	h := &RPCHandler{}
+	newWorkflows := []config.RawWorkflow{
+		{
+			WorkflowType: "SyncReviewRequestsWorkflow",
+			Name:         "  My Open PRs  ", // whitespace should be trimmed away
+			SectionTitle: "My PRs",
+			Filters:      []string{"FilterNotDraft"},
+		},
+		{
+			WorkflowType: "SyncReviewRequestsWorkflow",
+			Name:         "Team Reviews",
+			SectionTitle: "Needs Review",
+			Filters:      []string{"FilterByLabel:bug"},
+			Teams:        []string{"my-team"},
+		},
+	}
+	reply := &UpdateConfigReply{}
+	if err := h.UpdateConfig(&UpdateConfigArgs{Workflows: &newWorkflows}, reply); err != nil {
+		t.Fatalf("UpdateConfig() error = %v", err)
+	}
+
+	if !reply.Okay {
+		t.Fatalf("expected the update to be accepted, got %v", reply.Errors)
+	}
+	if len(reply.Config.Workflows) != 2 {
+		t.Fatalf("expected 2 workflows in the reply, got %+v", reply.Config.Workflows)
+	}
+	if reply.Config.Workflows[0].Name != "My Open PRs" {
+		t.Errorf("expected the workflow name to be trimmed, got %q", reply.Config.Workflows[0].Name)
+	}
+	if config.C().RawWorkflows[1].Name != "Team Reviews" {
+		t.Errorf("expected the running config to be reloaded, got %+v", config.C().RawWorkflows)
+	}
+
+	written, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read written config: %v", err)
+	}
+	if !strings.Contains(string(written), "Team Reviews") {
+		t.Errorf("expected the new workflow on disk, got:\n%s", written)
+	}
+	if !strings.Contains(string(written), `Repos = ['owner/repo']`) {
+		t.Errorf("expected untouched settings to survive, got:\n%s", written)
+	}
+}
+
+func TestUpdateConfigRejectsInvalidWorkflows(t *testing.T) {
+	path := useTempConfig(t, testConfigTOML)
+
+	h := &RPCHandler{}
+	bad := []config.RawWorkflow{{
+		WorkflowType: "NotAWorkflow",
+		Name:         "Broken",
+		SectionTitle: "",
+		Filters:      []string{"FilterByAuthor"},
+	}}
+	reply := &UpdateConfigReply{}
+	if err := h.UpdateConfig(&UpdateConfigArgs{Workflows: &bad}, reply); err != nil {
+		t.Fatalf("a rejected update should not be an RPC error, got %v", err)
+	}
+
+	if reply.Okay {
+		t.Fatal("expected the update to be rejected")
+	}
+	fields := map[string]bool{}
+	for _, e := range reply.Errors {
+		fields[e.Field] = true
+		if e.Workflow != 0 {
+			t.Errorf("expected problems to point at workflow 0, got %d", e.Workflow)
+		}
+	}
+	for _, want := range []string{"SectionTitle", "WorkflowType", "Filters"} {
+		if !fields[want] {
+			t.Errorf("expected a %s problem, got %v", want, reply.Errors)
+		}
+	}
+	if reply.Message == "" {
+		t.Error("expected a summary message explaining the rejection")
+	}
+
+	after, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read config: %v", err)
+	}
+	if string(after) != testConfigTOML {
+		t.Errorf("a rejected update must leave the file alone, got:\n%s", after)
+	}
+	// The reply should still describe the configuration that is actually live.
+	if len(reply.Config.Workflows) != 1 || reply.Config.Workflows[0].Name != "My Open PRs" {
+		t.Errorf("expected the unchanged config in the reply, got %+v", reply.Config.Workflows)
+	}
+}
+
+func TestGetConfigReportsAnUnparsableFile(t *testing.T) {
+	path := useTempConfig(t, testConfigTOML)
+	if err := os.WriteFile(path, []byte("this is not = = toml"), 0o644); err != nil {
+		t.Fatalf("failed to corrupt the test config: %v", err)
+	}
+
+	h := &RPCHandler{}
+	reply := &GetConfigReply{}
+	if err := h.GetConfig(&GetConfigArgs{}, reply); err != nil {
+		t.Fatalf("GetConfig() error = %v", err)
+	}
+
+	if reply.Okay {
+		t.Error("expected okay=false when the file on disk no longer parses")
+	}
+	if reply.Message == "" {
+		t.Error("expected a message explaining why the file couldn't be read")
+	}
+	// The running configuration is still meaningful and should come back.
