diff --git a/frontend/netlify.toml b/frontend/netlify.toml
new file mode 100644
index 0000000000..989ba55fe8
--- /dev/null
+++ b/frontend/netlify.toml
@@ -0,0 +1,45 @@
+[build]
+  base = "frontend"
+  # NODE_OPTIONS: 4 GB is a V8 heap ceiling guard, not actual memory usage.
+  # It prevents OOM kills during large builds; real RSS stays well below this.
+  command = "bun install && NODE_OPTIONS=--max_old_space_size=4096 bun run build"
+  publish = "build"
+
+[build.environment]
+  NODE_VERSION = "22"
+  BUN_VERSION = "1.3.11"
+
+[[headers]]
+  for = "/*"
+  [headers.values]
+    X-Content-Type-Options = "nosniff"
+
+# MF remote entry — never cached, CORS required for cross-origin import
+[[headers]]
+  for = "/embedded.js"
+  [headers.values]
+    Cache-Control = "no-cache, no-store, must-revalidate"
+    Access-Control-Allow-Origin = "*"
+    Access-Control-Allow-Methods = "GET, OPTIONS"
+    Access-Control-Allow-Headers = "*"
+    Access-Control-Max-Age = "86400"
+
+# MF manifest — never cached, CORS required for cross-origin fetch
+[[headers]]
+  for = "/mf-manifest.json"
+  [headers.values]
+    Cache-Control = "no-cache, no-store, must-revalidate"
+    Access-Control-Allow-Origin = "*"
+    Access-Control-Allow-Methods = "GET, OPTIONS"
+    Access-Control-Allow-Headers = "*"
+    Access-Control-Max-Age = "86400"
+
+# Hashed static assets are immutable, CORS required for cross-origin import
+[[headers]]
+  for = "/static/*"
+  [headers.values]
+    Cache-Control = "public, max-age=31536000, immutable"
+    Access-Control-Allow-Origin = "*"
+    Access-Control-Allow-Methods = "GET, OPTIONS"
+    Access-Control-Allow-Headers = "*"
+    Access-Control-Max-Age = "86400"
diff --git a/frontend/public/_redirects b/frontend/public/_redirects
new file mode 100644
index 0000000000..fdc5dfe6f1
--- /dev/null
+++ b/frontend/public/_redirects
@@ -0,0 +1,3 @@
+# SPA fallback for standalone mode. In embedded (MF) mode, only
+# remoteEntry.js/embedded.js and chunks are fetched.
+/*    /index.html   200
diff --git a/frontend/src/federation/console-app.tsx b/frontend/src/federation/console-app.tsx
index 5b09ae8b7b..8072ee6477 100644
--- a/frontend/src/federation/console-app.tsx
+++ b/frontend/src/federation/console-app.tsx
@@ -289,7 +289,13 @@ function ConsoleAppInner({
     if (navigateTo !== currentPath) {
       // Update ref to prevent echo back to host
       lastNotifiedPathRef.current = navigateTo;
-      router.navigate({ to: navigateTo });
+      const qIdx = navigateTo.indexOf('?');
+      const toPath = qIdx >= 0 ? navigateTo.slice(0, qIdx) : navigateTo;
+      const toSearch = qIdx >= 0 ? navigateTo.slice(qIdx + 1) : undefined;
+      router.navigate({
+        to: toPath,
+        search: toSearch ? Object.fromEntries(new URLSearchParams(toSearch)) : undefined,
+      });
     }
   }, [navigateTo, isInitialized, router]);