diff --git a/DeviceSettings.config b/DeviceSettings.config
index 49268e1..9cf6d02 100644
--- a/DeviceSettings.config
+++ b/DeviceSettings.config
@@ -1,24 +1,25 @@
 {
-  "MachineScopeMode": "SITE",
-  "ScopedMachineIps": [
-    "192.168.91.80"
-  ],
+"MachineScopeMode": "SITE",
+"ScopedMachineIps": [
+"192.168.91.80"
+],
 
-  "EnableTemplateDeviceToDbSync": false,
-  "EnableTemplateDbToDeviceSync": false,
+"EnableTemplateDeviceToDbSync": false,
+"EnableTemplateDbToDeviceSync": false,
 
-  "SourceMachineIp": "",
-  "TargetMachineIps": [
-    "192.168.91.80"
-  ],
+"SourceMachineIp": "",
+"TargetMachineIps": [
+"192.168.91.80"
+],
 
-  "SyncEmployeeIds": [],
-  "SyncDepartmentIds": [],
+"SyncEmployeeIds": [],
+"SyncDepartmentIds": [],
 
-  "EnableInitialDepartmentSync": true,
-  "InitialSyncDepartmentIds": [
-    "357"
-  ],
-  "EnableEmployeePhotoSource": true,
-  "EmployeePhotoBaseUrl": "https://portal.utopiaindustries.pk/uind/employee-photo/"
+"EnableInitialDepartmentSync": true,
+"InitialSyncDepartmentIds": [
+"357"
+],
+"InitialSyncEmployeeIds": [],
+"EnableEmployeePhotoSource": true,
+"EmployeePhotoBaseUrl": "https://portal.utopiaindustries.pk/uind/employee-photo/"
 }
diff --git a/HikvisionAttendanceWindowsService.cs b/HikvisionAttendanceWindowsService.cs
index 0c12e60..527e1ca 100644
--- a/HikvisionAttendanceWindowsService.cs
+++ b/HikvisionAttendanceWindowsService.cs
@@ -113,6 +113,13 @@ public sealed class HikvisionAttendanceWindowsService : ServiceBase
         [DataMember]
         public List<string> InitialSyncDepartmentIds { get; set; } = new List<string>();
 
+        /// <summary>
+        /// Optional allow-list of employee serial_numbers. When non-empty, initial sync enrolls only
+        /// these employees AND only if they belong to <see cref="InitialSyncDepartmentIds"/>. Empty = whole department.
+        /// </summary>
+        [DataMember]
+        public List<string> InitialSyncEmployeeIds { get; set; } = new List<string>();
+
         /// <summary>When true, initial sync downloads JPEG photos from <see cref="EmployeePhotoBaseUrl"/>.</summary>
         [DataMember]
         public bool EnableEmployeePhotoSource { get; set; }
@@ -573,6 +580,8 @@ public sealed class HikvisionAttendanceWindowsService : ServiceBase
                 cfg.EnableInitialDepartmentSync = overlay.EnableInitialDepartmentSync;
                 if (overlay.InitialSyncDepartmentIds != null)
                     cfg.InitialSyncDepartmentIds = new List<string>(overlay.InitialSyncDepartmentIds);
+                if (overlay.InitialSyncEmployeeIds != null)
+                    cfg.InitialSyncEmployeeIds = new List<string>(overlay.InitialSyncEmployeeIds);
                 cfg.EnableEmployeePhotoSource = overlay.EnableEmployeePhotoSource;
                 if (overlay.EmployeePhotoBaseUrl != null)
                     cfg.EmployeePhotoBaseUrl = overlay.EmployeePhotoBaseUrl;
@@ -619,6 +628,9 @@ public sealed class HikvisionAttendanceWindowsService : ServiceBase
             cfg.InitialSyncDepartmentIds ??= new List<string>();
             for (int i = 0; i < cfg.InitialSyncDepartmentIds.Count; i++)
                 cfg.InitialSyncDepartmentIds[i] = (cfg.InitialSyncDepartmentIds[i] ?? "").Trim();
+            cfg.InitialSyncEmployeeIds ??= new List<string>();
+            for (int i = 0; i < cfg.InitialSyncEmployeeIds.Count; i++)
+                cfg.InitialSyncEmployeeIds[i] = (cfg.InitialSyncEmployeeIds[i] ?? "").Trim();
             cfg.EmployeePhotoBaseUrl = string.IsNullOrWhiteSpace(cfg.EmployeePhotoBaseUrl)
                 ? ""
                 : cfg.EmployeePhotoBaseUrl.Trim();
@@ -669,6 +681,9 @@ public sealed class HikvisionAttendanceWindowsService : ServiceBase
         [DataMember]
         public List<string> InitialSyncDepartmentIds { get; set; } = new List<string>();
 
+        [DataMember]
+        public List<string> InitialSyncEmployeeIds { get; set; } = new List<string>();
+
         [DataMember]
         public bool EnableEmployeePhotoSource { get; set; }