+	if len(reply.Config.Workflows) != 1 {
+		t.Errorf("expected the in-memory config in the reply, got %+v", reply.Config.Workflows)
+	}
+}
+
+func TestUpdateConfigWithNoFieldsIsANoOp(t *testing.T) {
+	path := useTempConfig(t, testConfigTOML)
+
+	h := &RPCHandler{}
+	reply := &UpdateConfigReply{}
+	if err := h.UpdateConfig(&UpdateConfigArgs{}, reply); err != nil {
+		t.Fatalf("UpdateConfig() error = %v", err)
+	}
+	if !reply.Okay {
+		t.Errorf("an empty update should succeed, got %v", reply.Errors)
+	}
+	after, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("failed to read config: %v", err)
+	}
+	if string(after) != testConfigTOML {
+		t.Errorf("an empty update must not rewrite the file, got:\n%s", after)
+	}
+}
+
+func TestUpdateConfigUpdatesGlobalSettings(t *testing.T) {
+	useTempConfig(t, testConfigTOML)
+
+	h := &RPCHandler{}
+	sleep := 15
+	notify := true
+	username := "octocat"
+	repos := []string{" owner/repo ", "", "other/repo"}
+	reply := &UpdateConfigReply{}
+	args := &UpdateConfigArgs{
+		SleepDuration:        &sleep,
+		DesktopNotifications: &notify,
+		GithubUsername:       &username,
+		Repos:                &repos,
+	}
+	if err := h.UpdateConfig(args, reply); err != nil {
+		t.Fatalf("UpdateConfig() error = %v", err)
+	}
+	if !reply.Okay {
+		t.Fatalf("expected the update to be accepted, got %v", reply.Errors)
+	}
+	if reply.Config.SleepDuration != 15 || !reply.Config.DesktopNotifications || reply.Config.GithubUsername != "octocat" {
+		t.Errorf("global settings not applied: %+v", reply.Config)
+	}
+	if len(reply.Config.Repos) != 2 || reply.Config.Repos[0] != "owner/repo" {
+		t.Errorf("expected blank repo entries dropped and the rest trimmed, got %v", reply.Config.Repos)
+	}
+	// Workflows weren't part of the update, so they must survive untouched.
+	if len(reply.Config.Workflows) != 1 {
+		t.Errorf("expected the existing workflow to survive, got %+v", reply.Config.Workflows)
+	}
+}
diff --git a/server/server.go b/server/server.go
index 173a4d5..1ae9cc0 100644
--- a/server/server.go
+++ b/server/server.go
@@ -7,6 +7,7 @@ import (
 	"crs/git_tools"
 	"crs/llm"
 	"crs/utils"
+	"crs/workflows"
 	"encoding/json"
 	"fmt"
 	"log/slog"
@@ -678,6 +679,253 @@ func (h *RPCHandler) ListPlugins(args *ListPluginsArgs, reply *ListPluginsReply)
 	return nil
 }
 
+// --- Configuration ---
+//
+// Clients read and edit the server's TOML config (~/.config/codereviewserver.toml)
+// through GetConfig and UpdateConfig. GetConfig also hands back the workflow
+// type and filter registries so a client can build its pickers from what this
+// server actually supports rather than hard-coding them.
+
+// ConfigView is the client-facing view of the configuration file. SleepDuration
+// is expressed in minutes, matching the TOML field rather than the
+// time.Duration the server keeps in memory.
+type ConfigView struct {
+	Repos                       []string             `json:"Repos"`
+	SleepDuration               int                  `json:"SleepDuration"`
+	JiraDomain                  string               `json:"JiraDomain"`
+	GithubUsername              string               `json:"GithubUsername"`
+	RepoLocation                string               `json:"RepoLocation"`
+	AutoWorktree                bool                 `json:"AutoWorktree"`
+	DesktopNotifications        bool                 `json:"DesktopNotifications"`
+	SectionPriority             map[string]int       `json:"SectionPriority"`
+	SectionSorting              map[string]string    `json:"SectionSorting"`
+	Workflows                   []config.RawWorkflow `json:"Workflows"`
+	Plugins                     []config.Plugin      `json:"Plugins"`
+	ExperimentalLLMFileOrdering bool                 `json:"ExperimentalLLMFileOrdering"`
+	ExperimentalLLMReviewEase   bool                 `json:"ExperimentalLLMReviewEase"`
+}
+
+// newConfigView builds the view from a loaded config, normalizing nil maps and
+// slices to empty ones so JSON clients always see {} / [] instead of null.
