diff --git a/solitaire_core/src/game_state.rs b/solitaire_core/src/game_state.rs
index 37faa7a..49bacf1 100644
--- a/solitaire_core/src/game_state.rs
+++ b/solitaire_core/src/game_state.rs
@@ -289,10 +289,9 @@ impl GameState {
             .ok_or(MoveError::InvalidSource)?
             .cards
             .last_mut()
+            && !top.face_up
         {
-            if !top.face_up {
-                top.face_up = true;
-            }
+            top.face_up = true;
         }
 
         self.piles.get_mut(&to).ok_or(MoveError::InvalidDestination)?.cards.append(&mut moved);
diff --git a/solitaire_server/src/lib.rs b/solitaire_server/src/lib.rs
index 6cdfff5..1977a4e 100644
--- a/solitaire_server/src/lib.rs
+++ b/solitaire_server/src/lib.rs
@@ -19,7 +19,11 @@ use axum::{
 };
 use sqlx::SqlitePool;
 use std::sync::Arc;
-use tower_governor::{governor::GovernorConfigBuilder, GovernorLayer};
+use tower_governor::{
+    governor::GovernorConfigBuilder,
+    key_extractor::SmartIpKeyExtractor,
+    GovernorLayer,
+};
 
 /// Shared application state injected into every Axum handler via [`axum::extract::State`].
 ///
@@ -80,6 +84,7 @@ fn build_router_inner(state: AppState, rate_limit: bool) -> Router {
         // burst_size = 10, replenish every 6 seconds = 10/min steady-state.
         let governor_conf = Arc::new(
             GovernorConfigBuilder::default()
+                .key_extractor(SmartIpKeyExtractor)
                 .per_second(6)
                 .burst_size(10)
                 .finish()