diff --git a/internal/tui/config.go b/internal/tui/config.go
index ebb2e5c..9bc270d 100644
--- a/internal/tui/config.go
+++ b/internal/tui/config.go
@@ -14,10 +14,13 @@ func GenerateConfigTOML(cv ConfigValues) (string, error) {
 	sb.WriteString("# Server Configuration\n")
 	sb.WriteString("[server]\n")
 	// Always containerAppPort: the container listens on this port internally; the
-	// user's port is the host-side mapping (see RunAppClienteContainer).
+	// user's port is the host-side mapping (see RunAppClienteContainer). Persisted
+	// separately as host_port so it survives as the form default on a re-run.
 	sb.WriteString(fmt.Sprintf("port = %d\n", containerAppPort))
+	sb.WriteString(fmt.Sprintf("host_port = %s\n", cv.Server["port"]))
 	sb.WriteString(fmt.Sprintf("timeout_seconds = %s\n", cv.Server["timeout"]))
 	sb.WriteString(fmt.Sprintf("environment = %q\n", cv.Server["environment"]))
+	sb.WriteString(fmt.Sprintf("seccomp_unconfined = %t\n", cv.Server["seccomp_unconfined"] == "Sim"))
 	sb.WriteString("\n")
 
 	// [database]
diff --git a/internal/tui/config_test.go b/internal/tui/config_test.go
index f49c049..e087829 100644
--- a/internal/tui/config_test.go
+++ b/internal/tui/config_test.go
@@ -60,6 +60,12 @@ func TestGenerateConfigTOML_RoundTrip(t *testing.T) {
 	if cfg.Server.Environment != "production" {
 		t.Errorf("environment = %q, want %q", cfg.Server.Environment, "production")
 	}
+	if cfg.Server.HostPort != 9090 {
+		t.Errorf("host_port = %d, want 9090", cfg.Server.HostPort)
+	}
+	if cfg.Server.SeccompUnconfined {
+		t.Errorf("seccomp_unconfined = true, want false")
+	}
 	if cfg.Database.Type != "postgres" {
 		t.Errorf("database type = %q, want %q", cfg.Database.Type, "postgres")
 	}
@@ -103,8 +109,8 @@ func TestGenerateConfigTOML_PortIsAlwaysContainerPort(t *testing.T) {
 	if cfg.Server.Port != containerAppPort {
 		t.Errorf("config port = %d, want fixed containerAppPort %d", cfg.Server.Port, containerAppPort)
 	}
-	if strings.Contains(out, "port = 9090") {
-		t.Errorf("host port 9090 leaked into config.toml:\n%s", out)
+	if cfg.Server.HostPort != 9090 {
+		t.Errorf("host_port = %d, want 9090", cfg.Server.HostPort)
 	}
 }
 
diff --git a/internal/tui/model.go b/internal/tui/model.go
index 5f76af5..4234af9 100644
--- a/internal/tui/model.go
+++ b/internal/tui/model.go
@@ -61,9 +61,11 @@ type ConfigValues struct {
 
 type AppConfig struct {
 	Server struct {
-		Port        int64  `toml:"port"`
-		Timeout     int64  `toml:"timeout_seconds"`
-		Environment string `toml:"environment"`
+		Port              int64  `toml:"port"`
+		HostPort          int64  `toml:"host_port"`
+		Timeout           int64  `toml:"timeout_seconds"`
+		Environment       string `toml:"environment"`
+		SeccompUnconfined bool   `toml:"seccomp_unconfined"`
 	} `toml:"server"`
 	Database struct {
 		Type     string `toml:"type"`
@@ -83,7 +85,8 @@ type AppConfig struct {
 func loadConfig() AppConfig {
 	var config AppConfig
 
-	config.Server.Port = 8081
+	config.Server.Port = containerAppPort
+	config.Server.HostPort = 8081
 	config.Server.Timeout = 30
 	config.Server.Environment = "production"
 
@@ -113,6 +116,11 @@ func InitialModel() Model {
 	s.Spinner = spinner.Dot
 	s.Style = SpinnerStyle
 
+	seccompDefault := "Não"
+	if cfg.Server.SeccompUnconfined {
+		seccompDefault = "Sim"
+	}
+
 	return Model{
 		currentStep: StepCheckDocker,
 		loginForm: NewFormStep("Login no Repositório Docker", []FormField{
@@ -175,7 +183,7 @@ func InitialModel() Model {
 				Id:          "port",
 				Label:       "Porta (host)",
 				Placeholder: "8081",
-				Default:     strconv.FormatInt(cfg.Server.Port, 10),
+				Default:     strconv.FormatInt(cfg.Server.HostPort, 10),
 				Type:        FieldTypeNumber,
 				CharLimit:   4,
 			},
@@ -197,7 +205,7 @@ func InitialModel() Model {
 			{
 				Id:      "seccomp_unconfined",
 				Label:   "Modo Compatibilidade (máquinas antigas)",
-				Default: "Não",
+				Default: seccompDefault,
 				Type:    FieldTypeSelect,
 				Options: []string{"Não", "Sim"},
 			},