+func newConfigView(cfg config.Config) ConfigView {
+	view := ConfigView{
+		Repos:                       cfg.Repos,
+		SleepDuration:               int(cfg.SleepDuration.Minutes()),
+		JiraDomain:                  cfg.JiraDomain,
+		GithubUsername:              cfg.GithubUsername,
+		RepoLocation:                cfg.RepoLocation,
+		AutoWorktree:                cfg.AutoWorktree,
+		DesktopNotifications:        cfg.DesktopNotifications,
+		SectionPriority:             cfg.SectionPriority,
+		SectionSorting:              cfg.SectionSorting,
+		Workflows:                   cfg.RawWorkflows,
+		Plugins:                     cfg.Plugins,
+		ExperimentalLLMFileOrdering: cfg.ExperimentalLLMFileOrdering,
+		ExperimentalLLMReviewEase:   cfg.ExperimentalLLMReviewEase,
+	}
+	if view.Repos == nil {
+		view.Repos = []string{}
+	}
+	if view.SectionPriority == nil {
+		view.SectionPriority = map[string]int{}
+	}
+	if view.SectionSorting == nil {
+		view.SectionSorting = map[string]string{}
+	}
+	if view.Workflows == nil {
+		view.Workflows = []config.RawWorkflow{}
+	}
+	if view.Plugins == nil {
+		view.Plugins = []config.Plugin{}
+	}
+	return view
+}
+
+// ConfigPayload is the shared body of the config replies, so GetConfig and
+// UpdateConfig hand back the same shape and a client can render either one.
+type ConfigPayload struct {
+	Okay          bool                         `json:"okay"`
+	Message       string                       `json:"message"`
+	Path          string                       `json:"path"`
+	Config        ConfigView                   `json:"config"`
+	WorkflowTypes []workflows.WorkflowTypeInfo `json:"workflow_types"`
+	Filters       []workflows.FilterInfo       `json:"filters"`
+}
+
+func (p *ConfigPayload) populate(cfg config.Config) {
+	p.Okay = true
+	p.Config = newConfigView(cfg)
+	p.WorkflowTypes = workflows.WorkflowTypes()
+	p.Filters = workflows.FilterTypes()
+
+	path, err := config.ConfigPath()
+	if err != nil {
+		slog.Error("Error resolving config path", "error", err)
+	}
+	p.Path = path
+}
+
+type GetConfigArgs struct{}
+type GetConfigReply struct {
+	ConfigPayload
+}
+
+// GetConfig returns the current configuration, re-read from disk so clients
+// see edits made outside the server.
+func (h *RPCHandler) GetConfig(args *GetConfigArgs, reply *GetConfigReply) error {
+	reloadErr := config.Reload()
+	if reloadErr != nil {
+		// A config file that no longer parses shouldn't hide the running
+		// configuration; report the problem and return what's in memory.
+		slog.Error("Error reloading config", "error", reloadErr)
+	}
+	reply.populate(config.C())
+	if reloadErr != nil {
+		reply.Okay = false
+		reply.Message = fmt.Sprintf("Showing the configuration currently in memory; reloading from disk failed: %v", reloadErr)
+	}
+	return nil
+}
+
+// UpdateConfigArgs is a partial update: every field is optional and a field
+// left out (null) keeps whatever is on disk. Sending Workflows replaces the
+// whole list, which is how a client removes or reorders entries.
+type UpdateConfigArgs struct {
+	Repos                       *[]string             `json:"Repos"`
+	SleepDuration               *int                  `json:"SleepDuration"`
+	JiraDomain                  *string               `json:"JiraDomain"`
+	GithubUsername              *string               `json:"GithubUsername"`
+	RepoLocation                *string               `json:"RepoLocation"`
+	AutoWorktree                *bool                 `json:"AutoWorktree"`
+	DesktopNotifications        *bool                 `json:"DesktopNotifications"`
+	SectionPriority             *map[string]int       `json:"SectionPriority"`
+	SectionSorting              *map[string]string    `json:"SectionSorting"`
+	Workflows                   *[]config.RawWorkflow `json:"Workflows"`
+	ExperimentalLLMFileOrdering *bool                 `json:"ExperimentalLLMFileOrdering"`
+	ExperimentalLLMReviewEase   *bool                 `json:"ExperimentalLLMReviewEase"`
+}
+
+// UpdateConfigReply carries the same body as GetConfig plus any validation
+// problems. A rejected update is reported as okay=false with a populated
+// errors list — not as an RPC error — so clients can attach each message to the
+// field that caused it. The config in the reply is then the unchanged one still
+// on disk.
+type UpdateConfigReply struct {
+	ConfigPayload
+	Errors []config.ValidationError `json:"errors"`
+}
+
+// UpdateConfig validates a partial change against the configuration it would
+// produce, writes the merged TOML file (keeping the previous contents in
+// <path>.bak), and reloads the running config. Settings and keys the update
+// doesn't mention are preserved; comments in the file are not.
+//
+// Nothing is written unless validation passes. The background workflow manager
+// re-derives its workflows from the config at the top of each cycle, so a saved
+// change takes effect on the next sync.
+func (h *RPCHandler) UpdateConfig(args *UpdateConfigArgs, reply *UpdateConfigReply) error {
+	reply.Errors = []config.ValidationError{}
+
+	update := config.Update{
+		Repos:                       normalizeRepos(args.Repos),
+		SleepDuration:               args.SleepDuration,
+		JiraDomain:                  args.JiraDomain,
+		GithubUsername:              args.GithubUsername,
+		RepoLocation:                args.RepoLocation,
+		AutoWorktree:                args.AutoWorktree,
+		DesktopNotifications:        args.DesktopNotifications,
+		SectionPriority:             args.SectionPriority,
+		SectionSorting:              args.SectionSorting,
+		Workflows:                   normalizeWorkflows(args.Workflows),
+		ExperimentalLLMFileOrdering: args.ExperimentalLLMFileOrdering,
+		ExperimentalLLMReviewEase:   args.ExperimentalLLMReviewEase,
+	}
+
+	if update.IsEmpty() {
+		reply.populate(config.C())
+		reply.Message = "No changes requested"
+		return nil
+	}
+
+	problems, err := config.Apply(update, validateConfig)
+	if err != nil {
+		slog.Error("Error applying config update", "error", err)
+		return err
+	}
+
+	reply.populate(config.C())
+	if len(problems) > 0 {
+		reply.Okay = false
+		reply.Errors = problems
+		reply.Message = fmt.Sprintf("Configuration not saved: found %s", pluralize(len(problems), "problem", "problems"))
+		return nil
+	}
+	reply.Message = fmt.Sprintf("Configuration saved to %s", reply.Path)
+	return nil
+}
+
+// validateConfig runs both halves of validation: the root-level and
+// always-required workflow fields owned by the config package, plus the
+// workflow types and filters owned by the workflows package.
+func validateConfig(cfg *config.Config) []config.ValidationError {
+	problems := config.Validate(cfg)
+	return append(problems, workflows.ValidateWorkflows(cfg.RawWorkflows, cfg.Repos)...)
+}
+
+func pluralize(n int, singular, plural string) string {
+	if n == 1 {
+		return fmt.Sprintf("%d %s", n, singular)
+	}
+	return fmt.Sprintf("%d %s", n, plural)
+}
+
+// normalizeRepos trims each entry and drops the blank ones, so a trailing empty
+// line in a client's textarea doesn't become a validation error.
+func normalizeRepos(repos *[]string) *[]string {
+	if repos == nil {
+		return nil
+	}
+	cleaned := trimList(*repos)
+	return &cleaned
+}
+
+// normalizeWorkflows trims the string fields of each submitted workflow. Values
+// arrive from text inputs, and a stray space in a section title would otherwise
+// create a section distinct from the one the user meant.
+func normalizeWorkflows(wfs *[]config.RawWorkflow) *[]config.RawWorkflow {
+	if wfs == nil {
+		return nil
+	}
+	cleaned := make([]config.RawWorkflow, 0, len(*wfs))
+	for _, wf := range *wfs {
+		wf.WorkflowType = strings.TrimSpace(wf.WorkflowType)
+		wf.Name = strings.TrimSpace(wf.Name)
+		wf.Owner = strings.TrimSpace(wf.Owner)
+		wf.Repo = strings.TrimSpace(wf.Repo)
+		wf.JiraEpic = strings.TrimSpace(wf.JiraEpic)
+		wf.SectionTitle = strings.TrimSpace(wf.SectionTitle)
+		wf.PRState = strings.TrimSpace(wf.PRState)
+		wf.GithubUsername = strings.TrimSpace(wf.GithubUsername)
+		wf.Repos = trimList(wf.Repos)
+		wf.Filters = trimList(wf.Filters)
+		wf.Teams = trimList(wf.Teams)
+		cleaned = append(cleaned, wf)
+	}
+	return &cleaned
+}
+
+// trimList trims every entry of a string list and drops the ones left empty.
