diff --git a/.ai/lessons.md b/.ai/lessons.md
deleted file mode 100644
index 0c08f5d495..0000000000
--- a/.ai/lessons.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Lessons
-
-## Alpine x-transition + tw-animate-css exit animations flash at the end
-- Symptom: a modal/overlay fades out, then flashes fully visible for 1-2 frames before it disappears.
-- Cause: `animate-out` keyframes default to `animation-fill-mode: none`. The element snaps back to its natural state when the keyframe ends. Alpine hides the element (display: none) only after its own timer (read from `transition-duration`), which starts ~2 rAF later than the animation. The gap shows the element at full opacity.
-- Rule: every `x-transition:leave` that uses tw-animate-css `animate-out` MUST also include `fill-mode-forwards`.
-- Rule: when a user reports UI flicker, check ALL layers of the animation stack (state reset timing, spinner flash, keyframe fill mode, focus restore) before you report the fix as complete. My first fix covered state reset and spinner only; the fill-mode snap was the visible one.
diff --git a/.env.testing b/.env.testing
index 1a73117986..d445b5afed 100644
--- a/.env.testing
+++ b/.env.testing
@@ -1,6 +1,7 @@
 APP_ENV=testing
 APP_KEY=base64:8VEfVNVkXQ9mH2L33WBWNMF4eQ0BWD5CTzB8mIxcl+k=
 APP_DEBUG=true
+APP_MAINTENANCE_DRIVER=file
 
 DB_CONNECTION=testing
 
diff --git a/app/Actions/Database/StartClickhouse.php b/app/Actions/Database/StartClickhouse.php
index b256eb2255..f9e92e08f1 100644
--- a/app/Actions/Database/StartClickhouse.php
+++ b/app/Actions/Database/StartClickhouse.php
@@ -3,12 +3,14 @@
 namespace App\Actions\Database;
 
 use App\Models\StandaloneClickhouse;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartClickhouse
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneClickhouse $database;
 
@@ -16,7 +18,11 @@ class StartClickhouse
 
     public string $configuration_dir;
 
-    public function handle(StandaloneClickhouse $database)
+    private string $resolvedClickhouseUser;
+
+    private string $resolvedClickhousePassword;
+
+    public function handle(StandaloneClickhouse $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -51,7 +57,7 @@ class StartClickhouse
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'clickhouse-client', '--user', (string) $this->database->clickhouse_admin_user, '--password', (string) $this->database->clickhouse_admin_password, '--query', 'SELECT 1',
+                        'CMD', 'clickhouse-client', '--user', $this->resolvedClickhouseUser, '--password', $this->resolvedClickhousePassword, '--query', 'SELECT 1',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -109,7 +115,7 @@ class StartClickhouse
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -147,8 +153,17 @@ class StartClickhouse
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedClickhouseUser = (string) $this->database->clickhouse_admin_user;
+        $this->resolvedClickhousePassword = (string) $this->database->clickhouse_admin_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'CLICKHOUSE_USER') {
+                $this->resolvedClickhouseUser = $rawValue;
+            } elseif ($env->key === 'CLICKHOUSE_PASSWORD') {
+                $this->resolvedClickhousePassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('CLICKHOUSE_USER'))->isEmpty()) {
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index cd7e083286..cb1c517539 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -2,6 +2,9 @@
 
 namespace App\Actions\Database;
 
+use App\Enums\ActivityTypes;
+use App\Enums\ProcessStatus;
+use App\Jobs\DatabaseStartJob;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -12,6 +15,7 @@ use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use Lorisleiva\Actions\Concerns\AsAction;
 use Lorisleiva\Actions\Decorators\JobDecorator;
+use Spatie\Activitylog\Models\Activity;
 
 class StartDatabase
 {
@@ -22,7 +26,7 @@ class StartDatabase
         $job->onQueue(deployment_queue());
     }
 
-    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database)
+    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database): Activity|string
     {
         $server = $database->destination->server;
         if (! $server->isFunctional()) {
@@ -33,32 +37,32 @@ class StartDatabase
             'last_restart_at' => null,
             'last_restart_type' => null,
         ]);
-        switch ($database->getMorphClass()) {
-            case StandalonePostgresql::class:
-                $activity = StartPostgresql::run($database);
-                break;
-            case StandaloneRedis::class:
-                $activity = StartRedis::run($database);
-                break;
-            case StandaloneMongodb::class:
-                $activity = StartMongodb::run($database);
-                break;
-            case StandaloneMysql::class:
-                $activity = StartMysql::run($database);
-                break;
-            case StandaloneMariadb::class:
-                $activity = StartMariadb::run($database);
-                break;
-            case StandaloneKeydb::class:
-                $activity = StartKeydb::run($database);
-                break;
-            case StandaloneDragonfly::class:
-                $activity = StartDragonfly::run($database);
-                break;
-            case StandaloneClickhouse::class:
-                $activity = StartClickhouse::run($database);
-                break;
+
+        $activity = activity()
+            ->withProperties([
+                'server_uuid' => $server->uuid,
+                'type' => ActivityTypes::INLINE->value,
+                'type_uuid' => $database->uuid,
+                'status' => ProcessStatus::QUEUED->value,
+                'team_id' => $server->team_id,
+                'operation' => 'database-start',
+            ])
+            ->performedOn($database)
+            ->event(ActivityTypes::INLINE->value)
+            ->log('[]');
+
+        if ($activity === null) {
+            return 'Database start could not be queued because activity logging is disabled.';
         }
+
+        DatabaseStartJob::dispatch(
+            $database->getMorphClass(),
+            (int) $database->getKey(),
+            (int) $database->team()->id,
+            (int) $activity->getKey(),
+            auth()->id(),
+        );
+
         if ($database->is_public && $database->public_port) {
             StartDatabaseProxy::dispatch($database);
         }
diff --git a/app/Actions/Database/StartDragonfly.php b/app/Actions/Database/StartDragonfly.php
index ddd930f278..078d557f57 100644
--- a/app/Actions/Database/StartDragonfly.php
+++ b/app/Actions/Database/StartDragonfly.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneDragonfly;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartDragonfly
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneDragonfly $database;
 
@@ -20,7 +22,9 @@ class StartDragonfly
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneDragonfly $database)
+    private string $resolvedRedisPassword;
+
+    public function handle(StandaloneDragonfly $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -107,7 +111,7 @@ class StartDragonfly
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'redis-cli', '-a', (string) $this->database->dragonfly_password, 'ping',
+                        'CMD', 'redis-cli', '-a', $this->resolvedRedisPassword, 'ping',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -196,12 +200,13 @@ class StartDragonfly
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function buildStartCommand(): string
     {
-        $command = "dragonfly --requirepass {$this->database->dragonfly_password}";
+        $escapedRedisPassword = escapeshellarg($this->resolvedRedisPassword);
+        $command = "dragonfly --requirepass {$escapedRedisPassword}";
 
         if ($this->database->enable_ssl) {
             $sslArgs = [
@@ -251,8 +256,14 @@ class StartDragonfly
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedRedisPassword = (string) $this->database->dragonfly_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'REDIS_PASSWORD') {
+                $this->resolvedRedisPassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('REDIS_PASSWORD'))->isEmpty()) {
diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index cc017e3514..3b9cba28f4 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneKeydb;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartKeydb
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneKeydb $database;
 
@@ -20,7 +22,9 @@ class StartKeydb
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneKeydb $database)
+    private string $resolvedRedisPassword;
+
+    public function handle(StandaloneKeydb $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -109,7 +113,7 @@ class StartKeydb
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'keydb-cli', '--pass', (string) $this->database->keydb_password, 'ping',
+                        'CMD', 'keydb-cli', '--pass', $this->resolvedRedisPassword, 'ping',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -214,7 +218,7 @@ class StartKeydb
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -252,8 +256,14 @@ class StartKeydb
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedRedisPassword = (string) $this->database->keydb_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'REDIS_PASSWORD') {
+                $this->resolvedRedisPassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('REDIS_PASSWORD'))->isEmpty()) {
@@ -280,6 +290,7 @@ class StartKeydb
     {
         $hasKeydbConf = ! is_null($this->database->keydb_conf) && ! empty($this->database->keydb_conf);
         $keydbConfPath = '/etc/keydb/keydb.conf';
+        $escapedRedisPassword = escapeshellarg($this->resolvedRedisPassword);
 
         if ($hasKeydbConf) {
             $confContent = $this->database->keydb_conf;
@@ -288,10 +299,10 @@ class StartKeydb
             if ($hasRequirePass) {
                 $command = "keydb-server $keydbConfPath";
             } else {
-                $command = "keydb-server $keydbConfPath --requirepass {$this->database->keydb_password}";
+                $command = "keydb-server $keydbConfPath --requirepass {$escapedRedisPassword}";
             }
         } else {
-            $command = "keydb-server --requirepass {$this->database->keydb_password} --appendonly yes";
+            $command = "keydb-server --requirepass {$escapedRedisPassword} --appendonly yes";
         }
 
         if ($this->database->enable_ssl) {
diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index 2f030ae299..a05da25efd 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneMariadb;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartMariadb
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneMariadb $database;
 
@@ -20,7 +22,7 @@ class StartMariadb
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneMariadb $database)
+    public function handle(StandaloneMariadb $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -216,7 +218,7 @@ class StartMariadb
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -255,7 +257,7 @@ class StartMariadb
     {
         $environment_variables = collect();
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $environment_variables->push($env->key.'='.$this->database->resolveSecretManagerEnvironmentVariable($env));
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('MARIADB_ROOT_PASSWORD'))->isEmpty()) {
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 097e19f7b2..ff338aa99f 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneMongodb;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartMongodb
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneMongodb $database;
 
@@ -20,7 +22,13 @@ class StartMongodb
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneMongodb $database)
+    private string $resolvedMongoUsername;
+
+    private string $resolvedMongoPassword;
+
+    private string $resolvedMongoDatabase;
+
+    public function handle(StandaloneMongodb $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -265,7 +273,7 @@ class StartMongodb
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -303,8 +311,20 @@ class StartMongodb
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedMongoUsername = (string) $this->database->mongo_initdb_root_username;
+        $this->resolvedMongoPassword = (string) $this->database->mongo_initdb_root_password;
+        $this->resolvedMongoDatabase = (string) $this->database->mongo_initdb_database;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'MONGO_INITDB_ROOT_USERNAME') {
+                $this->resolvedMongoUsername = $rawValue;
+            } elseif ($env->key === 'MONGO_INITDB_ROOT_PASSWORD') {
+                $this->resolvedMongoPassword = $rawValue;
+            } elseif ($env->key === 'MONGO_INITDB_DATABASE') {
+                $this->resolvedMongoDatabase = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('MONGO_INITDB_ROOT_USERNAME'))->isEmpty()) {
@@ -337,9 +357,9 @@ class StartMongodb
 
     private function add_default_database()
     {
-        $dbJson = json_encode($this->database->mongo_initdb_database, JSON_UNESCAPED_SLASHES);
-        $userJson = json_encode($this->database->mongo_initdb_root_username, JSON_UNESCAPED_SLASHES);
-        $pwdJson = json_encode($this->database->mongo_initdb_root_password, JSON_UNESCAPED_SLASHES);
+        $dbJson = json_encode($this->resolvedMongoDatabase, JSON_UNESCAPED_SLASHES);
+        $userJson = json_encode($this->resolvedMongoUsername, JSON_UNESCAPED_SLASHES);
+        $pwdJson = json_encode($this->resolvedMongoPassword, JSON_UNESCAPED_SLASHES);
         $content = "db = db.getSiblingDB({$dbJson});db.createCollection('init_collection');db.createUser({user: {$userJson}, pwd: {$pwdJson}, roles: [{role:\"readWrite\",db:{$dbJson}}]});";
         $content_base64 = base64_encode($content);
         $this->commands[] = "mkdir -p $this->configuration_dir/docker-entrypoint-initdb.d";
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index d21ee02fb1..cff8d0b363 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneMysql;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartMysql
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneMysql $database;
 
@@ -20,7 +22,9 @@ class StartMysql
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneMysql $database)
+    private string $resolvedMysqlRootPassword;
+
+    public function handle(StandaloneMysql $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -104,7 +108,7 @@ class StartMysql
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'mysqladmin', 'ping', '-h', 'localhost', '-u', 'root', "-p{$this->database->mysql_root_password}",
+                        'CMD', 'mysqladmin', 'ping', '-h', 'localhost', '-u', 'root', "-p{$this->resolvedMysqlRootPassword}",
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -218,7 +222,7 @@ class StartMysql
 
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -256,8 +260,14 @@ class StartMysql
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedMysqlRootPassword = (string) $this->database->mysql_root_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'MYSQL_ROOT_PASSWORD') {
+                $this->resolvedMysqlRootPassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('MYSQL_ROOT_PASSWORD'))->isEmpty()) {
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index f70e8f3cfd..f9dd7a3c4f 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandalonePostgresql;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartPostgresql
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandalonePostgresql $database;
 
@@ -22,7 +24,11 @@ class StartPostgresql
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandalonePostgresql $database)
+    private string $resolvedPostgresUser;
+
+    private string $resolvedPostgresDatabase;
+
+    public function handle(StandalonePostgresql $database, ?Activity $activity = null)
     {
         $this->database = $database;
         $container_name = $this->database->uuid;
@@ -111,7 +117,7 @@ class StartPostgresql
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'psql', '-U', (string) $this->database->postgres_user, '-d', (string) $this->database->postgres_db, '-c', 'SELECT 1',
+                        'CMD', 'psql', '-U', $this->resolvedPostgresUser, '-d', $this->resolvedPostgresDatabase, '-c', 'SELECT 1',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -227,7 +233,7 @@ class StartPostgresql
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -265,8 +271,17 @@ class StartPostgresql
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedPostgresUser = (string) $this->database->postgres_user;
+        $this->resolvedPostgresDatabase = (string) $this->database->postgres_db;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'POSTGRES_USER') {
+                $this->resolvedPostgresUser = $rawValue;
+            } elseif ($env->key === 'POSTGRES_DB') {
+                $this->resolvedPostgresDatabase = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('POSTGRES_USER'))->isEmpty()) {
diff --git a/app/Actions/Database/StartRedis.php b/app/Actions/Database/StartRedis.php
index 8d65453f70..41ece532b1 100644
--- a/app/Actions/Database/StartRedis.php
+++ b/app/Actions/Database/StartRedis.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneRedis;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartRedis
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneRedis $database;
 
@@ -20,7 +22,11 @@ class StartRedis
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneRedis $database)
+    private ?string $resolvedRedisPassword = null;
+
+    private ?string $resolvedRedisUsername = null;
+
+    public function handle(StandaloneRedis $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -209,7 +215,7 @@ class StartRedis
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -249,23 +255,40 @@ class StartRedis
         $environment_variables = collect();
 
         foreach ($this->database->runtime_environment_variables as $env) {
+            $usesSecretManager = $this->database->environmentVariableUsesSecretManager($env);
+
             if ($env->is_shared) {
-                $environment_variables->push("$env->key=$env->real_value");
+                $environment_variables->push($env->key.'='.$this->database->resolveSecretManagerEnvironmentVariable($env));
 
                 if ($env->key === 'REDIS_PASSWORD') {
-                    $this->database->update(['redis_password' => $env->real_value]);
+                    $this->resolvedRedisPassword = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+
+                    if (! $usesSecretManager) {
+                        $this->database->update(['redis_password' => $this->resolvedRedisPassword]);
+                    }
                 }
 
                 if ($env->key === 'REDIS_USERNAME') {
-                    $this->database->update(['redis_username' => $env->real_value]);
+                    $this->resolvedRedisUsername = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+
+                    if (! $usesSecretManager) {
+                        $this->database->update(['redis_username' => $this->resolvedRedisUsername]);
+                    }
                 }
             } else {
-                if ($env->key === 'REDIS_PASSWORD') {
+                if ($env->key === 'REDIS_PASSWORD' && ! $usesSecretManager) {
                     $env->update(['value' => $this->database->redis_password]);
-                } elseif ($env->key === 'REDIS_USERNAME') {
+                } elseif ($env->key === 'REDIS_USERNAME' && ! $usesSecretManager) {
                     $env->update(['value' => $this->database->redis_username]);
                 }
-                $environment_variables->push("$env->key=$env->real_value");
+
+                if ($env->key === 'REDIS_PASSWORD') {
+                    $this->resolvedRedisPassword = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+                } elseif ($env->key === 'REDIS_USERNAME') {
+                    $this->resolvedRedisUsername = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+                }
+
+                $environment_variables->push($env->key.'='.$this->database->resolveSecretManagerEnvironmentVariable($env));
             }
         }
 
@@ -276,6 +299,7 @@ class StartRedis
 
     private function buildStartCommand(): string
     {
+        $redisPassword = $this->resolvedRedisPassword ?? $this->database->redis_password;
         $hasRedisConf = ! is_null($this->database->redis_conf) && ! empty($this->database->redis_conf);
         $redisConfPath = '/usr/local/etc/redis/redis.conf';
 
@@ -286,10 +310,10 @@ class StartRedis
             if ($hasRequirePass) {
                 $command = "redis-server $redisConfPath";
             } else {
-                $command = "redis-server $redisConfPath --requirepass {$this->database->redis_password}";
+                $command = "redis-server $redisConfPath --requirepass {$redisPassword}";
             }
         } else {
-            $command = "redis-server --requirepass {$this->database->redis_password} --appendonly yes";
+            $command = "redis-server --requirepass {$redisPassword} --appendonly yes";
         }
 
         if ($this->database->enable_ssl) {
diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php
index 44602f0619..c69863c572 100644
--- a/app/Actions/Fortify/CreateNewUser.php
+++ b/app/Actions/Fortify/CreateNewUser.php
@@ -30,7 +30,7 @@ class CreateNewUser implements CreatesNewUsers
     public function create(array $input): User
     {
         $settings = instanceSettings();
-        if (! $settings->is_registration_enabled) {
+        if (! $settings->isPasswordRegistrationAllowed()) {
             abort(403);
         }
 
diff --git a/app/Actions/Server/CheckUpdates.php b/app/Actions/Server/CheckUpdates.php
index f90e007089..5cf5658f8f 100644
--- a/app/Actions/Server/CheckUpdates.php
+++ b/app/Actions/Server/CheckUpdates.php
@@ -3,6 +3,7 @@
 namespace App\Actions\Server;
 
 use App\Models\Server;
+use Illuminate\Support\Facades\Log;
 use Lorisleiva\Actions\Concerns\AsAction;
 
 class CheckUpdates
@@ -106,6 +107,15 @@ class CheckUpdates
                     $out['osId'] = $osId;
                     $out['package_manager'] = $packageManager;
 
+                    return $out;
+                case 'apk':
+                    instant_remote_process(['apk update -q'], $server);
+                    $output = instant_remote_process(['LANG=C apk list --upgradable 2>/dev/null'], $server);
+
+                    $out = $this->parseApkOutput($output);
+                    $out['osId'] = $osId;
+                    $out['package_manager'] = $packageManager;
+
                     return $out;
                 default:
                     return [
@@ -266,11 +276,39 @@ class CheckUpdates
         // Include unparsed lines in the result for debugging if any exist
         if (! empty($unparsedLines)) {
             $result['unparsed_lines'] = $unparsedLines;
-            \Illuminate\Support\Facades\Log::debug('Pacman output contained unparsed lines', [
+            Log::debug('Pacman output contained unparsed lines', [
                 'unparsed_lines' => $unparsedLines,
             ]);
         }
 
         return $result;
     }
+
+    private function parseApkOutput(string $output): array
+    {
+        $updates = [];
+        $lines = explode("\n", $output);
+
+        foreach ($lines as $line) {
+            // Skip empty lines
+            if (empty($line)) {
+                continue;
+            }
+
+            // Example line: docker-cli-compose-2.31.0-r5 x86_64 {docker-cli-compose} (Apache-2.0) [upgradable from: docker-cli-compose-2.31.0-r4]
+            if (preg_match('/^(.+)-([0-9]\S*) (\S+) \{\S+\} \([^)]+\) \[upgradable from: .+?-([0-9][^\]]+)\]$/', $line, $matches)) {
+                $updates[] = [
+                    'package' => $matches[1],
+                    'new_version' => $matches[2],
+                    'architecture' => $matches[3],
+                    'current_version' => $matches[4],
+                ];
+            }
+        }
+
+        return [
+            'total_updates' => count($updates),
+            'updates' => $updates,
+        ];
+    }
 }
diff --git a/app/Actions/Server/InstallDocker.php b/app/Actions/Server/InstallDocker.php
index 2e08ec6ad9..552445d728 100644
--- a/app/Actions/Server/InstallDocker.php
+++ b/app/Actions/Server/InstallDocker.php
@@ -79,6 +79,8 @@ class InstallDocker
                 $command = $command->merge([$this->getSuseDockerInstallCommand()]);
             } elseif ($supported_os_type->contains('arch')) {
                 $command = $command->merge([$this->getArchDockerInstallCommand()]);
+            } elseif ($supported_os_type->contains('alpine')) {
+                $command = $command->merge([$this->getAlpineDockerInstallCommand()]);
             } else {
                 $command = $command->merge([$this->getGenericDockerInstallCommand()]);
             }
@@ -93,9 +95,8 @@ class InstallDocker
                 "jq -s '.[0] * .[1]' /etc/docker/daemon.json.coolify /etc/docker/daemon.json | tee /etc/docker/daemon.json.appended > /dev/null",
                 'mv /etc/docker/daemon.json.appended /etc/docker/daemon.json',
                 "echo 'Restarting Docker Engine...'",
-                'systemctl enable docker >/dev/null 2>&1 || true',
-                'systemctl restart docker',
             ]);
+            $command = $command->merge($this->getDockerServiceCommands($supported_os_type->contains('alpine')));
             if ($server->isSwarm()) {
                 $command = $command->merge([
                     'docker network create --attachable --driver overlay coolify-overlay >/dev/null 2>&1 || true',
@@ -154,6 +155,28 @@ class InstallDocker
             'systemctl start docker.service';
     }
 
+    private function getAlpineDockerInstallCommand(): string
+    {
+        return 'apk update && '.
+            'apk add docker docker-cli-buildx docker-cli-compose && '.
+            'mkdir -p /etc/docker';
+    }
+
+    private function getDockerServiceCommands(bool $usesOpenRc): array
+    {
+        if ($usesOpenRc) {
+            return [
+                'rc-update add docker default',
+                'rc-service docker restart',
+            ];
+        }
+
+        return [
+            'systemctl enable docker >/dev/null 2>&1 || true',
+            'systemctl restart docker',
+        ];
+    }
+
     private function getGenericDockerInstallCommand(): string
     {
         return 'curl -fsSL https://get.docker.com | sh';
diff --git a/app/Actions/Server/InstallPrerequisites.php b/app/Actions/Server/InstallPrerequisites.php
index 84be7f2068..57fd4f1d7c 100644
--- a/app/Actions/Server/InstallPrerequisites.php
+++ b/app/Actions/Server/InstallPrerequisites.php
@@ -53,6 +53,8 @@ class InstallPrerequisites
                 "echo 'Installing Prerequisites for Arch Linux...'",
                 'pacman -Syu --noconfirm --needed curl wget git jq',
             ]);
+        } elseif ($supported_os_type->contains('alpine')) {
+            $command = $command->merge($this->getAlpinePrerequisiteCommands());
         } else {
             throw new \Exception('Unsupported OS type for prerequisites installation');
         }
@@ -61,4 +63,18 @@ class InstallPrerequisites
 
