diff --git a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
index 58329fac6c..6aa8847c11 100644
--- a/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
+++ b/frontend/src/lib/components/raw_apps/RawAppEditorHeader.svelte
@@ -74,6 +74,7 @@
 	import type { RawAppData } from './dataTableRefUtils'
 	import { editInForkAllowed, editInForkLabel, openEditInFork } from '$lib/utils/editInFork'
 	import { isCloudHosted } from '$lib/cloud'
+	import { policyForDeploy } from '$lib/components/apps/editor/appPolicy'
 
 	// async function hash(message) {
 	// 	try {
@@ -314,7 +315,7 @@
 						value: app,
 						path,
 						summary: summary,
-						policy,
+						policy: policyForDeploy(policy),
 						deployment_message: deploymentMsg,
 						custom_path: customPath,
 						preserve_on_behalf_of: preserveOnBehalfOf || undefined,
@@ -435,7 +436,7 @@
 				app: {
 					value: app!,
 					summary: summary,
-					policy,
+					policy: policyForDeploy(policy),
 					path: npath,
 					deployment_message: deploymentMsg,
 					preserve_on_behalf_of: preserveOnBehalfOf || undefined,
@@ -485,7 +486,7 @@
 		await AppService.updateApp({
 			workspace: opWorkspace!,
 			path: appPath,
-			requestBody: { policy }
+			requestBody: { policy: policyForDeploy(policy) }
 		})
 		if (message) {
 			sendUserToast(message)
diff --git a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
index 2a6a354e5a..7b69a1f07b 100644
--- a/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps_raw/edit/[...path]/+page.svelte
@@ -5,6 +5,7 @@
 	import { AppService } from '$lib/gen'
 	import { userStore, workspaceStore } from '$lib/stores'
 	import { readFieldsRecursively } from '$lib/utils'
+	import { policyForDeploy } from '$lib/components/apps/editor/appPolicy'
 	import { goto } from '$lib/navigation'
 	import { sendUserToast } from '$lib/toast'
 	import DiffDrawer from '$lib/components/DiffDrawer.svelte'
@@ -120,7 +121,10 @@
 			runnables,
 			data,
 			summary,
-			policy,
+			// Shaped on the way into the row, not just on the way to a deploy: the address is
+			// derived per read, and a copy persisted here is the one thing that outlives the
+			// sweeps that exist to keep it out of a draft.
+			policy: policyForDeploy(policy),
 			custom_path: savedApp?.custom_path,
 			// Persist the typed path as `draft_path` only when it actually differs
 			// from the current path — a `draft_path` equal to the baseline is a
@@ -406,7 +410,7 @@
 						runnables,
 						data,
 						summary,
-						policy,
+						policy: policyForDeploy(policy),
 						custom_path: savedApp?.custom_path,
 						...(pendingDraftPath ? { draft_path: pendingDraftPath } : {})
 					} as RawAppDraft,