+// Returns nil for an all-empty list so the field is omitted from the TOML file.
+func trimList(values []string) []string {
+	var cleaned []string
+	for _, v := range values {
+		if trimmed := strings.TrimSpace(v); trimmed != "" {
+			cleaned = append(cleaned, trimmed)
+		}
+	}
+	return cleaned
+}
+
 type GetRateLimitStatusArgs struct{}
 type GetRateLimitStatusReply struct {
 	Remaining        int    `json:"remaining"`
diff --git a/workflows/validate.go b/workflows/validate.go
new file mode 100644
index 0000000..bfa3201
--- /dev/null
+++ b/workflows/validate.go
@@ -0,0 +1,250 @@
+package workflows
+
+import (
+	"crs/config"
+	"crs/git_tools"
+	"fmt"
+	"strings"
+)
+
+// WorkflowTypeInfo describes a workflow type so clients can offer it in a
+// picker without hard-coding the list. RequiredFields and OptionalFields are
+// the type-specific fields; Name, WorkflowType and SectionTitle are required by
+// every type and are left out.
+type WorkflowTypeInfo struct {
+	Name           string   `json:"name"`
+	Description    string   `json:"description"`
+	Deprecated     bool     `json:"deprecated"`
+	DeprecatedBy   string   `json:"deprecated_by,omitempty"`
+	RequiredFields []string `json:"required_fields"`
+	OptionalFields []string `json:"optional_fields"`
+}
+
+// workflowTypes is the registry backing MatchWorkflows' type switch. Keep the
+// two in sync: a type listed here must build, and a buildable type belongs
+// here so clients can offer it.
+var workflowTypes = []WorkflowTypeInfo{
+	{
+		Name:           "SyncReviewRequestsWorkflow",
+		Description:    "Sync pull requests from the configured repositories into a section, narrowed by filters.",
+		RequiredFields: []string{},
+		OptionalFields: []string{"Repos", "Filters", "Teams", "PRState", "IncludeDiff", "DesktopNotifications"},
+	},
+	{
+		Name:           "SingleRepoSyncReviewRequestsWorkflow",
+		Description:    "Sync pull requests from a single repository.",
+		Deprecated:     true,
+		DeprecatedBy:   "SyncReviewRequestsWorkflow with a single-element Repos list",
+		RequiredFields: []string{"Repo"},
+		OptionalFields: []string{"Filters", "Teams", "IncludeDiff", "DesktopNotifications"},
+	},
+	{
+		Name:           "ListMyPRsWorkflow",
+		Description:    "Sync pull requests you authored.",
+		Deprecated:     true,
+		DeprecatedBy:   "SyncReviewRequestsWorkflow with FilterMyPRs in Filters",
+		RequiredFields: []string{},
+		OptionalFields: []string{"Repos", "Filters", "PRState", "IncludeDiff", "DesktopNotifications"},
+	},
+	{
+		Name:           "ProjectListWorkflow",
+		Description:    "Sync the pull requests linked to the children of a Jira epic. Requires JiraDomain plus the JIRA_API_TOKEN and JIRA_API_EMAIL environment variables.",
+		RequiredFields: []string{"JiraEpic"},
+		OptionalFields: []string{"Repos", "Filters", "IncludeDiff", "DesktopNotifications"},
+	},
+}
+
+// WorkflowTypes returns the workflow types a config may use.
+func WorkflowTypes() []WorkflowTypeInfo {
+	out := make([]WorkflowTypeInfo, len(workflowTypes))
+	copy(out, workflowTypes)
+	return out
+}
+
+// IsKnownWorkflowType reports whether MatchWorkflows can build the named type.
+func IsKnownWorkflowType(name string) bool {
+	for _, wt := range workflowTypes {
+		if wt.Name == name {
+			return true
+		}
+	}
+	return false
+}
+
+// FilterInfo describes a filter clients can offer in a picker. Filters that
+// take an argument are written as "FilterName:argument" in the config.
+type FilterInfo struct {
+	Name        string `json:"name"`
+	Description string `json:"description"`
+	RequiresArg bool   `json:"requires_arg"`
+	ArgLabel    string `json:"arg_label,omitempty"`
+}
+
+// filterTypes describes every filter BuildFiltersList accepts. The no-argument
+// entries mirror filter_func_map; the three argument-taking filters are handled
+// explicitly in BuildFiltersList and have no entry there.
