diff --git a/README.md b/README.md
index 6367006..1da276f 100644
--- a/README.md
+++ b/README.md
@@ -103,12 +103,12 @@ providers:
     hostaliases:
       api.example.com: api.dsa.akamai.example.com
     testurl: https://fronted-ping.dsa.akamai.example.com/ping
-    fronting_snis:
+    frontingsnis:
       default:
-        use_arbitrary_snis: false
+        usearbitrarysnis: false
       br:
-        use_arbitrary_snis: true
-        arbitrary_snis:
+        usearbitrarysnis: true
+        arbitrarysnis:
           - mercadopago.com
           - amazon.com.br
     masquerades:
diff --git a/config.go b/config.go
index 1479dfa..3365f62 100644
--- a/config.go
+++ b/config.go
@@ -32,13 +32,18 @@ type Provider struct {
 	TestURL             string               `yaml:"testurl"`
 	Masquerades         []*Masquerade        `yaml:"masquerades"`
 	VerifyHostname      *string              `yaml:"verifyhostname"`
-	FrontingSNIs        map[string]*SNIConfig `yaml:"fronting_snis"`
+	// Pipeline-emitted YAML keys are lowercase-concatenated, not
+	// snake_case (the upstream generator uses lowercased Go field
+	// names with no yaml tag); the tag here must match the wire
+	// format exactly or yaml.Unmarshal silently leaves the field
+	// zero-valued.
+	FrontingSNIs map[string]*SNIConfig `yaml:"frontingsnis"`
 }
 
 // SNIConfig controls SNI generation for a specific country or "default".
 type SNIConfig struct {
-	UseArbitrarySNIs bool     `yaml:"use_arbitrary_snis"`
-	ArbitrarySNIs    []string `yaml:"arbitrary_snis"`
+	UseArbitrarySNIs bool     `yaml:"usearbitrarysnis"`
+	ArbitrarySNIs    []string `yaml:"arbitrarysnis"`
 }
 
 // Masquerade contains the data for a single domain front.
diff --git a/config_test.go b/config_test.go
index 17b794f..b5dfcb1 100644
--- a/config_test.go
+++ b/config_test.go
@@ -76,6 +76,10 @@ func TestExpandedProvider(t *testing.T) {
 }
 
 func TestParseConfigYAML(t *testing.T) {
+	// Keys are the lowercase-concatenated form the upstream generator
+	// emits (frontingsnis / usearbitrarysnis / arbitrarysnis), NOT
+	// snake_case — a tag-spelling mismatch silently parses these as zero
+	// values, so this fixture guards against that regressing.
 	yml := `
 trustedcas:
   - commonname: "Test CA"
@@ -88,6 +92,14 @@ providers:
     hostaliases:
       example.com: cdn.example.com
     testurl: https://test.example.com/ping
+    frontingsnis:
+      default:
+        usearbitrarysnis: false
+      ir:
+        usearbitrarysnis: true
+        arbitrarysnis:
+          - python.org
+          - snapp.ir
     masquerades:
       - domain: cdn.example.com
         ipaddress: "1.2.3.4"
@@ -101,4 +113,11 @@ providers:
 	assert.Equal(t, "cdn.example.com", p.HostAliases["example.com"])
 	require.Len(t, p.Masquerades, 1)
 	assert.Equal(t, "1.2.3.4", p.Masquerades[0].IpAddress)
+
+	require.Contains(t, p.FrontingSNIs, "default")
+	require.Contains(t, p.FrontingSNIs, "ir")
+	assert.False(t, p.FrontingSNIs["default"].UseArbitrarySNIs)
+	ir := p.FrontingSNIs["ir"]
+	assert.True(t, ir.UseArbitrarySNIs)
+	assert.Equal(t, []string{"python.org", "snapp.ir"}, ir.ArbitrarySNIs)
 }