diff --git a/clients/wearos/run.sh b/clients/wearos/run.sh
index 95a6b97..2d8f09f 100755
--- a/clients/wearos/run.sh
+++ b/clients/wearos/run.sh
@@ -277,6 +277,51 @@ resolve_watch_serial() {
     RESOLVED_SERIAL="${PICKED%% *}"
 }
 
+# --- Profile loading (watch target only) -----------------------------------
+# Profiles live in profiles.d/<name>.sh and define SERVER_URL, API_KEY, and
+# ALLOWED_SERIALS as a bash array. The .sh files are gitignored — see
+# profiles.d/example-profile.sh.example for the format.
+
+PROFILE_NAME=""
+SERVER_URL=""
+API_KEY=""
+ALLOWED_SERIALS=()
+
+load_profile() {
+    local name="$1"
+    local file="$SCRIPT_DIR/profiles.d/$name.sh"
+    if [[ ! -f "$file" ]]; then
+        local available
+        available="$(cd "$SCRIPT_DIR/profiles.d" 2>/dev/null && \
+                     ls *.sh 2>/dev/null | sed 's/\.sh$//' | tr '\n' ' ')"
+        [[ -z "$available" ]] && available="<none — create one in profiles.d/ from the .sh.example template>"
+        die "Unknown profile '$name'. Available: ${available}"
+    fi
+    # Reset to detect missing fields in the profile file.
+    SERVER_URL=""; API_KEY=""; ALLOWED_SERIALS=()
+    # shellcheck disable=SC1090
+    source "$file"
+    [[ -n "$SERVER_URL" ]]              || die "Profile '$name': SERVER_URL missing"
+    [[ -n "$API_KEY"    ]]              || die "Profile '$name': API_KEY missing"
+    [[ "${#ALLOWED_SERIALS[@]}" -gt 0 ]] || die "Profile '$name': ALLOWED_SERIALS empty"
+    PROFILE_NAME="$name"
+}
+
+# Aborts (via die) if $1 is not present in ALLOWED_SERIALS. The error message
+# names BOTH the attached serial and the allow-list, so the user can see at a
+# glance whether they grabbed the wrong watch or typed the wrong profile.
+verify_serial_allowed() {
+    local serial="$1"
+    local s
+    for s in "${ALLOWED_SERIALS[@]}"; do
+        [[ "$s" == "$serial" ]] && return 0
+    done
+    die "Watch serial '$serial' is NOT in ALLOWED_SERIALS for profile '$PROFILE_NAME'.
+Allowed: ${ALLOWED_SERIALS[*]}
+This refusal protects against installing the wrong key on the wrong watch
+(e.g. Brummel-key on Krey's watch → patient data goes to dev server)."
+}
+
 apply_target() {
     case "$DOCTATE_TARGET" in
         watch)