diff --git a/Cargo.lock b/Cargo.lock
index 4d08abaf..da06c5ad 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3437,6 +3437,7 @@ dependencies = [
  "bitflags 2.5.0",
  "bytes",
  "futures-core",
+ "futures-util",
  "http",
  "http-body",
  "http-body-util",
diff --git a/Cargo.toml b/Cargo.toml
index 9aadf621..f818d56f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -105,7 +105,7 @@ features = ["util"]
 
 [dependencies.tower-http]
 version = "0.5.2"
-features = ["add-extension", "cors", "sensitive-headers", "trace", "util"]
+features = ["add-extension", "cors", "sensitive-headers", "trace", "util", "catch-panic"]
 
 [dependencies.hyper]
 version = "1.3.1"
diff --git a/src/config/check.rs b/src/config/check.rs
index f221cbd5..f289851f 100644
--- a/src/config/check.rs
+++ b/src/config/check.rs
@@ -5,7 +5,7 @@ use tracing::{debug, error, info, warn};
 
 use crate::{utils::error::Error, Config};
 
-pub fn check(config: &Config) -> Result<(), Error> {
+pub(super) fn check(config: &Config) -> Result<(), Error> {
 	config.warn_deprecated();
 	config.warn_unknown_key();
 
diff --git a/src/config/mod.rs b/src/config/mod.rs
index f6ec335a..599b8cd8 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -22,10 +22,10 @@ use serde::{de::IgnoredAny, Deserialize};
 use tracing::{debug, error, warn};
 use url::Url;
 
-use self::proxy::ProxyConfig;
+use self::{check::check, proxy::ProxyConfig};
 use crate::utils::error::Error;
 
-mod check;
+pub(crate) mod check;
 mod proxy;
 
 #[derive(Deserialize, Clone, Debug)]
@@ -371,8 +371,6 @@ impl Config {
 			Ok(config) => config,
 		};
 
-		check::check(&config)?;
-
 		// don't start if we're listening on both UNIX sockets and TCP at same time
 		if config.is_dual_listening(&raw_config) {
 			return Err(Error::bad_config("dual listening on UNIX and TCP sockets not allowed."));
@@ -452,6 +450,8 @@ impl Config {
 				.collect::<Vec<_>>(),
 		}
 	}
+
+	pub fn check(&self) -> Result<(), Error> { check(self) }
 }
 
 impl fmt::Display for Config {
diff --git a/src/main.rs b/src/main.rs
index a827ea1d..6481e017 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -30,6 +30,7 @@ use tokio::{
 };
 use tower::ServiceBuilder;
 use tower_http::{
+	catch_panic::CatchPanicLayer,
 	cors::{self, CorsLayer},
 	trace::{DefaultOnFailure, TraceLayer},
 	ServiceBuilderExt as _,
@@ -76,7 +77,7 @@ async fn async_main(server: &Server) -> Result<(), Error> {
 	if let Err(error) = run(server).await {
 		error!("Critical error running server: {error}");
 		return Err(Error::Error(format!("{error}")));
-	};
+	}
 
 	if let Err(error) = stop(server).await {
 		error!("Critical error stopping server: {error}");
@@ -274,6 +275,7 @@ async fn build(server: &Server) -> io::Result<axum::routing::IntoMakeService<Rou
 	let middlewares = base_middlewares
 		.sensitive_headers([header::AUTHORIZATION])
 		.sensitive_request_headers([x_forwarded_for].into())
+		.layer(CatchPanicLayer::new())
 		.layer(axum::middleware::from_fn(request_spawn))
 		.layer(
 			TraceLayer::new_for_http()
@@ -438,6 +440,8 @@ fn init(args: clap::Args) -> Result<Server, Error> {
 		tracing_reload_handle = init_tracing_sub(&config);
 	};
 
+	config.check()?;
+
 	info!(
 		server_name = ?config.server_name,
 		database_path = ?config.database_path,