+var filterTypes = []FilterInfo{
+	{Name: "FilterMyReviewRequested", Description: "PRs where you are personally requested as a reviewer"},
+	{Name: "FilterNotDraft", Description: "Exclude draft PRs"},
+	{Name: "FilterIsDraft", Description: "Only include draft PRs"},
+	{Name: "FilterNotMyPRs", Description: "Exclude PRs you authored"},
+	{Name: "FilterMyPRs", Description: "Only include PRs you authored"},
+	{Name: "FilterCIPassing", Description: "Only include PRs with passing CI"},
+	{Name: "FilterCIFailing", Description: "Only include PRs with failing CI"},
+	{Name: "FilterStale", Description: "PRs with no activity for more than 3 days"},
+	{Name: "FilterNotStale", Description: "PRs with activity within the last 3 days"},
+	{Name: "FilterWaitingOnMe", Description: "PRs where you are a requested reviewer and need to act"},
+	{Name: "FilterWaitingOnAuthor", Description: "PRs where you acted last and are waiting on the author"},
+	{Name: "FilterByLabel", Description: "Only include PRs carrying a label", RequiresArg: true, ArgLabel: "label"},
+	{Name: "FilterByAuthor", Description: "Only include PRs authored by a user", RequiresArg: true, ArgLabel: "username"},
+	{Name: "FilterExcludeAuthor", Description: "Exclude PRs authored by a user", RequiresArg: true, ArgLabel: "username"},
+}
+
+// FilterTypes returns the filters a workflow may use.
+func FilterTypes() []FilterInfo {
+	out := make([]FilterInfo, len(filterTypes))
+	copy(out, filterTypes)
+	return out
+}
+
+// lookupFilter finds a filter by name.
+func lookupFilter(name string) (FilterInfo, bool) {
+	for _, f := range filterTypes {
+		if f.Name == name {
+			return f, true
+		}
+	}
+	return FilterInfo{}, false
+}
+
+// validPRStates are the values PRState may take; it is passed straight through
+// to the GitHub list-pull-requests API.
+var validPRStates = map[string]bool{"open": true, "closed": true, "all": true}
+
+// ValidateWorkflows checks each workflow against the registries this package
+// owns: the workflow types MatchWorkflows can build and the filters
+// BuildFiltersList accepts. globalRepos is the root-level Repos list, which
+// workflows inherit when they don't define their own.
+//
+// It complements config.Validate, which covers the fields (Name, SectionTitle,
+// …) that every workflow needs regardless of type.
+func ValidateWorkflows(raws []config.RawWorkflow, globalRepos []string) []config.ValidationError {
+	problems := []config.ValidationError{}
+
+	for i, raw := range raws {
+		if raw.WorkflowType != "" && !IsKnownWorkflowType(raw.WorkflowType) {
+			problems = append(problems, config.ValidationError{
+				Workflow: i,
+				Field:    "WorkflowType",
+				Message:  fmt.Sprintf("unknown workflow type %q (expected one of: %s)", raw.WorkflowType, strings.Join(workflowTypeNames(), ", ")),
+			})
+		}
+
+		problems = append(problems, validateFilters(i, raw.Filters)...)
+
+		for j, repo := range raw.Repos {
+			if _, _, err := git_tools.ParseRepoName(strings.TrimSpace(repo)); err != nil {
+				problems = append(problems, config.ValidationError{
+					Workflow: i, Field: "Repos",
+					Message: fmt.Sprintf("entry %d: %q is not in \"owner/repo\" form", j, repo),
+				})
+			}
+		}
+
+		if raw.PRState != "" && !validPRStates[raw.PRState] {
+			problems = append(problems, config.ValidationError{
+				Workflow: i, Field: "PRState",
+				Message: fmt.Sprintf("unknown state %q (expected \"open\", \"closed\", or \"all\")", raw.PRState),
+			})
+		}
+
+		for j, team := range raw.Teams {
+			if strings.TrimSpace(team) == "" {
+				problems = append(problems, config.ValidationError{
+					Workflow: i, Field: "Teams",
+					Message: fmt.Sprintf("entry %d is empty", j),
+				})
+			}
+		}
+
+		problems = append(problems, validateTypeSpecific(i, raw, globalRepos)...)
+	}
+
+	return problems
+}
+
+// validateFilters checks each configured filter string against the registry,
+// including the "FilterName:argument" form.
