diff --git a/package.json b/package.json
index 06210be..3a55033 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
 				"remote.spin.cliPath": {
 					"type": "string",
 					"markdownDescription": "The spin CLI that opens Spinbox workspaces (`spin+<workspace>`). Empty runs the one the Spinbox extension carries, or else `spin` on the PATH.",
-					"scope": "machine",
+					"scope": "application",
 					"default": ""
 				}
 			}
diff --git a/test/package-manifest.test.ts b/test/package-manifest.test.ts
index de4fae7..48abb39 100644
--- a/test/package-manifest.test.ts
+++ b/test/package-manifest.test.ts
@@ -12,7 +12,7 @@ const pkg = JSON.parse(fs.readFileSync(path.resolve(__dirname, '..', 'package.js
     activationEvents: string[];
     enabledApiProposals: string[];
     contributes: {
-        configuration: { properties: Record<string, unknown> };
+        configuration: { properties: Record<string, { scope?: string }> };
         commands: { command: string }[];
         resourceLabelFormatters: { authority: string }[];
     };
@@ -44,4 +44,14 @@ describe('package.json', () => {
         const read = [...src.matchAll(/getConfiguration\('([\w.]+)'\)\.get<\w+>\('([\w.]+)'/g)].map(m => `${m[1]}.${m[2]}`);
         expect(Object.keys(pkg.contributes.configuration.properties).sort()).toEqual([...new Set(read)].sort());
     });
+
+    // Every setting is of the machine the resolver runs on, which is the window's own and never
+    // the workspace's: application scope is read from the person's settings in every window. A
+    // machine one is not, once the window is remote: VS Code reconnecting a dropped window read
+    // remote.spin.cliPath as empty and ran another spin (test:spin-remote in vscode-spinbox).
+    it('scopes every setting to the application', () => {
+        for (const [name, setting] of Object.entries(pkg.contributes.configuration.properties)) {
+            expect(setting.scope, name).toBe('application');
+        }
+    });
 });