         return remote_process($command, $server);
     }
+
+    private function getAlpinePrerequisiteCommands(): array
+    {
+        return [
+            "echo 'Installing Prerequisites for Alpine Linux...'",
+            "sed -i '/^#.*\\/community/s/^#//' /etc/apk/repositories 2>/dev/null || true",
+            'apk update',
+            'command -v bash >/dev/null || apk add bash',
+            'command -v curl >/dev/null || apk add curl',
+            'command -v wget >/dev/null || apk add wget',
+            'command -v git >/dev/null || apk add git',
+            'command -v jq >/dev/null || apk add jq',
+        ];
+    }
 }
diff --git a/app/Actions/Server/UpdatePackage.php b/app/Actions/Server/UpdatePackage.php
index ab0ca94943..2b06e06011 100644
--- a/app/Actions/Server/UpdatePackage.php
+++ b/app/Actions/Server/UpdatePackage.php
@@ -58,6 +58,10 @@ class UpdatePackage
                     $commandAll = 'pacman -Syu --noconfirm';
                     $commandInstall = 'pacman -S --noconfirm '.$sanitizedPackage;
                     break;
+                case 'apk':
+                    $commandAll = 'apk update && apk upgrade';
+                    $commandInstall = 'apk upgrade '.$sanitizedPackage;
+                    break;
                 default:
                     return [
                         'error' => 'OS not supported',
diff --git a/app/Auth/Oidc/Exceptions/OidcDiscoveryException.php b/app/Auth/Oidc/Exceptions/OidcDiscoveryException.php
new file mode 100644
index 0000000000..e4a2ba0dfe
--- /dev/null
+++ b/app/Auth/Oidc/Exceptions/OidcDiscoveryException.php
@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcDiscoveryException extends OidcException {}
diff --git a/app/Auth/Oidc/Exceptions/OidcException.php b/app/Auth/Oidc/Exceptions/OidcException.php
new file mode 100644
index 0000000000..3050adedf9
--- /dev/null
+++ b/app/Auth/Oidc/Exceptions/OidcException.php
@@ -0,0 +1,7 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+use RuntimeException;
+
+class OidcException extends RuntimeException {}
diff --git a/app/Auth/Oidc/Exceptions/OidcJwksException.php b/app/Auth/Oidc/Exceptions/OidcJwksException.php
new file mode 100644
index 0000000000..097979548a
--- /dev/null
+++ b/app/Auth/Oidc/Exceptions/OidcJwksException.php
@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcJwksException extends OidcException {}
diff --git a/app/Auth/Oidc/Exceptions/OidcSigningKeyNotFoundException.php b/app/Auth/Oidc/Exceptions/OidcSigningKeyNotFoundException.php
new file mode 100644
index 0000000000..f57ddae554
--- /dev/null
+++ b/app/Auth/Oidc/Exceptions/OidcSigningKeyNotFoundException.php
@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcSigningKeyNotFoundException extends OidcTokenException {}
diff --git a/app/Auth/Oidc/Exceptions/OidcTokenException.php b/app/Auth/Oidc/Exceptions/OidcTokenException.php
new file mode 100644
index 0000000000..bdb92a6513
--- /dev/null
+++ b/app/Auth/Oidc/Exceptions/OidcTokenException.php
@@ -0,0 +1,5 @@
+<?php
+
+namespace App\Auth\Oidc\Exceptions;
+
+class OidcTokenException extends OidcException {}
diff --git a/app/Auth/Oidc/OidcConfig.php b/app/Auth/Oidc/OidcConfig.php
new file mode 100644
index 0000000000..04cb4effe5
--- /dev/null
+++ b/app/Auth/Oidc/OidcConfig.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Models\OauthSetting;
+
+final readonly class OidcConfig
+{
+    /**
+     * @param  array<int, string>  $scopes
+     */
+    public function __construct(
+        public string $issuerUrl,
+        public string $clientId,
+        public string $clientSecret,
+        public string $redirectUri,
+        public array $scopes = ['openid', 'email', 'profile'],
+        public bool $usePkce = true,
+        public int $clockSkewSeconds = 60,
+    ) {}
+
+    public static function fromOauthSetting(OauthSetting $setting): self
+    {
+        return new self(
+            issuerUrl: rtrim((string) $setting->base_url, '/'),
+            clientId: (string) $setting->client_id,
+            clientSecret: (string) $setting->client_secret,
+            redirectUri: filled($setting->redirect_uri) ? $setting->redirect_uri : route('auth.callback', 'oidc'),
+            scopes: $setting->scopeList(),
+            usePkce: $setting->use_pkce ?? true,
+            clockSkewSeconds: $setting->clock_skew_seconds ?? 60,
+        );
+    }
+}
diff --git a/app/Auth/Oidc/OidcDiscoveryDocument.php b/app/Auth/Oidc/OidcDiscoveryDocument.php
new file mode 100644
index 0000000000..d17061c51d
--- /dev/null
+++ b/app/Auth/Oidc/OidcDiscoveryDocument.php
@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Auth\Oidc\Exceptions\OidcDiscoveryException;
+
+final readonly class OidcDiscoveryDocument
+{
+    /**
+     * @param  array<int, string>  $supportedScopes
+     * @param  array<int, string>  $supportedClaims
+     * @param  array<int, string>  $idTokenSigningAlgValuesSupported
+     */
+    public function __construct(
+        public string $issuer,
+        public string $authorizationEndpoint,
+        public string $tokenEndpoint,
+        public string $userinfoEndpoint,
+        public string $jwksUri,
+        public ?string $endSessionEndpoint = null,
+        public array $supportedScopes = [],
+        public array $supportedClaims = [],
+        public array $idTokenSigningAlgValuesSupported = [],
+    ) {}
+
+    /**
+     * @param  array<string, mixed>  $payload
+     */
+    public static function fromArray(array $payload): self
+    {
+        foreach (['issuer', 'authorization_endpoint', 'token_endpoint', 'userinfo_endpoint', 'jwks_uri'] as $field) {
+            if (! is_string($payload[$field] ?? null) || trim($payload[$field]) === '') {
+                throw new OidcDiscoveryException("Discovery document is missing required field: {$field}");
+            }
+        }
+
+        return new self(
+            issuer: $payload['issuer'],
+            authorizationEndpoint: $payload['authorization_endpoint'],
+            tokenEndpoint: $payload['token_endpoint'],
+            userinfoEndpoint: $payload['userinfo_endpoint'],
+            jwksUri: $payload['jwks_uri'],
+            endSessionEndpoint: is_string($payload['end_session_endpoint'] ?? null) ? $payload['end_session_endpoint'] : null,
+            supportedScopes: self::stringList($payload['scopes_supported'] ?? []),
+            supportedClaims: self::stringList($payload['claims_supported'] ?? []),
+            idTokenSigningAlgValuesSupported: self::stringList($payload['id_token_signing_alg_values_supported'] ?? []),
+        );
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private static function stringList(mixed $value): array
+    {
+        if (! is_array($value)) {
+            return [];
+        }
+
+        return array_values(array_map('strval', $value));
+    }
+}
diff --git a/app/Auth/Oidc/OidcDiscoveryService.php b/app/Auth/Oidc/OidcDiscoveryService.php
new file mode 100644
index 0000000000..0847afc9a7
--- /dev/null
+++ b/app/Auth/Oidc/OidcDiscoveryService.php
@@ -0,0 +1,97 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Auth\Oidc\Exceptions\OidcDiscoveryException;
+use App\Auth\Oidc\Exceptions\OidcJwksException;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Throwable;
+
+class OidcDiscoveryService
+{
+    public function discover(string $issuerUrl): OidcDiscoveryDocument
+    {
+        $this->assertHttpsUrl($issuerUrl, new OidcDiscoveryException('Issuer URL must be an absolute HTTPS URL.'));
+
+        $issuerUrl = rtrim($issuerUrl, '/');
+        $cacheKey = 'oidc:discovery:'.hash('sha256', $issuerUrl);
+
+        return Cache::remember($cacheKey, 3600, function () use ($issuerUrl): OidcDiscoveryDocument {
+            $url = $issuerUrl.'/.well-known/openid-configuration';
+
+            try {
+                $response = Http::timeout(5)->connectTimeout(3)->acceptJson()->get($url);
+            } catch (Throwable $e) {
+                throw new OidcDiscoveryException("Failed to fetch discovery document: {$e->getMessage()}", previous: $e);
+            }
+
+            if ($response->failed()) {
+                throw new OidcDiscoveryException("Discovery endpoint returned HTTP {$response->status()}");
+            }
+
+            $json = $response->json();
+            if (! is_array($json) || $json === []) {
+                throw new OidcDiscoveryException('Discovery endpoint returned invalid JSON.');
+            }
+
+            $discovery = OidcDiscoveryDocument::fromArray($json);
+            if (rtrim($discovery->issuer, '/') !== $issuerUrl) {
+                throw new OidcDiscoveryException('Discovery issuer does not match the configured issuer URL.');
+            }
+
+            return $discovery;
+        });
+    }
+
+    /**
+     * Fetch the JWKS for the given URI.
+     *
+     * When $forceRefresh is true the cached document is bypassed so freshly
+     * rotated signing keys become visible immediately. A short cooldown still
+     * prevents a flood of upstream requests if many logins miss the same kid.
+     *
+     * @return array<string, mixed>
+     */
+    public function jwks(string $jwksUri, bool $forceRefresh = false): array
+    {
+        $this->assertHttpsUrl($jwksUri, new OidcJwksException('JWKS URI must be an absolute HTTPS URL.'));
+
+        $cacheKey = 'oidc:jwks:'.hash('sha256', $jwksUri);
+
+        if ($forceRefresh) {
+            $cooldownKey = $cacheKey.':refresh';
+            if (Cache::add($cooldownKey, true, 60)) {
+                Cache::forget($cacheKey);
+            }
+        }
+
+        return Cache::remember($cacheKey, 21600, function () use ($jwksUri): array {
+            try {
+                $response = Http::timeout(5)->connectTimeout(3)->acceptJson()->get($jwksUri);
+            } catch (Throwable $e) {
+                throw new OidcJwksException("Failed to fetch JWKS: {$e->getMessage()}", previous: $e);
+            }
+
+            if ($response->failed()) {
+                throw new OidcJwksException("JWKS endpoint returned HTTP {$response->status()}");
+            }
+
+            $json = $response->json();
+            if (! is_array($json) || ! is_array($json['keys'] ?? null)) {
+                throw new OidcJwksException("JWKS endpoint returned an invalid payload without 'keys'.");
+            }
+
+            return $json;
+        });
+    }
+
+    private function assertHttpsUrl(string $url, Throwable $exception): void
+    {
+        $parts = parse_url($url);
+
+        if (($parts['scheme'] ?? null) !== 'https' || ! is_string($parts['host'] ?? null) || $parts['host'] === '') {
+            throw $exception;
+        }
+    }
+}
diff --git a/app/Auth/Oidc/OidcTokenValidator.php b/app/Auth/Oidc/OidcTokenValidator.php
new file mode 100644
index 0000000000..a8563611dd
--- /dev/null
+++ b/app/Auth/Oidc/OidcTokenValidator.php
@@ -0,0 +1,199 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use App\Auth\Oidc\Exceptions\OidcSigningKeyNotFoundException;
+use App\Auth\Oidc\Exceptions\OidcTokenException;
+use Firebase\JWT\JWK;
+use Firebase\JWT\JWT;
+use Throwable;
+
+class OidcTokenValidator
+{
+    /**
+     * Algorithms we accept for id_token signatures. RS256 only — this is the
+     * OIDC baseline and a strict allowlist prevents algorithm-confusion and
+     * "none" attacks.
+     */
+    private const ALLOWED_ALGORITHM = 'RS256';
+
+    /**
+     * @param  array<string, mixed>  $jwks
+     * @return array<string, mixed>
+     */
+    public function validate(
+        string $idToken,
+        OidcDiscoveryDocument $discovery,
+        array $jwks,
+        string $clientId,
+        ?string $expectedNonce = null,
+        int $clockSkewSeconds = 60,
+    ): array {
+        $kid = $this->extractKid($idToken);
+
+        try {
+            $keys = JWK::parseKeySet($this->signingKeysOnly($jwks), self::ALLOWED_ALGORITHM);
+        } catch (Throwable $e) {
+            throw new OidcTokenException("Unable to parse JWKS: {$e->getMessage()}", previous: $e);
+        }
+
+        // Surface an unknown signing key distinctly so the caller can refresh
+        // the JWKS once (key rotation) before giving up.
+        if (! array_key_exists($kid, $keys)) {
+            throw new OidcSigningKeyNotFoundException('No matching JWKS key found for id_token kid.');
+        }
+
+        $previousLeeway = JWT::$leeway;
+        JWT::$leeway = $clockSkewSeconds;
+
+        try {
+            // Validates signature, header alg against the key alg (RS256),
+            // exp, nbf and iat. Throws on any failure.
+            $claims = (array) JWT::decode($idToken, $keys);
+        } catch (OidcTokenException $e) {
+            throw $e;
+        } catch (Throwable $e) {
+            throw new OidcTokenException("id_token validation failed: {$e->getMessage()}", previous: $e);
+        } finally {
+            JWT::$leeway = $previousLeeway;
+        }
+
+        $this->assertExpiry($claims);
+        $this->assertIssuer($claims, $discovery->issuer);
+        $this->assertAudience($claims, $clientId);
+        $this->assertNonce($claims, $expectedNonce);
+        $this->assertSubject($claims);
+
+        return $claims;
+    }
+
+    /**
+     * Drop JWKS entries explicitly marked for anything other than signing
+     * (e.g. "use":"enc") so they can never verify an id_token signature.
+     * firebase/php-jwt does not honour the "use" parameter on its own.
+     *
+     * @param  array<string, mixed>  $jwks
+     * @return array<string, mixed>
+     */
+    private function signingKeysOnly(array $jwks): array
+    {
+        $keys = array_values(array_filter(
+            $jwks['keys'] ?? [],
+            fn ($jwk): bool => is_array($jwk) && (! isset($jwk['use']) || $jwk['use'] === 'sig'),
+        ));
+
+        return ['keys' => $keys];
+    }
+
+    /**
+     * Decode just the JWT header to read the kid before signature
+     * verification, so an unknown key can be reported as a rotation miss.
+     */
+    private function extractKid(string $idToken): string
+    {
+        $segments = explode('.', $idToken);
+        if (count($segments) !== 3) {
+            throw new OidcTokenException('Malformed id_token.');
+        }
+
+        $header = json_decode($this->base64UrlDecode($segments[0]), true);
+        if (! is_array($header)) {
+            throw new OidcTokenException('id_token header contains invalid JSON.');
+        }
+
+        if (($header['alg'] ?? null) !== self::ALLOWED_ALGORITHM) {
+            throw new OidcTokenException('id_token uses a disallowed algorithm.');
+        }
+
+        $kid = $header['kid'] ?? null;
+        if (! is_string($kid) || $kid === '') {
+            throw new OidcTokenException('id_token header is missing kid.');
+        }
+
+        return $kid;
+    }
+
+    private function base64UrlDecode(string $value): string
+    {
+        $remainder = strlen($value) % 4;
+        if ($remainder !== 0) {
+            $value .= str_repeat('=', 4 - $remainder);
+        }
+
+        $decoded = base64_decode(strtr($value, '-_', '+/'), true);
+        if ($decoded === false) {
+            throw new OidcTokenException('Invalid base64url value in id_token header.');
+        }
+
+        return $decoded;
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertExpiry(array $claims): void
+    {
+        // Firebase enforces the exp window when present; OIDC requires it to exist.
+        if (! is_numeric($claims['exp'] ?? null)) {
+            throw new OidcTokenException('id_token is missing the exp claim.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertSubject(array $claims): void
+    {
+        $subject = $claims['sub'] ?? null;
+        if (! is_string($subject) || $subject === '') {
+            throw new OidcTokenException('id_token subject is missing or invalid.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertIssuer(array $claims, string $expectedIssuer): void
+    {
+        if (($claims['iss'] ?? null) !== $expectedIssuer) {
+            throw new OidcTokenException('id_token issuer does not match discovery issuer.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertAudience(array $claims, string $clientId): void
+    {
+        $audience = $claims['aud'] ?? null;
+        if (is_string($audience)) {
+            $audience = [$audience];
+        }
+
+        if (! is_array($audience) || ! in_array($clientId, $audience, true)) {
+            throw new OidcTokenException('id_token audience does not include configured client id.');
+        }
+
+        if (count($audience) > 1 && (! isset($claims['azp']) || $claims['azp'] !== $clientId)) {
+            throw new OidcTokenException('id_token azp is required when aud contains multiple values and must match configured client id.');
+        }
+
+        if (isset($claims['azp']) && $claims['azp'] !== $clientId) {
+            throw new OidcTokenException('id_token azp does not match configured client id.');
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    private function assertNonce(array $claims, ?string $expectedNonce): void
+    {
+        if ($expectedNonce === null) {
+            return;
+        }
+
+        if (($claims['nonce'] ?? null) !== $expectedNonce) {
+            throw new OidcTokenException('id_token nonce does not match.');
+        }
+    }
+}
diff --git a/app/Auth/Oidc/OidcUser.php b/app/Auth/Oidc/OidcUser.php
new file mode 100644
index 0000000000..645130e019
--- /dev/null
+++ b/app/Auth/Oidc/OidcUser.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Auth\Oidc;
+
+use Laravel\Socialite\Two\User as SocialiteUser;
+
+class OidcUser extends SocialiteUser
+{
+    public ?string $issuer = null;
+
+    public ?string $subject = null;
+
+    public bool $emailVerified = false;
+
+    /**
+     * @var array<string, mixed>
+     */
+    public array $idTokenClaims = [];
+
+    /**
+     * @param  array<string, mixed>  $claims
+     */
+    public function setIdTokenClaims(array $claims): self
+    {
+        $this->idTokenClaims = $claims;
+        $this->issuer = is_string($claims['iss'] ?? null) ? $claims['iss'] : null;
+        $this->subject = is_string($claims['sub'] ?? null) ? $claims['sub'] : null;
+        $this->emailVerified = ($claims['email_verified'] ?? false) === true;
+
+        return $this;
+    }
+}
diff --git a/app/Auth/Oidc/Socialite/OidcProvider.php b/app/Auth/Oidc/Socialite/OidcProvider.php
new file mode 100644
index 0000000000..383b0cc910
--- /dev/null
+++ b/app/Auth/Oidc/Socialite/OidcProvider.php
@@ -0,0 +1,299 @@
+<?php
+
+namespace App\Auth\Oidc\Socialite;
+
+use App\Auth\Oidc\Exceptions\OidcException;
+use App\Auth\Oidc\Exceptions\OidcSigningKeyNotFoundException;
+use App\Auth\Oidc\OidcConfig;
+use App\Auth\Oidc\OidcDiscoveryDocument;
+use App\Auth\Oidc\OidcDiscoveryService;
+use App\Auth\Oidc\OidcTokenValidator;
+use App\Auth\Oidc\OidcUser;
+use GuzzleHttp\RequestOptions;
+use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Str;
+use Laravel\Socialite\Two\AbstractProvider;
+use Laravel\Socialite\Two\InvalidStateException;
+use Laravel\Socialite\Two\ProviderInterface;
+
+class OidcProvider extends AbstractProvider implements ProviderInterface
+{
+    private const int OIDC_FLOW_TTL_MINUTES = 10;
+
+    /**
+     * @var array<int, string>
+     */
+    protected $scopes = ['openid', 'email', 'profile'];
+
+    protected $scopeSeparator = ' ';
+
+    protected ?OidcConfig $oidcConfig = null;
+
+    protected ?OidcDiscoveryDocument $discovery = null;
+
+    public function __construct(
+        Request $request,
+        protected OidcDiscoveryService $discoveryService,
+        protected OidcTokenValidator $tokenValidator,
+        string $clientId,
+        string $clientSecret,
+        string $redirectUrl,
+    ) {
+        parent::__construct($request, $clientId, $clientSecret, $redirectUrl);
+    }
+
+    public function setConfig(OidcConfig $config): self
+    {
+        $this->oidcConfig = $config;
+        $this->clientId = $config->clientId;
+        $this->clientSecret = $config->clientSecret;
+        $this->redirectUrl = $config->redirectUri;
+        $this->scopes = $config->scopes;
+        $this->discovery = null;
+
+        return $this;
+    }
+
+    public function getConfig(): OidcConfig
+    {
+        if ($this->oidcConfig === null) {
+            throw new OidcException('OIDC provider config is not set.');
+        }
+
+        return $this->oidcConfig;
+    }
+
+    protected function getAuthUrl($state): string
+    {
+        $config = $this->getConfig();
+        $nonce = Str::random(40);
+        $this->putOidcFlowValue($this->nonceSessionKey($state), $nonce);
+
+        $extra = ['nonce' => $nonce];
+        if ($config->usePkce) {
+            $verifier = $this->generateCodeVerifier();
+            $this->putOidcFlowValue($this->verifierSessionKey($state), $verifier);
+            $extra['code_challenge'] = $this->codeChallenge($verifier);
+            $extra['code_challenge_method'] = 'S256';
+        }
+
+        return $this->buildAuthUrlFromBase($this->resolveDiscovery()->authorizationEndpoint, $state)
+            .'&'.http_build_query($extra, '', '&', $this->encodingType);
+    }
+
+    protected function getTokenUrl(): string
+    {
+        return $this->resolveDiscovery()->tokenEndpoint;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function getUserByToken($token): array
+    {
+        $response = $this->getHttpClient()->get($this->resolveDiscovery()->userinfoEndpoint, [
+            RequestOptions::HEADERS => [
+                'Accept' => 'application/json',
+                'Authorization' => 'Bearer '.$token,
+            ],
+            RequestOptions::CONNECT_TIMEOUT => 5,
+            RequestOptions::TIMEOUT => 10,
+        ]);
+
+        $decoded = json_decode((string) $response->getBody(), true);
+
+        return is_array($decoded) ? $decoded : [];
+    }
+
+    /**
+     * @param  array<string, mixed>  $user
+     */
+    protected function mapUserToObject(array $user)
+    {
+        return (new OidcUser)->setRaw($user)->map([
+            'id' => $user['sub'] ?? null,
+            'nickname' => $user['preferred_username'] ?? null,
+            'name' => $this->resolveName($user),
+            'email' => $user['email'] ?? null,
+            'avatar' => $user['picture'] ?? null,
+        ]);
+    }
+
+    public function user()
+    {
+        if ($this->user) {
+            return $this->user;
+        }
+
+        if ($this->hasInvalidState()) {
+            throw new InvalidStateException;
+        }
+
+        $tokenResponse = $this->getAccessTokenResponse($this->getCode());
+        $accessToken = Arr::get($tokenResponse, 'access_token');
+        $idToken = Arr::get($tokenResponse, 'id_token');
+
+        if (! is_string($accessToken) || $accessToken === '' || ! is_string($idToken) || $idToken === '') {
+            throw new OidcException('OIDC token endpoint did not return required tokens.');
+        }
+
+        $discovery = $this->resolveDiscovery();
+        $config = $this->getConfig();
+        $expectedNonce = $this->pullOidcFlowValue($this->nonceSessionKey((string) $this->request->input('state')));
+        if ($expectedNonce === null) {
+            throw new OidcException('OIDC login session expired. Please try again.');
+        }
+
+        $claims = $this->validateIdToken($idToken, $discovery, $config, $expectedNonce);
+
+        $userinfo = $this->getUserByToken($accessToken);
+
+        // OIDC core §5.3.2: the userinfo sub MUST match the id_token sub.
+        // Reject the response rather than trust unsigned userinfo claims.
+        $userinfoSub = $userinfo['sub'] ?? null;
+        if (is_string($userinfoSub) && $userinfoSub !== '' && $userinfoSub !== ($claims['sub'] ?? null)) {
+            throw new OidcException('OIDC userinfo subject does not match the id_token subject.');
+        }
+
+        $merged = array_merge($userinfo, $claims);
+
+        /** @var OidcUser $user */
+        $user = $this->mapUserToObject($merged);
+        $user->setIdTokenClaims($claims)
+            ->setToken($accessToken)
+            ->setRefreshToken(Arr::get($tokenResponse, 'refresh_token'))
+            ->setExpiresIn(Arr::get($tokenResponse, 'expires_in'));
+
+        return $this->user = $user;
+    }
+
+    /**
+     * Validate the id_token, retrying once against a freshly fetched JWKS when
+     * the signing key is unknown. This keeps logins working immediately after
+     * the IdP rotates keys instead of failing until the JWKS cache expires.
+     *
+     * @return array<string, mixed>
+     */
+    protected function validateIdToken(
+        string $idToken,
+        OidcDiscoveryDocument $discovery,
+        OidcConfig $config,
+        ?string $expectedNonce,
+    ): array {
+        foreach ([false, true] as $forceRefresh) {
+            try {
+                return $this->tokenValidator->validate(
+                    idToken: $idToken,
+                    discovery: $discovery,
+                    jwks: $this->discoveryService->jwks($discovery->jwksUri, $forceRefresh),
+                    clientId: $config->clientId,
+                    expectedNonce: $expectedNonce,
+                    clockSkewSeconds: $config->clockSkewSeconds,
+                );
+            } catch (OidcSigningKeyNotFoundException $e) {
+                if ($forceRefresh) {
+                    throw $e;
+                }
+            }
+        }
+
+        throw new OidcSigningKeyNotFoundException('No matching JWKS key found for id_token kid.');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function getAccessTokenResponse($code)
+    {
+        $fields = $this->getTokenFields($code);
+        if ($this->getConfig()->usePkce) {
+            $verifier = $this->pullOidcFlowValue($this->verifierSessionKey((string) $this->request->input('state')));
+            if ($verifier === null) {
+                throw new OidcException('OIDC login session expired. Please try again.');
+            }
+
+            $fields['code_verifier'] = $verifier;
+        }
+
+        $response = $this->getHttpClient()->post($this->getTokenUrl(), [
+            RequestOptions::HEADERS => ['Accept' => 'application/json'],
+            RequestOptions::FORM_PARAMS => $fields,
+            RequestOptions::CONNECT_TIMEOUT => 5,
+            RequestOptions::TIMEOUT => 10,
+        ]);
+
+        $decoded = json_decode((string) $response->getBody(), true);
+
+        return is_array($decoded) ? $decoded : [];
+    }
+
+    protected function resolveDiscovery(): OidcDiscoveryDocument
+    {
+        return $this->discovery ??= $this->discoveryService->discover($this->getConfig()->issuerUrl);
+    }
+
+    protected function generateCodeVerifier(): string
+    {
+        return rtrim(strtr(base64_encode(random_bytes(64)), '+/', '-_'), '=');
+    }
+
+    protected function codeChallenge(string $verifier): string
+    {
+        return rtrim(strtr(base64_encode(hash('sha256', $verifier, true)), '+/', '-_'), '=');
+    }
+
+    /**
+     * @param  array<string, mixed>  $user
+     */
+    protected function resolveName(array $user): ?string
+    {
+        if (is_string($user['name'] ?? null) && $user['name'] !== '') {
+            return $user['name'];
+        }
+
+        $name = trim(((string) ($user['given_name'] ?? '')).' '.((string) ($user['family_name'] ?? '')));
+
+        return $name === '' ? null : $name;
+    }
+
+    protected function putOidcFlowValue(string $key, string $value): void
+    {
+        $this->request->session()->put($key, [
+            'value' => $value,
+            'expires_at' => now()->addMinutes(self::OIDC_FLOW_TTL_MINUTES)->timestamp,
+        ]);
+    }
+
+    protected function pullOidcFlowValue(string $key): ?string
+    {
+        $entry = $this->request->session()->pull($key);
+
+        if (! is_array($entry)) {
+            return null;
+        }
+
+        $value = $entry['value'] ?? null;
+        $expiresAt = $entry['expires_at'] ?? null;
+
+        if (! is_string($value) || $value === '' || ! is_int($expiresAt)) {
+            return null;
+        }
+
+        if ($expiresAt < now()->timestamp) {
+            return null;
+        }
+
+        return $value;
+    }
+
+    protected function nonceSessionKey(string $state): string
+    {
+        return "oidc.nonce.{$state}";
+    }
+
+    protected function verifierSessionKey(string $state): string
+    {
+        return "oidc.code_verifier.{$state}";
+    }
+}
diff --git a/app/Console/Commands/CleanupDatabase.php b/app/Console/Commands/CleanupDatabase.php
index 347ea94193..65f686ba61 100644
--- a/app/Console/Commands/CleanupDatabase.php
+++ b/app/Console/Commands/CleanupDatabase.php
@@ -2,6 +2,7 @@
 
 namespace App\Console\Commands;
 
+use App\Models\AuditEvent;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\DB;
 
@@ -49,6 +50,12 @@ class CleanupDatabase extends Command
             $activity_log->delete();
         }
 
+        $count = DB::table('audit_events')->where('created_at', '<', now()->subDays(90))->count();
+        echo "Delete $count entries from audit_events.\n";
+        if ($this->option('yes')) {
+            AuditEvent::pruneExpired();
+        }
+
         // Cleanup application_deployment_queues table
         $application_deployment_queues = DB::table('application_deployment_queues')->where('created_at', '<', now()->subDays($keep_days))->orderBy('created_at', 'desc')->skip(10);
         $count = $application_deployment_queues->count();
diff --git a/app/Helpers/SshMultiplexingHelper.php b/app/Helpers/SshMultiplexingHelper.php
index cbb18945e2..e7d6d071b4 100644
--- a/app/Helpers/SshMultiplexingHelper.php
+++ b/app/Helpers/SshMultiplexingHelper.php
@@ -243,12 +243,18 @@ class SshMultiplexingHelper
 
         $delimiter = base64_encode(Hash::make($command));
         $command = str_replace($delimiter, '', $command);
+        $remoteShellCommand = self::remoteShellCommand();
 
-        return $sshCommand.self::escapedUserAtHost($server)." 'bash -se' << \\$delimiter".PHP_EOL
+        return $sshCommand.self::escapedUserAtHost($server)." '{$remoteShellCommand}' << \\$delimiter".PHP_EOL
             .$command.PHP_EOL
             .$delimiter;
     }
 
+    private static function remoteShellCommand(): string
+    {
+        return 'if command -v bash >/dev/null 2>&1; then exec bash -se; else exec sh -se; fi';
+    }
+
     public static function getConnectionTimeout(Server $server): int
     {
         $timeout = data_get($server, 'settings.connection_timeout');
diff --git a/app/Http/Controllers/Api/ApplicationSecretManagerController.php b/app/Http/Controllers/Api/ApplicationSecretManagerController.php
new file mode 100644
index 0000000000..c8c311766d
--- /dev/null
+++ b/app/Http/Controllers/Api/ApplicationSecretManagerController.php
@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Application;
+use App\Models\IntegrationToken;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use OpenApi\Attributes as OA;
+
+class ApplicationSecretManagerController extends Controller
+{
+    #[OA\Patch(
+        summary: 'Configure Application Secret Manager',
+        description: 'Configure the secret manager source used by an application.',
+        path: '/applications/{uuid}/secret-manager',
+        operationId: 'configure-application-secret-manager',
+        security: [['bearerAuth' => []]],
+        tags: ['Secret Managers'],
+        parameters: [new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string'))],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: new OA\JsonContent(
+                required: ['integration_token_uuid'],
+                properties: [
+                    new OA\Property(property: 'integration_token_uuid', type: 'string'),
+                    new OA\Property(property: 'settings', type: 'object'),
+                ],
+            ),
+        ),
+        responses: [
+            new OA\Response(response: 200, description: 'Secret manager configured.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function update(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)
+            ->where('uuid', $request->route('uuid'))
+            ->first();
+
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $body = $request->json()->all();
+        $token = IntegrationToken::query()
+            ->where('team_id', $teamId)
+            ->where('uuid', $body['integration_token_uuid'] ?? '')
+            ->whereIn('provider', IntegrationToken::SECRET_MANAGER_PROVIDERS)
+            ->first();
+
+        if (! $token || ! in_array('secrets', $token->capabilities ?? [], true)) {
+            return response()->json(['message' => 'Secret manager integration token not found.'], 404);
+        }
+
+        $rules = [
+            'integration_token_uuid' => ['required', 'string'],
+            'settings' => ['sometimes', 'array'],
+        ];
+        $rules += match ($token->provider) {
+            'doppler' => $token->dopplerTokenType() === 'service_account' ? [
+                'settings.project' => ['required', 'string'],
+                'settings.config' => ['required', 'string'],
+            ] : [],
+            'infisical' => [
+                'settings.project_id' => ['required', 'string'],
+                'settings.environment' => ['required', 'string'],
+                'settings.secret_path' => ['nullable', 'string'],
+            ],
+            'vault' => [
+                'settings.mount' => ['required', 'string'],
+                'settings.path' => ['required', 'string'],
+            ],
+            default => [],
+        };
+
+        $validator = customApiValidator($body, $rules);
+        $extraFields = array_diff(array_keys($body), ['integration_token_uuid', 'settings']);
+
+        if ($validator->fails() || $extraFields !== []) {
+            $errors = $validator->errors();
+            foreach ($extraFields as $field) {
+                $errors->add($field, 'This field is not allowed.');
+            }
+
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+
+        $settings = array_filter($validator->validated()['settings'] ?? [], fn ($value) => filled($value));
+        $application->secretManagerLink()->updateOrCreate([], [
+            'integration_token_id' => $token->id,
+            'settings' => $settings ?: null,
+        ]);
+
+        auditLog('api.application.secret_manager.updated', [
+            'team_id' => $teamId,
+            'application_uuid' => $application->uuid,
+            'integration_token_uuid' => $token->uuid,
+        ]);
+
+        return response()->json([
+            'integration_token_uuid' => $token->uuid,
+            'provider' => $token->provider,
+            'settings' => $settings ?: null,
+        ]);
+    }
+}
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index dbe0f86336..246214986c 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -3393,7 +3393,7 @@ class ApplicationsController extends Controller
         if ($application->settings->is_container_label_readonly_enabled && ($requestHasDomains || $requestHasNoindexDomains || $requestHasHttpBasicAuth) && $server->isProxyShouldRun()) {
             $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
         }
-        $application->save();
+        $application->withoutAuditLogging(fn () => $application->save());
 
         auditLog('api.application.updated', [
             'team_id' => $teamId,
@@ -5901,14 +5901,6 @@ class ApplicationsController extends Controller
             return response()->json(['message' => $result['message']], 200);
         }
 
-        auditLog('api.application.rollback', [
-            'team_id' => $teamId,
-            'application_uuid' => $application->uuid,
-            'application_name' => $application->name,
-            'deployment_uuid' => $deployment_uuid,
-            'commit' => $commit,
-        ]);
-
         return response()->json([
             'message' => 'Rollback deployment queued.',
             'deployment_uuid' => $deployment_uuid,
diff --git a/app/Http/Controllers/Api/AuditEventsController.php b/app/Http/Controllers/Api/AuditEventsController.php
new file mode 100644
index 0000000000..da452bb303
--- /dev/null
+++ b/app/Http/Controllers/Api/AuditEventsController.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditEvent;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+
+class AuditEventsController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        if (! $request->user()->isAdminOfTeam($teamId)) {
+            return response()->json(['message' => 'Only team admins and owners can view audit logs.'], 403);
+        }
+
+        $validator = Validator::make($request->all(), [
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'search' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'action' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'source' => ['sometimes', 'nullable', 'string', Rule::in(['all', 'ui', 'api', 'mcp', 'webhook', 'system', 'scheduler'])],
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $validated = $validator->validated();
+        $perPage = (int) ($validated['per_page'] ?? 25);
+        $search = trim((string) ($validated['search'] ?? ''));
+        $canReadSensitive = $request->attributes->get('can_read_sensitive', false) === true;
+        $events = AuditEvent::query()
+            ->select([
+                'id',
+                'team_id',
+                'event',
+                'source',
+                'action',
+                'actor_type',
+                'actor_id',
+                'actor_name',
+                'resource_type',
+                'resource_uuid',
+                'resource_name',
+                'description',
+                'created_at',
+            ])
+            ->when($canReadSensitive, fn ($query) => $query->addSelect([
+                'actor_email',
+                'actor_token_id',
+                'actor_token_name',
+                'metadata',
+                'ip_address',
+                'user_agent',
+            ]))
+            ->visibleToTeam($teamId)
+            ->filtered(
+                search: $search,
+                action: (string) ($validated['action'] ?? 'all'),
+                source: (string) ($validated['source'] ?? 'all'),
+                searchSensitiveFields: $canReadSensitive,
+            )
+            ->latestFirst()
+            ->paginate($perPage);
+
+        return response()->json(serializeApiResponse($events));
+    }
+}
diff --git a/app/Http/Controllers/Api/IntegrationTokensController.php b/app/Http/Controllers/Api/IntegrationTokensController.php
new file mode 100644
index 0000000000..13a225a107
--- /dev/null
+++ b/app/Http/Controllers/Api/IntegrationTokensController.php
@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\IntegrationToken;
+use App\Services\IntegrationTokenValidator;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use OpenApi\Attributes as OA;
+
+class IntegrationTokensController extends Controller
+{
+    #[OA\Post(
+        summary: 'Create Secret Manager Token',
+        description: 'Create and validate a Doppler, Infisical, or Vault integration token.',
+        path: '/security/integration-tokens',
+        operationId: 'create-secret-manager-integration-token',
+        security: [['bearerAuth' => []]],
+        tags: ['Secret Managers'],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: new OA\JsonContent(
+                required: ['provider', 'name', 'token'],
+                properties: [
+                    new OA\Property(property: 'provider', type: 'string', enum: ['doppler', 'infisical', 'vault']),
+                    new OA\Property(property: 'name', type: 'string'),
+                    new OA\Property(property: 'token', type: 'string'),
+                    new OA\Property(property: 'metadata', type: 'object'),
+                ],
+            ),
+        ),
+        responses: [
+            new OA\Response(response: 201, description: 'Integration token created.'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function store(Request $request, IntegrationTokenValidator $tokenValidator): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $this->authorize('create', IntegrationToken::class);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $body = $request->json()->all();
+        $rules = [
+            'provider' => ['required', 'string', 'in:'.implode(',', IntegrationToken::SECRET_MANAGER_PROVIDERS)],
+            'name' => ['required', 'string', 'max:255'],
+            'token' => ['required', 'string'],
+            'metadata' => ['sometimes', 'array'],
+        ];
+
+        if (($body['provider'] ?? null) === 'doppler') {
+            $rules['token'][] = 'regex:/^dp\.(st|sa)\./';
+        } elseif (($body['provider'] ?? null) === 'infisical') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.client_id'] = ['required', 'string'];
+        } elseif (($body['provider'] ?? null) === 'vault') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.namespace'] = ['nullable', 'string'];
+        }
+
+        $validator = customApiValidator($body, $rules);
+        $extraFields = array_diff(array_keys($body), ['provider', 'name', 'token', 'metadata']);
+
+        if ($validator->fails() || $extraFields !== []) {
+            $errors = $validator->errors();
+            foreach ($extraFields as $field) {
+                $errors->add($field, 'This field is not allowed.');
+            }
+
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+
+        $validated = $validator->validated();
+        $metadata = array_filter($validated['metadata'] ?? [], fn ($value) => filled($value));
+
+        if (! $tokenValidator->validate($validated['provider'], $validated['token'], ['secrets'], $metadata)) {
+            return response()->json(['message' => $tokenValidator->errorMessage($validated['provider'])], 400);
+        }
+
+        $integrationToken = IntegrationToken::query()->create([
+            'team_id' => $teamId,
+            'provider' => $validated['provider'],
+            'name' => $validated['name'],
+            'token' => $validated['token'],
+            'capabilities' => ['secrets'],
+            'metadata' => $metadata ?: null,
+        ]);
+
+        auditLog('api.integration_token.created', [
+            'team_id' => $teamId,
+            'integration_token_uuid' => $integrationToken->uuid,
+            'provider' => $integrationToken->provider,
+        ]);
+
+        return response()->json(['uuid' => $integrationToken->uuid], 201);
+    }
+}
diff --git a/app/Http/Controllers/Api/ProjectController.php b/app/Http/Controllers/Api/ProjectController.php
index eb137c5349..16eff1ba18 100644
--- a/app/Http/Controllers/Api/ProjectController.php
+++ b/app/Http/Controllers/Api/ProjectController.php
@@ -271,12 +271,6 @@ class ProjectController extends Controller
             'team_id' => $teamId,
         ]);
 
-        auditLog('api.project.created', [
-            'team_id' => $teamId,
-            'project_uuid' => $project->uuid,
-            'project_name' => $project->name,
-        ]);
-
         return response()->json([
             'uuid' => $project->uuid,
         ])->setStatusCode(201);
@@ -396,13 +390,6 @@ class ProjectController extends Controller
 
         $project->update($request->only($allowedFields));
 
-        auditLog('api.project.updated', [
-            'team_id' => $teamId,
-            'project_uuid' => $project->uuid,
-            'project_name' => $project->name,
-            'changed_fields' => array_values(array_intersect($allowedFields, array_keys($request->all()))),
-        ]);
-
         return response()->json([
             'uuid' => $project->uuid,
             'name' => $project->name,
@@ -482,16 +469,8 @@ class ProjectController extends Controller
             return response()->json(['message' => 'Project has resources, so it cannot be deleted.'], 400);
         }
 
-        $projectUuid = $project->uuid;
-        $projectName = $project->name;
         $project->delete();
 
-        auditLog('api.project.deleted', [
-            'team_id' => $teamId,
-            'project_uuid' => $projectUuid,
-            'project_name' => $projectName,
-        ]);
-
         return response()->json(['message' => 'Project deleted.']);
     }
 
diff --git a/app/Http/Controllers/OauthController.php b/app/Http/Controllers/OauthController.php
index 4038fe63e2..93d27615a7 100644
--- a/app/Http/Controllers/OauthController.php
+++ b/app/Http/Controllers/OauthController.php
@@ -2,47 +2,60 @@
 
 namespace App\Http\Controllers;
 
-use App\Models\User;
-use Illuminate\Support\Facades\Auth;
+use App\Models\OauthSetting;
+use App\Services\Auth\OauthLoginService;
+use Illuminate\Support\Facades\Log;
 use Symfony\Component\HttpKernel\Exception\HttpException;
 
 class OauthController extends Controller
 {
     public function redirect(string $provider)
     {
-        $socialite_provider = get_socialite_provider($provider);
+        $oauthSetting = $this->enabledProvider($provider);
+        $socialiteProvider = get_socialite_provider($oauthSetting->provider);
 
-        return $socialite_provider->redirect();
+        return $socialiteProvider->redirect();
     }
 
