diff --git a/hub/route/configs.go b/hub/route/configs.go
index d4bda2bf4..b23a35a52 100644
--- a/hub/route/configs.go
+++ b/hub/route/configs.go
@@ -24,9 +24,11 @@ import (
 func configRouter() http.Handler {
 	r := chi.NewRouter()
 	r.Get("/", getConfigs)
-	r.Put("/", updateConfigs)
-	r.Post("/geo", updateGeoDatabases)
-	r.Patch("/", patchConfigs)
+	if !embedMode { // disallow update/patch configs in embed mode
+		r.Put("/", updateConfigs)
+		r.Post("/geo", updateGeoDatabases)
+		r.Patch("/", patchConfigs)
+	}
 	return r
 }
 
diff --git a/hub/route/groups.go b/hub/route/groups.go
index 68d1f3542..873a94df5 100644
--- a/hub/route/groups.go
+++ b/hub/route/groups.go
@@ -16,7 +16,7 @@ import (
 	"github.com/metacubex/mihomo/tunnel"
 )
 
-func GroupRouter() http.Handler {
+func groupRouter() http.Handler {
 	r := chi.NewRouter()
 	r.Get("/", getGroups)
 
diff --git a/hub/route/patch_android.go b/hub/route/patch_android.go
new file mode 100644
index 000000000..5eba27964
--- /dev/null
+++ b/hub/route/patch_android.go
@@ -0,0 +1,7 @@
+//go:build android && cmfa
+
+package route
+
+func init() {
+	SetEmbedMode(true) // set embed mode default
+}
diff --git a/hub/route/server.go b/hub/route/server.go
index e71347fcd..21102cc38 100644
--- a/hub/route/server.go
+++ b/hub/route/server.go
@@ -36,8 +36,14 @@ var (
 	tlsServer  *http.Server
 	unixServer *http.Server
 	pipeServer *http.Server
+
+	embedMode = false
 )
 
+func SetEmbedMode(embed bool) {
+	embedMode = embed
+}
+
 type Traffic struct {
 	Up   int64 `json:"up"`
 	Down int64 `json:"down"`
@@ -114,15 +120,17 @@ func router(isDebug bool, secret string, dohServer string, cors Cors) *chi.Mux {
 		r.Get("/version", version)
 		r.Mount("/configs", configRouter())
 		r.Mount("/proxies", proxyRouter())
-		r.Mount("/group", GroupRouter())
+		r.Mount("/group", groupRouter())
 		r.Mount("/rules", ruleRouter())
 		r.Mount("/connections", connectionRouter())
 		r.Mount("/providers/proxies", proxyProviderRouter())
 		r.Mount("/providers/rules", ruleProviderRouter())
 		r.Mount("/cache", cacheRouter())
 		r.Mount("/dns", dnsRouter())
-		r.Mount("/restart", restartRouter())
-		r.Mount("/upgrade", upgradeRouter())
+		if !embedMode { // disallow restart and upgrade in embed mode
+			r.Mount("/restart", restartRouter())
+			r.Mount("/upgrade", upgradeRouter())
+		}
 		addExternalRouters(r)
 
 	})