diff --git a/x-ui-latest.sh b/x-ui-latest.sh
index 8e8bb56..386fb1c 100644
--- a/x-ui-latest.sh
+++ b/x-ui-latest.sh
@@ -84,6 +84,12 @@ gen_random_string() {
     echo
 }
 
+# Matches the panel's host group_id format (16 lowercase alphanumerics)
+gen_group_id() {
+    head -c 4096 /dev/urandom | tr -dc 'a-z0-9' | head -c 16
+    echo
+}
+
 check_free() {
     nc -z 127.0.0.1 "$1" &>/dev/null
     return $?
@@ -799,6 +805,12 @@ configure_xui_db() {
     private_key=$(echo "$output" | grep "^PrivateKey:" | awk '{print $2}')
     public_key=$(echo "$output"  | grep "^Password"   | awk '{print $3}')
     trojan_pass=$(gen_random_string 10)
+    # Per-host group_id: without it the panel cannot edit or delete the host
+    local gid_reality gid_ws gid_xhttp gid_trojan
+    gid_reality=$(gen_group_id)
+    gid_ws=$(gen_group_id)
+    gid_xhttp=$(gen_group_id)
+    gid_trojan=$(gen_group_id)
     emoji_flag=$(LC_ALL=en_US.UTF-8 curl -s --max-time 10 https://ipwho.is/ | jq -r '.flag.emoji' 2>/dev/null)
     [[ -z "$emoji_flag" || "$emoji_flag" == "null" ]] && emoji_flag="🌐"
 
@@ -988,12 +1000,12 @@ VALUES (
 -- rendered as the share-link endpoint at subscription time.
 -- REALITY keeps its own TLS params (security=same); the rest front through
 -- nginx at :443 with TLS.
-INSERT INTO "hosts" ("inbound_id","sort_order","remark","address","port","security","fingerprint","alpn")
+INSERT INTO "hosts" ("inbound_id","group_id","sort_order","remark","address","port","security","fingerprint","alpn")
 VALUES
-    ((SELECT id FROM inbounds WHERE tag='inbound-8443'),           0, 'reality', '${domain}', 443, 'same', '',        '[]'),
-    ((SELECT id FROM inbounds WHERE tag='inbound-${ws_port}'),     0, 'ws',      '${domain}', 443, 'tls',  'firefox', '["h2","http/1.1"]'),
-    ((SELECT id FROM inbounds WHERE tag='inbound-/dev/shm/uds2023.sock,0666:0|'), 0, 'xhttp', '${domain}', 443, 'tls', 'firefox', '["h2","http/1.1"]'),
-    ((SELECT id FROM inbounds WHERE tag='inbound-${trojan_port}'), 0, 'trojan',  '${domain}', 443, 'tls',  'firefox', '["h2","http/1.1"]');
+    ((SELECT id FROM inbounds WHERE tag='inbound-8443'),           '${gid_reality}', 0, 'reality', '${domain}', 443, 'same', '',        '[]'),
+    ((SELECT id FROM inbounds WHERE tag='inbound-${ws_port}'),     '${gid_ws}',      0, 'ws',      '${domain}', 443, 'tls',  'firefox', '["h2","http/1.1"]'),
+    ((SELECT id FROM inbounds WHERE tag='inbound-/dev/shm/uds2023.sock,0666:0|'), '${gid_xhttp}', 0, 'xhttp', '${domain}', 443, 'tls', 'firefox', '["h2","http/1.1"]'),
+    ((SELECT id FROM inbounds WHERE tag='inbound-${trojan_port}'), '${gid_trojan}',  0, 'trojan',  '${domain}', 443, 'tls',  'firefox', '["h2","http/1.1"]');
 EOF
 
     /usr/local/x-ui/x-ui setting \