-    public function callback(string $provider)
+    public function callback(string $provider, OauthLoginService $oauthLoginService)
     {
         try {
-            $oauthUser = get_socialite_provider($provider)->user();
-            $email = trim((string) $oauthUser->email);
-            if ($email === '') {
-                abort(403, 'OAuth provider did not return an email address');
-            }
-            $email = strtolower($email);
-            $user = User::whereEmail($email)->first();
-            if (! $user) {
-                $settings = instanceSettings();
-                if (! $settings->is_registration_enabled) {
-                    abort(403, 'Registration is disabled');
-                }
-
-                $user = User::create([
-                    'name' => $oauthUser->name,
-                    'email' => $email,
-                ]);
-            }
-            Auth::login($user);
+            $oauthSetting = $this->enabledProvider($provider);
+            $oauthUser = get_socialite_provider($oauthSetting->provider)->user();
+            $oauthLoginService->login($oauthSetting->provider, $oauthUser, $oauthSetting);
 
             return redirect('/');
         } catch (\Exception $e) {
+            $this->logCallbackFailure($provider, $e);
+
             $errorCode = $e instanceof HttpException ? 'auth.failed' : 'auth.failed.callback';
 
             return redirect()->route('login')->withErrors([__($errorCode)]);
         }
     }
+
+    private function logCallbackFailure(string $provider, \Throwable $exception): void
+    {
+        Log::error('OAuth callback failed.', [
+            'provider' => $provider,
+            'exception_class' => $exception::class,
+            'exception_message' => $exception->getMessage(),
+            'request_error' => request()->query('error'),
+            'request_error_description' => request()->query('error_description'),
+            'has_code' => request()->query->has('code'),
+            'has_state' => request()->query->has('state'),
+            'ip' => request()->ip(),
+            'exception' => $exception,
+        ]);
+    }
+
+    private function enabledProvider(string $provider): OauthSetting
+    {
+        $oauthSetting = OauthSetting::where('provider', $provider)->first();
+        if (! $oauthSetting || ! $oauthSetting->enabled || ! $oauthSetting->couldBeEnabled()) {
+            throw new HttpException(403, 'OAuth provider is not enabled');
+        }
+
+        return $oauthSetting;
+    }
 }
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index aca4293919..b1cb8d853d 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -29,6 +29,7 @@ use Illuminate\Auth\Middleware\RequirePassword;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
 use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
+use Illuminate\Foundation\Http\Middleware\InvokeDeferredCallbacks;
 use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
 use Illuminate\Http\Middleware\HandleCors;
 use Illuminate\Http\Middleware\SetCacheHeaders;
@@ -59,6 +60,7 @@ class Kernel extends HttpKernel
         ValidatePostSize::class,
         TrimStrings::class,
         ConvertEmptyStringsToNull::class,
+        InvokeDeferredCallbacks::class,
 
     ];
 
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 01a365a0c5..19c0b750ec 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -19,6 +19,7 @@ use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
 use App\Notifications\Application\DeploymentFailed;
 use App\Notifications\Application\DeploymentSuccess;
+use App\Support\RemoteSecretReferences;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
 use App\Traits\ExecuteRemoteCommand;
@@ -147,6 +148,9 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private $env_args;
 
+    /** @var array<string, string>|null */
+    private ?array $remote_secrets_cache = null;
+
     private $env_nixpacks_args;
 
     private $env_railpack_args;
@@ -1287,6 +1291,11 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
                 return true;
             }
+            if ($this->has_remote_buildtime_secret_references()) {
+                $this->application_deployment_queue->addLogEntry('Remote build-time secrets are configured. Running the build to check for updated values.');
+
+                return false;
+            }
             $configurationDiff = $this->application->pendingDeploymentConfigurationDiff();
             if (! $configurationDiff->requiresBuild()) {
                 $this->application_deployment_queue->addLogEntry("No build configuration changed & image found ({$this->production_image_name}) with the same Git Commit SHA. Build step skipped.");
@@ -1314,6 +1323,18 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         return false;
     }
 
+    private function has_remote_buildtime_secret_references(): bool
+    {
+        $environmentVariables = $this->pull_request_id === 0
+            ? $this->application->environment_variables()
+            : $this->application->environment_variables_preview();
+
+        return $environmentVariables
+            ->where('is_buildtime', true)
+            ->get(['value'])
+            ->contains(fn (EnvironmentVariable $environmentVariable) => RemoteSecretReferences::containsReference($environmentVariable->value));
+    }
+
     private function check_image_locally_or_remotely()
     {
         $this->execute_remote_command([
@@ -1335,6 +1356,101 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * Fetch the secrets from the application's secret manager source. Values
+     * live only in memory during the deployment and in the generated .env on
+     * the server — they are never persisted in the Coolify database. Fetched
+     * lazily (only when a variable references a secret), once per deployment.
+     * A fetch failure fails the deployment.
+     *
+     * @return array<string, string>
+     */
+    private function remote_secrets(): array
+    {
+        if ($this->remote_secrets_cache !== null) {
+            return $this->remote_secrets_cache;
+        }
+
+        $link = $this->application->secretManagerLink()->with('integrationToken')->first();
+
+        if (! $link) {
+            throw new DeploymentException('Environment variables reference remote secrets ({{vault.KEY}}), but no secret manager source is configured for this application.');
+        }
+
+        $provider = $link->integrationToken->providerName();
+        $tokenName = $link->integrationToken->name;
+
+        try {
+            $secrets = $link->fetchSecrets();
+        } catch (Throwable $e) {
+            $this->application_deployment_queue->addLogEntry("Failed to fetch secrets from {$provider} ({$tokenName}, {$link->sourceSummary()}): {$e->getMessage()}", 'stderr');
+
+            throw new DeploymentException("Could not fetch secrets from {$provider}. The deployment was stopped so the application does not start with missing secrets.");
+        }
+
+        $this->application_deployment_queue->addLogEntry('Fetched '.count($secrets)." secrets from {$provider} ({$tokenName}, {$link->sourceSummary()}).");
+
+        return $this->remote_secrets_cache = $secrets;
+    }
+
+    /**
+     * Replace {{vault.KEY}} references with values from the configured secret
+     * manager source. Missing keys fail the deployment with a
+     * list — changing the source never re-checks references, so this is the
+     * moment problems surface.
+     */
+    private function substitute_remote_secrets(string $value, string $envKey): string
+    {
+        $secrets = $this->remote_secrets();
+        $missing = RemoteSecretReferences::missingKeys($value, $secrets);
+
+        if ($missing !== []) {
+            $message = 'Missing secret keys: '.implode(', ', $missing)." (referenced by {$envKey}).";
+            $this->application_deployment_queue->addLogEntry($message, 'stderr');
+
+            throw new DeploymentException($message.' Check the secret manager source of this application.');
+        }
+
+        return RemoteSecretReferences::substitute($value, $secrets);
+    }
+
+    /**
+     * Resolve shared variables, then secret references, in a raw variable value.
+     */
+    private function resolve_environment_variable_raw(EnvironmentVariable $env): string
+    {
+        $value = $env->get_real_environment_variables_with_server($env->value, $this->application, $this->mainServer);
+
+        return $this->substitute_remote_secrets($value ?? '', $env->key);
+    }
+
+    /**
+     * Resolve a runtime variable to its dotenv representation. Values with
+     * secret references are substituted and written as literals.
+     */
+    private function resolve_environment_variable(EnvironmentVariable $env): ?string
+    {
+        if (! RemoteSecretReferences::containsReference($env->value)) {
+            return $env->getResolvedValueWithServer($this->mainServer);
+        }
+
+        return $this->format_remote_secret_value($this->resolve_environment_variable_raw($env));
+    }
+
+    /**
+     * Format a remote secret value for the runtime .env file (dotenv syntax read
+     * by docker compose). Values are treated as literals — no interpolation.
+     */
+    private function format_remote_secret_value(string $value): string
+    {
+        if (! str_contains($value, "'")) {
+            return "'".$value."'";
+        }
+
+        // Fall back to double quotes; $$ escapes compose interpolation.
+        return '"'.str_replace(['\\', '"', '$'], ['\\\\', '\\"', '$$'], $value).'"';
+    }
+
     private function generate_runtime_environment_variables()
     {
         $envs = collect([]);
@@ -1403,7 +1519,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             });
 
             foreach ($runtime_environment_variables as $env) {
-                $envs->push($env->key.'='.$env->getResolvedValueWithServer($this->mainServer));
+                $envs->push($env->key.'='.$this->resolve_environment_variable($env));
             }
 
             // Check for PORT environment variable mismatch with ports_exposes
@@ -1470,7 +1586,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             });
 
             foreach ($runtime_environment_variables_preview as $env) {
-                $envs->push($env->key.'='.$env->getResolvedValueWithServer($this->mainServer));
+                $envs->push($env->key.'='.$this->resolve_environment_variable($env));
             }
 
             // Fall back to production env vars for keys not overridden by preview vars,
@@ -1484,7 +1600,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     return $env->is_runtime && ! in_array($env->key, $previewKeys);
                 });
                 foreach ($fallback_production_vars as $env) {
-                    $envs->push($env->key.'='.$env->getResolvedValueWithServer($this->mainServer));
+                    $envs->push($env->key.'='.$this->resolve_environment_variable($env));
                 }
             }
 
@@ -1592,6 +1708,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $this->execute_remote_command(
             [
                 executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee $this->workdir/.env > /dev/null"),
+                'skip_command_log' => true,
             ]
         );
 
@@ -1610,6 +1727,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $this->execute_remote_command(
                 [
                     "echo '$envs_base64' | base64 -d | tee $this->configuration_dir/.env > /dev/null",
+                    'skip_command_log' => true,
                 ]
             );
             $this->server = $this->build_server;
@@ -1617,6 +1735,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $this->execute_remote_command(
                 [
                     "echo '$envs_base64' | base64 -d | tee $this->configuration_dir/.env > /dev/null",
+                    'skip_command_log' => true,
                 ]
             );
         }
@@ -1743,6 +1862,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     continue;
                 }
 
+                if (RemoteSecretReferences::containsReference($env->value)) {
+                    $envs_dict[$env->key] = escapeBashEnvValue($this->resolve_environment_variable_raw($env));
+
+                    continue;
+                }
+
                 $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
                 // For literal/multiline vars, real_value includes quotes that we need to remove
                 if ($env->is_literal || $env->is_multiline) {
@@ -1798,6 +1923,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     continue;
                 }
 
+                if (RemoteSecretReferences::containsReference($env->value)) {
+                    $envs_dict[$env->key] = escapeBashEnvValue($this->resolve_environment_variable_raw($env));
+
+                    continue;
+                }
+
                 $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
                 // For literal/multiline vars, real_value includes quotes that we need to remove
                 if ($env->is_literal || $env->is_multiline) {
@@ -1857,9 +1988,11 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private function validatedBuildtimeEnvironmentVariableKey(string $key, string $origin): string
     {
+
         try {
             if (! ValidationPatterns::isValidEnvironmentVariableKey($key)) {
                 throw new \InvalidArgumentException('Invalid build-time environment variable key.');
+
             }
 
             return $key;
@@ -2762,6 +2895,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private function normalize_resolved_build_variable_value(EnvironmentVariable $environmentVariable): ?string
     {
+        if (RemoteSecretReferences::containsReference($environmentVariable->value)) {
+            $resolved = $this->resolve_environment_variable_raw($environmentVariable);
+
+            return $resolved === '' ? null : $resolved;
+        }
+
         $resolvedValue = $environmentVariable->getResolvedValueWithServer($this->mainServer);
         if (is_null($resolvedValue) || $resolvedValue === '') {
             return null;
@@ -3305,7 +3444,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
 
             foreach ($envs as $env) {
-                $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
+                $resolvedValue = RemoteSecretReferences::containsReference($env->value)
+                    ? $this->resolve_environment_variable_raw($env)
+                    : $env->getResolvedValueWithServer($this->mainServer);
                 if (! is_null($resolvedValue)) {
                     $this->env_args->put($env->key, $resolvedValue);
                 }
@@ -3321,7 +3462,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
 
             foreach ($envs as $env) {
-                $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
+                $resolvedValue = RemoteSecretReferences::containsReference($env->value)
+                    ? $this->resolve_environment_variable_raw($env)
+                    : $env->getResolvedValueWithServer($this->mainServer);
                 if (! is_null($resolvedValue)) {
                     $this->env_args->put($env->key, $resolvedValue);
                 }
@@ -4415,7 +4558,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         } else {
             $secrets_string = $variables
                 ->map(function ($env) {
-                    return "{$env->key}={$env->getResolvedValueWithServer($this->mainServer)}";
+                    return "{$env->key}={$this->resolve_environment_variable($env)}";
                 })
                 ->sort()
                 ->implode('|');
@@ -4481,7 +4624,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 if (data_get($env, 'is_multiline') === true) {
                     $argsToInsert->push("ARG {$env->key}");
                 } else {
-                    $argsToInsert->push("ARG {$env->key}={$env->getResolvedValueWithServer($this->mainServer)}");
+                    $argsToInsert->push("ARG {$env->key}=".escapeBashEnvValue($this->resolve_environment_variable_raw($env)));
                 }
             }
             // Add Coolify variables as ARGs
@@ -4503,7 +4646,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 if (data_get($env, 'is_multiline') === true) {
                     $argsToInsert->push("ARG {$env->key}");
                 } else {
-                    $argsToInsert->push("ARG {$env->key}={$env->getResolvedValueWithServer($this->mainServer)}");
+                    $argsToInsert->push("ARG {$env->key}=".escapeBashEnvValue($this->resolve_environment_variable_raw($env)));
                 }
             }
             // Add Coolify variables as ARGs
@@ -4517,6 +4660,14 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
         }
 
+        if ($argsToInsert->isNotEmpty()) {
+            $environmentVariables = $envs->mapWithKeys(function ($environmentVariable) {
+                return [$environmentVariable->key => escapeBashEnvValue($this->resolve_environment_variable_raw($environmentVariable))];
+            });
+            $secretsHash = $this->generate_secrets_hash($environmentVariables);
+            $argsToInsert->push("ARG COOLIFY_BUILD_SECRETS_HASH={$secretsHash}");
+        }
+
         // Development logging to show what ARGs are being injected
         if (isDev()) {
             $this->application_deployment_queue->addLogEntry('[DEBUG] ========================================');
@@ -4538,11 +4689,6 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                     $dockerfile->splice($fromLineIndex + 1, 0, [$arg]);
                 }
             }
-            $envs_mapped = $envs->mapWithKeys(function ($env) {
-                return [$env->key => $env->getResolvedValueWithServer($this->mainServer)];
-            });
-            $secrets_hash = $this->generate_secrets_hash($envs_mapped);
-            $argsToInsert->push("ARG COOLIFY_BUILD_SECRETS_HASH={$secrets_hash}");
         }
 
         $dockerfile_base64 = base64_encode($dockerfile->implode("\n"));
@@ -4551,11 +4697,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             [
                 executeInDocker($this->deployment_uuid, "echo '{$dockerfile_base64}' | base64 -d | tee {$this->workdir}{$this->dockerfile_location} > /dev/null"),
                 'hidden' => true,
-            ],
-            [
-                executeInDocker($this->deployment_uuid, "cat {$this->workdir}{$this->dockerfile_location}"),
-                'hidden' => true,
-                'ignore_errors' => true,
+                'skip_command_log' => true,
             ]);
     }
 
diff --git a/app/Jobs/DatabaseStartJob.php b/app/Jobs/DatabaseStartJob.php
new file mode 100644
index 0000000000..e21ee38c61
--- /dev/null
+++ b/app/Jobs/DatabaseStartJob.php
@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Actions\Database\StartClickhouse;
+use App\Actions\Database\StartDragonfly;
+use App\Actions\Database\StartKeydb;
+use App\Actions\Database\StartMariadb;
+use App\Actions\Database\StartMongodb;
+use App\Actions\Database\StartMysql;
+use App\Actions\Database\StartPostgresql;
+use App\Actions\Database\StartRedis;
+use App\Enums\ProcessStatus;
+use App\Events\DatabaseStatusChanged;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Spatie\Activitylog\Models\Activity;
+use Throwable;
+
+class DatabaseStartJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 600;
+
+    public function __construct(
+        public string $databaseClass,
+        public int $databaseId,
+        public int $teamId,
+        public int $activityId,
+        public ?int $userId,
+    ) {
+        $this->onQueue(deployment_queue());
+    }
+
+    public function handle(): void
+    {
+        $database = $this->databaseClass::query()->findOrFail($this->databaseId);
+        abort_unless((int) $database->team()->id === $this->teamId, 403);
+        $activity = Activity::query()->findOrFail($this->activityId);
+
+        match ($database->getMorphClass()) {
+            StandalonePostgresql::class => StartPostgresql::run($database, $activity),
+            StandaloneRedis::class => StartRedis::run($database, $activity),
+            StandaloneMongodb::class => StartMongodb::run($database, $activity),
+            StandaloneMysql::class => StartMysql::run($database, $activity),
+            StandaloneMariadb::class => StartMariadb::run($database, $activity),
+            StandaloneKeydb::class => StartKeydb::run($database, $activity),
+            StandaloneDragonfly::class => StartDragonfly::run($database, $activity),
+            StandaloneClickhouse::class => StartClickhouse::run($database, $activity),
+        };
+
+        event(new DatabaseStatusChanged($this->userId));
+    }
+
+    public function failed(?Throwable $exception): void
+    {
+        try {
+            $activity = Activity::query()->find($this->activityId);
+            if (! $activity) {
+                return;
+            }
+
+            $activity->properties = $activity->properties->merge([
+                'status' => ProcessStatus::ERROR->value,
+                'error' => 'Database start failed.',
+                'failed_at' => now()->toIso8601String(),
+            ]);
+            $activity->save();
+        } finally {
+            event(new DatabaseStatusChanged($this->userId));
+        }
+    }
+}
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index 8ea4bbc958..cb31e6c111 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -170,6 +170,30 @@ class Discord extends Component
         }
     }
 
+    public function toggleDiscordEnabled(): void
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->discordEnabled) {
+                $this->discordEnabled = false;
+            } else {
+                $this->validate([
+                    'discordWebhookUrl' => 'required',
+                ], [
+                    'discordWebhookUrl.required' => 'Discord Webhook URL is required.',
+                ]);
+                $this->discordEnabled = true;
+            }
+
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            handleError($e, $this);
+        }
+    }
+
     public function instantSave()
     {
         try {
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 5bd55137b5..ea626ed57a 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -258,32 +258,59 @@ class Email extends Component
         }
     }
 
+    public function toggleSmtp()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->smtpEnabled) {
+                $this->smtpEnabled = false;
+                $this->saveModel();
+            } else {
+                $this->validateSmtpSettings();
+                $this->smtpEnabled = true;
+                $this->resendEnabled = false;
+                $this->submitSmtp();
+            }
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        } finally {
+            $this->dispatch('refresh');
+        }
+    }
+
+    public function toggleResend()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->resendEnabled) {
+                $this->resendEnabled = false;
+                $this->saveModel();
+            } else {
+                $this->validateResendSettings();
+                $this->resendEnabled = true;
+                $this->smtpEnabled = false;
+                $this->submitResend();
+            }
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        } finally {
+            $this->dispatch('refresh');
+        }
+    }
+
     public function submitSmtp()
     {
         $this->authorize('update', $this->settings);
 
         try {
             $this->resetErrorBag();
-            $this->validate([
-                'smtpEnabled' => 'boolean',
-                'smtpFromAddress' => 'required|email',
-                'smtpFromName' => 'required|string',
-                'smtpHost' => 'required|string',
-                'smtpPort' => 'required|numeric',
-                'smtpEncryption' => 'required|string|in:starttls,tls,none',
-                'smtpUsername' => 'nullable|string',
-                'smtpPassword' => 'nullable|string',
-                'smtpTimeout' => 'nullable|numeric',
-                'smtpEhloDomain' => ['nullable', 'string', new ValidHostname],
-            ], [
-                'smtpFromAddress.required' => 'From Address is required.',
-                'smtpFromAddress.email' => 'Please enter a valid email address.',
-                'smtpFromName.required' => 'From Name is required.',
-                'smtpHost.required' => 'SMTP Host is required.',
-                'smtpPort.required' => 'SMTP Port is required.',
-                'smtpPort.numeric' => 'SMTP Port must be a number.',
-                'smtpEncryption.required' => 'Encryption type is required.',
-            ]);
+            $this->validateSmtpSettings();
 
             if ($this->smtpEnabled) {
                 $this->settings->resend_enabled = $this->resendEnabled = false;
@@ -315,17 +342,7 @@ class Email extends Component
 
         try {
             $this->resetErrorBag();
-            $this->validate([
-                'resendEnabled' => 'boolean',
-                'resendApiKey' => $this->resendEnabled ? 'required|string' : 'nullable|string',
-                'smtpFromAddress' => 'required|email',
-                'smtpFromName' => 'required|string',
-            ], [
-                'resendApiKey.required' => 'Resend API Key is required.',
-                'smtpFromAddress.required' => 'From Address is required.',
-                'smtpFromAddress.email' => 'Please enter a valid email address.',
-                'smtpFromName.required' => 'From Name is required.',
-            ]);
+            $this->validateResendSettings();
             if ($this->resendEnabled) {
                 $this->settings->smtp_enabled = $this->smtpEnabled = false;
             }
@@ -342,6 +359,45 @@ class Email extends Component
         }
     }
 
+    private function validateSmtpSettings(): void
+    {
+        $this->validate([
+            'smtpEnabled' => 'boolean',
+            'smtpFromAddress' => 'required|email',
+            'smtpFromName' => 'required|string',
+            'smtpHost' => 'required|string',
+            'smtpPort' => 'required|numeric',
+            'smtpEncryption' => 'required|string|in:starttls,tls,none',
+            'smtpUsername' => 'nullable|string',
+            'smtpPassword' => 'nullable|string',
+            'smtpTimeout' => 'nullable|numeric',
+            'smtpEhloDomain' => ['nullable', 'string', new ValidHostname],
+        ], [
+            'smtpFromAddress.required' => 'From Address is required.',
+            'smtpFromAddress.email' => 'Please enter a valid email address.',
+            'smtpFromName.required' => 'From Name is required.',
+            'smtpHost.required' => 'SMTP Host is required.',
+            'smtpPort.required' => 'SMTP Port is required.',
+            'smtpPort.numeric' => 'SMTP Port must be a number.',
+            'smtpEncryption.required' => 'Encryption type is required.',
+        ]);
+    }
+
+    private function validateResendSettings(): void
+    {
+        $this->validate([
+            'resendEnabled' => 'boolean',
+            'resendApiKey' => $this->resendEnabled ? 'required|string' : 'nullable|string',
+            'smtpFromAddress' => 'required|email',
+            'smtpFromName' => 'required|string',
+        ], [
+            'resendApiKey.required' => 'Resend API Key is required.',
+            'smtpFromAddress.required' => 'From Address is required.',
+            'smtpFromAddress.email' => 'Please enter a valid email address.',
+            'smtpFromName.required' => 'From Name is required.',
+        ]);
+    }
+
     public function sendTestEmail()
     {
         try {
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index 7caacdb916..cae1c3d689 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -163,6 +163,34 @@ class Pushover extends Component
         }
     }
 
+    public function togglePushoverEnabled()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->pushoverEnabled) {
+                $this->pushoverEnabled = false;
+            } else {
+                $this->validate([
+                    'pushoverUserKey' => 'required',
+                    'pushoverApiToken' => 'required',
+                ], [
+                    'pushoverUserKey.required' => 'Pushover User Key is required.',
+                    'pushoverApiToken.required' => 'Pushover API Token is required.',
+                ]);
+                $this->pushoverEnabled = true;
+            }
+
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        } finally {
+            $this->dispatch('refresh');
+        }
+    }
+
     public function instantSave()
     {
         try {
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index fe84710bdf..644252c1a3 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -154,6 +154,32 @@ class Slack extends Component
         }
     }
 
+    public function toggleSlackEnabled()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->slackEnabled) {
+                $this->slackEnabled = false;
+            } else {
+                $this->validate([
+                    'slackWebhookUrl' => 'required',
+                ], [
+                    'slackWebhookUrl.required' => 'Slack Webhook URL is required.',
+                ]);
+                $this->slackEnabled = true;
+            }
+
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        } finally {
+            $this->dispatch('refresh');
+        }
+    }
+
     public function instantSave()
     {
         try {
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index 51239b8621..f999294477 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -263,6 +263,34 @@ class Telegram extends Component
         }
     }
 
+    public function toggleTelegramEnabled(): void
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->telegramEnabled) {
+                $this->telegramEnabled = false;
+            } else {
+                $this->validate([
+                    'telegramToken' => 'required',
+                    'telegramChatId' => 'required',
+                ], [
+                    'telegramToken.required' => 'Telegram Token is required.',
+                    'telegramChatId.required' => 'Telegram Chat ID is required.',
+                ]);
+                $this->telegramEnabled = true;
+            }
+
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            handleError($e, $this);
+        } finally {
+            $this->dispatch('refresh');
+        }
+    }
+
     public function saveModel()
     {
         $this->authorize('update', $this->settings);
diff --git a/app/Livewire/Notifications/Webhook.php b/app/Livewire/Notifications/Webhook.php
index a3480ada69..fb537fc7d9 100644
--- a/app/Livewire/Notifications/Webhook.php
+++ b/app/Livewire/Notifications/Webhook.php
@@ -148,6 +148,30 @@ class Webhook extends Component
         }
     }
 
+    public function toggleWebhookEnabled()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->webhookEnabled) {
+                $this->webhookEnabled = false;
+            } else {
+                $this->validate([
+                    'webhookUrl' => 'required',
+                ], [
+                    'webhookUrl.required' => 'Webhook URL is required.',
+                ]);
+                $this->webhookEnabled = true;
+            }
+
+            $this->saveModel();
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        }
+    }
+
     public function instantSave()
     {
         try {
diff --git a/app/Livewire/Profile/Index.php b/app/Livewire/Profile/Index.php
index 04f58dadd2..69f27b0e55 100644
--- a/app/Livewire/Profile/Index.php
+++ b/app/Livewire/Profile/Index.php
@@ -2,19 +2,15 @@
 
 namespace App\Livewire\Profile;
 
-use App\Services\AvatarStorageService;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Validation\Rules\Password;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
-use Livewire\WithFileUploads;
 
 class Index extends Component
 {
-    use WithFileUploads;
-
     public int $userId;
 
     public string $email;
@@ -36,6 +32,10 @@ class Index extends Component
 
     public bool $show_verification = false;
 
+    public bool $uses_sso = false;
+
+    public ?string $sso_provider_label = null;
+
     public $avatar;
 
     public function uploadAvatar(AvatarStorageService $avatarStorage): bool
@@ -75,8 +75,12 @@ class Index extends Component
         $this->name = Auth::user()->name;
         $this->email = Auth::user()->email;
 
+        $oauthIdentity = Auth::user()->oauthIdentities()->latest('id')->first();
+        $this->uses_sso = $oauthIdentity !== null;
+        $this->sso_provider_label = $oauthIdentity ? $this->providerLabel($oauthIdentity->provider) : null;
+
         // Check if there's a pending email change
-        if (Auth::user()->hasEmailChangeRequest()) {
+        if (! $this->uses_sso && Auth::user()->hasEmailChangeRequest()) {
             $this->new_email = Auth::user()->pending_email;
             $this->show_verification = true;
         }
@@ -101,6 +105,10 @@ class Index extends Component
     public function requestEmailChange()
     {
         try {
+            if ($this->rejectSsoEmailChange()) {
+                return;
+            }
+
             // For self-hosted, check if email is enabled
             if (! isCloud()) {
                 $settings = instanceSettings();
@@ -159,6 +167,10 @@ class Index extends Component
     public function verifyEmailChange()
     {
         try {
+            if ($this->rejectSsoEmailChange()) {
+                return;
+            }
+
             $this->validate([
                 'email_verification_code' => ['required', 'string', 'size:6'],
             ]);
@@ -204,7 +216,6 @@ class Index extends Component
                 $this->show_verification = false;
 
                 $this->dispatch('success', 'Email address updated successfully.');
-                $this->dispatch('close-email-change-modal');
             } else {
                 $this->dispatch('error', 'Failed to update email address.');
             }
@@ -216,6 +227,10 @@ class Index extends Component
     public function resendVerificationCode()
     {
         try {
+            if ($this->rejectSsoEmailChange()) {
+                return;
+            }
+
             // Check if there's a pending request
             if (! Auth::user()->hasEmailChangeRequest()) {
                 $this->dispatch('error', 'No pending email change request.');
@@ -269,6 +284,30 @@ class Index extends Component
         $this->dispatch('success', 'Email change request cancelled.');
     }
 
+    public function showEmailChangeForm()
+    {
+        if ($this->rejectSsoEmailChange()) {
+            return;
+        }
+
+        $this->show_email_change = true;
+        $this->new_email = '';
+    }
+
+    private function rejectSsoEmailChange(): bool
+    {
+        if (! Auth::user()->hasSsoIdentity()) {
+            return false;
+        }
+
+        $this->uses_sso = true;
+        $this->show_email_change = false;
+        $this->show_verification = false;
+        $this->dispatch('error', 'Email addresses managed by SSO cannot be changed in Coolify.');
+
+        return true;
+    }
+
     public function resetPassword()
     {
         try {
@@ -299,6 +338,14 @@ class Index extends Component
         }
     }
 
+    private function providerLabel(string $provider): string
+    {
+        return match ($provider) {
+            'oidc' => 'OIDC',
+            default => str($provider)->headline()->toString(),
+        };
+    }
+
     public function render()
     {
         return view('livewire.profile.index');
diff --git a/app/Livewire/Project/Application/DeploymentNavbar.php b/app/Livewire/Project/Application/DeploymentNavbar.php
index b60f543ba5..3abc2da73c 100644
--- a/app/Livewire/Project/Application/DeploymentNavbar.php
+++ b/app/Livewire/Project/Application/DeploymentNavbar.php
@@ -104,7 +104,6 @@ class DeploymentNavbar extends Component
         $this->application_deployment_queue->update([
             'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
         ]);
-
         try {
             if ($this->application->settings->is_build_server_enabled) {
                 $server = Server::ownedByCurrentTeam()->find($build_server_id);
diff --git a/app/Livewire/Project/Application/Heading.php b/app/Livewire/Project/Application/Heading.php
index 6c75cd7a61..830a4eace8 100644
--- a/app/Livewire/Project/Application/Heading.php
+++ b/app/Livewire/Project/Application/Heading.php
@@ -156,6 +156,11 @@ class Heading extends Component
 
             $this->dispatch('info', 'Gracefully stopping application.<br/>It could take a while depending on the application.');
             StopApplication::dispatch($this->application, false, $this->docker_cleanup);
+            auditLog('ui.application.stopped', [
+                'team_id' => $this->application->team()?->id,
+                'application_uuid' => $this->application->uuid,
+                'application_name' => $this->application->name,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index 832a0d55cf..46681d5d57 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -306,6 +306,12 @@ class Previews extends Component
             ApplicationPreview::where('application_id', $this->application->id)
                 ->where('pull_request_id', $pull_request_id)
                 ->update(['status' => 'exited']);
+            auditLog('ui.application.preview_stopped', [
+                'team_id' => $this->application->team()?->id,
+                'application_uuid' => $this->application->uuid,
+                'application_name' => $this->application->name,
+                'pull_request_id' => $pull_request_id,
+            ]);
             ServiceStatusChanged::dispatch($this->application->environment->project->team->id);
 
             GetContainersStatus::run($server);
diff --git a/app/Livewire/Project/CloneMe.php b/app/Livewire/Project/CloneMe.php
index fff2b7fbf5..ad032779b3 100644
--- a/app/Livewire/Project/CloneMe.php
+++ b/app/Livewire/Project/CloneMe.php
@@ -102,6 +102,14 @@ class CloneMe extends Component
             if (! $selectedDestination) {
                 throw new \Exception('Destination not found.');
             }
+            auditLog('ui.project.clone_started', [
+                'team_id' => $this->project->team_id,
+                'project_uuid' => $this->project->uuid,
+                'project_name' => $this->project->name,
+                'clone_type' => $type,
+                'new_name' => $this->newName,
+                'destination_uuid' => $selectedDestination->uuid,
+            ]);
             if ($type === 'project') {
                 $foundProject = Project::where('name', $this->newName)->first();
                 if ($foundProject) {
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 4a709d2b96..d938ebde8d 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -212,10 +212,18 @@ class BackupEdit extends Component
                 }
             }
 
+            $database = $this->backup->database;
+            $backupUuid = $this->backup->uuid;
             $this->backup->delete();
+            auditLog('ui.database.backup_schedule_deleted', [
+                'team_id' => $database->team()?->id,
+                'database_uuid' => $database->uuid,
+                'database_name' => $database->name,
+                'backup_uuid' => $backupUuid,
+            ]);
 
-            if ($this->backup->database->getMorphClass() === ServiceDatabase::class) {
-                $serviceDatabase = $this->backup->database;
+            if ($database->getMorphClass() === ServiceDatabase::class) {
+                $serviceDatabase = $database;
 
                 return redirectRoute($this, 'project.service.database.backups', [
                     'project_uuid' => $this->parameters['project_uuid'],
@@ -251,9 +259,14 @@ class BackupEdit extends Component
             }
 
             DatabaseBackupJob::dispatch($this->backup);
-            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
-
             $database = $this->backup->database;
+            auditLog('ui.database.backup_started', [
+                'team_id' => $database->team()?->id,
+                'database_uuid' => $database->uuid,
+                'database_name' => $database->name,
+                'backup_uuid' => $this->backup->uuid,
+            ]);
+            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
 
             if ($database instanceof ServiceDatabase) {
                 return redirect()->route('project.service.database.backup.executions', [
diff --git a/app/Livewire/Project/Database/BackupNow.php b/app/Livewire/Project/Database/BackupNow.php
index 8c83e33556..39a1960119 100644
--- a/app/Livewire/Project/Database/BackupNow.php
+++ b/app/Livewire/Project/Database/BackupNow.php
@@ -25,6 +25,13 @@ class BackupNow extends Component
             }
 