+func validateFilters(index int, filters []string) []config.ValidationError {
+	problems := []config.ValidationError{}
+	for _, entry := range filters {
+		name, arg := ParseFilterString(strings.TrimSpace(entry))
+		info, known := lookupFilter(name)
+		if !known {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "Filters",
+				Message: fmt.Sprintf("unknown filter %q", name),
+			})
+			continue
+		}
+		if info.RequiresArg && strings.TrimSpace(arg) == "" {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "Filters",
+				Message: fmt.Sprintf("%s requires an argument (e.g. %s:<%s>)", name, name, info.ArgLabel),
+			})
+		}
+		if !info.RequiresArg && arg != "" {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "Filters",
+				Message: fmt.Sprintf("%s does not take an argument, got %q", name, arg),
+			})
+		}
+	}
+	return problems
+}
+
+// validateTypeSpecific checks the fields a particular workflow type needs.
+func validateTypeSpecific(index int, raw config.RawWorkflow, globalRepos []string) []config.ValidationError {
+	problems := []config.ValidationError{}
+
+	switch raw.WorkflowType {
+	case "SingleRepoSyncReviewRequestsWorkflow":
+		if _, _, err := git_tools.ParseRepoName(strings.TrimSpace(raw.Repo)); err != nil {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "Repo",
+				Message: "is required and must be in \"owner/repo\" form",
+			})
+		}
+	case "ProjectListWorkflow":
+		if strings.TrimSpace(raw.JiraEpic) == "" {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "JiraEpic",
+				Message: "is required (the Jira epic key, e.g. BOARD-123)",
+			})
+		}
+		if len(raw.Repos) == 0 && len(globalRepos) == 0 && (raw.Owner == "" || raw.Repo == "") {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "Repos",
+				Message: "is required when no root-level Repos list is configured",
+			})
+		}
+	case "SyncReviewRequestsWorkflow", "ListMyPRsWorkflow":
+		if len(raw.Repos) == 0 && len(globalRepos) == 0 {
+			problems = append(problems, config.ValidationError{
+				Workflow: index, Field: "Repos",
+				Message: "is required when no root-level Repos list is configured",
+			})
+		}
+	}
+
+	return problems
+}
+
+// workflowTypeNames lists the registered type names, for error messages.
+func workflowTypeNames() []string {
+	names := make([]string, 0, len(workflowTypes))
+	for _, wt := range workflowTypes {
+		names = append(names, wt.Name)
+	}
+	return names
+}
diff --git a/workflows/validate_test.go b/workflows/validate_test.go
new file mode 100644
index 0000000..693a613
--- /dev/null
+++ b/workflows/validate_test.go
@@ -0,0 +1,176 @@
+package workflows
+
+import (
+	"crs/config"
+	"strings"
+	"testing"
+)
+
+// TestFilterRegistryCoversFilterFuncMap guards the two lists from drifting: a
+// filter that BuildFiltersList accepts but FilterTypes doesn't list would be
+// rejected by ValidateWorkflows even though the workflow runs fine.
+func TestFilterRegistryCoversFilterFuncMap(t *testing.T) {
+	for name := range filter_func_map {
+		info, ok := lookupFilter(name)
+		if !ok {
+			t.Errorf("filter %q is buildable but missing from the filter registry", name)
+			continue
+		}
+		if info.RequiresArg {
+			t.Errorf("filter %q takes no argument in filter_func_map but the registry says it requires one", name)
+		}
+	}
+}
+
+// TestArgumentFiltersAreBuildable checks the other direction for the filters
+// BuildFiltersList special-cases: each one must build when given an argument.
+func TestArgumentFiltersAreBuildable(t *testing.T) {
+	for _, info := range FilterTypes() {
+		if !info.RequiresArg {
+			continue
+		}
+		raw := config.RawWorkflow{Name: "test", Filters: []string{info.Name + ":value"}}
+		filters, err := BuildFiltersList(&raw)
+		if err != nil {
+			t.Errorf("filter %q is in the registry but failed to build: %v", info.Name, err)
+			continue
+		}
+		if len(filters) != 1 {
+			t.Errorf("expected filter %q to build one filter, got %d", info.Name, len(filters))
+		}
+	}
+}
+
+// TestRegisteredWorkflowTypesAreBuildable keeps the type registry in sync with
+// the switch in MatchWorkflows.
+func TestRegisteredWorkflowTypesAreBuildable(t *testing.T) {
+	repos := []string{"owner/repo"}
+	for _, wt := range WorkflowTypes() {
+		raw := config.RawWorkflow{
+			WorkflowType: wt.Name,
+			Name:         "test",
+			SectionTitle: "Section",
+		}
+		// Fill in whatever the type declares it needs.
