diff --git a/agent/internal/httpapi/config_candidate_apply_test.go b/agent/internal/httpapi/config_candidate_apply_test.go
new file mode 100644
index 0000000..d53f133
--- /dev/null
+++ b/agent/internal/httpapi/config_candidate_apply_test.go
@@ -0,0 +1,144 @@
+package httpapi
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"rk3588sys/agent/internal/config"
+	"rk3588sys/agent/internal/mediaserver"
+)
+
+func TestHandleConfigCandidateApplyPromotesCandidateAndBacksUpCurrent(t *testing.T) {
+	reloadCalls := 0
+	msServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost && r.URL.Path == "/api/config/reload" {
+			reloadCalls++
+			w.WriteHeader(http.StatusOK)
+			_, _ = w.Write([]byte(`{"ok":true}`))
+			return
+		}
+		t.Fatalf("unexpected media-server request %s %s", r.Method, r.URL.Path)
+	}))
+	defer msServer.Close()
+
+	ms, err := mediaserver.New(msServer.URL, 3000, 1, nil)
+	if err != nil {
+		t.Fatalf("new mediaserver client: %v", err)
+	}
+
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "media-server.json")
+	currentBody := []byte(`{"templates":{"tpl":{"nodes":[],"edges":[]}},"instances":[],"metadata":{"config_id":"current","config_version":"v1"}}`)
+	candidateBody := []byte(`{"templates":{"tpl":{"nodes":[],"edges":[]}},"instances":[],"metadata":{"config_id":"candidate","config_version":"v2"}}`)
+	if err := os.WriteFile(cfgPath, currentBody, 0o644); err != nil {
+		t.Fatalf("write current: %v", err)
+	}
+	if err := os.WriteFile(cfgPath+".candidate.json", candidateBody, 0o644); err != nil {
+		t.Fatalf("write candidate: %v", err)
+	}
+
+	s := &Server{
+		agentCfg: config.AgentConfig{ConfigPath: cfgPath, Token: "test-token"},
+		ms:       ms,
+	}
+	req := httptest.NewRequest(http.MethodPost, "/v1/config/candidate/apply", strings.NewReader(`{}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-RK-Token", "test-token")
+	rr := httptest.NewRecorder()
+
+	s.handleConfigCandidateApply(rr, req)
+
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status code: got %d body=%s", rr.Code, rr.Body.String())
+	}
+	if reloadCalls != 1 {
+		t.Fatalf("reload calls = %d", reloadCalls)
+	}
+
+	gotCurrent, err := os.ReadFile(cfgPath)
+	if err != nil {
+		t.Fatalf("read current: %v", err)
+	}
+	if strings.TrimSpace(string(gotCurrent)) != string(candidateBody) {
+		t.Fatalf("current body = %s", gotCurrent)
+	}
+	gotLastGood, err := os.ReadFile(cfgPath + ".last_good.json")
+	if err != nil {
+		t.Fatalf("read last_good: %v", err)
+	}
+	if strings.TrimSpace(string(gotLastGood)) != string(currentBody) {
+		t.Fatalf("last_good body = %s", gotLastGood)
+	}
+	if _, err := os.Stat(cfgPath + ".candidate.json"); !os.IsNotExist(err) {
+		t.Fatalf("candidate should be removed, stat err=%v", err)
+	}
+
+	var resp map[string]any
+	if err := json.Unmarshal(rr.Body.Bytes(), &resp); err != nil {
+		t.Fatalf("decode response: %v", err)
+	}
+	if resp["ok"] != true {
+		t.Fatalf("response = %#v", resp)
+	}
+	status, ok := resp["status"].(map[string]any)
+	if !ok {
+		t.Fatalf("status missing: %#v", resp)
+	}
+	metadata, ok := status["metadata"].(map[string]any)
+	if !ok || metadata["config_id"] != "candidate" {
+		t.Fatalf("status metadata = %#v", status["metadata"])
+	}
+	candidate, ok := status["candidate"].(map[string]any)
+	if !ok || candidate["exists"] != false {
+		t.Fatalf("status candidate = %#v", status["candidate"])
+	}
+}
+
+func TestApplyCandidateConfigBytes(t *testing.T) {
+	reloadCalls := 0
+	msServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodPost && r.URL.Path == "/api/config/reload" {
+			reloadCalls++
+			w.WriteHeader(http.StatusOK)
+			return
+		}
+		t.Fatalf("unexpected media-server request %s %s", r.Method, r.URL.Path)
+	}))
+	defer msServer.Close()
+	ms, err := mediaserver.New(msServer.URL, 3000, 1, nil)
+	if err != nil {
+		t.Fatalf("new mediaserver client: %v", err)
+	}
+
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "media-server.json")
+	currentBody := []byte(`{"templates":{"tpl":{"nodes":[],"edges":[]}},"instances":[],"metadata":{"config_id":"current","config_version":"v1"}}`)
+	candidateBody := []byte(`{"templates":{"tpl":{"nodes":[],"edges":[]}},"instances":[],"metadata":{"config_id":"candidate","config_version":"v2"}}`)
+	if err := os.WriteFile(cfgPath, currentBody, 0o644); err != nil {
+		t.Fatalf("write current: %v", err)
+	}
+
+	s := &Server{
+		agentCfg: config.AgentConfig{ConfigPath: cfgPath},
+		ms:       ms,
+	}
+	if err := s.applyCandidateConfigBytes(context.Background(), candidateBody); err != nil {
+		t.Fatalf("applyCandidateConfigBytes: %v", err)
+	}
+	if reloadCalls != 1 {
+		t.Fatalf("reload calls = %d", reloadCalls)
+	}
+	gotLastGood, err := os.ReadFile(cfgPath + ".last_good.json")
+	if err != nil {
+		t.Fatalf("read last_good: %v", err)
+	}
+	if strings.TrimSpace(string(gotLastGood)) != string(currentBody) {
+		t.Fatalf("last_good body = %s", gotLastGood)
+	}
+}
diff --git a/agent/internal/httpapi/extras.go b/agent/internal/httpapi/extras.go
index 0893a86..b04853a 100644
--- a/agent/internal/httpapi/extras.go
+++ b/agent/internal/httpapi/extras.go
@@ -186,6 +186,14 @@ func (s *Server) handleConfigStatus(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	writeJSON(w, http.StatusOK, s.configStatusPayload())
+}
+
+func (s *Server) configCandidatePath() string {
+	return s.agentCfg.ConfigPath + ".candidate.json"
+}
+
+func (s *Server) configStatusPayload() map[string]any {
 	current := readConfigFileStatus(s.agentCfg.ConfigPath)
 	lastGoodPath := s.agentCfg.ConfigPath + ".last_good.json"
 	lastGood := readConfigFileStatus(lastGoodPath)
@@ -225,12 +233,7 @@ func (s *Server) handleConfigStatus(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 	resp["media_server"] = media
-
-	writeJSON(w, http.StatusOK, resp)
-}
-
-func (s *Server) configCandidatePath() string {
-	return s.agentCfg.ConfigPath + ".candidate.json"
+	return resp
 }
 
