diff --git a/frontend/src/lib/components/instanceSettings.ts b/frontend/src/lib/components/instanceSettings.ts
index 4acc11e758..ec46de0ddf 100644
--- a/frontend/src/lib/components/instanceSettings.ts
+++ b/frontend/src/lib/components/instanceSettings.ts
@@ -298,6 +298,15 @@ export const settings: Record<string, Setting[]> = {
 			ee_only: '',
 			hideInQuickSetup: true
 		},
+		{
+			label: 'Disable token in MCP URLs',
+			description:
+				'Reject the ?token= query parameter on the MCP endpoints, so MCP clients authenticate with an Authorization header or through the OAuth flow. A token in a URL is a credential that ends up in browser history, proxy logs and referrers. Existing MCP URLs carrying a token stop working. Servers and workers pick this up within a minute; dedicated MCP servers (MODE=mcp) apply it when they next restart.',
+			key: 'mcp_disable_token_query_param',
+			fieldType: 'boolean',
+			storage: 'setting',
+			hideInQuickSetup: true
+		},
 		{
 			label: 'Audit log retention (days)',
 			key: 'audit_log_retention_days',
@@ -686,14 +695,6 @@ export const settings: Record<string, Setting[]> = {
 			fieldType: 'boolean',
 			storage: 'setting'
 		},
-		{
-			label: 'Disable token in MCP URLs',
-			description:
-				'Reject the ?token= query parameter on the MCP endpoints, so MCP clients authenticate with an Authorization header or through the OAuth flow. A token in a URL is a credential that ends up in browser history, proxy logs and referrers. Existing MCP URLs carrying a token stop working. Servers and workers pick this up within a minute; dedicated MCP servers (MODE=mcp) apply it when they next restart.',
-			key: 'mcp_disable_token_query_param',
-			fieldType: 'boolean',
-			storage: 'setting'
-		},
 		{
 			label: 'Auto-login SSO provider',
 			description: