diff --git a/deployment/cloud/vite.cloud.config.mjs b/deployment/cloud/vite.cloud.config.mjs
index 3a304120a..127d91b1c 100644
--- a/deployment/cloud/vite.cloud.config.mjs
+++ b/deployment/cloud/vite.cloud.config.mjs
@@ -45,7 +45,9 @@ const rudderStarting = {
 // - The backend's paths go to admin.mjs, whose gates decide: /cdn/ and /api-prod/api/ public, /pb/ records
 //   by PocketBase's own rules, and /pb/_/, _superusers and /admin/ for the admin password.
 // - GATED bundles (gatedProfiles, e.g. key-cities) must never reach a public surface. The Studio already leaves
-//   them out of its list; here their source and dev pages are refused too, so a typed URL can't load them.
+//   them out of its list; here their source and dev pages are refused too, so a typed URL can't load them. So is
+//   /__plugin-gallery/registry.json, the raw discovery list for smoke tools: it still names the gated bundles and
+//   their profiles, and the Studio itself reads only manifest.json.
 // - /__open-in-editor (Vite's own) would start an editor process on this server for a visitor: refused.
 const PUBLIC = env.DX_PUBLIC_STUDIO === '1'
 const publicGuard = {
@@ -58,7 +60,7 @@ const publicGuard = {
       let p = (req.url || '').split('?')[0]
       try { p = decodeURIComponent(p) } catch { /* keep it raw */ }
       const gated = GATED_PROFILES.some((g) => p.includes(`/plugin-designs/${g}/`) || p === `/__leaf/${g}` || p.startsWith(`/__leaf/${g}/`))
-      if (!gated && !p.startsWith('/__open-in-editor')) return next()
+      if (!gated && !p.startsWith('/__open-in-editor') && p !== '/__plugin-gallery/registry.json') return next()
       res.statusCode = 404
       res.setHeader('content-type', 'text/plain; charset=utf-8')
       res.end('not found\n')