diff --git a/management-ui/src/pages/WAF/index.tsx b/management-ui/src/pages/WAF/index.tsx
index 63d2957..662eda2 100644
--- a/management-ui/src/pages/WAF/index.tsx
+++ b/management-ui/src/pages/WAF/index.tsx
@@ -1,6 +1,6 @@
 import { useState } from 'react'
 import {
-  Alert, Badge, Button, Card, Col, Drawer, Form, Input, Row,
+  Alert, Button, Card, Col, Drawer, Form, Input, Row,
   Select, Space, Switch, Tag, Tooltip, Typography, message,
 } from 'antd'
 import {
@@ -52,7 +52,7 @@ async function fetchWafConfigs(): Promise<WafConfig[]> {
 
 async function fetchWafConfig(domainId: number): Promise<WafConfig> {
   const r = await apiClient.get(`/waf/configs/${domainId}`)
-  if (isEnvelope(r.data)) return r.data.data.config as WafConfig
+  if (isEnvelope(r.data)) return (r.data.data as { config: WafConfig }).config
   return defaultConfig(domainId)
 }
 
@@ -68,6 +68,15 @@ function defaultConfig(domainId: number): WafConfig {
   }
 }
 
+interface WafFormValues {
+  enabled: boolean
+  mode: 'detection' | 'blocking'
+  paranoia_level: number
+  rule_exclusions_str: string
+  trusted_proxies_str: string
+  custom_rules: string
+}
+
 // ---------- Config Drawer ---------------------------------------------------
 
 interface ConfigDrawerProps {
@@ -80,7 +89,7 @@ function ConfigDrawer({ domainName, domainId, onClose }: ConfigDrawerProps) {
   const { t } = useTranslation()
   const qc = useQueryClient()
   const isViewer = useAuthStore((s) => s.user?.role) === 'viewer'
-  const [form] = Form.useForm<WafConfig>()
+  const [form] = Form.useForm<WafFormValues>()
 
   const { data: cfg, isLoading } = useQuery({
     queryKey: ['waf', 'config', domainId],
@@ -129,9 +138,9 @@ function ConfigDrawer({ domainName, domainId, onClose }: ConfigDrawerProps) {
             trusted_proxies_str: (cfg.trusted_proxies ?? []).join(', '),
           }}
           onFinish={(vals) => {
-            const exclusions = (vals.rule_exclusions_str as unknown as string ?? '')
+            const exclusions = (vals.rule_exclusions_str ?? '')
               .split(',').map((s: string) => s.trim()).filter(Boolean)
-            const proxies = (vals.trusted_proxies_str as unknown as string ?? '')
+            const proxies = (vals.trusted_proxies_str ?? '')
               .split(',').map((s: string) => s.trim()).filter(Boolean)
             save.mutate({
               domain_id: domainId!,