+		for _, field := range wt.RequiredFields {
+			switch field {
+			case "Repo":
+				raw.Repo = "owner/repo"
+			case "JiraEpic":
+				raw.JiraEpic = "BOARD-1"
+			}
+		}
+		built := MatchWorkflows([]config.RawWorkflow{raw}, &repos, "jira.example.com")
+		if len(built) != 1 {
+			t.Errorf("workflow type %q is registered but MatchWorkflows built %d workflows", wt.Name, len(built))
+		}
+	}
+}
+
+func TestValidateWorkflowsAcceptsAWorkingWorkflow(t *testing.T) {
+	raws := []config.RawWorkflow{{
+		WorkflowType: "SyncReviewRequestsWorkflow",
+		Name:         "My Open PRs",
+		SectionTitle: "My PRs",
+		Filters:      []string{"FilterNotDraft", "FilterByLabel:bug"},
+		Repos:        []string{"owner/repo"},
+		PRState:      "open",
+	}}
+	if problems := ValidateWorkflows(raws, nil); len(problems) != 0 {
+		t.Errorf("expected no problems, got %v", problems)
+	}
+}
+
+func TestValidateWorkflows(t *testing.T) {
+	tests := []struct {
+		name        string
+		raw         config.RawWorkflow
+		globalRepos []string
+		wantField   string
+		wantMessage string // substring
+	}{
+		{
+			name:        "unknown workflow type",
+			raw:         config.RawWorkflow{WorkflowType: "MagicWorkflow", Name: "w", SectionTitle: "s"},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "WorkflowType",
+			wantMessage: "unknown workflow type",
+		},
+		{
+			name:        "unknown filter",
+			raw:         config.RawWorkflow{WorkflowType: "SyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s", Filters: []string{"FilterNope"}},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "Filters",
+			wantMessage: "unknown filter",
+		},
+		{
+			name:        "filter missing its argument",
+			raw:         config.RawWorkflow{WorkflowType: "SyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s", Filters: []string{"FilterByLabel"}},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "Filters",
+			wantMessage: "requires an argument",
+		},
+		{
+			name:        "argument on a filter that takes none",
+			raw:         config.RawWorkflow{WorkflowType: "SyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s", Filters: []string{"FilterNotDraft:yes"}},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "Filters",
+			wantMessage: "does not take an argument",
+		},
+		{
+			name:        "malformed workflow repo",
+			raw:         config.RawWorkflow{WorkflowType: "SyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s", Repos: []string{"repo"}},
+			wantField:   "Repos",
+			wantMessage: "owner/repo",
+		},
+		{
+			name:      "no repos anywhere",
+			raw:       config.RawWorkflow{WorkflowType: "SyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s"},
+			wantField: "Repos",
+			// falls back to the root-level list, which is empty here
+			wantMessage: "root-level Repos",
+		},
+		{
+			name:        "unknown PR state",
+			raw:         config.RawWorkflow{WorkflowType: "SyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s", PRState: "merged"},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "PRState",
+			wantMessage: "unknown state",
+		},
+		{
+			name:        "project list without an epic",
+			raw:         config.RawWorkflow{WorkflowType: "ProjectListWorkflow", Name: "w", SectionTitle: "s"},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "JiraEpic",
+			wantMessage: "required",
+		},
+		{
+			name:        "single repo workflow without a repo",
+			raw:         config.RawWorkflow{WorkflowType: "SingleRepoSyncReviewRequestsWorkflow", Name: "w", SectionTitle: "s"},
+			globalRepos: []string{"owner/repo"},
+			wantField:   "Repo",
+			wantMessage: "owner/repo",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			problems := ValidateWorkflows([]config.RawWorkflow{tt.raw}, tt.globalRepos)
+			if len(problems) == 0 {
+				t.Fatalf("expected a validation problem, got none")
+			}
+			found := false
+			for _, p := range problems {
+				if p.Workflow != 0 {
+					t.Errorf("expected the problem to point at workflow 0, got %d", p.Workflow)
+				}
+				if p.Field == tt.wantField && strings.Contains(p.Message, tt.wantMessage) {
+					found = true
+				}
+			}
+			if !found {
+				t.Errorf("expected a %s problem mentioning %q, got %v", tt.wantField, tt.wantMessage, problems)
+			}
+		})
+	}
+}