             DatabaseBackupJob::dispatch($this->backup);
+            $database = $this->backup->database;
+            auditLog('ui.database.backup_started', [
+                'team_id' => $database->team()?->id,
+                'database_uuid' => $database->uuid,
+                'database_name' => $database->name,
+                'backup_uuid' => $this->backup->uuid,
+            ]);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Database/Heading.php b/app/Livewire/Project/Database/Heading.php
index f2f8fa387d..993200b578 100644
--- a/app/Livewire/Project/Database/Heading.php
+++ b/app/Livewire/Project/Database/Heading.php
@@ -89,6 +89,7 @@ class Heading extends Component
 
             $this->dispatch('info', 'Gracefully stopping database.');
             StopDatabase::dispatch($this->database, false, $this->docker_cleanup);
+            $this->auditDatabaseAction('ui.database.stopped');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
         }
@@ -100,6 +101,7 @@ class Heading extends Component
             $this->authorize('manage', $this->database);
 
             $activity = RestartDatabase::run($this->database);
+            $this->auditDatabaseAction('ui.database.restarted');
             $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
             $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
         } catch (\Throwable $e) {
@@ -113,6 +115,7 @@ class Heading extends Component
             $this->authorize('manage', $this->database);
 
             $activity = StartDatabase::run($this->database);
+            $this->auditDatabaseAction('ui.database.started');
             $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
             $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
         } catch (\Throwable $e) {
@@ -128,4 +131,13 @@ class Heading extends Component
             ],
         ]);
     }
+
+    private function auditDatabaseAction(string $event): void
+    {
+        auditLog($event, [
+            'team_id' => $this->database->team()?->id,
+            'database_uuid' => $this->database->uuid,
+            'database_name' => $this->database->name,
+        ]);
+    }
 }
diff --git a/app/Livewire/Project/Database/ImportForm.php b/app/Livewire/Project/Database/ImportForm.php
index 5b8d90e2bb..87c9328eb3 100644
--- a/app/Livewire/Project/Database/ImportForm.php
+++ b/app/Livewire/Project/Database/ImportForm.php
@@ -510,6 +510,12 @@ EOD;
                 // Dispatch activity to the monitor and open slide-over
                 $this->dispatch('activityMonitor', $activity->id);
                 $this->dispatch('databaserestore');
+                auditLog('ui.database.import_started', [
+                    'team_id' => $this->resource->team()?->id,
+                    'database_uuid' => $this->resource->uuid,
+                    'database_name' => $this->resource->name,
+                    'source' => 'file',
+                ]);
             }
         } catch (\Throwable $e) {
             handleError($e, $this);
@@ -768,6 +774,13 @@ EOD;
             // Dispatch activity to the monitor and open slide-over
             $this->dispatch('activityMonitor', $activity->id);
             $this->dispatch('databaserestore');
+            auditLog('ui.database.restore_started', [
+                'team_id' => $this->resource->team()?->id,
+                'database_uuid' => $this->resource->uuid,
+                'database_name' => $this->resource->name,
+                'source' => 's3',
+                'storage_id' => $this->s3StorageId,
+            ]);
             $this->dispatch('info', 'Restoring database from S3. Progress will be shown in the activity monitor...');
         } catch (\Throwable $e) {
             $this->importRunning = false;
diff --git a/app/Livewire/Project/Service/Heading.php b/app/Livewire/Project/Service/Heading.php
index 0e7fed960f..d692a71546 100644
--- a/app/Livewire/Project/Service/Heading.php
+++ b/app/Livewire/Project/Service/Heading.php
@@ -116,6 +116,7 @@ class Heading extends Component
         try {
             $this->authorizeService('deploy');
             $activity = StartService::run($this->service, pullLatestImages: true);
+            $this->auditServiceAction('ui.service.started');
             $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -149,6 +150,7 @@ class Heading extends Component
         try {
             $this->authorizeService('stop');
             StopService::dispatch($this->service, false, $this->docker_cleanup);
+            $this->auditServiceAction('ui.service.stopped');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -165,6 +167,7 @@ class Heading extends Component
                 return;
             }
             $activity = StartService::run($this->service, stopBeforeStart: true);
+            $this->auditServiceAction('ui.service.restarted');
             $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -206,6 +209,7 @@ class Heading extends Component
                 return;
             }
             $activity = StartService::run($this->service, pullLatestImages: true, stopBeforeStart: true);
+            $this->auditServiceAction('ui.service.restarted');
             $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -222,6 +226,15 @@ class Heading extends Component
         $this->authorize($ability, $this->service);
     }
 
+    private function auditServiceAction(string $event): void
+    {
+        auditLog($event, [
+            'team_id' => $this->service->team()?->id,
+            'service_uuid' => $this->service->uuid,
+            'service_name' => $this->service->name,
+        ]);
+    }
+
     public function render()
     {
         return view('livewire.project.service.heading', [
diff --git a/app/Livewire/Project/Service/Storage.php b/app/Livewire/Project/Service/Storage.php
index adb19a3135..10079276f2 100644
--- a/app/Livewire/Project/Service/Storage.php
+++ b/app/Livewire/Project/Service/Storage.php
@@ -78,6 +78,7 @@ class Storage extends Component
         $this->activeTab = $this->resolveDefaultTab();
         $this->fileStorage = collect();
         $this->loadFileStorageForActiveTab();
+        $this->name = $this->generateDefaultVolumeName();
     }
 
     public function refreshStoragesFromEvent()
@@ -208,9 +209,7 @@ class Storage extends Component
             $this->validate([
                 'name' => ValidationPatterns::volumeNameRules(),
                 'mount_path' => 'required|string',
-                'host_path' => $this->isSwarm
-                    ? ['required', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN]
-                    : ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
+                'host_path' => ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             ], array_merge(ValidationPatterns::volumeNameMessages(), [
                 'host_path.regex' => 'Host path must start with / and only contain safe path characters.',
             ]));
@@ -343,7 +342,7 @@ class Storage extends Component
 
     public function clearForm()
     {
-        $this->name = '';
+        $this->name = $this->generateDefaultVolumeName();
         $this->mount_path = '';
         $this->host_path = null;
         $this->file_storage_path = '';
@@ -376,6 +375,13 @@ class Storage extends Component
         throw new \Exception('No valid resource type for file mount storage type!');
     }
 
+    private function generateDefaultVolumeName(): string
+    {
+        $name = str($this->resource->name)->slug()->value();
+
+        return ($name ?: 'volume').'-data';
+    }
+
     public function fileStoragePreviewPath(): string
     {
         $path = str($this->file_storage_path)->trim();
diff --git a/app/Livewire/Project/Shared/Destination.php b/app/Livewire/Project/Shared/Destination.php
index 94fb4b4eb3..9262b9847e 100644
--- a/app/Livewire/Project/Shared/Destination.php
+++ b/app/Livewire/Project/Shared/Destination.php
@@ -64,6 +64,13 @@ class Destination extends Component
             $this->authorize('deploy', $this->resource);
             $server = Server::ownedByCurrentTeam()->findOrFail($serverId);
             StopApplicationOneServer::run($this->resource, $server);
+            auditLog('ui.application.destination_stopped', [
+                'team_id' => $this->resource->team()?->id,
+                'application_uuid' => $this->resource->uuid,
+                'application_name' => $this->resource->name,
+                'server_uuid' => $server->uuid,
+                'server_name' => $server->name,
+            ]);
             $this->refreshServers();
         } catch (\Exception $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Add.php b/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
index 1dcb7c7810..15b4410a5f 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
@@ -9,14 +9,27 @@ use App\Models\Server;
 use App\Models\Service;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
+use App\Traits\HasSecretManagerAutocomplete;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
 
 class Add extends Component
 {
-    use AuthorizesRequests, EnvironmentVariableAnalyzer;
+    use AuthorizesRequests, EnvironmentVariableAnalyzer, HasSecretManagerAutocomplete;
+
+    protected function secretManagerResource(): ?Model
+    {
+        if ($this->shared || ! $this->resource) {
+            return null;
+        }
+
+        return $this->resource;
+    }
+
+    public $resource;
 
     public $parameters;
 
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 8350cffa4c..fea181395c 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -13,7 +13,9 @@ use App\Models\SharedEnvironmentVariable;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
 use App\Traits\EnvironmentVariableProtection;
+use App\Traits\HasSecretManagerAutocomplete;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
@@ -22,7 +24,12 @@ class Show extends Component
 {
     public bool $showEnvironmentType = true;
 
-    use AuthorizesRequests, EnvironmentVariableAnalyzer, EnvironmentVariableProtection;
+    use AuthorizesRequests, EnvironmentVariableAnalyzer, EnvironmentVariableProtection, HasSecretManagerAutocomplete;
+
+    protected function secretManagerResource(): ?Model
+    {
+        return $this->isSharedVariable ? null : $this->env->resourceable;
+    }
 
     public $parameters;
 
@@ -164,7 +171,24 @@ class Show extends Component
         $this->valuesLoaded = true;
     }
 
+    public function copyValue(): ?string
+    {
+        if ($this->env->is_shown_once || (auth()->user()?->isMember() ?? true)) {
+            return null;
+        }
+
+        if (! $this->env instanceof ModelsEnvironmentVariable) {
+            return $this->env->value;
+        }
+
+        return $this->env->get_real_environment_variables_with_server(
+            $this->env->resolveReferencedValue(),
+            $this->env->resourceable,
+        );
+    }
+
     private function syncData(bool $toModel = false): void
+
     {
         if ($toModel) {
             $this->key = ValidationPatterns::normalizeEnvironmentVariableKey($this->key);
@@ -207,7 +231,7 @@ class Show extends Component
             $this->is_required = (bool) ($this->env->is_required ?? false);
             // Use the stored column, not the value-based accessor (that decrypts).
             $this->is_shared = (bool) ($this->env->getAttributes()['is_shared'] ?? false);
-            $this->isValueHidden = auth()->user()?->isMember() ?? false;
+            $this->isValueHidden = auth()->user()?->isMember() ?? true;
 
             if ($this->valuesLoaded) {
                 $this->hydrateValueFields();
@@ -234,12 +258,12 @@ class Show extends Component
             $this->is_really_required = $this->is_required && blank($this->value);
         }
 
-        if ($this->env->is_shown_once || auth()->user()?->isMember()) {
+        if ($this->env->is_shown_once || (auth()->user()?->isMember() ?? true)) {
             $this->value = null;
             $this->real_value = null;
         }
 
-        $this->isValueHidden = auth()->user()?->isMember() ?? false;
+        $this->isValueHidden = auth()->user()?->isMember() ?? true;
     }
 
     public function checkEnvs()
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php b/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php
index da55dee197..c2f0059399 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/ShowHardcoded.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared\EnvironmentVariable;
 
+use App\Models\EnvironmentVariable;
 use Livewire\Component;
 
 class ShowHardcoded extends Component
@@ -20,6 +21,10 @@ class ShowHardcoded extends Component
 
     public bool $isPreview = false;
 
+    public ?string $resourceableType = null;
+
+    public ?int $resourceableId = null;
+
     public function mount()
     {
         $this->key = $this->env['key'];
@@ -28,6 +33,20 @@ class ShowHardcoded extends Component
         $this->serviceName = $this->env['service_name'] ?? null;
     }
 
+    public function copyValue(): ?string
+    {
+        if (auth()->user()?->isMember() ?? true) {
+            return null;
+        }
+
+        return EnvironmentVariable::make([
+            'value' => $this->value,
+            'is_preview' => $this->isPreview,
+            'resourceable_type' => $this->resourceableType,
+            'resourceable_id' => $this->resourceableId,
+        ])->resolveReferencedValue();
+    }
+
     public function render()
     {
         return view('livewire.project.shared.environment-variable.show-hardcoded');
diff --git a/app/Livewire/Project/Shared/ResourceOperations.php b/app/Livewire/Project/Shared/ResourceOperations.php
index dd00be25cc..61b4b2d2ed 100644
--- a/app/Livewire/Project/Shared/ResourceOperations.php
+++ b/app/Livewire/Project/Shared/ResourceOperations.php
@@ -86,6 +86,14 @@ class ResourceOperations extends Component
             if (! $server->canHostResources()) {
                 return $this->addError('destination_id', 'The selected server cannot host resources.');
             }
+            auditLog('ui.resource.clone_started', [
+                'team_id' => $this->resource->team()?->id,
+                'resource_uuid' => $this->resource->uuid,
+                'resource_name' => $this->resource->name,
+                'resource_type' => class_basename($this->resource),
+                'destination_uuid' => $new_destination->uuid,
+                'environment_id' => $new_environment->id,
+            ]);
 
             if ($this->resource->getMorphClass() === Application::class) {
                 $new_resource = clone_application($this->resource, $new_destination, [
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 30d1024621..c121f1b93b 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -184,6 +184,13 @@ class Show extends Component
             $this->authorize('update', $this->resource);
             $this->authorize('update', $this->task);
             ScheduledTaskJob::dispatch($this->task);
+            auditLog('ui.scheduled_task.executed', [
+                'team_id' => $this->resource->team()?->id,
+                'resource_uuid' => $this->resource->uuid,
+                'resource_name' => $this->resource->name,
+                'scheduled_task_uuid' => $this->task->uuid,
+                'scheduled_task_name' => $this->task->name,
+            ]);
             $this->dispatch('success', 'Scheduled task executed.');
         } catch (\Exception $e) {
             return handleError($e);
diff --git a/app/Livewire/Project/Shared/SecretManagerLinks.php b/app/Livewire/Project/Shared/SecretManagerLinks.php
new file mode 100644
index 0000000000..c0641b56c5
--- /dev/null
+++ b/app/Livewire/Project/Shared/SecretManagerLinks.php
@@ -0,0 +1,290 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Models\IntegrationToken;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+/**
+ * Manages a resource's single secret manager source and lets the user
+ * browse remote key names, add {{vault.KEY}} reference variables, and import
+ * all missing keys. Secret values never enter the component state or the DB.
+ */
+class SecretManagerLinks extends Component
+{
+    use AuthorizesRequests;
+
+    public $resource;
+
+    public $link;
+
+    public $availableTokens;
+
+    public string $integration_token_uuid = '';
+
+    public array $settings = [];
+
+    /** @var list<string> Remote key names only — values are never stored. */
+    public array $keys = [];
+
+    public bool $keysLoaded = false;
+
+    public string $search = '';
+
+    public function mount(): void
+    {
+        $this->loadData();
+    }
+
+    private function loadData(): void
+    {
+        $this->link = $this->resource->secretManagerLink()->with('integrationToken')->first();
+        $this->availableTokens = IntegrationToken::ownedByCurrentTeam()
+            ->whereIn('provider', IntegrationToken::SECRET_MANAGER_PROVIDERS)
+            ->get()
+            ->filter(fn (IntegrationToken $token) => in_array('secrets', $token->capabilities ?? [], true))
+            ->values();
+
+        if ($this->link) {
+            $this->integration_token_uuid = $this->link->integrationToken->uuid;
+            $this->settings = $this->link->settings ?? [];
+        }
+    }
+
+    public function getSelectedTokenProperty(): ?IntegrationToken
+    {
+        if (blank($this->integration_token_uuid)) {
+            return null;
+        }
+
+        return $this->availableTokens->firstWhere('uuid', $this->integration_token_uuid);
+    }
+
+    protected function rules(): array
+    {
+        $rules = [
+            'integration_token_uuid' => ['required', 'string'],
+        ];
+
+        $rules += match ($this->selectedToken?->provider) {
+            'doppler' => $this->selectedToken->dopplerTokenType() === 'service_account'
+                ? [
+                    'settings.project' => ['required', 'string'],
+                    'settings.config' => ['required', 'string'],
+                ]
+                : [],
+            'infisical' => [
+                'settings.project_id' => ['required', 'string'],
+                'settings.environment' => ['required', 'string'],
+                'settings.secret_path' => ['nullable', 'string'],
+            ],
+            'vault' => [
+                'settings.mount' => ['required', 'string'],
+                'settings.path' => ['required', 'string'],
+            ],
+            default => [],
+        };
+
+        return $rules;
+    }
+
+    /**
+     * Auto-save when a token is selected in the dropdown. Existing {{vault.*}}
+     * references are intentionally NOT re-checked — missing keys surface at
+     * the next deployment.
+     */
+    public function updatedIntegrationTokenUuid(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $token = $this->selectedToken;
+
+            if (! $token) {
+                return;
+            }
+
+            if ($this->link?->integrationToken?->provider !== $token->provider
+                || $this->link?->integrationToken?->dopplerTokenType() !== $token->dopplerTokenType()) {
+                $this->settings = [];
+            }
+
+            $settings = array_filter($this->settings, fn ($value) => filled($value));
+
+            $this->resource->secretManagerLink()->updateOrCreate([], [
+                'integration_token_id' => $token->id,
+                'settings' => $settings ?: null,
+            ]);
+            $this->auditSecretManagerAction('source_updated', [
+                'integration_token_uuid' => $token->uuid,
+                'provider' => $token->provider,
+            ]);
+
+            $this->resetKeys();
+            $this->loadData();
+            $this->dispatch('success', 'Secret manager source saved. References resolve at the next deployment.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    /**
+     * Auto-save of the provider-specific settings fields (called on blur).
+     */
+    public function saveSettings(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->link) {
+            return;
+        }
+
+        $validated = $this->validate();
+
+        try {
+
+            $settings = array_filter(data_get($validated, 'settings', []), fn ($value) => filled($value));
+
+            $this->link->update(['settings' => $settings ?: null]);
+            $this->auditSecretManagerAction('settings_updated');
+            $this->resetKeys();
+            $this->loadData();
+            $this->dispatch('success', 'Secret manager settings saved.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function removeSource(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $token = $this->link?->integrationToken;
+            $this->resource->secretManagerLink()->delete();
+            $this->auditSecretManagerAction('source_removed', [
+                'integration_token_uuid' => $token?->uuid,
+                'provider' => $token?->provider,
+            ]);
+            $this->link = null;
+            $this->integration_token_uuid = '';
+            $this->settings = [];
+            $this->resetKeys();
+            $this->loadData();
+            $this->dispatch('success', 'Secret manager source removed. Existing {{vault.*}} references will fail the next deployment until they are removed too.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function loadKeys(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            if (! $this->link) {
+                return;
+            }
+
+            // Values are fetched into memory, reduced to key names, and discarded.
+            $keys = array_keys($this->link->fetchSecrets());
+            sort($keys);
+            $this->keys = $keys;
+            $this->keysLoaded = true;
+            $this->auditSecretManagerAction('keys_viewed', ['key_count' => count($keys)]);
+        } catch (\Throwable $e) {
+            $this->dispatch('error', 'Could not fetch keys: '.$e->getMessage());
+        }
+    }
+
+    public function addReference(string $key): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            if (! in_array($key, $this->keys, true)) {
+                return;
+            }
+
+            if ($this->resource->environment_variables()->where('key', $key)->exists()) {
+                $this->dispatch('error', "A variable with the key {$key} already exists.");
+
+                return;
+            }
+
+            $this->resource->environment_variables()->create([
+                'key' => $key,
+                'value' => '{{vault.'.$key.'}}',
+            ]);
+            $this->auditSecretManagerAction('reference_created', ['secret_key' => $key]);
+
+            $this->dispatch('refreshEnvs');
+            $this->dispatch('success', "Added {$key} as {{vault.{$key}}}.");
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function importAll(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            if (! $this->link) {
+                return;
+            }
+
+            $imported = $this->link->importMissingReferences();
+            $this->auditSecretManagerAction('references_imported', [
+                'key_count' => count($imported),
+                'secret_keys' => $imported,
+            ]);
+
+            $this->dispatch('refreshEnvs');
+            $this->dispatch('success', $imported === []
+                ? 'All remote keys already exist as variables.'
+                : 'Imported '.count($imported).' keys as {{vault.KEY}} references.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    private function resetKeys(): void
+    {
+        $this->keys = [];
+        $this->keysLoaded = false;
+        $this->search = '';
+    }
+
+    /** @param array<string, mixed> $context */
+    private function auditSecretManagerAction(string $action, array $context = []): void
+    {
+        $resourceType = str(class_basename($this->resource))->snake()->value();
+
+        auditLog("ui.{$resourceType}.secret_manager.{$action}", array_merge([
+            'team_id' => $this->resource->team()?->id,
+            "{$resourceType}_uuid" => $this->resource->uuid,
+            "{$resourceType}_name" => $this->resource->name,
+        ], $context));
+    }
+
+    public function getFilteredKeysProperty(): array
+    {
+        if (blank($this->search)) {
+            return $this->keys;
+        }
+
+        return array_values(array_filter(
+            $this->keys,
+            fn (string $key) => stripos($key, $this->search) !== false,
+        ));
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.shared.secret-manager-links', [
+            'selectedToken' => $this->selectedToken,
+            'filteredKeys' => $this->filteredKeys,
+        ]);
+    }
+}
diff --git a/app/Livewire/Project/Shared/Storages/All.php b/app/Livewire/Project/Shared/Storages/All.php
index fcd7752a0c..3dadfb46f4 100644
--- a/app/Livewire/Project/Shared/Storages/All.php
+++ b/app/Livewire/Project/Shared/Storages/All.php
@@ -108,6 +108,25 @@ class All extends Component
         $this->submit($storageId);
     }
 
+    public function clearHostPath(int $storageId): void
+    {
+        $this->authorize('update', $this->resource);
+
+        $storage = $this->findStorageOrFail($storageId);
+        if ($storage->shouldBeReadOnlyInUI()) {
+            $this->dispatch('error', 'This volume is read-only.');
+
+            return;
+        }
+
+        $storage->host_path = null;
+        $storage->save();
+        $this->forms[$storageId]['hostPath'] = null;
+
+        $this->dispatch('configurationChanged');
+        $this->dispatch('success', 'Source path removed. Use a directory mount for host directory bindings.');
+    }
+
     /**
      * Livewire listbox onChange cannot pass args; PR suffix fields call this via updatedForms.
      */
diff --git a/app/Livewire/Project/Shared/Storages/Show.php b/app/Livewire/Project/Shared/Storages/Show.php
deleted file mode 100644
index c70ebc57fd..0000000000
--- a/app/Livewire/Project/Shared/Storages/Show.php
+++ /dev/null
@@ -1,201 +0,0 @@
-<?php
-
-namespace App\Livewire\Project\Shared\Storages;
-
-use App\Livewire\Project\Service\Storage as StorageComponent;
-use App\Models\Application;
-use App\Models\LocalPersistentVolume;
-use App\Models\ScheduledVolumeBackup;
-use App\Support\ValidationPatterns;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-class Show extends Component
-{
-    use AuthorizesRequests;
-
-    public LocalPersistentVolume $storage;
-
-    public $resource;
-
-    public bool $isReadOnly = false;
-
-    public bool $isFirst = true;
-
-    public bool $isService = false;
-
-    public ?string $startedAt = null;
-
-    public bool $supportsPreviewSuffix = false;
-
-    // Explicit properties
-    public string $name;
-
-    public string $mountPath;
-
-    public ?string $hostPath = null;
-
-    public bool $isPreviewSuffixEnabled = true;
-
-    public bool $hasEnabledBackup = false;
-
-    public ?string $backupUrl = null;
-
-    /**
-     * When true, parent already batched badge/url data — skip per-row queries on mount.
-     */
-    public bool $backupMetaHydrated = false;
-
-    /** When true, the Backup Configure Livewire modal is mounted (lazy). */
-    public bool $showBackupModal = false;
-
-    protected $validationAttributes = [
-        'name' => 'name',
-        'mountPath' => 'mount',
-        'hostPath' => 'host',
-    ];
-
-    protected function rules(): array
-    {
-        return [
-            'name' => ValidationPatterns::volumeNameRules(),
-            'mountPath' => ['required', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
-            'hostPath' => ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
-            'isPreviewSuffixEnabled' => 'required|boolean',
-        ];
-    }
-
-    protected function messages(): array
-    {
-        return array_merge(
-            ValidationPatterns::volumeNameMessages(),
-            [
-                'mountPath.regex' => 'Mount path must start with / and only contain safe path characters.',
-                'hostPath.regex' => 'Host path must start with / and only contain safe path characters.',
-            ]
-        );
-    }
-
-    /**
-     * Sync data between component properties and model
-     *
-     * @param  bool  $toModel  If true, sync FROM properties TO model. If false, sync FROM model TO properties.
-     */
-    private function syncData(bool $toModel = false): void
-    {
-        if ($toModel) {
-            // Sync TO model (before save)
-            $this->storage->name = $this->name;
-            $this->storage->mount_path = $this->mountPath;
-            $this->storage->host_path = $this->hostPath;
-            $this->storage->is_preview_suffix_enabled = $this->isPreviewSuffixEnabled;
-        } else {
-            // Sync FROM model (on load/refresh)
-            $this->name = $this->storage->name;
-            $this->mountPath = $this->storage->mount_path;
-            $this->hostPath = $this->storage->host_path;
-            $this->isPreviewSuffixEnabled = $this->storage->is_preview_suffix_enabled ?? true;
-        }
-    }
-
-    public function mount(): void
-    {
-        $this->syncData(false);
-        $this->isReadOnly = $this->storage->shouldBeReadOnlyInUI();
-        // PR deployment volume suffixes only apply to git-based applications.
-        $this->supportsPreviewSuffix = $this->resource instanceof Application
-            && $this->resource->git_based()
-            && filled($this->resource->git_repository)
-            && ! $this->isService;
-        // Parent All batches badge/url; isolated embeds still hydrate themselves.
-        if (! $this->backupMetaHydrated) {
-            $this->refreshBackupStatus();
-        }
-    }
-
-    #[On('refreshVolumeBackups')]
-    public function refreshBackupStatus(): void
-    {
-        $backup = $this->storage->scheduledBackups()->first();
-
-        $this->hasEnabledBackup = $backup?->enabled ?? false;
-        $this->backupUrl = null;
-
-        if (! $this->hasEnabledBackup || ! $this->resource instanceof Application) {
-            return;
-        }
-
-        $this->resource->loadMissing('environment.project');
-
-        $parameters = [
-            'project_uuid' => $this->resource->project()->uuid,
-            'environment_uuid' => $this->resource->environment->uuid,
-            'application_uuid' => $this->resource->uuid,
-        ];
-        $hasOtherBackups = ScheduledVolumeBackup::query()
-            ->forApplication($this->resource)
-            ->where('id', '!=', $backup->id)
-            ->exists();
-
-        $this->backupUrl = $hasOtherBackups
-            ? route('project.application.backup.index', [...$parameters, 'search' => $this->storage->name])
-            : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
-    }
-
-    public function openBackupModal(): void
-    {
-        $this->authorize('update', $this->resource);
-        $this->showBackupModal = true;
-    }
-
-    #[On('modalClosed')]
-    public function onModalClosed(): void
-    {
-        // Drop the nested Create component from the DOM after close to free snapshot weight.
-        if ($this->showBackupModal) {
-            $this->showBackupModal = false;
-        }
-    }
-
-    public function instantSave(): void
-    {
-        $this->authorize('update', $this->resource);
-        $this->validate();
-
-        $this->syncData(true);
-        $this->storage->save();
-        $this->dispatch('success', 'Storage updated successfully');
-    }
-
-    public function submit()
-    {
-        $this->authorize('update', $this->resource);
-
-        $this->validate();
-        $this->syncData(true);
-        $this->storage->save();
-        $this->dispatch('success', 'Storage updated successfully');
-    }
-
-    public function delete($password, $selectedActions = [])
-    {
-        $this->authorize('update', $this->resource);
-
-        if (! verifyPasswordConfirmation($password, $this)) {
-            return 'The provided password is incorrect.';
-        }
-
-        if ($this->storage->scheduledBackups()->exists()) {
-            $this->dispatch('error', 'Delete this volume backup schedule and its archives before deleting the volume.');
-
-            return false;
-        }
-
-        $this->storage->delete();
-        $this->dispatch('storageCountsChanged')->to(StorageComponent::class);
-        $this->dispatch('configurationChanged');
-
-        return true;
-    }
-}
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index a8e2d72df1..86023628e2 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -208,6 +208,12 @@ class VolumeBackups extends Component
         }
 
         VolumeBackupJob::dispatch($this->backup);
+        auditLog('ui.volume_backup.started', [
+            'team_id' => $this->resource->team()?->id,
+            'resource_uuid' => $this->resource->uuid,
+            'resource_name' => $this->resource->name,
+            'backup_uuid' => $this->backup->uuid,
+        ]);
         $this->dispatch('success', 'Storage backup queued.');
 
         return redirect()->route($this->routeName('executions'), $this->routeParameters());
diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index 5a978ac84f..a1cc4db19f 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -140,6 +140,12 @@ class ApiTokens extends Component
             ]);
             $expiresAt = $this->expiresInDays ? now()->addDays($this->expiresInDays) : null;
             $token = auth()->user()->createToken($this->description, array_values($this->permissions), $expiresAt);
+            auditLog('ui.api_token.created', [
+                'team_id' => currentTeam()->id,
+                'api_token_name' => $this->description,
+                'abilities' => array_values($this->permissions),
+                'expires_at' => $expiresAt?->toIso8601String(),
+            ]);
             $this->getTokens();
             // Do NOT strip the numeric prefix (e.g. "69|...") — Sanctum uses it to index and look up tokens.
             session()->flash('token', $token->plainTextToken);
@@ -156,7 +162,12 @@ class ApiTokens extends Component
                 ->where('id', $id)
                 ->firstOrFail();
             $this->authorize('delete', $token);
+            $tokenName = $token->name;
             $token->delete();
+            auditLog('ui.api_token.revoked', [
+                'team_id' => currentTeam()->id,
+                'api_token_name' => $tokenName,
+            ]);
             $this->getTokens();
         } catch (\Exception $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Security/IntegrationTokenEditor.php b/app/Livewire/Security/IntegrationTokenEditor.php
new file mode 100644
index 0000000000..2a33591822
--- /dev/null
+++ b/app/Livewire/Security/IntegrationTokenEditor.php
@@ -0,0 +1,152 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\IntegrationToken;
+use App\Services\IntegrationTokenValidator;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class IntegrationTokenEditor extends Component
+{
+    use AuthorizesRequests;
+
+    public IntegrationToken $integrationToken;
+
+    public string $name = '';
+
+    public string $newToken = '';
+
+    public array $capabilities = [];
+
+    public array $metadata = [];
+
+    public function mount(string $integration_token_uuid): void
+    {
+        $this->integrationToken = IntegrationToken::ownedByCurrentTeam()
+            ->whereUuid($integration_token_uuid)
+            ->firstOrFail();
+
+        $this->authorize('view', $this->integrationToken);
+
+        $this->name = $this->integrationToken->name;
+        $this->capabilities = $this->integrationToken->capabilities;
+        $this->metadata = $this->integrationToken->metadata ?? [];
+    }
+
+    protected function rules(): array
+    {
+        $allowedCapability = $this->integrationToken->provider === 'cloudflare' ? 'dns' : 'secrets';
+
+        $rules = [
+            'name' => ['required', 'string', 'max:255'],
+            'newToken' => ['nullable', 'string'],
+            'capabilities' => ['required', 'array', 'min:1'],
+            'capabilities.*' => ['required', 'in:'.$allowedCapability],
+        ];
+
+        if ($this->integrationToken->provider === 'infisical') {
+            $rules['metadata.base_url'] = ['required', 'url'];
+            $rules['metadata.client_id'] = ['required', 'string'];
+        }
+
+        if ($this->integrationToken->provider === 'vault') {
+            $rules['metadata.base_url'] = ['required', 'url'];
+            $rules['metadata.namespace'] = ['nullable', 'string'];
+        }
+
+        return $rules;
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'capabilities.required' => 'Select at least one capability.',
+            'capabilities.min' => 'Select at least one capability.',
+        ];
+    }
+
+    public function save(IntegrationTokenValidator $validator): void
+    {
+        $this->authorize('update', $this->integrationToken);
+        $validated = $this->validate();
+        $provider = $this->integrationToken->provider;
+        $token = filled($validated['newToken']) ? $validated['newToken'] : $this->integrationToken->token;
+        $metadata = array_filter(data_get($validated, 'metadata', []), fn ($value) => filled($value));
+        $capabilitiesChanged = collect($validated['capabilities'])->sort()->values()->all()
+            !== collect($this->integrationToken->capabilities)->sort()->values()->all();
+        $metadataChanged = $metadata != ($this->integrationToken->metadata ?? []);
+
+        try {
+            if ((filled($validated['newToken']) || $capabilitiesChanged || $metadataChanged)
+                && ! $validator->validate($provider, $token, $validated['capabilities'], $metadata)) {
+                $this->dispatch('error', $validator->errorMessage($provider));
+
+                return;
+            }
+
+            $updates = [
+                'name' => $validated['name'],
+                'capabilities' => $validated['capabilities'],
+                'metadata' => $metadata ?: null,
+            ];
+
+            if (filled($validated['newToken'])) {
+                $updates['token'] = $validated['newToken'];
+            }
+
+            $this->integrationToken->update($updates);
+            $this->newToken = '';
+
+            auditLog('ui.integration_token.updated', [
+                'team_id' => currentTeam()->id,
+                'integration_token_uuid' => $this->integrationToken->uuid,
+                'integration_token_name' => $this->integrationToken->name,
+                'provider' => $this->integrationToken->provider,
+                'rotated' => array_key_exists('token', $updates),
+            ]);
+
+            $this->dispatch(
+                'integration-token-updated',
+                uuid: $this->integrationToken->uuid,
+                name: $this->integrationToken->name,
+                capabilities: $this->integrationToken->capabilities,
+            );
+            $this->dispatch('success', 'Integration token updated successfully.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function delete(string $password = ''): void
+    {
+        $this->authorize('delete', $this->integrationToken);
+
+        if ($this->integrationToken->secretManagerLinks()->exists()) {
+            $this->dispatch('error', 'This token is used by one or more resources as a secret manager source. Remove those links first.');
+
+            return;
+        }
+
+        $uuid = $this->integrationToken->uuid;
+        $name = $this->integrationToken->name;
+        $provider = $this->integrationToken->provider;
+        $this->integrationToken->delete();
+
+        auditLog('ui.integration_token.deleted', [
+            'team_id' => currentTeam()->id,
+            'integration_token_uuid' => $uuid,
+            'integration_token_name' => $name,
+            'provider' => $provider,
+        ]);
+
+        $this->dispatch('integration-token-deleted', uuid: $this->integrationToken->uuid);
+        $this->dispatch('close-modal');
+        $this->dispatch('success', 'Integration token deleted successfully.');
+    }
+
+    public function render()
+    {
+        return view('livewire.security.integration-token-editor');
+    }
+}
diff --git a/app/Livewire/Security/IntegrationTokenForm.php b/app/Livewire/Security/IntegrationTokenForm.php
new file mode 100644
index 0000000000..26ecce1e14
--- /dev/null
+++ b/app/Livewire/Security/IntegrationTokenForm.php
@@ -0,0 +1,127 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\IntegrationToken;
+use App\Services\IntegrationTokenValidator;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class IntegrationTokenForm extends Component
+{
+    use AuthorizesRequests;
+
+    public bool $modal_mode = false;
+
+    public string $provider = 'cloudflare';
+
+    public string $name = '';
+
+    public string $token = '';
+
+    public array $capabilities = ['dns'];
+
+    public array $metadata = [];
+
+    public function mount(): void
+    {
+        $this->authorize('create', IntegrationToken::class);
+    }
+
+    public function updatedProvider(): void
+    {
+        if ($this->provider === 'cloudflare') {
+            $this->capabilities = ['dns'];
+            $this->metadata = [];
+        } else {
+            $this->capabilities = ['secrets'];
+            $this->metadata = $this->provider === 'infisical'
+                ? ['base_url' => 'https://app.infisical.com']
+                : [];
+        }
+    }
+
+    protected function rules(): array
+    {
+        $allowedCapability = $this->provider === 'cloudflare' ? 'dns' : 'secrets';
+
+        $rules = [
+            'provider' => ['required', 'in:'.implode(',', array_keys(IntegrationToken::PROVIDER_NAMES))],
+            'name' => ['required', 'string', 'max:255'],
+            'token' => ['required', 'string'],
+            'capabilities' => ['required', 'array', 'min:1'],
+            'capabilities.*' => ['required', 'in:'.$allowedCapability],
+        ];
+
+        if ($this->provider === 'infisical') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.client_id'] = ['required', 'string'];
+        }
+
+        if ($this->provider === 'doppler') {
+            $rules['token'][] = 'regex:/^dp\.(st|sa)\./';
+        }
+
+        if ($this->provider === 'vault') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.namespace'] = ['nullable', 'string'];
+        }
+
+        return $rules;
+    }
+
+    protected function messages(): array
+    {
+        return [
+            'capabilities.required' => 'Select at least one capability.',
+            'capabilities.min' => 'Select at least one capability.',
+            'token.regex' => 'Use a Doppler service token (dp.st.*) or service account token (dp.sa.*).',
+        ];
+    }
+
+    public function addToken(IntegrationTokenValidator $validator): void
+    {
+        $validated = $this->validate();
+        $metadata = array_filter(data_get($validated, 'metadata', []), fn ($value) => filled($value));
+
+        try {
+            if (! $validator->validate($validated['provider'], $validated['token'], $validated['capabilities'], $metadata)) {
+                $this->dispatch('error', $validator->errorMessage($validated['provider']));
+
+                return;
+            }
+
+            $integrationToken = IntegrationToken::query()->create([
+                'provider' => $validated['provider'],
+                'name' => $validated['name'],
+                'token' => $validated['token'],
+                'capabilities' => $validated['capabilities'],
+                'metadata' => $metadata ?: null,
+                'team_id' => currentTeam()->id,
+            ]);
+
+            auditLog('ui.integration_token.created', [
+                'team_id' => currentTeam()->id,
+                'integration_token_uuid' => $integrationToken->uuid,
+                'integration_token_name' => $integrationToken->name,
+                'provider' => $integrationToken->provider,
+            ]);
+
+            $this->reset(['name', 'token']);
+            $this->dispatch('integrationTokenAdded')->to(IntegrationTokens::class);
+
+            if ($this->modal_mode) {
+                $this->dispatch('close-modal');
+            }
+
+            $this->dispatch('success', 'Integration token added successfully.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.security.integration-token-form');
+    }
+}
diff --git a/app/Livewire/Security/IntegrationTokens.php b/app/Livewire/Security/IntegrationTokens.php
new file mode 100644
index 0000000000..71805fb841
--- /dev/null
+++ b/app/Livewire/Security/IntegrationTokens.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Livewire\Security;
+
+use App\Models\IntegrationToken;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\On;
+use Livewire\Component;
+
+class IntegrationTokens extends Component
+{
+    use AuthorizesRequests;
+
+    public $tokens;
+
+    public function mount(): void
+    {
+        $this->authorize('viewAny', IntegrationToken::class);
+        $this->loadTokens();
+    }
+
+    #[On('integrationTokenAdded')]
+    public function loadTokens(): void
+    {
+        $this->tokens = IntegrationToken::ownedByCurrentTeam()->latest()->get();
+    }
+
+    public function deleteToken(int $tokenId, string $password = ''): void
+    {
+        $token = IntegrationToken::ownedByCurrentTeam()->findOrFail($tokenId);
+        $this->authorize('delete', $token);
+
+        if ($token->secretManagerLinks()->exists()) {
+            $this->dispatch('error', 'This token is used by one or more resources as a secret manager source. Remove those links first.');
+
+            return;
+        }
+
+        $tokenUuid = $token->uuid;
+        $tokenName = $token->name;
+        $provider = $token->provider;
+        $token->delete();
+        auditLog('ui.integration_token.deleted', [
+            'team_id' => currentTeam()->id,
+            'integration_token_uuid' => $tokenUuid,
+            'integration_token_name' => $tokenName,
+            'provider' => $provider,
+        ]);
+        $this->loadTokens();
+        $this->dispatch('success', 'Integration token deleted successfully.');
+    }
+
+    public function render()
+    {
+        return view('livewire.security.integration-tokens');
+    }
+}
diff --git a/app/Livewire/Server/DockerCleanup.php b/app/Livewire/Server/DockerCleanup.php
index 40dd92d87e..d0a8d8ca9d 100644
--- a/app/Livewire/Server/DockerCleanup.php
+++ b/app/Livewire/Server/DockerCleanup.php
@@ -134,6 +134,13 @@ class DockerCleanup extends Component
         try {
             $this->authorize('update', $this->server);
             DockerCleanupJob::dispatch($this->server, true, $this->deleteUnusedVolumes, $this->deleteUnusedNetworks);
+            auditLog('ui.server.docker_cleanup_started', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'delete_unused_volumes' => $this->deleteUnusedVolumes,
+                'delete_unused_networks' => $this->deleteUnusedNetworks,
+            ]);
             $this->dispatch('success', 'Manual cleanup job started. Depending on the amount of data, this might take a while.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Server/LogDrains.php b/app/Livewire/Server/LogDrains.php
index 5ce657f001..9319c856c0 100644
--- a/app/Livewire/Server/LogDrains.php
+++ b/app/Livewire/Server/LogDrains.php
@@ -177,6 +177,49 @@ class LogDrains extends Component
         }
     }
 
+    public function toggleLogDrain(string $type): void
+    {
+        $previousNewRelicEnabled = $this->server->settings->is_logdrain_newrelic_enabled;
+        $previousAxiomEnabled = $this->server->settings->is_logdrain_axiom_enabled;
+        $previousCustomEnabled = $this->server->settings->is_logdrain_custom_enabled;
+
+        try {
+            $this->authorize('update', $this->server);
+            $this->resetErrorBag();
+
+            $enabledProperty = $this->enabledProperty($type);
+
+            if ($this->{$enabledProperty}) {
+                $this->{$enabledProperty} = false;
+            } else {
+                $this->validateLogDrainSettings($type);
+                $this->isLogDrainNewRelicEnabled = $type === 'newrelic';
+                $this->isLogDrainAxiomEnabled = $type === 'axiom';
+                $this->isLogDrainCustomEnabled = $type === 'custom';
+            }
+
+            $this->syncData(true);
+
+            if ($this->server->isLogDrainEnabled()) {
+                StartLogDrain::run($this->server);
+                $this->dispatch('success', 'Log drain service started.');
+            } else {
+                StopLogDrain::run($this->server);
+                $this->dispatch('success', 'Log drain service stopped.');
+            }
+        } catch (\Throwable $e) {
+            // Restore the previously persisted enabled flags so the UI/DB never
+            // claim a runtime state that the Start/StopLogDrain action failed to apply.
+            $this->server->settings->is_logdrain_newrelic_enabled = $previousNewRelicEnabled;
+            $this->server->settings->is_logdrain_axiom_enabled = $previousAxiomEnabled;
+            $this->server->settings->is_logdrain_custom_enabled = $previousCustomEnabled;
+            $this->server->settings->save();
+            $this->syncData();
+
+            handleError($e, $this);
+        }
+    }
+
     public function submit()
     {
         try {
@@ -192,4 +235,33 @@ class LogDrains extends Component
     {
         return view('livewire.server.log-drains');
     }
+
+    private function enabledProperty(string $type): string
+    {
+        return match ($type) {
+            'newrelic' => 'isLogDrainNewRelicEnabled',
+            'axiom' => 'isLogDrainAxiomEnabled',
+            'custom' => 'isLogDrainCustomEnabled',
+            default => throw new \InvalidArgumentException('Unknown log drain type.'),
+        };
+    }
+
+    private function validateLogDrainSettings(string $type): void
+    {
+        match ($type) {
+            'newrelic' => $this->validate([
+                'logDrainNewRelicLicenseKey' => ['required', 'regex:/^[a-zA-Z0-9_\-\.]+$/'],
+                'logDrainNewRelicBaseUri' => ['required', 'url'],
+            ]),
+            'axiom' => $this->validate([
+                'logDrainAxiomDatasetName' => ['required', 'regex:/^[a-zA-Z0-9_\-\.]+$/'],
+                'logDrainAxiomApiKey' => ['required', 'regex:/^[a-zA-Z0-9_\-\.]+$/'],
+            ]),
+            'custom' => $this->validate([
+                'logDrainCustomConfig' => ['required'],
+                'logDrainCustomConfigParser' => ['string', 'nullable'],
+            ]),
+            default => throw new \InvalidArgumentException('Unknown log drain type.'),
+        };
+    }
 }
diff --git a/app/Livewire/Server/Navbar.php b/app/Livewire/Server/Navbar.php
index d9f70ea253..242b0971ec 100644
--- a/app/Livewire/Server/Navbar.php
+++ b/app/Livewire/Server/Navbar.php
@@ -101,6 +101,11 @@ class Navbar extends Component
 
             // Always use background job for all servers
             RestartProxyJob::dispatch($this->server);
+            auditLog('ui.proxy.restarted', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+            ]);
 
         } catch (\Throwable $e) {
             $this->restartInitiated = false;
@@ -125,6 +130,11 @@ class Navbar extends Component
         try {
             $this->authorize('manageProxy', $this->server);
             $activity = StartProxy::run($this->server, force: true);
+            auditLog('ui.proxy.started', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+            ]);
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -136,6 +146,12 @@ class Navbar extends Component
         try {
             $this->authorize('manageProxy', $this->server);
             StopProxy::dispatch($this->server, $forceStop);
+            auditLog('ui.proxy.stopped', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'force' => $forceStop,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Server/TransferImport.php b/app/Livewire/Server/TransferImport.php
index db8999c268..9fe37c10ca 100644
--- a/app/Livewire/Server/TransferImport.php
+++ b/app/Livewire/Server/TransferImport.php
@@ -123,6 +123,15 @@ class TransferImport extends Component
             $this->lastWarnings = array_values((array) data_get($result, 'warnings', []));
             $this->importedServerUuid = $dryRun ? null : data_get($result, 'server_uuid');
 
+            if (! $dryRun) {
+                auditLog('ui.server.imported', [
+                    'team_id' => $teamId,
+                    'server_uuid' => $this->importedServerUuid,
+                    'claimed' => (bool) data_get($result, 'claimed'),
+                    'adopt_mode' => $this->adoptMode,
+                ]);
+            }
+
             if ($dryRun) {
                 $this->dispatch('success', 'Dry run completed — nothing was written.');
             } elseif (data_get($result, 'claimed')) {
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index 45aff3f3c9..4bb89c9f08 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -19,6 +19,9 @@ class Advanced extends Component
     #[Validate('boolean')]
     public bool $is_registration_enabled;
 
+    #[Validate('boolean')]
+    public bool $disable_registration_when_oauth_enabled;
+
     #[Validate('boolean')]
     public bool $do_not_track;
 
@@ -61,6 +64,7 @@ class Advanced extends Component
     {
         return [
             'is_registration_enabled' => 'boolean',
+            'disable_registration_when_oauth_enabled' => 'boolean',
             'do_not_track' => 'boolean',
             'is_dns_validation_enabled' => 'boolean',
             'custom_dns_servers' => ['nullable', 'string', new ValidDnsServers],
@@ -87,6 +91,7 @@ class Advanced extends Component
         $this->allowed_ips = $this->settings->allowed_ips;
         $this->do_not_track = $this->settings->do_not_track;
         $this->is_registration_enabled = $this->settings->is_registration_enabled;
+        $this->disable_registration_when_oauth_enabled = $this->settings->disable_registration_when_oauth_enabled;
         $this->is_dns_validation_enabled = $this->settings->is_dns_validation_enabled;
         $this->is_api_enabled = $this->settings->is_api_enabled;
         $this->disable_two_step_confirmation = $this->settings->disable_two_step_confirmation;
@@ -203,6 +208,7 @@ class Advanced extends Component
         try {
             $this->authorize('update', $this->settings);
             $this->settings->is_registration_enabled = $this->is_registration_enabled;
+            $this->settings->disable_registration_when_oauth_enabled = $this->disable_registration_when_oauth_enabled;
             $this->settings->do_not_track = $this->do_not_track;
             $this->settings->is_dns_validation_enabled = $this->is_dns_validation_enabled;
             $this->settings->custom_dns_servers = $this->custom_dns_servers;
diff --git a/app/Livewire/SettingsEmail.php b/app/Livewire/SettingsEmail.php
index 4b5857db50..975ce9a241 100644
--- a/app/Livewire/SettingsEmail.php
+++ b/app/Livewire/SettingsEmail.php
@@ -160,30 +160,59 @@ class SettingsEmail extends Component
         $this->instantSave('Resend');
     }
 
+    public function toggleSmtp()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->smtpEnabled) {
+                $this->smtpEnabled = false;
+                $this->syncData(true);
+                $this->dispatch('success', 'SMTP settings updated.');
+            } else {
+                $this->validateSmtpSettings();
+                $this->smtpEnabled = true;
+                $this->resendEnabled = false;
+                $this->submitSmtp();
+            }
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        }
+    }
+
+    public function toggleResend()
+    {
+        try {
+            $this->resetErrorBag();
+
+            if ($this->resendEnabled) {
+                $this->resendEnabled = false;
+                $this->syncData(true);
+                $this->dispatch('success', 'Resend settings updated.');
+            } else {
+                $this->validateResendSettings();
+                $this->resendEnabled = true;
+                $this->smtpEnabled = false;
+                $this->submitResend();
+            }
+        } catch (\Throwable $e) {
+            $this->syncData();
+
+            return handleError($e, $this);
+        }
+    }
+
     public function submitSmtp()
     {
         try {
             $this->authorize('update', $this->settings);
-            $this->validate([
-                'smtpEnabled' => 'boolean',
-                'smtpFromAddress' => 'required|email',
-                'smtpFromName' => 'required|string',
-                'smtpHost' => 'required|string',
-                'smtpPort' => 'required|numeric',
-                'smtpEncryption' => 'required|string|in:starttls,tls,none',
-                'smtpUsername' => 'nullable|string',
-                'smtpPassword' => 'nullable|string',
-                'smtpTimeout' => 'nullable|numeric',
-                'smtpEhloDomain' => ['nullable', 'string', new ValidHostname],
-            ], [
-                'smtpFromAddress.required' => 'From Address is required.',
-                'smtpFromAddress.email' => 'Please enter a valid email address.',
-                'smtpFromName.required' => 'From Name is required.',
-                'smtpHost.required' => 'SMTP Host is required.',
-                'smtpPort.required' => 'SMTP Port is required.',
-                'smtpPort.numeric' => 'SMTP Port must be a number.',
-                'smtpEncryption.required' => 'Encryption type is required.',
-            ]);
+            $this->validateSmtpSettings();
+
+            if ($this->smtpEnabled) {
+                $this->settings->resend_enabled = $this->resendEnabled = false;
+            }
 
             $this->settings->smtp_enabled = $this->smtpEnabled;
             $this->settings->smtp_host = $this->smtpHost;
@@ -210,17 +239,11 @@ class SettingsEmail extends Component
     {
         try {
             $this->authorize('update', $this->settings);
-            $this->validate([
-                'resendEnabled' => 'boolean',
-                'resendApiKey' => $this->resendEnabled ? 'required|string' : 'nullable|string',
-                'smtpFromAddress' => 'required|email',
-                'smtpFromName' => 'required|string',
-            ], [
-                'resendApiKey.required' => 'Resend API Key is required.',
-                'smtpFromAddress.required' => 'From Address is required.',
-                'smtpFromAddress.email' => 'Please enter a valid email address.',
-                'smtpFromName.required' => 'From Name is required.',
-            ]);
+            $this->validateResendSettings();
+
+            if ($this->resendEnabled) {
+                $this->settings->smtp_enabled = $this->smtpEnabled = false;
+            }
 
             $this->settings->resend_enabled = $this->resendEnabled;
             $this->settings->resend_api_key = $this->resendApiKey;
@@ -237,6 +260,45 @@ class SettingsEmail extends Component
         }
     }
 
+    private function validateSmtpSettings(): void
+    {
+        $this->validate([
+            'smtpEnabled' => 'boolean',
+            'smtpFromAddress' => 'required|email',
+            'smtpFromName' => 'required|string',
+            'smtpHost' => 'required|string',
+            'smtpPort' => 'required|numeric',
+            'smtpEncryption' => 'required|string|in:starttls,tls,none',
+            'smtpUsername' => 'nullable|string',
+            'smtpPassword' => 'nullable|string',
+            'smtpTimeout' => 'nullable|numeric',
+            'smtpEhloDomain' => ['nullable', 'string', new ValidHostname],
+        ], [
+            'smtpFromAddress.required' => 'From Address is required.',
+            'smtpFromAddress.email' => 'Please enter a valid email address.',
+            'smtpFromName.required' => 'From Name is required.',
+            'smtpHost.required' => 'SMTP Host is required.',
+            'smtpPort.required' => 'SMTP Port is required.',
+            'smtpPort.numeric' => 'SMTP Port must be a number.',
+            'smtpEncryption.required' => 'Encryption type is required.',
+        ]);
+    }
+
+    private function validateResendSettings(): void
+    {
+        $this->validate([
+            'resendEnabled' => 'boolean',
+            'resendApiKey' => $this->resendEnabled ? 'required|string' : 'nullable|string',
+            'smtpFromAddress' => 'required|email',
+            'smtpFromName' => 'required|string',
+        ], [
+            'resendApiKey.required' => 'Resend API Key is required.',
+            'smtpFromAddress.required' => 'From Address is required.',
+            'smtpFromAddress.email' => 'Please enter a valid email address.',
+            'smtpFromName.required' => 'From Name is required.',
+        ]);
+    }
+
     public function sendTestEmail()
     {
         try {
diff --git a/app/Livewire/SettingsOauth.php b/app/Livewire/SettingsOauth.php
index 4082718191..3b24d0cd2e 100644
--- a/app/Livewire/SettingsOauth.php
+++ b/app/Livewire/SettingsOauth.php
@@ -2,53 +2,89 @@
 
 namespace App\Livewire;
 
+use App\Models\InstanceSettings;
 use App\Models\OauthSetting;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Validation\ValidationException;
 use Livewire\Component;
 
 class SettingsOauth extends Component
 {
     use AuthorizesRequests;
 
+    public InstanceSettings $settings;
+
     public $oauth_settings_map;
 
-    protected function rules()
+    public ?string $selectedProvider = null;
+
+    public bool $disable_registration_when_oauth_enabled = false;
+
+    protected function rules(): array
     {
-        return OauthSetting::all()->reduce(function ($carry, $setting) {
-            $carry["oauth_settings_map.$setting->provider.enabled"] = 'required';
-            $carry["oauth_settings_map.$setting->provider.client_id"] = 'nullable';
-            $carry["oauth_settings_map.$setting->provider.client_secret"] = 'nullable';
-            $carry["oauth_settings_map.$setting->provider.redirect_uri"] = 'nullable';
-            $carry["oauth_settings_map.$setting->provider.tenant"] = 'nullable';
-            $carry["oauth_settings_map.$setting->provider.base_url"] = 'nullable';
+        return $this->validationRules();
+    }
+
+    private function validationRules(?string $provider = null): array
+    {
+        $rules = OauthSetting::all()->reduce(function ($carry, $setting) use ($provider) {
+            if ($provider !== null && $setting->provider !== $provider) {
+                return $carry;
+            }
+
+            $carry["oauth_settings_map.$setting->provider.enabled"] = 'required|boolean';
+            $carry["oauth_settings_map.$setting->provider.client_id"] = 'nullable|string';
+            $carry["oauth_settings_map.$setting->provider.client_secret"] = 'nullable|string';
+            $carry["oauth_settings_map.$setting->provider.redirect_uri"] = 'nullable|string|max:2048|url:http,https';
+            $carry["oauth_settings_map.$setting->provider.tenant"] = 'nullable|string';
+            $carry["oauth_settings_map.$setting->provider.base_url"] = 'nullable|string|max:2048|url:http,https';
+            $carry["oauth_settings_map.$setting->provider.custom_label"] = 'nullable|string|max:255';
+            $carry["oauth_settings_map.$setting->provider.scopes"] = 'nullable|string|max:1000';
+            $carry["oauth_settings_map.$setting->provider.allow_registration"] = 'boolean';
+            $carry["oauth_settings_map.$setting->provider.auto_join_root_team"] = 'boolean';
+            $carry["oauth_settings_map.$setting->provider.require_email_verified"] = 'boolean';
+            $carry["oauth_settings_map.$setting->provider.use_pkce"] = 'boolean';
+            $carry["oauth_settings_map.$setting->provider.clock_skew_seconds"] = 'nullable|integer|min:0|max:600';
 
             return $carry;
         }, []);
+
+        if ($provider === null) {
+            $rules['disable_registration_when_oauth_enabled'] = 'boolean';
+        }
+
+        return $rules;
     }
 
-    public function mount()
+    public function mount(?string $provider = null): ?RedirectResponse
     {
         if (! isInstanceAdmin()) {
             return redirect()->route('home');
         }
-        $this->oauth_settings_map = OauthSetting::all()->sortBy('provider')->reduce(function ($carry, $setting) {
-            $carry[$setting->provider] = [
-                'id' => $setting->id,
-                'provider' => $setting->provider,
-                'enabled' => $setting->enabled,
-                'client_id' => $setting->client_id,
-                'client_secret' => $setting->client_secret,
-                'redirect_uri' => $setting->redirect_uri,
-                'tenant' => $setting->tenant,
-                'base_url' => $setting->base_url,
-            ];
 
-            return $carry;
-        }, []);
+        $this->settings = instanceSettings();
+        $this->selectedProvider = $provider;
+        $this->disable_registration_when_oauth_enabled = (bool) $this->settings->disable_registration_when_oauth_enabled;
+        $this->oauth_settings_map = OauthSetting::all()
+            ->sortBy(fn (OauthSetting $setting): string => $setting->isOidc() ? '' : $setting->provider)
+            ->reduce(function ($carry, $setting) {
+                $carry[$setting->provider] = $this->oauthSettingToArray($setting);
+
+                return $carry;
+            }, []);
+
+        if ($this->selectedProvider !== null && ! array_key_exists($this->selectedProvider, $this->oauth_settings_map)) {
+            abort(404);
+        }
+
+        return null;
     }
 
-    private function updateOauthSettings(?string $provider = null)
+    private function updateOauthSettings(?string $provider = null): void
     {
+        $this->validate($this->validationRules($provider));
+
         if ($provider) {
             $oauthData = $this->oauth_settings_map[$provider];
             $oauth = OauthSetting::find($oauthData['id']);
@@ -57,78 +93,128 @@ class SettingsOauth extends Component
                 throw new \Exception('OAuth setting for '.$provider.' not found. It may have been deleted.');
             }
 
-            $oauth->fill([
-                'enabled' => $oauthData['enabled'],
-                'client_id' => $oauthData['client_id'],
-                'client_secret' => $oauthData['client_secret'],
-                'redirect_uri' => $oauthData['redirect_uri'],
-                'tenant' => $oauthData['tenant'],
-                'base_url' => $oauthData['base_url'],
-            ]);
-
-            if ($oauthData['enabled'] && ! $oauth->couldBeEnabled()) {
-                $oauth->update(['enabled' => false]);
-                throw new \Exception('OAuth settings are not complete for '.$oauth->provider.'.<br/>Please fill in all required fields.');
-            }
+            $this->fillOauthSetting($oauth, $oauthData);
+            $this->ensureProviderCanBeEnabled($oauth);
             $oauth->save();
 
-            // Update the array with fresh data
-            $this->oauth_settings_map[$provider] = [
-                'id' => $oauth->id,
-                'provider' => $oauth->provider,
-                'enabled' => $oauth->enabled,
-                'client_id' => $oauth->client_id,
-                'client_secret' => $oauth->client_secret,
-                'redirect_uri' => $oauth->redirect_uri,
-                'tenant' => $oauth->tenant,
-                'base_url' => $oauth->base_url,
-            ];
+            $this->oauth_settings_map[$provider] = $this->oauthSettingToArray($oauth);
 
             $this->dispatch('success', 'OAuth settings for '.$oauth->provider.' updated successfully!');
-        } else {
-            $errors = [];
-            foreach (array_values($this->oauth_settings_map) as $settingData) {
-                $oauth = OauthSetting::find($settingData['id']);
 
-                if (! $oauth) {
-                    $errors[] = "OAuth setting for provider '{$settingData['provider']}' not found. It may have been deleted.";
-
-                    continue;
-                }
-
-                $oauth->fill([
-                    'enabled' => $settingData['enabled'],
-                    'client_id' => $settingData['client_id'],
-                    'client_secret' => $settingData['client_secret'],
-                    'redirect_uri' => $settingData['redirect_uri'],
-                    'tenant' => $settingData['tenant'],
-                    'base_url' => $settingData['base_url'],
-                ]);
-
-                if ($settingData['enabled'] && ! $oauth->couldBeEnabled()) {
-                    $oauth->enabled = false;
-                    $errors[] = "OAuth settings are incomplete for '{$oauth->provider}'. Required fields are missing. The provider has been disabled.";
-                }
-
-                $oauth->save();
-
-                // Update the array with fresh data
-                $this->oauth_settings_map[$oauth->provider] = [
-                    'id' => $oauth->id,
-                    'provider' => $oauth->provider,
-                    'enabled' => $oauth->enabled,
-                    'client_id' => $oauth->client_id,
-                    'client_secret' => $oauth->client_secret,
-                    'redirect_uri' => $oauth->redirect_uri,
-                    'tenant' => $oauth->tenant,
-                    'base_url' => $oauth->base_url,
-                ];
-            }
-
-            if (! empty($errors)) {
-                $this->dispatch('error', implode('<br/>', $errors));
-            }
+            return;
         }
+
+        $errors = [];
+        foreach (array_values($this->oauth_settings_map) as $settingData) {
+            $oauth = OauthSetting::find($settingData['id']);
+
+            if (! $oauth) {
+                $errors[] = "OAuth setting for provider '{$settingData['provider']}' not found. It may have been deleted.";
+
+                continue;
+            }
+
+            $this->fillOauthSetting($oauth, $settingData);
+
+            if ($oauth->enabled && ! $oauth->couldBeEnabled()) {
+                $oauth->enabled = false;
+                $errors[] = "OAuth settings are incomplete for '{$oauth->provider}'. Required fields are missing. The provider has been disabled.";
+            }
+
+            if ($oauth->enabled && $oauth->isOidc() && ! in_array('openid', $oauth->scopeList(), true)) {
+                $oauth->enabled = false;
+                $errors[] = "OIDC scopes must include 'openid'. The provider has been disabled.";
+            }
+
+            $oauth->save();
+            $this->oauth_settings_map[$oauth->provider] = $this->oauthSettingToArray($oauth);
+        }
+
+        instanceSettings()->update([
+            'disable_registration_when_oauth_enabled' => $this->disable_registration_when_oauth_enabled,
+        ]);
+
+        if (! empty($errors)) {
+            $this->dispatch('error', implode('<br/>', $errors));
+        }
+    }
+
+    private function fillOauthSetting(OauthSetting $oauth, array $data): void
+    {
+        $oauth->fill([
+            'enabled' => (bool) ($data['enabled'] ?? false),
+            'client_id' => $data['client_id'] ?? null,
+            'client_secret' => $data['client_secret'] ?? null,
+            'redirect_uri' => $this->nullableString($data['redirect_uri'] ?? null),
+            'tenant' => $data['tenant'] ?? null,
+            'base_url' => $this->nullableString($data['base_url'] ?? null),
+            'custom_label' => $data['custom_label'] ?? null,
+            'scopes' => $data['scopes'] ?? null,
+            'allow_registration' => (bool) ($data['allow_registration'] ?? false),
+            'auto_join_root_team' => (bool) ($data['auto_join_root_team'] ?? false),
+            'require_email_verified' => (bool) ($data['require_email_verified'] ?? true),
+            'use_pkce' => (bool) ($data['use_pkce'] ?? true),
+            'clock_skew_seconds' => (int) ($data['clock_skew_seconds'] ?? 60),
+        ]);
+    }
+
+    private function nullableString(mixed $value): ?string
+    {
+        if ($value === null) {
+            return null;
+        }
+
+        $value = trim((string) $value);
+
+        return $value === '' ? null : $value;
+    }
+
+    private function ensureProviderCanBeEnabled(OauthSetting $oauth): void
+    {
+        if (! $oauth->enabled) {
+            return;
+        }
+
+        if (! $oauth->couldBeEnabled()) {
+            $oauth->update(['enabled' => false]);
+            throw new \Exception('OAuth settings are not complete for '.$oauth->provider.'.<br/>Please fill in all required fields.');
+        }
+
+        if ($oauth->isOidc() && ! in_array('openid', $oauth->scopeList(), true)) {
+            $oauth->update(['enabled' => false]);
+            throw new \Exception("OIDC scopes must include 'openid'.");
+        }
+    }
+
+    private function oauthSettingToArray(OauthSetting $setting): array
+    {
+        return [
+            'id' => $setting->id,
+            'provider' => $setting->provider,
+            'enabled' => $setting->enabled,
+            'client_id' => $setting->client_id,
+            'client_secret' => $setting->client_secret,
+            'redirect_uri' => $setting->redirect_uri,
+            'tenant' => $setting->tenant,
+            'base_url' => $setting->base_url,
+            'custom_label' => $setting->custom_label,
+            'scopes' => $setting->scopes ?: 'openid email profile',
+            'allow_registration' => $setting->allow_registration,
+            'auto_join_root_team' => $setting->auto_join_root_team,
+            'require_email_verified' => $setting->require_email_verified ?? true,
+            'use_pkce' => $setting->use_pkce ?? true,
+            'clock_skew_seconds' => $setting->clock_skew_seconds ?? 60,
+            'label' => $this->providerLabel($setting->provider),
+        ];
+    }
+
+    public function providerLabel(string $provider): string
+    {
+        return match ($provider) {
+            'oidc' => 'OpenID Connect',
+            'gitlab' => 'GitLab',
+            default => str($provider)->headline()->toString(),
+        };
     }
 
     public function instantSave(string $provider)
@@ -141,56 +227,88 @@ class SettingsOauth extends Component
         }
     }
 
-    public function toggleProvider(string $provider): mixed
+    public function toggleProvider(string $provider)
     {
         try {
             $this->authorize('update', instanceSettings());
 
             if (! array_key_exists($provider, $this->oauth_settings_map)) {
-                throw new \Exception('OAuth provider not found.');
+                abort(404);
             }
 
-            $enabling = ! $this->oauth_settings_map[$provider]['enabled'];
-            if ($enabling) {
-                $this->validate($this->providerRules($provider));
+            if (! (bool) $this->oauth_settings_map[$provider]['enabled']) {
+                $this->validateProviderCanBeEnabled($provider);
             }
 
-            $this->oauth_settings_map[$provider]['enabled'] = $enabling;
+            $this->oauth_settings_map[$provider]['enabled'] = ! (bool) $this->oauth_settings_map[$provider]['enabled'];
             $this->updateOauthSettings($provider);
-        } catch (\Throwable $e) {
+        } catch (\Exception $e) {
+            $oauth = OauthSetting::where('provider', $provider)->first();
+            if ($oauth) {
+                $this->oauth_settings_map[$provider] = $this->oauthSettingToArray($oauth);
+            }
+
             return handleError($e, $this);
         }
-
-        return null;
     }
 
-    private function providerRules(string $provider): array
+    private function validateProviderCanBeEnabled(string $provider): void
     {
-        $prefix = "oauth_settings_map.$provider";
-        $rules = [
-            "$prefix.client_id" => 'required',
-            "$prefix.client_secret" => 'required',
-        ];
+        $this->validate($this->validationRules($provider));
 
-        if ($provider === 'azure') {
-            $rules["$prefix.tenant"] = 'required';
+        $oauth = OauthSetting::find($this->oauth_settings_map[$provider]['id']);
+        if (! $oauth) {
+            throw new \Exception('OAuth setting for '.$provider.' not found. It may have been deleted.');
         }
 
-        if (in_array($provider, ['authentik', 'clerk'], true)) {
-            $rules["$prefix.base_url"] = 'required';
+        $this->fillOauthSetting($oauth, [
+            ...$this->oauth_settings_map[$provider],
+            'enabled' => true,
+        ]);
+
+        if (! $oauth->couldBeEnabled()) {
+            throw new \Exception('OAuth settings are not complete for '.$oauth->provider.'.<br/>Please fill in all required fields.');
         }
 
-        return $rules;
+        if ($oauth->isOidc() && ! in_array('openid', $oauth->scopeList(), true)) {
+            throw new \Exception("OIDC scopes must include 'openid'.");
+        }
     }
 
-    public function submit()
+    public function saveRegistrationPolicy(): void
+    {
+        $this->authorize('update', instanceSettings());
+        $this->validate([
+            'disable_registration_when_oauth_enabled' => 'boolean',
+        ]);
+
+        instanceSettings()->update([
+            'disable_registration_when_oauth_enabled' => $this->disable_registration_when_oauth_enabled,
+        ]);
+
+        $this->dispatch('success', 'Authentication settings updated successfully!');
+    }
+
+    public function submit(): void
     {
         try {
             $this->authorize('update', instanceSettings());
-            $this->updateOauthSettings();
-            $this->dispatch('success', 'Instance settings updated successfully!');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
+            $this->updateOauthSettings($this->selectedProvider);
+
+            if ($this->selectedProvider === null) {
+                $this->dispatch('success', 'Instance settings updated successfully!');
+            }
+        } catch (ValidationException $e) {
+            throw $e;
+        } catch (\Exception $e) {
+            if ($this->selectedProvider !== null) {
+                $oauth = OauthSetting::where('provider', $this->selectedProvider)->first();
+                if ($oauth) {
+                    $this->oauth_settings_map[$this->selectedProvider] = $this->oauthSettingToArray($oauth);
+                }
+            }
+
+            handleError($e, $this);
         }
     }
 }
diff --git a/app/Livewire/Team/AuditLog.php b/app/Livewire/Team/AuditLog.php
new file mode 100644
index 0000000000..53cb203eff
--- /dev/null
+++ b/app/Livewire/Team/AuditLog.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Livewire\Team;
+
+use App\Models\AuditEvent;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Str;
+use Livewire\Component;
+use Livewire\WithPagination;
+
+class AuditLog extends Component
+{
+    use WithPagination;
+
+    public string $search = '';
+
+    public string $action = 'all';
+
+    public string $source = 'all';
+
+    public int $perPage = 25;
+
+    public function boot(): void
+    {
+        abort_unless(auth()->user()->isAdminOfTeam(currentTeam()->id), 403);
+    }
+
+    public function updatedSearch(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedAction(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedSource(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(10, min(100, $this->perPage));
+        $this->resetPage();
+    }
+
+    public function render(): View
+    {
+        $search = trim($this->search);
+        $teamId = currentTeam()->id;
+        $canViewInstanceEvents = $teamId === 0 && isInstanceAdmin();
+        $visibleEvents = AuditEvent::query()->visibleToTeam($teamId, $canViewInstanceEvents);
+        $actionOptions = [
+            ['value' => 'all', 'label' => 'All actions'],
+            ...$visibleEvents->clone()
+                ->select('action')
+                ->distinct()
+                ->orderBy('action')
+                ->pluck('action')
+                ->map(fn (string $action): array => ['value' => $action, 'label' => Str::headline($action)])
+                ->all(),
+        ];
+        $events = AuditEvent::query()
+            ->visibleToTeam($teamId, $canViewInstanceEvents)
+            ->filtered($search, $this->action, $this->source)
+            ->latestFirst()
+            ->paginate($this->perPage);
+
+        return view('livewire.team.audit-log', ['actionOptions' => $actionOptions, 'events' => $events]);
+    }
+}
diff --git a/app/Livewire/Team/Invitations.php b/app/Livewire/Team/Invitations.php
index 8ecafc417c..b66c49ac9e 100644
--- a/app/Livewire/Team/Invitations.php
+++ b/app/Livewire/Team/Invitations.php
@@ -22,6 +22,8 @@ class Invitations extends Component
             $this->authorize('manageInvitations', currentTeam());
 
             $invitation = TeamInvitation::ownedByCurrentTeam()->findOrFail($invitation_id);
+            $invitationEmail = $invitation->email;
+            $invitationUuid = $invitation->uuid;
             DB::transaction(function () use ($invitation): void {
                 $user = User::whereEmail($invitation->email)->first();
                 if (filled($user)) {
@@ -30,6 +32,11 @@ class Invitations extends Component
 
                 $invitation->delete();
             });
+            auditLog('ui.team_invitation.revoked', [
+                'team_id' => currentTeam()->id,
+                'invitation_uuid' => $invitationUuid,
+                'invitation_email' => $invitationEmail,
+            ]);
             $this->refreshInvitations();
             $this->dispatch('success', 'Invitation revoked.');
         } catch (\Exception) {
diff --git a/app/Livewire/Team/InviteLink.php b/app/Livewire/Team/InviteLink.php
index a93bf8dd92..d6ea836075 100644
--- a/app/Livewire/Team/InviteLink.php
+++ b/app/Livewire/Team/InviteLink.php
@@ -103,6 +103,13 @@ class InviteLink extends Component
                 'link' => $link,
                 'via' => $sendEmail ? 'email' : 'link',
             ]);
+            auditLog('ui.team_invitation.created', [
+                'team_id' => currentTeam()->id,
+                'invitation_uuid' => $invitation->uuid,
+                'invitation_email' => $invitation->email,
+                'role' => $invitation->role,
+                'via' => $invitation->via,
+            ]);
             if ($sendEmail) {
                 $mail = new MailMessage;
                 $mail->view('emails.invitation-link', [
diff --git a/app/Livewire/Team/Member.php b/app/Livewire/Team/Member.php
index 38c932c39d..d99fd2eb1b 100644
--- a/app/Livewire/Team/Member.php
+++ b/app/Livewire/Team/Member.php
@@ -30,6 +30,7 @@ class Member extends Component
                 $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::ADMIN->value]);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            $this->auditRoleUpdate($teamId, Role::ADMIN);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -50,6 +51,7 @@ class Member extends Component
                 $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::OWNER->value]);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            $this->auditRoleUpdate($teamId, Role::OWNER);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -70,6 +72,7 @@ class Member extends Component
                 $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::MEMBER->value]);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            $this->auditRoleUpdate($teamId, Role::MEMBER);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -90,6 +93,12 @@ class Member extends Component
                 $this->member->teams()->detach($teamId);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            auditLog('ui.team_member.removed', [
+                'team_id' => $teamId,
+                'member_id' => $this->member->id,
+                'member_name' => $this->member->name,
+                'member_email' => $this->member->email,
+            ]);
             // Clear cache for the removed user - both old and new key formats
             Cache::forget("team:{$this->member->id}");
             Cache::forget("user:{$this->member->id}:team:{$teamId}");
@@ -103,4 +112,15 @@ class Member extends Component
     {
         return $this->member->teams()->where('teams.id', currentTeam()->id)->first()?->pivot?->role;
     }
+
+    private function auditRoleUpdate(int $teamId, Role $role): void
+    {
+        auditLog('ui.team_member.role_updated', [
+            'team_id' => $teamId,
+            'member_id' => $this->member->id,
+            'member_name' => $this->member->name,
+            'member_email' => $this->member->email,
+            'role' => $role->value,
+        ]);
+    }
 }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index cec8d501ab..6737e57986 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -10,11 +10,14 @@ use App\Services\DeploymentConfiguration\ConfigurationDiff;
 use App\Services\DeploymentConfiguration\ConfigurationDiffer;
 use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
+use App\Traits\Auditable;
+
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasConfiguration;
 use App\Traits\HasMetrics;
 use App\Traits\HasNoindexDomains;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Database\Factories\ApplicationFactory;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -124,10 +127,8 @@ use Symfony\Component\Yaml\Yaml;
 
 class Application extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasConfiguration, HasMetrics, HasNoindexDomains, HasSafeStringAttribute, SoftDeletes;
-
     /** @use HasFactory<ApplicationFactory> */
-    use HasFactory;
+    use Auditable, ClearsGlobalSearchCache, HasConfiguration, HasFactory, HasMetrics, HasNoindexDomains, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     public const MAX_DOCKER_COMPOSE_SIZE_BYTES = 5 * 1024 * 1024;
 
@@ -397,6 +398,7 @@ class Application extends BaseModel
             $application->persistentStorages()->delete();
             $application->environment_variables()->delete();
             $application->environment_variables_preview()->delete();
+            $application->secretManagerLink()->delete();
             foreach ($application->scheduled_tasks as $task) {
                 $task->delete();
             }
diff --git a/app/Models/ApplicationDeploymentQueue.php b/app/Models/ApplicationDeploymentQueue.php
index ee190532c4..f16f7f8f96 100644
--- a/app/Models/ApplicationDeploymentQueue.php
+++ b/app/Models/ApplicationDeploymentQueue.php
@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Casts\EncryptedArrayCast;
+use App\Enums\ApplicationDeploymentStatus;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Carbon;
@@ -44,6 +45,44 @@ use OpenApi\Attributes as OA;
 )]
 class ApplicationDeploymentQueue extends Model
 {
+    protected static function booted(): void
+    {
+        static::created(function (ApplicationDeploymentQueue $deployment): void {
+            if (! auth()->check() || ! $deployment->rollback) {
+                return;
+            }
+
+            $application = $deployment->application;
+            $source = $deployment->is_api ? 'api' : 'ui';
+
+            auditLog("{$source}.application.rollback", [
+                'team_id' => $application?->team()?->id,
+                'application_uuid' => $application?->uuid,
+                'application_name' => $application?->name,
+                'deployment_uuid' => $deployment->deployment_uuid,
+                'commit' => $deployment->commit,
+            ]);
+        });
+
+        static::updated(function (ApplicationDeploymentQueue $deployment): void {
+            if (! auth()->check()
+                || ! $deployment->wasChanged('status')
+                || $deployment->status !== ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
+                return;
+            }
+
+            $application = $deployment->application;
+            $source = $deployment->is_api ? 'api' : 'ui';
+
+            auditLog("{$source}.deployment.cancelled", [
+                'team_id' => $application?->team()?->id,
+                'application_uuid' => $application?->uuid,
+                'application_name' => $application?->name,
+                'deployment_uuid' => $deployment->deployment_uuid,
+            ]);
+        });
+    }
+
     protected $fillable = [
         'application_id',
         'deployment_uuid',
diff --git a/app/Models/AuditEvent.php b/app/Models/AuditEvent.php
new file mode 100644
index 0000000000..2383dee267
--- /dev/null
+++ b/app/Models/AuditEvent.php
@@ -0,0 +1,211 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
+use Throwable;
+
+class AuditEvent extends Model
+{
+    use HasFactory;
+
+    public const UPDATED_AT = null;
+
+    protected $fillable = [
+        'team_id',
+        'event',
+        'source',
+        'action',
+        'actor_type',
+        'actor_id',
+        'actor_name',
+        'actor_email',
+        'actor_token_id',
+        'actor_token_name',
+        'resource_type',
+        'resource_uuid',
+        'resource_name',
+        'description',
+        'metadata',
+        'ip_address',
+        'user_agent',
+        'created_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'metadata' => 'array',
+            'created_at' => 'datetime',
+        ];
+    }
+
+    public function scopeVisibleToTeam(Builder $query, int $teamId, bool $includeInstanceEvents = false): Builder
+    {
+        return $query->where(function (Builder $query) use ($includeInstanceEvents, $teamId): void {
+            $query->where('team_id', $teamId)
+                ->when($includeInstanceEvents, fn (Builder $query) => $query->orWhereNull('team_id'));
+        });
+    }
+
+    public function scopeFiltered(
+        Builder $query,
+        string $search = '',
+        string $action = 'all',
+        string $source = 'all',
+        bool $searchSensitiveFields = true,
+    ): Builder {
+        return $query
+            ->when($action !== 'all', fn (Builder $query) => $query->where('action', $action))
+            ->when($source !== 'all', fn (Builder $query) => $query->where('source', $source))
+            ->when($search !== '', function (Builder $query) use ($search, $searchSensitiveFields): void {
+                $query->where(function (Builder $query) use ($search, $searchSensitiveFields): void {
+                    $query->where('event', 'like', "%{$search}%")
+                        ->orWhere('description', 'like', "%{$search}%")
+                        ->orWhere('resource_name', 'like', "%{$search}%")
+                        ->orWhere('actor_name', 'like', "%{$search}%")
+                        ->when($searchSensitiveFields, fn (Builder $query) => $query->orWhere('actor_email', 'like', "%{$search}%"));
+                });
+            });
+    }
+
+    public function scopeLatestFirst(Builder $query): Builder
+    {
+        return $query->latest('created_at')->latest('id');
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public static function record(string $event, array $context = []): void
+    {
+        try {
+            $attributes = self::attributesFor($event, $context);
+
+            DB::afterCommit(function () use ($attributes): void {
+                defer(function () use ($attributes): void {
+                    try {
+                        self::query()->create($attributes);
+                    } catch (Throwable $exception) {
+                        Log::warning('Audit event persistence failed', [
+                            'event' => $attributes['event'],
+                            'exception' => $exception::class,
+                        ]);
+                    }
+                })->always();
+            });
+        } catch (Throwable $exception) {
+            Log::warning('Audit event preparation failed', [
+                'event' => $event,
+                'exception' => $exception::class,
+            ]);
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     * @return array<string, mixed>
+     */
+    private static function attributesFor(string $event, array $context): array
+    {
+        $teamId = data_get(auth()->user()?->currentAccessToken(), 'team_id')
+            ?? data_get($context, 'team_id')
+            ?? currentTeam()?->id
+            ?? self::teamIdFromContext($context);
+
+        $parts = explode('.', $event);
+        $source = $parts[0] ?? 'system';
+        $resourceType = data_get($context, 'resource') ?? ($parts[1] ?? null);
+        $action = data_get($context, 'action') ?? (end($parts) ?: 'event');
+        $resourceUuid = self::firstContextValue($context, $resourceType ? "{$resourceType}_uuid" : null, '_uuid');
+        $resourceName = self::firstContextValue($context, $resourceType ? "{$resourceType}_name" : null, '_name');
+        $user = auth()->user();
+        $token = $user?->currentAccessToken();
+        $actorType = match (true) {
+            in_array($source, ['mcp', 'webhook', 'system', 'scheduler'], true) => $source,
+            $token !== null => 'api_token',
+            $user !== null => 'user',
+            default => 'system',
+        };
+
+        return [
+            'team_id' => $teamId,
+            'event' => $event,
+            'source' => $source,
+            'action' => $action,
+            'actor_type' => $actorType,
+            'actor_id' => $user?->id,
+            'actor_name' => $user?->name,
+            'actor_email' => $user?->email,
+            'actor_token_id' => $token?->id,
+            'actor_token_name' => $token?->name,
+            'resource_type' => $resourceType,
+            'resource_uuid' => $resourceUuid,
+            'resource_name' => $resourceName,
+            'description' => data_get($context, 'audit_description')
+                ?? trim(($resourceName ?? Str::headline((string) $resourceType)).' '.Str::headline($action)),
+            'metadata' => self::redact($context),
+            'ip_address' => app()->bound('request') ? request()->ip() : null,
+            'user_agent' => app()->bound('request') ? Str::limit((string) request()->userAgent(), 200, '') : null,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    private static function teamIdFromContext(array $context): ?int
+    {
+        $applicationUuid = data_get($context, 'application_uuid');
+        if (! is_string($applicationUuid) || $applicationUuid === '') {
+            return null;
+        }
+
+        return Application::query()
+            ->where('uuid', $applicationUuid)
+            ->first()?->team()?->id;
+    }
+
+    public static function pruneExpired(): int
+    {
+        return self::query()
+            ->where('created_at', '<', now()->subDays(90))
+            ->delete();
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    private static function firstContextValue(array $context, ?string $preferredKey, string $suffix): mixed
+    {
+        if ($preferredKey !== null && filled(data_get($context, $preferredKey))) {
+            return data_get($context, $preferredKey);
+        }
+
+        $key = Arr::first(array_keys($context), fn (string $key): bool => str_ends_with($key, $suffix));
+
+        return $key ? data_get($context, $key) : null;
+    }
+
+    private static function redact(mixed $value, ?string $key = null): mixed
+    {
+        if ($key !== null && preg_match('/password|secret|token|private_key|signature|credential|invitation_email|api_key|access_key|authorization|cookie/i', $key)) {
+            return '[REDACTED]';
+        }
+
+        if (! is_array($value)) {
+            return $value;
+        }
+
+        return collect($value)
+            ->mapWithKeys(fn (mixed $item, string|int $itemKey): array => [
+                $itemKey => self::redact($item, (string) $itemKey),
+            ])
+            ->all();
+    }
+}
diff --git a/app/Models/Environment.php b/app/Models/Environment.php
index 1364d874a1..e98f13d21f 100644
--- a/app/Models/Environment.php
+++ b/app/Models/Environment.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -21,8 +22,8 @@ use OpenApi\Attributes as OA;
 )]
 class Environment extends BaseModel
 {
+    use Auditable, HasFactory;
     use ClearsGlobalSearchCache;
-    use HasFactory;
     use HasSafeStringAttribute;
 
     protected $fillable = [
diff --git a/app/Models/EnvironmentVariable.php b/app/Models/EnvironmentVariable.php
index 89188b31b1..e7dd8564bc 100644
--- a/app/Models/EnvironmentVariable.php
+++ b/app/Models/EnvironmentVariable.php
@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
 use App\Support\ValidationPatterns;
+use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use OpenApi\Attributes as OA;
@@ -34,6 +35,8 @@ use OpenApi\Attributes as OA;
 )]
 class EnvironmentVariable extends BaseModel
 {
+    use Auditable;
+
     public const BUILDPACK_CONTROL_VARIABLE_PREFIXES = ['NIXPACKS_', 'RAILPACK_'];
 
     protected $attributes = [
@@ -249,17 +252,21 @@ class EnvironmentVariable extends BaseModel
     protected function isShared(): Attribute
     {
         return Attribute::make(
-            get: function () {
-                $type = str($this->value)->after('{{')->before('.')->value;
-                if (str($this->value)->startsWith('{{'.$type) && str($this->value)->endsWith('}}')) {
-                    return true;
-                }
-
-                return false;
-            }
+            get: fn () => $this->isSharedReference(),
         );
     }
 
+    private function isSharedReference(): bool
+    {
+        if (blank($this->value)) {
+            return false;
+        }
+
+        $types = implode('|', SHARED_VARIABLE_TYPES);
+
+        return preg_match('/^{{\s*(?:'.$types.')\..*}}$/s', trim($this->value)) === 1;
+    }
+
     public function get_real_environment_variables_with_server(?string $environment_variable = null, $resource = null, $server = null)
     {
         return $this->get_real_environment_variables_internal($environment_variable, $resource, $server);
@@ -302,6 +309,23 @@ class EnvironmentVariable extends BaseModel
         return $real_value;
     }
 
+    public function resolveReferencedValue(): ?string
+    {
+        $value = $this->value;
+
+        if ($this->is_literal || blank($value) || ! str($value)->startsWith('$')) {
+            return $value;
+        }
+
+        $referencedKey = str($value)->after('$')->trim('{}')->value();
+
+        return static::where('resourceable_type', $this->resourceable_type)
+            ->where('resourceable_id', $this->resourceable_id)
+            ->where('is_preview', (bool) $this->is_preview)
+            ->where('key', $referencedKey)
+            ->first()?->value ?? $value;
+    }
+
     private function get_real_environment_variables(?string $environment_variable = null, $resource = null)
     {
         return $this->get_real_environment_variables_internal($environment_variable, $resource);
@@ -389,8 +413,6 @@ class EnvironmentVariable extends BaseModel
 
     protected function updateIsShared(): void
     {
-        $type = str($this->value)->after('{{')->before('.')->value;
-        $isShared = str($this->value)->startsWith('{{'.$type) && str($this->value)->endsWith('}}');
-        $this->is_shared = $isShared;
+        $this->is_shared = $this->isSharedReference();
     }
 }
diff --git a/app/Models/GithubApp.php b/app/Models/GithubApp.php
index 564fbcf6a4..96c7a2d39d 100644
--- a/app/Models/GithubApp.php
+++ b/app/Models/GithubApp.php
@@ -2,11 +2,14 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Support\Facades\DB;
 
 class GithubApp extends BaseModel
 {
+    use Auditable;
+
     public function delete(): ?bool
     {
         return DB::transaction(fn () => parent::delete());
diff --git a/app/Models/GitlabApp.php b/app/Models/GitlabApp.php
index c6c2b84095..727ec77cd1 100644
--- a/app/Models/GitlabApp.php
+++ b/app/Models/GitlabApp.php
@@ -2,12 +2,15 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Support\Facades\Crypt;
 
 class GitlabApp extends BaseModel
 {
+    use Auditable;
+
     protected $fillable = [
         'name',
         'organization',
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 26aceec354..1e7d8282a5 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -22,6 +22,7 @@ class InstanceSettings extends Model
         'do_not_track',
         'is_auto_update_enabled',
         'is_registration_enabled',
+        'disable_registration_when_oauth_enabled',
         'next_channel',
         'smtp_enabled',
         'smtp_from_address',
@@ -89,6 +90,8 @@ class InstanceSettings extends Model
 
         'allowed_ip_ranges' => 'array',
         'is_auto_update_enabled' => 'boolean',
+        'is_registration_enabled' => 'boolean',
+        'disable_registration_when_oauth_enabled' => 'boolean',
         'auto_update_frequency' => 'string',
         'update_check_frequency' => 'string',
         'sentinel_token' => 'encrypted',
@@ -116,6 +119,19 @@ class InstanceSettings extends Model
         });
     }
 
+    public function isPasswordRegistrationAllowed(): bool
+    {
+        if (! $this->is_registration_enabled) {
+            return false;
+        }
+
+        if (! $this->disable_registration_when_oauth_enabled) {
+            return true;
+        }
+
+        return ! OauthSetting::where('enabled', true)->exists();
+    }
+
     public function fqdn(): Attribute
     {
         return Attribute::make(
diff --git a/app/Models/IntegrationToken.php b/app/Models/IntegrationToken.php
new file mode 100644
index 0000000000..53b4dd6f4a
--- /dev/null
+++ b/app/Models/IntegrationToken.php
@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class IntegrationToken extends BaseModel
+{
+    public const SECRET_MANAGER_PROVIDERS = ['doppler', 'infisical', 'vault'];
+
+    public const PROVIDER_NAMES = [
+        'cloudflare' => 'Cloudflare',
+        'doppler' => 'Doppler',
+        'infisical' => 'Infisical',
+        'vault' => 'HashiCorp Vault',
+    ];
+
+    protected $fillable = [
+        'team_id',
+        'provider',
+        'name',
+        'token',
+        'capabilities',
+        'metadata',
+    ];
+
+    protected $hidden = [
+        'token',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'token' => 'encrypted',
+            'capabilities' => 'array',
+            'metadata' => 'array',
+        ];
+    }
+
+    public function team(): BelongsTo
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public function secretManagerLinks(): HasMany
+    {
+        return $this->hasMany(SecretManagerLink::class);
+    }
+
+    public function isSecretManager(): bool
+    {
+        return in_array($this->provider, self::SECRET_MANAGER_PROVIDERS, true);
+    }
+
+    public function providerName(): string
+    {
+        return self::PROVIDER_NAMES[$this->provider] ?? ucfirst($this->provider);
+    }
+
+    public function dopplerTokenType(): ?string
+    {
+        if ($this->provider !== 'doppler') {
+            return null;
+        }
+
+        return match (true) {
+            str_starts_with($this->token, 'dp.st.') => 'service',
+            str_starts_with($this->token, 'dp.sa.') => 'service_account',
+            default => null,
+        };
+    }
+
+    public static function ownedByCurrentTeam()
+    {
+        return self::query()->where('team_id', currentTeam()->id);
+    }
+}
diff --git a/app/Models/OauthIdentity.php b/app/Models/OauthIdentity.php
new file mode 100644
index 0000000000..1edf71ad2f
--- /dev/null
+++ b/app/Models/OauthIdentity.php
@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class OauthIdentity extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'user_id',
+        'provider',
+        'issuer',
+        'provider_user_id',
+        'email',
+        'raw_claims',
+        'last_login_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'raw_claims' => 'array',
+            'last_login_at' => 'datetime',
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}
diff --git a/app/Models/OauthSetting.php b/app/Models/OauthSetting.php
index e7999134a6..7765e41160 100644
--- a/app/Models/OauthSetting.php
+++ b/app/Models/OauthSetting.php
@@ -11,7 +11,19 @@ class OauthSetting extends Model
 {
     use HasFactory;
 
-    protected $fillable = ['provider', 'client_id', 'client_secret', 'redirect_uri', 'tenant', 'base_url', 'enabled'];
+    protected $fillable = ['provider', 'client_id', 'client_secret', 'redirect_uri', 'tenant', 'base_url', 'enabled', 'custom_label', 'scopes', 'allow_registration', 'auto_join_root_team', 'require_email_verified', 'use_pkce', 'clock_skew_seconds'];
+
+    protected function casts(): array
+    {
+        return [
+            'enabled' => 'boolean',
+            'allow_registration' => 'boolean',
+            'auto_join_root_team' => 'boolean',
+            'require_email_verified' => 'boolean',
+            'use_pkce' => 'boolean',
+            'clock_skew_seconds' => 'integer',
+        ];
+    }
 
     protected $hidden = [
         'client_secret',
@@ -32,9 +44,46 @@ class OauthSetting extends Model
                 return filled($this->client_id) && filled($this->client_secret) && filled($this->tenant);
             case 'authentik':
             case 'clerk':
+            case 'oidc':
                 return filled($this->client_id) && filled($this->client_secret) && filled($this->base_url);
             default:
                 return filled($this->client_id) && filled($this->client_secret);
         }
     }
+
+    /**
+     * @return array<int, string>
+     */
+    public function scopeList(): array
+    {
+        $scopes = str($this->scopes ?: 'openid email profile')
+            ->replace(',', ' ')
+            ->explode(' ')
+            ->map(fn (string $scope) => trim($scope))
+            ->filter()
+            ->unique()
+            ->values()
+            ->all();
+
+        return $scopes === [] ? ['openid', 'email', 'profile'] : $scopes;
+    }
+
+    public function loginLabel(): string
+    {
+        if (filled($this->custom_label)) {
+            return $this->custom_label;
+        }
+
+        $envLabel = config("services.{$this->provider}.custom_label");
+        if (filled($envLabel)) {
+            return $envLabel;
+        }
+
+        return __("auth.login.{$this->provider}");
+    }
+
+    public function isOidc(): bool
+    {
+        return $this->provider === 'oidc';
+    }
 }
diff --git a/app/Models/PrivateKey.php b/app/Models/PrivateKey.php
index 3f72642a57..43aa310cbc 100644
--- a/app/Models/PrivateKey.php
+++ b/app/Models/PrivateKey.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
 use DanHarrin\LivewireRateLimiting\WithRateLimiting;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -31,7 +32,7 @@ use phpseclib3\Crypt\PublicKeyLoader;
 )]
 class PrivateKey extends BaseModel
 {
-    use HasFactory, HasSafeStringAttribute, WithRateLimiting;
+    use Auditable, HasFactory, HasSafeStringAttribute, WithRateLimiting;
 
     protected $fillable = [
         'name',
diff --git a/app/Models/Project.php b/app/Models/Project.php
index 57dbf823ce..65c21c1e78 100644
--- a/app/Models/Project.php
+++ b/app/Models/Project.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -20,8 +21,8 @@ use OpenApi\Attributes as OA;
 )]
 class Project extends BaseModel
 {
+    use Auditable, HasFactory;
     use ClearsGlobalSearchCache;
-    use HasFactory;
     use HasSafeStringAttribute;
 
     protected $fillable = [
@@ -63,7 +64,9 @@ class Project extends BaseModel
             ]);
         });
         static::deleting(function ($project) {
-            $project->environments()->delete();
+            foreach ($project->environments()->get() as $environment) {
+                $environment->delete();
+            }
             $project->settings()->delete();
             $shared_variables = $project->environment_variables();
             foreach ($shared_variables as $shared_variable) {
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index e4b1e2fd68..3c0d9e7e95 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
+use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -14,7 +15,7 @@ use Illuminate\Support\Facades\Validator;
 
 class S3Storage extends BaseModel
 {
-    use HasFactory, HasSafeStringAttribute;
+    use Auditable, HasFactory, HasSafeStringAttribute;
 
     private const CONNECTION_TIMEOUT_SECONDS = 15;
 
diff --git a/app/Models/SecretManagerLink.php b/app/Models/SecretManagerLink.php
new file mode 100644
index 0000000000..34e4e90d12
--- /dev/null
+++ b/app/Models/SecretManagerLink.php
@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Models;
+
+use App\Services\DopplerService;
+use App\Services\InfisicalService;
+use App\Services\VaultService;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+/**
+ * Links a resource (currently Application) to a remote secret manager source.
+ * Holds only the source coordinates — secret values are never persisted.
+ */
+class SecretManagerLink extends BaseModel
+{
+    protected $fillable = [
+        'resourceable_type',
+        'resourceable_id',
+        'integration_token_id',
+        'settings',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'settings' => 'array',
+        ];
+    }
+
+    public function resourceable(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    public function integrationToken(): BelongsTo
+    {
+        return $this->belongsTo(IntegrationToken::class);
+    }
+
+    /**
+     * Fetch the secrets from the remote manager. Values live only in memory.
+     *
+     * @return array<string, string>
+     */
+    public function fetchSecrets(): array
+    {
+        $token = $this->integrationToken;
+        $settings = $this->settings ?? [];
+        $metadata = $token->metadata ?? [];
+
+        return match ($token->provider) {
+            'doppler' => (new DopplerService($token->token))->fetchSecrets(
+                data_get($settings, 'project'),
+                data_get($settings, 'config'),
+            ),
+            'infisical' => (new InfisicalService(
+                data_get($metadata, 'base_url', 'https://app.infisical.com'),
+                (string) data_get($metadata, 'client_id'),
+                $token->token,
+            ))->fetchSecrets(
+                (string) data_get($settings, 'project_id'),
+                (string) data_get($settings, 'environment'),
+                (string) data_get($settings, 'secret_path', '/'),
+            ),
+            'vault' => (new VaultService(
+                (string) data_get($metadata, 'base_url'),
+                $token->token,
+                data_get($metadata, 'namespace'),
+            ))->fetchSecrets(
+                (string) data_get($settings, 'mount', 'secret'),
+                (string) data_get($settings, 'path'),
+            ),
+            default => throw new \RuntimeException("Unsupported secret manager provider [{$token->provider}]."),
+        };
+    }
+
+    /**
+     * Create one {{vault.KEY}} reference variable per remote key that has no
+     * variable with that key yet. Only key names touch the database.
+     *
+     * @return list<string> The keys that were imported
+     */
+    public function importMissingReferences(): array
+    {
+        $keys = array_keys($this->fetchSecrets());
+        sort($keys);
+
+        $existing = $this->resourceable->environment_variables()->pluck('key')->flip();
+        $imported = [];
+
+        foreach ($keys as $key) {
+            if (isset($existing[$key])) {
+                continue;
+            }
+
+            $this->resourceable->environment_variables()->create([
+                'key' => $key,
+                'value' => '{{vault.'.$key.'}}',
+            ]);
+            $imported[] = $key;
+        }
+
+        return $imported;
+    }
+
+    /** Short human-readable description of the remote source for the UI. */
+    public function sourceSummary(): string
+    {
+        $settings = $this->settings ?? [];
+
+        return match ($this->integrationToken->provider) {
+            'doppler' => trim(implode('/', array_filter([
+                data_get($settings, 'project'),
+                data_get($settings, 'config'),
+            ])), '/') ?: 'token scope',
+            'infisical' => data_get($settings, 'project_id').'/'.data_get($settings, 'environment').data_get($settings, 'secret_path', '/'),
+            'vault' => data_get($settings, 'mount', 'secret').'/'.data_get($settings, 'path'),
+            default => '',
+        };
+    }
+}
diff --git a/app/Models/Server.php b/app/Models/Server.php
index dccbed15ed..9cc91d40d4 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -21,6 +21,7 @@ use App\Services\DigitalOceanService;
 use App\Services\HetznerService;
 use App\Services\VultrService;
 use App\Support\ValidationPatterns;
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
@@ -111,7 +112,7 @@ use Symfony\Component\Yaml\Yaml;
 
 class Server extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasFactory, HasMetrics, SchemalessAttributesTrait, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasFactory, HasMetrics, SchemalessAttributesTrait, SoftDeletes;
 
