diff --git a/app/middleware/csrf.py b/app/middleware/csrf.py
index 72036be..93799a4 100644
--- a/app/middleware/csrf.py
+++ b/app/middleware/csrf.py
@@ -16,7 +16,7 @@ class CSRFMiddleware(BaseHTTPMiddleware):
     """
 
     SAFE_METHODS = {"GET", "HEAD", "OPTIONS"}
-    EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/db/", "/workspace"}
+    EXCLUDED_PATHS = {"/api/webhook", "/api/v1", "/auth/callback", "/auth/register", "/auth/local-login", "/api/user", "/board/api/pages", "/board/api/favorites", "/api/workspace", "/api/local-workspace", "/api/settings", "/db/", "/workspace"}
 
     async def dispatch(self, request: Request, call_next):
         # Webhook receiver, OAuth callback, and internal API are exempt
diff --git a/app/templates/settings.html b/app/templates/settings.html
index 6e2bf56..32f9d13 100644
--- a/app/templates/settings.html
+++ b/app/templates/settings.html
@@ -48,7 +48,7 @@
 .tag-count{font-size:12px;color:var(--text-dim);}
 .new-tag-form{display:flex;align-items:center;gap:10px;margin-top:8px;padding:8px 10px;background:var(--bg-tertiary);border:1px dashed var(--border);border-radius:8px;}
 .new-tag-form input{flex:1;background:none;border:none;color:var(--text);font-size:13px;outline:none;}
-.color-swatch{width:22px;height:22px;border-radius:50%;cursor:pointer;border:2px solid transparent;transition:all 120ms;}
+.color-swatch{width:22px;height:22px;border-radius:6px;cursor:pointer;border:2px solid transparent;transition:all 120ms;}
 .color-swatch:hover{transform:scale(1.15);}
 .color-swatch.selected{border-color:var(--text);box-shadow:0 0 0 2px var(--accent);}