diff --git a/third_party/vanta/.cursor-plugin/plugin.json b/third_party/vanta/.cursor-plugin/plugin.json
index d4976d6fa..4c8e0114a 100644
--- a/third_party/vanta/.cursor-plugin/plugin.json
+++ b/third_party/vanta/.cursor-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
   "name": "vanta",
   "displayName": "Vanta",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "minClientVersions": {
     "cursor": "3.13.0"
   },
@@ -32,6 +32,7 @@
   ],
   "variables": {
     "type": "object",
+    "required": ["VANTA_MCP_HOST"],
     "properties": {
       "VANTA_MCP_HOST": {
         "type": "string",
diff --git a/third_party/vanta/CHANGELOG.md b/third_party/vanta/CHANGELOG.md
index 6e615e92d..e8ddd91fa 100644
--- a/third_party/vanta/CHANGELOG.md
+++ b/third_party/vanta/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 All notable changes to this plugin will be documented here.
 
+## 1.1.1
+
+- Require `VANTA_MCP_HOST` so the server URL cannot be saved with the region left unsubstituted.
+
 ## 1.1.0
 
 - Replaced the three regional servers with one `vanta` server at `https://${VANTA_MCP_HOST}/mcp`, so a user sees one Vanta connection instead of three.
diff --git a/third_party/vanta/mcp-url.test.mjs b/third_party/vanta/mcp-url.test.mjs
new file mode 100644
index 000000000..9a624be34
--- /dev/null
+++ b/third_party/vanta/mcp-url.test.mjs
@@ -0,0 +1,33 @@
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { test } from "node:test";
+import { fileURLToPath } from "node:url";
+
+const root = dirname(fileURLToPath(import.meta.url));
+
+test("the Vanta server URL host is a required setup value", () => {
+  const plugin = JSON.parse(
+    readFileSync(join(root, ".cursor-plugin/plugin.json"), "utf8")
+  );
+  const mcp = JSON.parse(readFileSync(join(root, "mcp.json"), "utf8"));
+  const url = mcp.mcpServers.vanta.url;
+  const required = new Set(plugin.variables.required ?? []);
+  const used = [...url.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)].map(
+    (match) => match[1]
+  );
+
+  assert.deepEqual(used, ["VANTA_MCP_HOST"]);
+  assert.equal(url, "https://${VANTA_MCP_HOST}/mcp");
+  for (const name of used) {
+    assert.ok(
+      required.has(name),
+      `${name} is interpolated into the server URL but is not required, so an install can save a URL Cursor cannot resolve`
+    );
+  }
+  assert.deepEqual(plugin.variables.properties.VANTA_MCP_HOST.enum, [
+    "mcp.vanta.com",
+    "mcp.eu.vanta.com",
+    "mcp.aus.vanta.com",
+  ]);
+});