     /**
      * Sentinel IP for servers that do not have a real address yet
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 3b80a19412..2f1a0264c2 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -5,8 +5,11 @@ namespace App\Models;
 use App\Enums\ProcessStatus;
 use App\Services\ContainerStatusAggregator;
 use App\Support\DomainPortOverrides;
+use App\Traits\Auditable;
+
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -43,7 +46,7 @@ use Symfony\Component\Yaml\Yaml;
 )]
 class Service extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasFactory, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasFactory, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     private static $parserVersion = '5';
 
@@ -1615,7 +1618,7 @@ class Service extends BaseModel
             return 3;
         });
         foreach ($sorted as $env) {
-            $envs->push("{$env->key}={$env->real_value}");
+            $envs->push("{$env->key}={$this->resolveSecretManagerEnvironmentVariable($env)}");
         }
         if ($envs->count() === 0) {
             $commands[] = 'touch .env';
diff --git a/app/Models/SharedEnvironmentVariable.php b/app/Models/SharedEnvironmentVariable.php
index c70bf9f08a..086cc33e50 100644
--- a/app/Models/SharedEnvironmentVariable.php
+++ b/app/Models/SharedEnvironmentVariable.php
@@ -3,11 +3,14 @@
 namespace App\Models;
 
 use App\Support\ValidationPatterns;
+use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 
 class SharedEnvironmentVariable extends Model
 {
+    use Auditable;
+
     protected $fillable = [
         // Core identification
         'key',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index 7ca45cc3b7..6265345ee9 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -2,17 +2,21 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneClickhouse extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    protected array $auditExclude = ['last_online_at'];
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 769d9f00c4..da4804dd2d 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -2,17 +2,19 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneDragonfly extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 15a1fe2f82..f4dbaec210 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -2,17 +2,19 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneKeydb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index 378d36395d..c923b489bd 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -2,10 +2,12 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
@@ -13,7 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMariadb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index 1010ca5f37..70b108087a 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -2,17 +2,19 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMongodb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 90828bf012..6a08a4dc45 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -2,17 +2,19 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMysql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index e7db812858..f8dc5c0caa 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -2,17 +2,19 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandalonePostgresql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 3262611903..3bfcc5434e 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -2,17 +2,21 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneRedis extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    protected array $auditExclude = ['last_online_at'];
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/Tag.php b/app/Models/Tag.php
index d5cccabd8f..30844b2bb6 100644
--- a/app/Models/Tag.php
+++ b/app/Models/Tag.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Support\Facades\DB;
 use OpenApi\Attributes as OA;
@@ -18,7 +19,7 @@ use OpenApi\Attributes as OA;
 )]
 class Tag extends BaseModel
 {
-    use HasSafeStringAttribute;
+    use Auditable, HasSafeStringAttribute;
 
     protected $fillable = [
         'name',
diff --git a/app/Models/Team.php b/app/Models/Team.php
index 4cf6391231..6ec79f2046 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -8,6 +8,7 @@ use App\Notifications\Channels\SendsDiscord;
 use App\Notifications\Channels\SendsEmail;
 use App\Notifications\Channels\SendsPushover;
 use App\Notifications\Channels\SendsSlack;
+use App\Traits\Auditable;
 use App\Traits\HasNotificationSettings;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -39,7 +40,7 @@ use OpenApi\Attributes as OA;
 
 class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, SendsSlack
 {
-    use HasFactory, HasNotificationSettings, HasSafeStringAttribute, Notifiable;
+    use Auditable, HasFactory, HasNotificationSettings, HasSafeStringAttribute, Notifiable;
 
     protected $fillable = [
         'name',
@@ -86,8 +87,11 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
             }
 
             // Transfer instance-wide sources to root team so they remain available
-            GithubApp::where('team_id', $team->id)->where('is_system_wide', true)->update(['team_id' => 0]);
-            GitlabApp::where('team_id', $team->id)->where('is_system_wide', true)->update(['team_id' => 0]);
+            $systemWideSources = GithubApp::where('team_id', $team->id)->where('is_system_wide', true)->get()
+                ->concat(GitlabApp::where('team_id', $team->id)->where('is_system_wide', true)->get());
+            foreach ($systemWideSources as $source) {
+                $source->update(['team_id' => 0]);
+            }
 
             // Delete non-instance-wide sources owned by this team
             $teamSources = GithubApp::where('team_id', $team->id)->get()
@@ -313,6 +317,11 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
         return $this->hasMany(CloudProviderToken::class);
     }
 
+    public function integrationTokens()
+    {
+        return $this->hasMany(IntegrationToken::class);
+    }
+
     public function sources()
     {
         $sources = collect([]);
diff --git a/app/Models/User.php b/app/Models/User.php
index 5b38473962..10303422bd 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -11,6 +11,7 @@ use App\Services\ChangelogService;
 use App\Traits\DeletesUserSessions;
 use DateTimeInterface;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Notifications\Notifiable;
@@ -507,12 +508,26 @@ class User extends Authenticatable implements SendsEmail
             && Carbon::now()->lessThan($this->email_change_code_expires_at);
     }
 
+    public function oauthIdentities(): HasMany
+    {
+        return $this->hasMany(OauthIdentity::class);
+    }
+
+    public function hasSsoIdentity(): bool
+    {
+        return $this->oauthIdentities()->exists();
+    }
+
     /**
      * Check if the user has a password set.
-     * OAuth users are created without passwords.
      */
     public function hasPassword(): bool
     {
         return ! empty($this->password);
     }
+
+    public function requiresPasswordConfirmation(): bool
+    {
+        return $this->hasPassword() && ! $this->hasSsoIdentity();
+    }
 }
diff --git a/app/Policies/IntegrationTokenPolicy.php b/app/Policies/IntegrationTokenPolicy.php
new file mode 100644
index 0000000000..309c8167f2
--- /dev/null
+++ b/app/Policies/IntegrationTokenPolicy.php
@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\IntegrationToken;
+use App\Models\User;
+
+class IntegrationTokenPolicy
+{
+    public function viewAny(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    public function view(User $user, IntegrationToken $integrationToken): bool
+    {
+        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
+    }
+
+    public function update(User $user, IntegrationToken $integrationToken): bool
+    {
+        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
+    }
+
+    public function delete(User $user, IntegrationToken $integrationToken): bool
+    {
+        return $user->isAdmin() && $integrationToken->team_id === currentTeam()->id;
+    }
+}
diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php
index 5856791662..e4d2b0a851 100644
--- a/app/Providers/AppServiceProvider.php
+++ b/app/Providers/AppServiceProvider.php
@@ -2,6 +2,9 @@
 
 namespace App\Providers;
 
+use App\Auth\Oidc\OidcDiscoveryService;
+use App\Auth\Oidc\OidcTokenValidator;
+use App\Auth\Oidc\Socialite\OidcProvider;
 use App\Models\PersonalAccessToken;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\App;
@@ -10,6 +13,7 @@ use Illuminate\Support\Facades\Http;
 use Illuminate\Support\ServiceProvider;
 use Illuminate\Validation\Rules\Password;
 use Laravel\Sanctum\Sanctum;
+use Laravel\Socialite\Contracts\Factory as SocialiteFactory;
 use Stripe\StripeClient;
 
 class AppServiceProvider extends ServiceProvider
@@ -22,12 +26,11 @@ class AppServiceProvider extends ServiceProvider
     public function boot(): void
     {
         $this->configureCommands();
-
         $this->configureModels();
         $this->configurePasswords();
         $this->configureSanctumModel();
         $this->configureGitHubHttp();
-
+        $this->configureOidcSocialite();
     }
 
     private function configureCommands(): void
@@ -62,6 +65,24 @@ class AppServiceProvider extends ServiceProvider
         Sanctum::usePersonalAccessTokenModel(PersonalAccessToken::class);
     }
 
+    private function configureOidcSocialite(): void
+    {
+        if (! $this->app->bound(SocialiteFactory::class)) {
+            return;
+        }
+
+        $this->app->make(SocialiteFactory::class)->extend('oidc', function ($app) {
+            return new OidcProvider(
+                $app['request'],
+                $app->make(OidcDiscoveryService::class),
+                $app->make(OidcTokenValidator::class),
+                '',
+                '',
+                '',
+            );
+        });
+    }
+
     private function configureGitHubHttp(): void
     {
         Http::macro('GitHub', function (string $api_url, ?string $github_access_token = null) {
@@ -77,16 +98,5 @@ class AppServiceProvider extends ServiceProvider
                 ])->baseUrl($api_url);
             }
         });
-
-        Http::macro('GitLab', function (string $api_url, ?string $access_token = null) {
-            $client = Http::withHeaders([
-                'Accept' => 'application/json',
-            ])->baseUrl($api_url);
-            if ($access_token) {
-                $client = $client->withToken($access_token);
-            }
-
-            return $client;
-        });
     }
 }
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 09b2a3e089..e8e6fb42c6 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -15,6 +15,7 @@ use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\PushoverNotificationSettings;
@@ -52,6 +53,7 @@ use App\Policies\EnvironmentVariablePolicy;
 use App\Policies\GithubAppPolicy;
 use App\Policies\GitlabAppPolicy;
 use App\Policies\InstanceSettingsPolicy;
+use App\Policies\IntegrationTokenPolicy;
 use App\Policies\NotificationPolicy;
 use App\Policies\PrivateKeyPolicy;
 use App\Policies\ProjectPolicy;
@@ -132,6 +134,7 @@ class AuthServiceProvider extends ServiceProvider
 
         // Cloud provider policies
         CloudProviderToken::class => CloudProviderTokenPolicy::class,
+        IntegrationToken::class => IntegrationTokenPolicy::class,
         CloudInitScript::class => CloudInitScriptPolicy::class,
         Tag::class => TagPolicy::class,
 
diff --git a/app/Providers/DuskServiceProvider.php b/app/Providers/DuskServiceProvider.php
deleted file mode 100644
index 07e0e8709f..0000000000
--- a/app/Providers/DuskServiceProvider.php
+++ /dev/null
@@ -1,21 +0,0 @@
-<?php
-
-namespace App\Providers;
-
-use Illuminate\Support\ServiceProvider;
-
-class DuskServiceProvider extends ServiceProvider
-{
-    /**
-     * Register Dusk's browser macros.
-     */
-    public function boot(): void
-    {
-        \Laravel\Dusk\Browser::macro('loginWithRootUser', function () {
-            return $this->visit('/login')
-                ->type('email', 'test@example.com')
-                ->type('password', 'password')
-                ->press('Login');
-        });
-    }
-}
diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
index ce16e617d7..b5ca1922eb 100644
--- a/app/Providers/FortifyServiceProvider.php
+++ b/app/Providers/FortifyServiceProvider.php
@@ -46,7 +46,7 @@ class FortifyServiceProvider extends ServiceProvider
             $isFirstUser = User::count() === 0;
 
             $settings = instanceSettings();
-            if (! $settings->is_registration_enabled) {
+            if (! $settings->isPasswordRegistrationAllowed()) {
                 return redirect()->route('login');
             }
 
@@ -59,13 +59,13 @@ class FortifyServiceProvider extends ServiceProvider
             $settings = instanceSettings();
             $enabled_oauth_providers = OauthSetting::where('enabled', true)->get();
             $users = User::count();
-            if ($users == 0) {
-                // If there are no users, redirect to registration
+            if ($users == 0 && $settings->isPasswordRegistrationAllowed()) {
+                // If there are no users and password registration is allowed, redirect to registration.
                 return redirect()->route('register');
             }
 
             return view('auth.login', [
-                'is_registration_enabled' => $settings->is_registration_enabled,
+                'is_registration_enabled' => $settings->isPasswordRegistrationAllowed(),
                 'enabled_oauth_providers' => $enabled_oauth_providers,
             ]);
         });
diff --git a/app/Services/Auth/OauthLoginService.php b/app/Services/Auth/OauthLoginService.php
new file mode 100644
index 0000000000..2ec8f88e3e
--- /dev/null
+++ b/app/Services/Auth/OauthLoginService.php
@@ -0,0 +1,228 @@
+<?php
+
+namespace App\Services\Auth;
+
+use App\Auth\Oidc\OidcUser;
+use App\Models\OauthIdentity;
+use App\Models\OauthSetting;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+
+class OauthLoginService
+{
+    public function login(string $provider, object $oauthUser, OauthSetting $oauthSetting): User
+    {
+        $email = strtolower(trim((string) $oauthUser->email));
+        if ($email === '' || ! filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            throw new HttpException(403, 'OAuth provider did not return a valid email address');
+        }
+
+        $user = $provider === 'oidc'
+            ? $this->resolveOidcUser($oauthUser, $oauthSetting, $email)
+            : $this->resolveOauthUser($oauthUser, $oauthSetting, $email);
+
+        Auth::login($user);
+        $team = $user->currentTeam() ?? $user->teams()->first() ?? $user->recreate_personal_team();
+        session(['currentTeam' => $user->currentTeam = $team]);
+
+        return $user;
+    }
+
+    private function resolveOauthUser(object $oauthUser, OauthSetting $oauthSetting, string $email): User
+    {
+        $provider = $oauthSetting->provider;
+        $providerUserId = $oauthUser->id ?? null;
+        if (
+            (! is_string($providerUserId) && ! is_int($providerUserId))
+            || (is_string($providerUserId) && trim($providerUserId) === '')
+        ) {
+            throw new HttpException(403, 'OAuth provider did not return a valid user ID');
+        }
+        $providerUserId = (string) $providerUserId;
+        $rawClaims = is_array($oauthUser->user ?? null) ? $oauthUser->user : [];
+
+        $identityKey = [
+            'provider' => $provider,
+            'issuer' => $provider,
+            'provider_user_id' => $providerUserId,
+        ];
+
+        try {
+            return DB::transaction(function () use ($oauthUser, $oauthSetting, $email, $provider, $providerUserId, $rawClaims, $identityKey): User {
+                $identity = OauthIdentity::where($identityKey)->first();
+
+                if ($identity) {
+                    $identity->update([
+                        'email' => $email,
+                        'raw_claims' => $rawClaims,
+                        'last_login_at' => now(),
+                    ]);
+
+                    return $identity->user;
+                }
+
+                $user = User::whereEmail($email)->first();
+                if (! $user) {
+                    if (! $this->canCreateUser($oauthSetting)) {
+                        throw new HttpException(403, 'Registration is disabled');
+                    }
+
+                    $user = $this->createUser($oauthUser->name ?: $email, $email, $oauthSetting);
+                }
+
+                OauthIdentity::create([
+                    'user_id' => $user->id,
+                    'provider' => $provider,
+                    'issuer' => $provider,
+                    'provider_user_id' => $providerUserId,
+                    'email' => $email,
+                    'raw_claims' => $rawClaims,
+                    'last_login_at' => now(),
+                ]);
+
+                return $user;
+            });
+        } catch (UniqueConstraintViolationException $exception) {
+            return OauthIdentity::where($identityKey)->first()?->user ?? throw $exception;
+        }
+    }
+
+    private function resolveOidcUser(object $oauthUser, OauthSetting $oauthSetting, string $email): User
+    {
+        $issuer = $oauthUser instanceof OidcUser && filled($oauthUser->issuer)
+            ? $oauthUser->issuer
+            : data_get($oauthUser->user, 'iss');
+        $subject = $oauthUser instanceof OidcUser && filled($oauthUser->subject)
+            ? $oauthUser->subject
+            : data_get($oauthUser->user, 'sub', $oauthUser->id);
+        $emailVerified = ($oauthUser instanceof OidcUser && $oauthUser->emailVerified)
+            || data_get($oauthUser->user, 'email_verified') === true;
+
+        if (! is_string($issuer) || $issuer === '' || ! is_string($subject) || $subject === '') {
+            throw new HttpException(403, 'OIDC provider did not return issuer and subject claims');
+        }
+
+        if ($oauthSetting->require_email_verified && ! $emailVerified) {
+            throw new HttpException(403, 'OIDC provider did not verify the email address');
+        }
+
+        $rawClaims = is_array($oauthUser->user ?? null) ? $oauthUser->user : [];
+
+        $identityKey = [
+            'provider' => 'oidc',
+            'issuer' => $issuer,
+            'provider_user_id' => $subject,
+        ];
+
+        try {
+            return DB::transaction(function () use ($oauthUser, $oauthSetting, $email, $issuer, $subject, $emailVerified, $rawClaims, $identityKey): User {
+                $identity = OauthIdentity::where($identityKey)->first();
+
+                if ($identity) {
+                    $identity->update([
+                        'email' => $email,
+                        'raw_claims' => $rawClaims,
+                        'last_login_at' => now(),
+                    ]);
+
+                    return $identity->user;
+                }
+
+                $user = User::whereEmail($email)->first();
+
+                // Linking a new OIDC identity to an existing local account by email
+                // is account takeover unless the provider attests the email. This
+                // guard is independent of the require_email_verified toggle, which
+                // only governs the broader login flow.
+                if ($user && ! $emailVerified) {
+                    throw new HttpException(403, 'OIDC provider must verify the email address before linking to an existing account');
+                }
+
+                if (! $user) {
+                    if (! $this->canCreateUser($oauthSetting)) {
+                        throw new HttpException(403, 'Registration is disabled');
+                    }
+
+                    $user = $this->createUser($oauthUser->name ?: $email, $email, $oauthSetting);
+                }
+
+                OauthIdentity::create([
+                    'user_id' => $user->id,
+                    'provider' => 'oidc',
+                    'issuer' => $issuer,
+                    'provider_user_id' => $subject,
+                    'email' => $email,
+                    'raw_claims' => $rawClaims,
+                    'last_login_at' => now(),
+                ]);
+
+                return $user;
+            });
+        } catch (UniqueConstraintViolationException $exception) {
+            return OauthIdentity::where($identityKey)->first()?->user ?? throw $exception;
+        }
+    }
+
+    private function canCreateUser(OauthSetting $oauthSetting): bool
+    {
+        return instanceSettings()->is_registration_enabled || $oauthSetting->allow_registration;
+    }
+
+    private function createUser(string $name, string $email, OauthSetting $oauthSetting): User
+    {
+        if (User::count() === 0) {
+            $user = (new User)->forceFill([
+                'id' => 0,
+                'name' => $name,
+                'email' => $email,
+                'password' => Hash::make(Str::random(64)),
+            ]);
+            $user->save();
+
+            $team = $user->teams()->first() ?? Team::find(0);
+            if ($team !== null && ! $user->teams()->where('team_id', $team->id)->exists()) {
+                $user->teams()->attach($team, ['role' => 'owner']);
+            }
+
+            instanceSettings()->update(['is_registration_enabled' => false]);
+
+            return $user;
+        }
+
+        if ($oauthSetting->auto_join_root_team) {
+            return $this->createRootTeamOnlyUser($name, $email);
+        }
+
+        return User::create([
+            'name' => $name,
+            'email' => $email,
+            'password' => Hash::make(Str::random(64)),
+        ]);
+    }
+
+    private function createRootTeamOnlyUser(string $name, string $email): User
+    {
+        return DB::transaction(function () use ($name, $email) {
+            $rootTeam = Team::find(0);
+            if ($rootTeam === null) {
+                throw new HttpException(403, 'Root team is not available for OAuth user provisioning');
+            }
+
+            $user = User::withoutEvents(fn () => User::create([
+                'name' => $name,
+                'email' => $email,
+                'password' => Hash::make(Str::random(64)),
+            ]));
+
+            $user->teams()->attach($rootTeam, ['role' => 'member']);
+
+            return $user;
+        });
+    }
+}
diff --git a/app/Services/CloudflareTokenValidator.php b/app/Services/CloudflareTokenValidator.php
new file mode 100644
index 0000000000..2a4a761027
--- /dev/null
+++ b/app/Services/CloudflareTokenValidator.php
@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+
+class CloudflareTokenValidator
+{
+    public function validate(string $token, array $capabilities): bool
+    {
+        $client = $this->client($token);
+        $verification = $client->get('https://api.cloudflare.com/client/v4/user/tokens/verify');
+
+        if (! $verification->successful() || $verification->json('result.status') !== 'active') {
+            return false;
+        }
+
+        if (in_array('dns', $capabilities, true)) {
+            $zones = $client->get('https://api.cloudflare.com/client/v4/zones', ['per_page' => 1]);
+            $zoneId = $zones->json('result.0.id');
+
+            if (! $zones->successful() || ! is_string($zoneId)) {
+                return false;
+            }
+
+            return $client->get("https://api.cloudflare.com/client/v4/zones/{$zoneId}/dns_records", [
+                'per_page' => 1,
+            ])->successful();
+        }
+
+        return true;
+    }
+
+    private function client(string $token): PendingRequest
+    {
+        return Http::withToken($token)
+            ->acceptJson()
+            ->connectTimeout(5)
+            ->timeout(10);
+    }
+}
diff --git a/app/Services/DatabaseStartCommandExecutor.php b/app/Services/DatabaseStartCommandExecutor.php
new file mode 100644
index 0000000000..dab3599101
--- /dev/null
+++ b/app/Services/DatabaseStartCommandExecutor.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\ProcessStatus;
+use App\Helpers\SshMultiplexingHelper;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Process;
+use Spatie\Activitylog\Models\Activity;
+
+class DatabaseStartCommandExecutor
+{
+    public function execute(array $commands, Model $database, Activity $activity): Activity
+    {
+        $server = $database->destination->server;
+        if ($server->isNonRoot()) {
+            $commands = parseCommandsByLineForSudo(collect($commands), $server)->all();
+        }
+
+        $secrets = method_exists($database, 'resolvedSecretManagerValuesForRedaction')
+            ? $database->resolvedSecretManagerValuesForRedaction()
+            : [];
+        $remoteCommand = SshMultiplexingHelper::generateSshCommand($server, implode("\n", $commands));
+
+        $activity->properties = $activity->properties->merge(['status' => ProcessStatus::IN_PROGRESS->value]);
+        $activity->save();
+
+        $process = Process::timeout(config('constants.ssh.command_timeout'))
+            ->idleTimeout(3600)
+            ->start($remoteCommand, function (string $type, string $output) use ($activity, $secrets): void {
+                $this->appendOutput($activity, $type, $this->redact($output, $secrets));
+            });
+
+        $result = $process->wait();
+        $status = $result->successful() ? ProcessStatus::FINISHED : ProcessStatus::ERROR;
+        $activity->properties = $activity->properties->merge([
+            'status' => $status->value,
+            'exitCode' => $result->exitCode(),
+        ]);
+        $activity->save();
+
+        if (! $result->successful()) {
+            throw new \RuntimeException($this->redact($result->errorOutput(), $secrets), $result->exitCode());
+        }
+
+        return $activity;
+    }
+
+    private function redact(string $value, array $secrets): string
+    {
+        foreach ($secrets as $secret) {
+            if (is_string($secret) && $secret !== '') {
+                $value = str_replace($secret, REDACTED, $value);
+            }
+        }
+
+        return sanitize_utf8_text(remove_iip($value));
+    }
+
+    private function appendOutput(Activity $activity, string $type, string $output): void
+    {
+        if ($output === '') {
+            return;
+        }
+
+        $entries = json_decode($activity->description ?: '[]', true, flags: JSON_THROW_ON_ERROR);
+        $entries[] = [
+            'type' => $type,
+            'output' => $output,
+            'timestamp' => hrtime(true),
+            'batch' => 1,
+            'order' => count($entries) + 1,
+        ];
+        $activity->description = json_encode($entries, flags: JSON_THROW_ON_ERROR | JSON_UNESCAPED_UNICODE);
+        $activity->save();
+    }
+}
diff --git a/app/Services/DopplerService.php b/app/Services/DopplerService.php
new file mode 100644
index 0000000000..2513a4f7d8
--- /dev/null
+++ b/app/Services/DopplerService.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+
+class DopplerService
+{
+    private string $baseUrl = 'https://api.doppler.com';
+
+    public function __construct(private string $token) {}
+
+    public function validate(): bool
+    {
+        try {
+            return $this->client()->get($this->baseUrl.'/v3/me')->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Download all secrets for a config. Project and config are not needed for
+     * service tokens (the token itself is pinned to one config).
+     *
+     * @return array<string, string>
+     */
+    public function fetchSecrets(?string $project = null, ?string $config = null): array
+    {
+        $query = ['format' => 'json'];
+        if (filled($project)) {
+            $query['project'] = $project;
+        }
+        if (filled($config)) {
+            $query['config'] = $config;
+        }
+
+        $response = $this->client()->get($this->baseUrl.'/v3/configs/config/secrets/download', $query);
+
+        if (! $response->successful()) {
+            throw new \RuntimeException('Doppler API error: '.($response->json('messages.0') ?? 'HTTP '.$response->status()));
+        }
+
+        return collect($response->json())
+            ->map(fn ($value) => is_string($value) ? $value : json_encode($value))
+            ->all();
+    }
+
+    private function client(): PendingRequest
+    {
+        return Http::withToken($this->token)
+            ->acceptJson()
+            ->connectTimeout(5)
+            ->timeout(10);
+    }
+}
diff --git a/app/Services/InfisicalService.php b/app/Services/InfisicalService.php
new file mode 100644
index 0000000000..06f1e5d49f
--- /dev/null
+++ b/app/Services/InfisicalService.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Services;
+
+use App\Rules\SafeExternalUrl;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Validator;
+
+class InfisicalService
+{
+    private string $baseUrl;
+
+    /** @var array<string, mixed> */
+    private array $httpClientOptions;
+
+    public function __construct(string $baseUrl, private string $clientId, private string $clientSecret)
+    {
+        $this->baseUrl = rtrim($baseUrl, '/');
+        Validator::make(['base_url' => $this->baseUrl], ['base_url' => new SafeExternalUrl])->validate();
+        $this->httpClientOptions = SafeExternalUrl::httpClientOptions($this->baseUrl);
+    }
+
+    public function validate(): bool
+    {
+        try {
+            $this->login();
+
+            return true;
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function fetchSecrets(string $projectId, string $environment, string $secretPath = '/'): array
+    {
+        $client = $this->client()->withToken($this->login());
+        $secretPath = $secretPath ?: '/';
+
+        $response = $client->get($this->baseUrl.'/api/v4/secrets', [
+            'projectId' => $projectId,
+            'environment' => $environment,
+            'secretPath' => $secretPath,
+        ]);
+
+        // Older self-hosted instances only expose the v3 endpoint.
+        if ($response->status() === 404) {
+            $response = $client->get($this->baseUrl.'/api/v3/secrets/raw', [
+                'workspaceId' => $projectId,
+                'environment' => $environment,
+                'secretPath' => $secretPath,
+            ]);
+        }
+
+        if (! $response->successful()) {
+            throw new \RuntimeException('Infisical API error: '.($response->json('message') ?? 'HTTP '.$response->status()));
+        }
+
+        return collect($response->json('secrets', []))
+            ->mapWithKeys(fn ($secret) => [(string) data_get($secret, 'secretKey') => (string) data_get($secret, 'secretValue', '')])
+            ->all();
+    }
+
+    private function login(): string
+    {
+        $response = $this->client()->post($this->baseUrl.'/api/v1/auth/universal-auth/login', [
+            'clientId' => $this->clientId,
+            'clientSecret' => $this->clientSecret,
+        ]);
+
+        $accessToken = $response->json('accessToken');
+        if (! $response->successful() || blank($accessToken)) {
+            throw new \RuntimeException('Infisical login failed: '.($response->json('message') ?? 'HTTP '.$response->status()));
+        }
+
+        return $accessToken;
+    }
+
+    private function client(): PendingRequest
+    {
+        return Http::acceptJson()
+            ->withOptions($this->httpClientOptions)
+            ->connectTimeout(5)
+            ->timeout(10);
+    }
+}
diff --git a/app/Services/IntegrationTokenValidator.php b/app/Services/IntegrationTokenValidator.php
new file mode 100644
index 0000000000..6033ce98f7
--- /dev/null
+++ b/app/Services/IntegrationTokenValidator.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Services;
+
+/**
+ * Validates an integration token against its provider API before it is saved.
+ */
+class IntegrationTokenValidator
+{
+    public function validate(string $provider, string $token, array $capabilities, array $metadata = []): bool
+    {
+        return match ($provider) {
+            'cloudflare' => app(CloudflareTokenValidator::class)->validate($token, $capabilities),
+            'doppler' => (new DopplerService($token))->validate(),
+            'infisical' => (new InfisicalService(
+                (string) data_get($metadata, 'base_url', 'https://app.infisical.com'),
+                (string) data_get($metadata, 'client_id'),
+                $token,
+            ))->validate(),
+            'vault' => (new VaultService(
+                (string) data_get($metadata, 'base_url'),
+                $token,
+                data_get($metadata, 'namespace'),
+            ))->validate(),
+            default => false,
+        };
+    }
+
+    public function errorMessage(string $provider): string
+    {
+        return match ($provider) {
+            'cloudflare' => 'The token could not access the selected Cloudflare capabilities. Check its permissions and zone resources.',
+            'doppler' => 'The Doppler token could not be verified. Check the token and its access.',
+            'infisical' => 'Infisical login failed. Check the base URL, the client ID, and the client secret.',
+            'vault' => 'The Vault token could not be verified. Check the base URL, the namespace, and the token.',
+            default => 'The token could not be verified.',
+        };
+    }
+}
diff --git a/app/Services/VaultService.php b/app/Services/VaultService.php
new file mode 100644
index 0000000000..e41652cd54
--- /dev/null
+++ b/app/Services/VaultService.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Services;
+
+use App\Rules\SafeExternalUrl;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Validator;
+
+class VaultService
+{
+    private string $baseUrl;
+
+    /** @var array<string, mixed> */
+    private array $httpClientOptions;
+
+    public function __construct(string $baseUrl, private string $token, private ?string $namespace = null)
+    {
+        $this->baseUrl = rtrim($baseUrl, '/');
+        Validator::make(['base_url' => $this->baseUrl], ['base_url' => new SafeExternalUrl])->validate();
+        $this->httpClientOptions = SafeExternalUrl::httpClientOptions($this->baseUrl);
+    }
+
+    public function validate(): bool
+    {
+        try {
+            return $this->client()->get($this->baseUrl.'/v1/auth/token/lookup-self')->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Read a KV v2 secret. Non-string values are stored as JSON strings.
+     *
+     * @return array<string, string>
+     */
+    public function fetchSecrets(string $mount, string $path): array
+    {
+        $mount = trim($mount, '/');
+        $path = trim($path, '/');
+
+        $response = $this->client()->get($this->baseUrl."/v1/{$mount}/data/{$path}");
+
+        if (! $response->successful()) {
+            throw new \RuntimeException('Vault API error: '.($response->json('errors.0') ?? 'HTTP '.$response->status()));
+        }
+
+        return collect($response->json('data.data', []))
+            ->map(fn ($value) => is_string($value) ? $value : json_encode($value))
+            ->all();
+    }
+
+    private function client(): PendingRequest
+    {
+        $client = Http::withHeaders(['X-Vault-Token' => $this->token])
+            ->acceptJson()
+            ->withOptions($this->httpClientOptions)
+            ->connectTimeout(5)
+            ->timeout(10);
+
+        if (filled($this->namespace)) {
+            $client = $client->withHeaders(['X-Vault-Namespace' => $this->namespace]);
+        }
+
+        return $client;
+    }
+}
diff --git a/app/Support/RemoteSecretReferences.php b/app/Support/RemoteSecretReferences.php
new file mode 100644
index 0000000000..530c29a28c
--- /dev/null
+++ b/app/Support/RemoteSecretReferences.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Support;
+
+/**
+ * Parses {{vault.KEY}} style references to remote secret manager values.
+ * The namespace is provider-neutral and resolves against the resource's
+ * configured secret source. It is intentionally
+ * intentionally NOT "secret" so references stay visually distinct from the
+ * shared variable syntax ({{team.KEY}}, {{project.KEY}}, ...). References are
+ * only resolved inside the deployment job — never in the UI or in realValue —
+ * so secret values stay out of the database and the interface.
+ */
+class RemoteSecretReferences
+{
+    public const PATTERN = '/{{\s*vault\.([A-Za-z0-9_]+)\s*}}/';
+
+    public static function containsReference(?string $value): bool
+    {
+        return filled($value) && preg_match(self::PATTERN, $value) === 1;
+    }
+
+    /**
+     * @return list<string> Referenced secret key names (unique, in order of appearance)
+     */
+    public static function referencedKeys(?string $value): array
+    {
+        if (blank($value)) {
+            return [];
+        }
+
+        preg_match_all(self::PATTERN, $value, $matches);
+
+        return array_values(array_unique($matches[1]));
+    }
+
+    /**
+     * Replace every reference with its value from the secrets map.
+     * Keys missing from the map are left as-is — collect them first with
+     * missingKeys() and fail before calling substitute().
+     *
+     * @param  array<string, string>  $secrets
+     */
+    public static function substitute(string $value, array $secrets): string
+    {
+        return preg_replace_callback(
+            self::PATTERN,
+            fn (array $matches) => array_key_exists($matches[1], $secrets) ? $secrets[$matches[1]] : $matches[0],
+            $value,
+        );
+    }
+
+    /**
+     * @param  array<string, string>  $secrets
+     * @return list<string>
+     */
+    public static function missingKeys(?string $value, array $secrets): array
+    {
+        return array_values(array_filter(
+            self::referencedKeys($value),
+            fn (string $key) => ! array_key_exists($key, $secrets),
+        ));
+    }
+}
diff --git a/app/Traits/Auditable.php b/app/Traits/Auditable.php
new file mode 100644
index 0000000000..878d46c1e4
--- /dev/null
+++ b/app/Traits/Auditable.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\PersonalAccessToken;
+use App\Models\Team;
+use Closure;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+
+trait Auditable
+{
+    private bool $auditLoggingEnabled = true;
+
+    public static function bootAuditable(): void
+    {
+        static::created(fn (Model $model) => $model->recordAuditMutation('created'));
+        static::updated(fn (Model $model) => $model->recordAuditMutation('updated'));
+        static::deleted(fn (Model $model) => $model->recordAuditMutation('deleted'));
+    }
+
+    private function recordAuditMutation(string $action): void
+    {
+        if (! $this->auditLoggingEnabled || ! auth()->check()) {
+            return;
+        }
+
+        $teamId = $this->auditTeamId();
+        if ($teamId === null) {
+            return;
+        }
+
+        $changedFields = $action === 'updated'
+            ? collect(array_keys($this->getChanges()))
+                ->reject(fn (string $field): bool => in_array($field, [
+                    'updated_at',
+                    'order',
+                    'status',
+                    ...($this->auditExclude ?? []),
+                ], true))
+                ->values()
+                ->all()
+            : [];
+
+        if ($action === 'updated' && $changedFields === []) {
+            return;
+        }
+
+        $resourceType = Str::snake(class_basename($this));
+        $source = auth()->user()?->currentAccessToken() instanceof PersonalAccessToken ? 'api' : 'ui';
+
+        auditLog("{$source}.{$resourceType}.{$action}", [
+            'team_id' => $teamId,
+            "{$resourceType}_uuid" => $this->getAttribute('uuid'),
+            "{$resourceType}_name" => $this->getAttribute('name') ?? $this->getAttribute('key'),
+            'changed_fields' => $changedFields,
+        ]);
+    }
+
+    public function withoutAuditLogging(Closure $callback): mixed
+    {
+        $wasAuditLoggingEnabled = $this->auditLoggingEnabled;
+        $this->auditLoggingEnabled = false;
+
+        try {
+            return $callback();
+        } finally {
+            $this->auditLoggingEnabled = $wasAuditLoggingEnabled;
+        }
+    }
+
+    private function auditTeamId(): ?int
+    {
+        if ($this instanceof Team) {
+            return (int) $this->getKey();
+        }
+
+        if ($this->getAttribute('team_id') !== null) {
+            return (int) $this->getAttribute('team_id');
+        }
+
+        if ($this->getAttribute('project_id') !== null) {
+            return $this->project?->team_id;
+        }
+
+        if ($this->getAttribute('environment_id') !== null) {
+            return $this->environment?->project?->team_id;
+        }
+
+        if ($this->getAttribute('server_id') !== null) {
+            return $this->server?->team_id;
+        }
+
+        if ($this->getAttribute('resourceable_id') !== null) {
+            return $this->resourceable?->team()?->id
+                ?? $this->resourceable?->team_id
+                ?? $this->resourceable?->environment?->project?->team_id;
+        }
+
+        return null;
+    }
+}
diff --git a/app/Traits/ExecuteRemoteCommand.php b/app/Traits/ExecuteRemoteCommand.php
index a2c3d06da9..b8ff5df14b 100644
--- a/app/Traits/ExecuteRemoteCommand.php
+++ b/app/Traits/ExecuteRemoteCommand.php
@@ -46,6 +46,13 @@ trait ExecuteRemoteCommand
             );
         }
 
