diff --git a/backend/middleware/security.js b/backend/middleware/security.js
index 89d612b..c9f77c6 100644
--- a/backend/middleware/security.js
+++ b/backend/middleware/security.js
@@ -15,11 +15,20 @@ function readApiKey() {
 }
 
 let cachedApiKey = null;
+let cachedApiKeyMtime = 0;
 function getApiKey() {
-  if (cachedApiKey === null) cachedApiKey = readApiKey();
+  try {
+    const stat = fs.statSync(CONFIG_PATH);
+    if (cachedApiKeyMtime === stat.mtimeMs) return cachedApiKey;
+    cachedApiKey = readApiKey();
+    cachedApiKeyMtime = stat.mtimeMs;
+  } catch {
+    cachedApiKey = null;
+    cachedApiKeyMtime = 0;
+  }
   return cachedApiKey;
 }
-function clearApiKeyCache() { cachedApiKey = null; }
+function clearApiKeyCache() { cachedApiKey = null; cachedApiKeyMtime = 0; }
 
 const xssOptions = {
   whiteList: {