diff --git a/public/manifest.json b/public/manifest.json
index d94dc7fe3..922540d9d 100644
--- a/public/manifest.json
+++ b/public/manifest.json
@@ -40,7 +40,7 @@
     {
       "name": "Add measurement",
       "short_name": "Add",
-      "url": "/measurements?add=WEIGHT&source=shortcut",
+      "url": "/measurements?add=WEIGHT",
       "icons": [
         { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
       ]
@@ -48,15 +48,7 @@
     {
       "name": "Today",
       "short_name": "Today",
-      "url": "/?source=shortcut",
-      "icons": [
-        { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
-      ]
-    },
-    {
-      "name": "Medications",
-      "short_name": "Meds",
-      "url": "/medications?source=shortcut",
+      "url": "/",
       "icons": [
         { "src": "/logo-192.png", "sizes": "192x192", "type": "image/png" }
       ]
diff --git a/src/__tests__/sw-security-hardening.test.ts b/src/__tests__/sw-security-hardening.test.ts
index a587f28ce..71aae3668 100644
--- a/src/__tests__/sw-security-hardening.test.ts
+++ b/src/__tests__/sw-security-hardening.test.ts
@@ -2,6 +2,8 @@ import { describe, expect, it } from "vitest";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
+import { surfaceModule } from "@/lib/modules/surface";
+
 /**
  * F-7 (mobile security audit, 2026-05-16): three regressions to lock
  * in for `public/sw.js`.
@@ -107,3 +109,25 @@ describe("public/manifest.json PWA identity hygiene (F-7, 2026-05-16)", () => {
     expect(manifest.start_url).toBe("/");
   });
 });
+
+describe("public/manifest.json shortcuts", () => {
+  const manifest = JSON.parse(readFileSync(MANIFEST_PATH, "utf-8")) as {
+    shortcuts: Array<{ name: string; url: string }>;
+  };
+
+  it("open only pages no module can switch off", () => {
+    // The manifest is static: a shortcut into a module would open the
+    // "switched off" notice for everyone who turned that module off.
+    expect(manifest.shortcuts.length).toBeGreaterThan(0);
+    for (const { name, url } of manifest.shortcuts) {
+      const { pathname } = new URL(url, "https://app.example");
+      expect(surfaceModule(`nav:${pathname}`), name).toBeUndefined();
+    }
+  });
+
+  it("carry no query parameter the app does not read", () => {
+    for (const { name, url } of manifest.shortcuts) {
+      expect(url, name).not.toContain("source=");
+    }
+  });
+});