diff --git a/agent.py b/agent.py
index 2120784..243525b 100644
--- a/agent.py
+++ b/agent.py
@@ -575,15 +575,20 @@ class CustomerIntegrationEngineer(A2AAgent[CustomerIntegrationEngineerConfig, No
                 else:
                     step_results.append(AcceptanceStepResult(name=test.name, status="skipped", attempts=0, detail="dry_run/default safe mode: endpoint metadata was validated but no DNS lookup or external request was sent", idempotency_key=idem))
                 continue
-            validation = await _validate_endpoint_target(test.url, request.external_host_allowlist)
-            if validation:
-                step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=validation, idempotency_key=idem))
-                warnings.append(validation)
+            metadata_validation = _validate_endpoint_metadata(test.url, request.external_host_allowlist)
+            if metadata_validation:
+                step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=metadata_validation, idempotency_key=idem))
+                warnings.append(metadata_validation)
                 continue
             if live_network_block:
                 step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=live_network_block, idempotency_key=idem))
                 warnings.append(live_network_block)
                 continue
+            validation = await _validate_endpoint_target(test.url, request.external_host_allowlist)
+            if validation:
+                step_results.append(AcceptanceStepResult(name=test.name, status="blocked", attempts=0, detail=validation, idempotency_key=idem))
+                warnings.append(validation)
+                continue
             result = await _call_endpoint_with_retries(test, request.max_retries, request.timeout_seconds, idem)
             network_calls += result.attempts
             step_results.append(result)