diff --git a/app/Livewire/Admin/EditDatacenter.php b/app/Livewire/Admin/EditDatacenter.php
index dbf02f1..a11a3cd 100644
--- a/app/Livewire/Admin/EditDatacenter.php
+++ b/app/Livewire/Admin/EditDatacenter.php
@@ -39,12 +39,15 @@ class EditDatacenter extends ModalComponent
     public function save()
     {
         $this->authorize('datacenters.manage');
+
         // Accept the configured countries plus the record's own legacy value, so a
-        // datacenter created before the curated list can still be edited (e.g. a
-        // name-only change) without being forced to replace a free-form location.
+        // datacenter created before the curated list can still be edited. The
+        // legacy value is read from the DB — never from the client-hydrated
+        // property, which could be forged to whitelist an arbitrary location.
+        $dc = Datacenter::query()->where('uuid', $this->uuid)->firstOrFail();
         $allowed = array_keys((array) config('countries'));
-        if ($this->originalLocation !== '') {
-            $allowed[] = $this->originalLocation;
+        if ($dc->location) {
+            $allowed[] = $dc->location;
         }
         $data = $this->validate([
             'name' => 'required|string|max:255',