 func readConfigFileStatus(path string) configFileStatus {
diff --git a/agent/internal/httpapi/server.go b/agent/internal/httpapi/server.go
index 576bf75..8f760f3 100644
--- a/agent/internal/httpapi/server.go
+++ b/agent/internal/httpapi/server.go
@@ -110,6 +110,7 @@ func New(agentCfg config.AgentConfig, baseDir string, ms *mediaserver.Client, st
 	mux.HandleFunc("/v1/info", s.handleInfo)
 	mux.HandleFunc("/v1/config/status", s.handleConfigStatus)
 	mux.HandleFunc("/v1/config/candidate", s.handleConfigCandidate)
+	mux.HandleFunc("/v1/config/candidate/apply", s.handleConfigCandidateApply)
 	mux.HandleFunc("/v1/config", s.handleConfig)
 	mux.HandleFunc("/v1/config/ui/schema", s.handleConfigUISchema)
 	mux.HandleFunc("/v1/config/ui/state", s.handleConfigUIState)
@@ -222,6 +223,44 @@ func (s *Server) handleConfigCandidate(w http.ResponseWriter, r *http.Request) {
 	})
 }
 
+func (s *Server) handleConfigCandidateApply(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		errorJSON(w, http.StatusMethodNotAllowed, "method not allowed")
+		return
+	}
+	if !s.authorize(r, true) {
+		errorJSON(w, http.StatusUnauthorized, "unauthorized")
+		return
+	}
+
+	candidatePath := s.configCandidatePath()
+	body, err := os.ReadFile(candidatePath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			errorJSON(w, http.StatusNotFound, "candidate config not found")
+			return
+		}
+		errorJSON(w, http.StatusInternalServerError, "internal error: read candidate failed: "+err.Error())
+		return
+	}
+	if _, err := validateRootConfigJSON(body); err != nil {
+		errorJSON(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	if err := s.applyCandidateConfigBytes(r.Context(), body); err != nil {
+		s.recordAudit(r, "config.candidate.apply", false, err.Error())
+		errorJSON(w, http.StatusInternalServerError, "internal error: "+err.Error())
+		return
+	}
+	_ = os.Remove(candidatePath)
+	s.recordAudit(r, "config.candidate.apply", true, candidatePath)
+
+	writeJSON(w, http.StatusOK, map[string]any{
+		"ok":     true,
+		"status": s.configStatusPayload(),
+	})
+}
+
 func (s *Server) handleConfig(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
@@ -335,6 +374,18 @@ func (s *Server) applyRootConfigBytes(ctx context.Context, body []byte) error {
 	return nil
 }
 
+func (s *Server) applyCandidateConfigBytes(ctx context.Context, body []byte) error {
+	current, err := os.ReadFile(s.agentCfg.ConfigPath)
+	if err == nil && len(current) > 0 {
+		if err := files.WriteFileAtomic(s.agentCfg.ConfigPath+".last_good.json", append(current, '\n'), 0o644); err != nil {
+			return fmt.Errorf("write last_good failed: %w", err)
+		}
+	} else if err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("read current config failed: %w", err)
+	}
+	return s.applyRootConfigBytes(ctx, body)
+}
+
 var modelNameRE = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)
 var configNameRE = regexp.MustCompile(`^[A-Za-z0-9._-]+$`)