diff --git a/packages/server/src/server/__tests__/instance-proxy.test.ts b/packages/server/src/server/__tests__/instance-proxy.test.ts
index 53c05b9d..87c9b52f 100644
--- a/packages/server/src/server/__tests__/instance-proxy.test.ts
+++ b/packages/server/src/server/__tests__/instance-proxy.test.ts
@@ -132,6 +132,13 @@ describe("instance proxy location enforcement", () => {
     assert.match(JSON.parse(response.body).url, /^\/api\/model\/default\?/)
   })
 
+  it("allows active plugin metadata", async () => {
+    const { app } = await harness()
+    const response = await app.inject({ method: "GET", url: "/workspaces/workspace/instance/api/plugin" })
+    assert.equal(response.statusCode, 200)
+    assert.match(JSON.parse(response.body).url, /^\/api\/plugin\?/)
+  })
+
   it("allows ownership-scoped agent fallback lookups", async () => {
     const { app } = await harness()
     const response = await app.inject({ method: "GET", url: "/workspaces/workspace/instance/api/agent/build" })
diff --git a/packages/server/src/server/http-server.ts b/packages/server/src/server/http-server.ts
index 046981e3..e77294ff 100644
--- a/packages/server/src/server/http-server.ts
+++ b/packages/server/src/server/http-server.ts
@@ -895,7 +895,7 @@ function hasDotSegment(value: string): boolean {
 function isAllowedInstanceApiRoute(method: string, pathname: string): boolean {
   const route = pathname.replace(/\/+$/, "")
   const allowed: Array<[string, RegExp]> = [
-    ["GET", /^\/api\/(?:agent|command|config|integration|mcp|model|provider)$/],
+    ["GET", /^\/api\/(?:agent|command|config|integration|mcp|model|plugin|provider)$/],
     ["GET", /^\/api\/agent\/[^/]+$/],
     ["GET", /^\/api\/model\/default$/],
     ["GET", /^\/api\/(?:permission|question)\/request$/],