diff --git a/frontend/packages/dashboard/src/flow.js b/frontend/packages/dashboard/src/flow.js
index eefe8710..d4b1c9eb 100644
--- a/frontend/packages/dashboard/src/flow.js
+++ b/frontend/packages/dashboard/src/flow.js
@@ -187,10 +187,20 @@ import {
       logEl: flow,
       pillAnchor: flowMain,
       historyUrl: '/dashboard/history',
-      streamUrl: '/dashboard/stream',
+      // #408: server-side filter — only the kinds this page actually
+      // renders or routes (sent/delivered → broker terminal,
+      // container_state_changed/_removed → local autocomplete cache).
+      // Backend (#499) pre-parses the allow-list at subscribe time so
+      // the per-frame hot path is one HashSet::contains and the
+      // JSON-serialise is skipped entirely on irrelevant kinds. The
+      // dashboard tabs page (tabs.js) keeps the unfiltered subscribe
+      // since it routes every mutation kind into its derived stores.
+      streamUrl: '/dashboard/stream?kinds=sent,delivered,container_state_changed,container_removed',
       // #448: route through the SharedWorker so this page's SSE shares
       // a single backend connection with /index.html (and any other
-      // open hyperhive tab).
+      // open hyperhive tab). Worker keys on the full URL (incl.
+      // query string), so the filtered subscribe is its own upstream
+      // — won't accidentally share with tabs.js's wider subscribe.
       streamFactory: openStream,
       renderers: {
         sent:      (ev, api) => renderMsg(ev, api, '→'),