diff --git a/core/src/main/java/com/threerings/getdown/data/Application.java b/core/src/main/java/com/threerings/getdown/data/Application.java
index 030cedf..92262f1 100644
--- a/core/src/main/java/com/threerings/getdown/data/Application.java
+++ b/core/src/main/java/com/threerings/getdown/data/Application.java
@@ -484,7 +484,7 @@ public class Application
             String suffix = _trackingURLSuffix == null ? "" : _trackingURLSuffix;
             String ga = getGATrackingCode();
             return _trackingURL == null ? null :
-                HostWhitelist.INSTANCE.verify(new URL(_trackingURL + encodePath(event + suffix + ga)));
+                HostWhitelist.verify(new URL(_trackingURL + encodePath(event + suffix + ga)));
         } catch (MalformedURLException mue) {
             log.warning("Invalid tracking URL", "path", _trackingURL, "event", event, "error", mue);
             return null;
@@ -601,7 +601,7 @@ public class Application
                 latest = SysProps.replaceDomain(latest);
             }
             try {
-                _latest = HostWhitelist.INSTANCE.verify(new URL(latest));
+                _latest = HostWhitelist.verify(new URL(latest));
             } catch (MalformedURLException mue) {
                 log.warning("Invalid URL for latest attribute.", mue);
             }
@@ -1409,7 +1409,7 @@ public class Application
         throws MalformedURLException
     {
         String url = version < 0 ? _appbase : _appbase.replace("%VERSION%", "" + version);
-        return HostWhitelist.INSTANCE.verify(new URL(url));
+        return HostWhitelist.verify(new URL(url));
     }
 
     /**
diff --git a/core/src/main/java/com/threerings/getdown/util/Config.java b/core/src/main/java/com/threerings/getdown/util/Config.java
index 8a34b1b..abdb37b 100644
--- a/core/src/main/java/com/threerings/getdown/util/Config.java
+++ b/core/src/main/java/com/threerings/getdown/util/Config.java
@@ -328,7 +328,7 @@ public class Config
         }
         if (!StringUtil.isBlank(value)) {
             try {
-                HostWhitelist.INSTANCE.verify(new URL(value));
+                HostWhitelist.verify(new URL(value));
             } catch (MalformedURLException e) {
                 log.warning("Invalid URL.", "url", value, e);
                 value = null;
diff --git a/core/src/main/java/com/threerings/getdown/util/HostWhitelist.java b/core/src/main/java/com/threerings/getdown/util/HostWhitelist.java
index c44c3af..7fbcff1 100644
--- a/core/src/main/java/com/threerings/getdown/util/HostWhitelist.java
+++ b/core/src/main/java/com/threerings/getdown/util/HostWhitelist.java
@@ -7,7 +7,6 @@ package com.threerings.getdown.util;
 
 import java.net.MalformedURLException;
 import java.net.URL;
-import java.util.Collections;
 import java.util.List;
 
 import com.threerings.getdown.data.Build;
@@ -20,49 +19,36 @@ import com.threerings.getdown.data.Build;
  */
 public final class HostWhitelist
 {
-    public static final HostWhitelist INSTANCE = new HostWhitelist();
-
-    private final List<String> _hosts;
-
-    HostWhitelist ()
+    /**
+     * Verifies that the specified URL should be accessible, per the built-in host whitelist.
+     * See {@link Build#hostWhitelist()} and {@link #verify(List,URL)}.
+     */
+    public static URL verify (URL url) throws MalformedURLException
     {
-        this(Build.hostWhitelist());
-    }
-
-    HostWhitelist (List<String> hosts)
-    {
-        _hosts = Collections.unmodifiableList(hosts);
+        return verify(Build.hostWhitelist(), url);
     }
 
     /**
-     * Verifies that the specified URL should be accessible, per this host whitelist.
+     * Verifies that the specified URL should be accessible, per the supplied host whitelist.
      * If the URL should not be accessible, this method throws a {@link MalformedURLException}.
      * If the URL should be accessible, this method simply returns the {@link URL} passed in.
      */
-    public final URL verify (URL url) throws MalformedURLException
+    public static URL verify (List<String> hosts, URL url) throws MalformedURLException
     {
-        if (url == null || _hosts.isEmpty()) {
+        if (url == null || hosts.isEmpty()) {
             // either there is no URL to validate or no whitelist was configured
             return url;
         }
 
         String urlHost = url.getHost();
-
-        for (String host : _hosts) {
+        for (String host : hosts) {
             String regex = host.replace(".", "\\.").replace("*", ".*");
             if (urlHost.matches(regex)) {
                 return url;
             }
         }
 
-        throw new MalformedURLException("The host for the specified URL (" + url
-            + ") is not in the host whitelist: " + _hosts);
-    }
-
-    /** {@inheritDoc} */
-    @Override
-    public String toString()
-    {
-        return _hosts.toString();
+        throw new MalformedURLException(
+            "The host for the specified URL (" + url + ") is not in the host whitelist: " + hosts);
     }
 }
diff --git a/core/src/test/java/com/threerings/getdown/util/HostWhitelistTest.java b/core/src/test/java/com/threerings/getdown/util/HostWhitelistTest.java
index c8fc24f..0922f6c 100644
--- a/core/src/test/java/com/threerings/getdown/util/HostWhitelistTest.java
+++ b/core/src/test/java/com/threerings/getdown/util/HostWhitelistTest.java
@@ -10,6 +10,7 @@ import static org.junit.Assert.assertEquals;
 import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.Arrays;
+import java.util.List;
 
 import org.junit.Test;
 
@@ -141,12 +142,12 @@ public class HostWhitelistTest
     private static void checkCanVerify (String whitelist, String url, boolean expectedToPass)
         throws MalformedURLException
     {
-        HostWhitelist w = new HostWhitelist(Arrays.asList(StringUtil.parseStringArray(whitelist)));
+        List<String> w = Arrays.asList(StringUtil.parseStringArray(whitelist));
         URL u = new URL(url);
         boolean passed;
 
         try {
-            w.verify(u);
+            HostWhitelist.verify(w, u);
             passed = true;
         } catch (MalformedURLException e) {
             passed = false;