diff --git a/Docs/Tasks.md b/Docs/Tasks.md
index 991e97a..a71b401 100644
--- a/Docs/Tasks.md
+++ b/Docs/Tasks.md
@@ -550,6 +550,8 @@ If the cookie name ever needs to change (e.g., to support multi-tenant deploymen
 
 ### Task 19 — Remove dead loop variable and asyncio import in auth_service
 
+**Status:** Completed
+
 **Severity:** Low
 
 **Where:**
@@ -578,6 +580,8 @@ Dead code misleads readers into thinking `loop` is used for something. The origi
 
 ### Task 20 — Offload ensure_jail_configs to a thread at startup
 
+**Status:** Completed
+
 **Severity:** Low
 
 **Where:**
diff --git a/backend/app/startup.py b/backend/app/startup.py
index 35d33ef..9a38328 100644
--- a/backend/app/startup.py
+++ b/backend/app/startup.py
@@ -18,6 +18,7 @@ from apscheduler.schedulers.asyncio import AsyncIOScheduler  # type: ignore[impo
 from app.db import init_db, open_db
 from app.services import geo_service, setup_service
 from app.tasks import blocklist_import, geo_cache_flush, geo_re_resolve, health_check, history_sync
+from app.utils.async_utils import run_blocking
 from app.utils.jail_config import ensure_jail_configs
 from app.utils.runtime_state import set_runtime_settings
 from app.utils.setup_state import set_setup_complete_cache
@@ -117,7 +118,7 @@ async def startup_shared_resources(
     finally:
         await startup_db.close()
 
-    ensure_jail_configs(Path(settings.fail2ban_config_dir) / "jail.d")
+    await run_blocking(ensure_jail_configs, Path(settings.fail2ban_config_dir) / "jail.d")
 
     if unresolved_count > 0:
         log.warning("geo_cache_unresolved_ips", unresolved=unresolved_count)