diff --git a/gateway/authz_mixin.py b/gateway/authz_mixin.py
index 86984913372..f84ca259ccb 100644
--- a/gateway/authz_mixin.py
+++ b/gateway/authz_mixin.py
@@ -47,10 +47,14 @@ class GatewayAuthorizationMixin:
         if not platform:
             return None
         profile_name = (profile or "").strip() or None
-        if profile_name:
+        if profile_name and profile_name != "default":
             profile_adapters = getattr(self, "_profile_adapters", None) or {}
             if profile_name in profile_adapters:
                 return profile_adapters[profile_name].get(platform)
+            # Fail closed: a stamped secondary profile with no registry entry
+            # (e.g. its adapter failed to connect) must NOT fall back to the
+            # default profile's adapter — that sends replies out the wrong bot.
+            return None
         adapters = getattr(self, "adapters", None) or {}
         return adapters.get(platform)
 
diff --git a/gateway/run.py b/gateway/run.py
index fd6f9d6a42f..51e33ceb499 100644
--- a/gateway/run.py
+++ b/gateway/run.py
@@ -8337,25 +8337,15 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 "'open'."
             )
 
-        # Secondary profiles must never bind ports — the default profile's
-        # listener serves every profile through /p/<profile>/. Force-disable
-        # any port-binding platform that _apply_env_overrides may have enabled.
-        for pb_platform in _PORT_BINDING_PLATFORM_VALUES:
-            try:
-                plat = Platform(pb_platform)
-            except ValueError:
-                continue
-            if plat in profile_cfg.platforms:
-                profile_cfg.platforms[plat].enabled = False
-
         profile_map = self._profile_adapters.setdefault(profile_name, {})
         connected = 0
         for platform, platform_config in profile_cfg.platforms.items():
             if not platform_config.enabled:
                 continue
-            # The default profile owns the single shared HTTP listener and
-            # serves every profile through the /p/<profile>/ URL prefix.
-            # A secondary profile must NOT enable a port-binding platform.
+            # A secondary profile must NOT enable a port-binding platform: the
+            # default profile's listener already serves every profile via the
+            # /p/<profile>/ prefix, so a second bind can only collide. This is a
+            # config error, not a transient failure — fail fast and loud.
             if platform.value in _PORT_BINDING_PLATFORM_VALUES:
                 raise MultiplexConfigError(
                     f"Profile '{profile_name}' enables the port-binding platform "