+        if (isset($this->remote_secrets_cache)) {
+            $lockedVars = $lockedVars->merge(array_values(array_filter(
+                $this->remote_secrets_cache,
+                static fn (mixed $value): bool => is_string($value) && $value !== ''
+            )));
+        }
+
         foreach ($lockedVars as $key => $value) {
             $escapedValue = preg_quote($value, '/');
             $text = preg_replace(
diff --git a/app/Traits/ExecutesDatabaseStartCommands.php b/app/Traits/ExecutesDatabaseStartCommands.php
new file mode 100644
index 0000000000..d267a8b1b2
--- /dev/null
+++ b/app/Traits/ExecutesDatabaseStartCommands.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Traits;
+
+use App\Services\DatabaseStartCommandExecutor;
+use Illuminate\Database\Eloquent\Model;
+use Spatie\Activitylog\Models\Activity;
+
+trait ExecutesDatabaseStartCommands
+{
+    private function executeDatabaseStartCommands(array $commands, Model $database, ?Activity $activity = null): Activity
+    {
+        if ($activity) {
+            return app(DatabaseStartCommandExecutor::class)->execute($commands, $database, $activity);
+        }
+
+        return remote_process($commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+    }
+}
diff --git a/app/Traits/HasSecretManager.php b/app/Traits/HasSecretManager.php
new file mode 100644
index 0000000000..8b3e50b7bd
--- /dev/null
+++ b/app/Traits/HasSecretManager.php
@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\EnvironmentVariable;
+use App\Models\SecretManagerLink;
+use App\Support\RemoteSecretReferences;
+use Illuminate\Database\Eloquent\Relations\MorphOne;
+use RuntimeException;
+
+trait HasSecretManager
+{
+    /** @var array<string, string>|null */
+    private ?array $resolvedSecretManagerValues = null;
+
+    public static function bootHasSecretManager(): void
+    {
+        static::deleting(fn ($resource) => $resource->secretManagerLink()->delete());
+    }
+
+    public function secretManagerLink(): MorphOne
+    {
+        return $this->morphOne(SecretManagerLink::class, 'resourceable');
+    }
+
+    public function resolveSecretManagerEnvironmentVariable(EnvironmentVariable $environmentVariable): ?string
+    {
+        $value = $this->resolveSecretManagerEnvironmentVariableValue($environmentVariable);
+
+        return $this->formatEnvironmentVariableValue($environmentVariable, $value);
+    }
+
+    public function formatEnvironmentVariableValue(EnvironmentVariable $environmentVariable, ?string $value): ?string
+    {
+        if ($value === null) {
+            return null;
+        }
+
+        if (json_validate($value) && (str_starts_with($value, '{') || str_starts_with($value, '['))) {
+            return $value;
+        }
+
+        return $environmentVariable->is_literal || $environmentVariable->is_multiline
+            ? "'{$value}'"
+            : escapeEnvVariables($value);
+    }
+
+    public function resolveSecretManagerEnvironmentVariableValue(EnvironmentVariable $environmentVariable): ?string
+    {
+        $value = $this->resolvedEnvironmentVariableValue($environmentVariable);
+
+        if ($value === null) {
+            return null;
+        }
+
+        if (RemoteSecretReferences::containsReference($value)) {
+            $secrets = $this->secretManagerValues();
+            $missing = RemoteSecretReferences::missingKeys($value, $secrets);
+
+            if ($missing !== []) {
+                throw new RuntimeException('Missing secret keys: '.implode(', ', $missing)." (referenced by {$environmentVariable->key}).");
+            }
+
+            $value = RemoteSecretReferences::substitute($value, $secrets);
+        }
+
+        return $value;
+    }
+
+    public function environmentVariableUsesSecretManager(EnvironmentVariable $environmentVariable): bool
+    {
+        return RemoteSecretReferences::containsReference(
+            $this->resolvedEnvironmentVariableValue($environmentVariable),
+        );
+    }
+
+    private function resolvedEnvironmentVariableValue(EnvironmentVariable $environmentVariable): ?string
+    {
+        return $environmentVariable->get_real_environment_variables_with_server(
+            $environmentVariable->value,
+            $this,
+            data_get($this, 'server'),
+        );
+    }
+
+    /** @return array<string, string> */
+    private function secretManagerValues(): array
+    {
+        if ($this->resolvedSecretManagerValues !== null) {
+            return $this->resolvedSecretManagerValues;
+        }
+
+        $link = $this->secretManagerLink()->with('integrationToken')->first();
+
+        if (! $link) {
+            throw new RuntimeException('Environment variables reference remote secrets, but no secret manager source is configured.');
+        }
+
+        return $this->resolvedSecretManagerValues = $link->fetchSecrets();
+    }
+
+    /** @return array<string, string> */
+    public function resolvedSecretManagerValuesForRedaction(): array
+    {
+        return $this->resolvedSecretManagerValues ?? [];
+    }
+}
diff --git a/app/Traits/HasSecretManagerAutocomplete.php b/app/Traits/HasSecretManagerAutocomplete.php
new file mode 100644
index 0000000000..1b46ca2dd5
--- /dev/null
+++ b/app/Traits/HasSecretManagerAutocomplete.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\SecretManagerLink;
+
+/**
+ * Exposes the resource's secret manager source to the env-var-input
+ * autocomplete: a boolean for the "vault" scope, and a lazy key-name fetch
+ * (called from the frontend only when the user types a vault reference).
+ * Secret values never reach the component state — key names only.
+ */
+trait HasSecretManagerAutocomplete
+{
+    public function hasSecretManagerSource(): bool
+    {
+        return $this->secretManagerLinkForAutocomplete() !== null;
+    }
+
+    /**
+     * @return list<string>
+     */
+    public function fetchSecretManagerKeys(): array
+    {
+        $this->skipRender();
+
+        $link = $this->secretManagerLinkForAutocomplete();
+
+        if (! $link) {
+            return [];
+        }
+
+        try {
+            $this->authorize('view', $link->resourceable);
+            $keys = array_keys($link->fetchSecrets());
+            sort($keys);
+
+            return $keys;
+        } catch (\Throwable) {
+            throw new \RuntimeException('Unable to fetch secret manager keys.');
+        }
+    }
+
+    private function secretManagerLinkForAutocomplete(): ?SecretManagerLink
+    {
+        $resource = $this->secretManagerResource();
+
+        if (! $resource || ! method_exists($resource, 'secretManagerLink')) {
+            return null;
+        }
+
+        if (! $resource->relationLoaded('secretManagerLink')) {
+            $resource->load('secretManagerLink.integrationToken');
+        }
+
+        return $resource->secretManagerLink;
+    }
+}
diff --git a/app/View/Components/Forms/EnvVarInput.php b/app/View/Components/Forms/EnvVarInput.php
index a3e6646fec..9ff5d72dc5 100644
--- a/app/View/Components/Forms/EnvVarInput.php
+++ b/app/View/Components/Forms/EnvVarInput.php
@@ -35,6 +35,7 @@ class EnvVarInput extends Component
         public mixed $canResource = null,
         public bool $autoDisable = true,
         public array $availableVars = [],
+        public bool $hasVaultSource = false,
         public ?string $projectUuid = null,
         public ?string $environmentUuid = null,
         public ?string $serverUuid = null,
diff --git a/bootstrap/helpers/applications.php b/bootstrap/helpers/applications.php
index 339a0bcf7b..2fb0bb3f53 100644
--- a/bootstrap/helpers/applications.php
+++ b/bootstrap/helpers/applications.php
@@ -84,6 +84,15 @@ function queue_application_deployment(Application $application, string $deployme
         'only_this_server' => $only_this_server,
     ]);
 
+    if (auth()->check() && ! $is_webhook && ! $is_api && ! $rollback) {
+        auditLog($restart_only ? 'ui.application.restarted' : 'ui.application.deployed', [
+            'application_uuid' => $application->uuid,
+            'application_name' => $application->name,
+            'deployment_uuid' => $deployment_uuid,
+            'force_rebuild' => $force_rebuild,
+        ]);
+    }
+
     if ($no_questions_asked) {
         $deployment->update([
             'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
diff --git a/bootstrap/helpers/audit.php b/bootstrap/helpers/audit.php
index 8477450c4b..1a1ad0a994 100644
--- a/bootstrap/helpers/audit.php
+++ b/bootstrap/helpers/audit.php
@@ -1,13 +1,10 @@
 <?php
 
-use Illuminate\Support\Facades\Log;
+use App\Models\AuditEvent;
 
 if (! function_exists('auditLog')) {
     /**
-     * Write a security-relevant audit entry to the dedicated `audit` log channel.
-     *
-     * Never include secrets (private keys, passwords, tokens, webhook secrets,
-     * signature header values, env-var values) in $context.
+     * Queue an audit event for persistence after the response.
      *
      * @param  string  $event  Dot-namespaced event name, e.g. `api.private_key.created`.
      * @param  array<string, mixed>  $context  Identifiers + outcome details.
@@ -16,39 +13,15 @@ if (! function_exists('auditLog')) {
     function auditLog(string $event, array $context = [], string $level = 'info'): void
     {
         try {
-            $request = app()->bound('request') ? request() : null;
-            $user = auth()->check() ? auth()->user() : null;
-            $token = $user?->currentAccessToken();
-
-            $base = [
-                'event' => $event,
-                'ip' => $request?->ip(),
-                'ua' => substr((string) $request?->userAgent(), 0, 200),
-                'user_id' => $user?->id,
-                'user_email' => $user?->email,
-                'team_id' => $token ? data_get($token, 'team_id') : null,
-                'token_id' => $token?->id ?? null,
-                'token_name' => $token?->name ?? null,
-                'method' => $request?->method(),
-                'path' => $request?->path(),
-            ];
-
-            $payload = array_merge($base, $context);
-
-            Log::channel('audit')->{$level}($event, $payload);
-        } catch (Throwable $e) {
-            // Audit logging must never break the request path.
-            try {
-                Log::warning('auditLog failed: '.$e->getMessage(), ['event' => $event]);
-            } catch (Throwable) {
-            }
+            AuditEvent::record($event, $context);
+        } catch (Throwable) {
         }
     }
 }
 
 if (! function_exists('auditLogWebhookFailure')) {
     /**
-     * Record a webhook signature/auth verification failure to the `audit` channel.
+     * Record a webhook signature/auth verification failure.
      */
     function auditLogWebhookFailure(string $provider, string $reason, array $context = []): void
     {
@@ -58,10 +31,7 @@ if (! function_exists('auditLogWebhookFailure')) {
             $event = "webhook.{$provider}.signature_failed";
 
             $base = [
-                'event' => $event,
                 'reason' => $reason,
-                'ip' => $request?->ip(),
-                'ua' => substr((string) $request?->userAgent(), 0, 200),
                 'method' => $request?->method(),
                 'path' => $request?->path(),
                 'event_header' => $request?->header('X-GitHub-Event')
@@ -70,12 +40,8 @@ if (! function_exists('auditLogWebhookFailure')) {
                     ?? $request?->header('X-Event-Key'),
             ];
 
-            Log::channel('audit')->warning($event, array_merge($base, $context));
-        } catch (Throwable $e) {
-            try {
-                Log::warning('auditLogWebhookFailure failed: '.$e->getMessage(), ['provider' => $provider]);
-            } catch (Throwable) {
-            }
+            auditLog($event, array_merge($base, $context), 'warning');
+        } catch (Throwable) {
         }
     }
 }
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index fbfbc9b566..44ceb603b9 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -4619,7 +4619,7 @@ function formatContainerStatus(string $status): string
  * Check if password confirmation should be skipped.
  * Returns true if:
  * - Two-step confirmation is globally disabled
- * - User has no password (OAuth users)
+ * - User has no usable local password confirmation (including SSO users)
  *
  * Used by modal-confirmation.blade.php to determine if password step should be shown.
  *
@@ -4632,8 +4632,9 @@ function shouldSkipPasswordConfirmation(): bool
         return true;
     }
 
-    // Skip if user has no password (OAuth users)
-    if (! Auth::user()?->hasPassword()) {
+    // OAuth users may have an unusable generated password, so the linked
+    // identity is the source of truth for whether confirmation is possible.
+    if (! Auth::user()?->requiresPasswordConfirmation()) {
         return true;
     }
 
@@ -4644,7 +4645,7 @@ function shouldSkipPasswordConfirmation(): bool
  * Verify password for two-step confirmation.
  * Skips verification if:
  * - Two-step confirmation is globally disabled
- * - User has no password (OAuth users)
+ * - User has no usable local password confirmation (including SSO users)
  *
  * @param  mixed  $password  The password to verify (may be array if skipped by frontend)
  * @param  Component|null  $component  Optional Livewire component to add errors to
diff --git a/bootstrap/helpers/socialite.php b/bootstrap/helpers/socialite.php
index fd3fbe74ba..f177e6c16f 100644
--- a/bootstrap/helpers/socialite.php
+++ b/bootstrap/helpers/socialite.php
@@ -1,7 +1,13 @@
 <?php
 
+use App\Auth\Oidc\OidcConfig;
 use App\Models\OauthSetting;
 use Laravel\Socialite\Facades\Socialite;
+use Laravel\Socialite\Two\BitbucketProvider;
+use Laravel\Socialite\Two\GithubProvider;
+use Laravel\Socialite\Two\GitlabProvider;
+use SocialiteProviders\Discord\Provider;
+use SocialiteProviders\Manager\Config;
 
 function get_socialite_provider(string $provider)
 {
@@ -12,7 +18,7 @@ function get_socialite_provider(string $provider)
     }
 
     if ($provider === 'azure') {
-        $azure_config = new \SocialiteProviders\Manager\Config(
+        $azure_config = new Config(
             $oauth_setting->client_id,
             $oauth_setting->client_secret,
             $oauth_setting->redirect_uri,
@@ -23,7 +29,7 @@ function get_socialite_provider(string $provider)
     }
 
     if ($provider == 'authentik' || $provider == 'clerk') {
-        $authentik_clerk_config = new \SocialiteProviders\Manager\Config(
+        $authentik_clerk_config = new Config(
             $oauth_setting->client_id,
             $oauth_setting->client_secret,
             $oauth_setting->redirect_uri,
@@ -34,7 +40,7 @@ function get_socialite_provider(string $provider)
     }
 
     if ($provider == 'zitadel') {
-        $zitadel_config = new \SocialiteProviders\Manager\Config(
+        $zitadel_config = new Config(
             $oauth_setting->client_id,
             $oauth_setting->client_secret,
             $oauth_setting->redirect_uri,
@@ -44,8 +50,12 @@ function get_socialite_provider(string $provider)
         return Socialite::driver('zitadel')->setConfig($zitadel_config);
     }
 
+    if ($provider === 'oidc') {
+        return Socialite::driver('oidc')->setConfig(OidcConfig::fromOauthSetting($oauth_setting));
+    }
+
     if ($provider == 'google') {
-        $google_config = new \SocialiteProviders\Manager\Config(
+        $google_config = new Config(
             $oauth_setting->client_id,
             $oauth_setting->client_secret,
             $oauth_setting->redirect_uri
@@ -63,11 +73,11 @@ function get_socialite_provider(string $provider)
     ];
 
     $provider_class_map = [
-        'bitbucket' => \Laravel\Socialite\Two\BitbucketProvider::class,
-        'discord' => \SocialiteProviders\Discord\Provider::class,
-        'github' => \Laravel\Socialite\Two\GithubProvider::class,
-        'gitlab' => \Laravel\Socialite\Two\GitlabProvider::class,
-        'infomaniak' => \SocialiteProviders\Infomaniak\Provider::class,
+        'bitbucket' => BitbucketProvider::class,
+        'discord' => Provider::class,
+        'github' => GithubProvider::class,
+        'gitlab' => GitlabProvider::class,
+        'infomaniak' => SocialiteProviders\Infomaniak\Provider::class,
     ];
 
     $socialite = Socialite::buildProvider(
diff --git a/composer.json b/composer.json
index 416b5e8f65..4778cc91dd 100644
--- a/composer.json
+++ b/composer.json
@@ -14,6 +14,7 @@
         "php": "^8.4",
         "danharrin/livewire-rate-limiting": "^2.2.1",
         "doctrine/dbal": "^4.4.4",
+        "firebase/php-jwt": "7.1.0",
         "guzzlehttp/guzzle": "^7.15.3",
         "laravel/fortify": "^1.37.3",
         "laravel/framework": "^12.65.0",
@@ -63,7 +64,6 @@
         "driftingly/rector-laravel": "^2.5.0",
         "fakerphp/faker": "^1.24.1",
         "laravel/boost": "^2.4.8",
-        "laravel/dusk": "^8.6.0",
         "laravel/pint": "^1.30.4",
         "mockery/mockery": "^1.6.12",
         "nunomaduro/collision": "^8.9.5",
diff --git a/composer.lock b/composer.lock
index e5718b31b0..55be2166b6 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "971daeb1b3078a36428c0fb56bb895b7",
+    "content-hash": "13e5d201c34a64cdf53e80a21304c9d5",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -13698,80 +13698,6 @@
             },
             "time": "2026-05-19T20:09:50+00:00"
         },
-        {
-            "name": "laravel/dusk",
-            "version": "v8.6.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/laravel/dusk.git",
-                "reference": "e7fd48762c6a82ad2cd311db07587aa2a97ce143"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/laravel/dusk/zipball/e7fd48762c6a82ad2cd311db07587aa2a97ce143",
-                "reference": "e7fd48762c6a82ad2cd311db07587aa2a97ce143",
-                "shasum": ""
-            },
-            "require": {
-                "ext-json": "*",
-                "ext-zip": "*",
-                "guzzlehttp/guzzle": "^7.5",
-                "illuminate/console": "^10.0|^11.0|^12.0|^13.0",
-                "illuminate/support": "^10.0|^11.0|^12.0|^13.0",
-                "php": "^8.1",
-                "php-webdriver/webdriver": "^1.15.2",
-                "symfony/console": "^6.2|^7.0|^8.0",
-                "symfony/finder": "^6.2|^7.0|^8.0",
-                "symfony/process": "^6.2|^7.0|^8.0",
-                "vlucas/phpdotenv": "^5.2"
-            },
-            "require-dev": {
-                "laravel/framework": "^10.0|^11.0|^12.0|^13.0",
-                "mockery/mockery": "^1.6",
-                "orchestra/testbench-core": "^8.19|^9.17|^10.8|^11.0",
-                "phpstan/phpstan": "^1.10",
-                "phpunit/phpunit": "^10.1|^11.0|^12.0.1",
-                "psy/psysh": "^0.11.12|^0.12",
-                "symfony/yaml": "^6.2|^7.0|^8.0"
-            },
-            "suggest": {
-                "ext-pcntl": "Used to gracefully terminate Dusk when tests are running."
-            },
-            "type": "library",
-            "extra": {
-                "laravel": {
-                    "providers": [
-                        "Laravel\\Dusk\\DuskServiceProvider"
-                    ]
-                }
-            },
-            "autoload": {
-                "psr-4": {
-                    "Laravel\\Dusk\\": "src/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "authors": [
-                {
-                    "name": "Taylor Otwell",
-                    "email": "taylor@laravel.com"
-                }
-            ],
-            "description": "Laravel Dusk provides simple end-to-end testing and browser automation.",
-            "keywords": [
-                "laravel",
-                "testing",
-                "webdriver"
-            ],
-            "support": {
-                "issues": "https://github.com/laravel/dusk/issues",
-                "source": "https://github.com/laravel/dusk/tree/v8.6.0"
-            },
-            "time": "2026-04-15T14:50:40+00:00"
-        },
         {
             "name": "laravel/pint",
             "version": "v1.30.4",
@@ -14817,72 +14743,6 @@
             },
             "time": "2022-02-21T01:04:05+00:00"
         },
-        {
-            "name": "php-webdriver/webdriver",
-            "version": "1.16.0",
-            "source": {
-                "type": "git",
-                "url": "https://github.com/php-webdriver/php-webdriver.git",
-                "reference": "ac0662863aa120b4f645869f584013e4c4dba46a"
-            },
-            "dist": {
-                "type": "zip",
-                "url": "https://api.github.com/repos/php-webdriver/php-webdriver/zipball/ac0662863aa120b4f645869f584013e4c4dba46a",
-                "reference": "ac0662863aa120b4f645869f584013e4c4dba46a",
-                "shasum": ""
-            },
-            "require": {
-                "ext-curl": "*",
-                "ext-json": "*",
-                "ext-zip": "*",
-                "php": "^7.3 || ^8.0",
-                "symfony/polyfill-mbstring": "^1.12",
-                "symfony/process": "^5.0 || ^6.0 || ^7.0 || ^8.0"
-            },
-            "replace": {
-                "facebook/webdriver": "*"
-            },
-            "require-dev": {
-                "ergebnis/composer-normalize": "^2.20.0",
-                "ondram/ci-detector": "^4.0",
-                "php-coveralls/php-coveralls": "^2.4",
-                "php-mock/php-mock-phpunit": "^2.0",
-                "php-parallel-lint/php-parallel-lint": "^1.2",
-                "phpunit/phpunit": "^9.3",
-                "squizlabs/php_codesniffer": "^3.5",
-                "symfony/var-dumper": "^5.0 || ^6.0 || ^7.0 || ^8.0"
-            },
-            "suggest": {
-                "ext-simplexml": "For Firefox profile creation"
-            },
-            "type": "library",
-            "autoload": {
-                "files": [
-                    "lib/Exception/TimeoutException.php"
-                ],
-                "psr-4": {
-                    "Facebook\\WebDriver\\": "lib/"
-                }
-            },
-            "notification-url": "https://packagist.org/downloads/",
-            "license": [
-                "MIT"
-            ],
-            "description": "A PHP client for Selenium WebDriver. Previously facebook/webdriver.",
-            "homepage": "https://github.com/php-webdriver/php-webdriver",
-            "keywords": [
-                "Chromedriver",
-                "geckodriver",
-                "php",
-                "selenium",
-                "webdriver"
-            ],
-            "support": {
-                "issues": "https://github.com/php-webdriver/php-webdriver/issues",
-                "source": "https://github.com/php-webdriver/php-webdriver/tree/1.16.0"
-            },
-            "time": "2025-12-28T23:57:40+00:00"
-        },
         {
             "name": "phpstan/phpstan",
             "version": "2.2.8",
diff --git a/config/app.php b/config/app.php
index 13a5b7d4b8..59aa6f4c28 100644
--- a/config/app.php
+++ b/config/app.php
@@ -193,8 +193,8 @@ return [
     */
 
     'maintenance' => [
-        'driver' => 'cache',
-        'store' => 'redis',
+        'driver' => env('APP_MAINTENANCE_DRIVER', 'cache'),
+        'store' => env('APP_MAINTENANCE_STORE', 'redis'),
     ],
 
     /*
diff --git a/config/logging.php b/config/logging.php
index 05cf8e13d3..89c9d38dde 100644
--- a/config/logging.php
+++ b/config/logging.php
@@ -133,13 +133,6 @@ return [
             'days' => 14,
         ],
 
-        'audit' => [
-            'driver' => 'daily',
-            'path' => storage_path('logs/audit.log'),
-            'level' => env('LOG_AUDIT_LEVEL', 'info'),
-            'days' => env('LOG_AUDIT_DAYS', 90),
-            'replace_placeholders' => true,
-        ],
     ],
 
 ];
diff --git a/config/services.php b/config/services.php
index c5956cf6c9..3a2a0631ef 100644
--- a/config/services.php
+++ b/config/services.php
@@ -60,6 +60,14 @@ return [
         'tenant' => env('GOOGLE_TENANT'),
     ],
 
+    'oidc' => [
+        'client_id' => env('OIDC_CLIENT_ID'),
+        'client_secret' => env('OIDC_CLIENT_SECRET'),
+        'redirect' => env('OIDC_REDIRECT_URI'),
+        'base_url' => env('OIDC_BASE_URL'),
+        'custom_label' => env('OIDC_LOGIN_LABEL'),
+    ],
+
     'zitadel' => [
         'client_id' => env('ZITADEL_CLIENT_ID'),
         'client_secret' => env('ZITADEL_CLIENT_SECRET'),
diff --git a/database/factories/AuditEventFactory.php b/database/factories/AuditEventFactory.php
new file mode 100644
index 0000000000..01ddebbd2b
--- /dev/null
+++ b/database/factories/AuditEventFactory.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\AuditEvent;
+use App\Models\Team;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<AuditEvent>
+ */
+class AuditEventFactory extends Factory
+{
+    protected $model = AuditEvent::class;
+
+    public function definition(): array
+    {
+        return [
+            'team_id' => Team::factory(),
+            'event' => 'ui.application.updated',
+            'source' => 'ui',
+            'action' => 'updated',
+            'actor_type' => 'user',
+            'description' => 'Application updated',
+            'metadata' => [],
+            'created_at' => now(),
+        ];
+    }
+}
diff --git a/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php b/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
index 19c4445b26..13fe6b6784 100644
--- a/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
+++ b/database/migrations/2026_05_29_000000_encrypt_application_deployment_configuration_columns.php
@@ -8,6 +8,12 @@ return new class extends Migration
     /**
      * The configuration snapshot/diff now store an encrypted blob (not valid
      * JSON), so the columns must hold arbitrary text instead of json.
+     *
+     * Coolify's own backend runs exclusively on PostgreSQL in production and
+     * SQLite in testing (see config/database.php — the only configured
+     * connections are `pgsql` and `testing`). MySQL/MariaDB are user-managed
+     * resources, never Coolify's application database, so no driver path is
+     * needed for them here.
      */
     public function up(): void
     {
diff --git a/database/migrations/2026_06_04_091631_add_oidc_fields_to_oauth_settings_table.php b/database/migrations/2026_06_04_091631_add_oidc_fields_to_oauth_settings_table.php
new file mode 100644
index 0000000000..3160ef9ddb
--- /dev/null
+++ b/database/migrations/2026_06_04_091631_add_oidc_fields_to_oauth_settings_table.php
@@ -0,0 +1,40 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('oauth_settings', function (Blueprint $table) {
+            $table->string('custom_label')->nullable();
+            $table->string('scopes')->nullable();
+            $table->boolean('allow_registration')->default(true);
+            $table->boolean('require_email_verified')->default(true);
+            $table->boolean('use_pkce')->default(true);
+            $table->unsignedSmallInteger('clock_skew_seconds')->default(60);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('oauth_settings', function (Blueprint $table) {
+            $table->dropColumn([
+                'custom_label',
+                'scopes',
+                'allow_registration',
+                'require_email_verified',
+                'use_pkce',
+                'clock_skew_seconds',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_06_04_091631_create_oauth_identities_table.php b/database/migrations/2026_06_04_091631_create_oauth_identities_table.php
new file mode 100644
index 0000000000..9f838e5779
--- /dev/null
+++ b/database/migrations/2026_06_04_091631_create_oauth_identities_table.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::create('oauth_identities', function (Blueprint $table) {
+            $table->id();
+            $table->foreignId('user_id')->constrained()->cascadeOnDelete();
+            $table->string('provider');
+            $table->string('issuer');
+            $table->string('provider_user_id');
+            $table->string('email')->nullable()->index();
+            $table->json('raw_claims')->nullable();
+            $table->timestamp('last_login_at')->nullable();
+            $table->timestamps();
+
+            $table->unique(['provider', 'issuer', 'provider_user_id'], 'oauth_identity_provider_issuer_user_unique');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::dropIfExists('oauth_identities');
+    }
+};
diff --git a/database/migrations/2026_06_04_091632_add_oauth_registration_policy_to_instance_settings_table.php b/database/migrations/2026_06_04_091632_add_oauth_registration_policy_to_instance_settings_table.php
new file mode 100644
index 0000000000..06c0f1dd52
--- /dev/null
+++ b/database/migrations/2026_06_04_091632_add_oauth_registration_policy_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('disable_registration_when_oauth_enabled')->default(false);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('disable_registration_when_oauth_enabled');
+        });
+    }
+};
diff --git a/database/migrations/2026_06_23_151229_add_auto_join_root_team_to_oauth_settings_table.php b/database/migrations/2026_06_23_151229_add_auto_join_root_team_to_oauth_settings_table.php
new file mode 100644
index 0000000000..b0f5aad18a
--- /dev/null
+++ b/database/migrations/2026_06_23_151229_add_auto_join_root_team_to_oauth_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('oauth_settings', function (Blueprint $table) {
+            $table->boolean('auto_join_root_team')->default(false);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('oauth_settings', function (Blueprint $table) {
+            $table->dropColumn('auto_join_root_team');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_15_000000_create_integration_tokens_table.php b/database/migrations/2026_08_15_000000_create_integration_tokens_table.php
new file mode 100644
index 0000000000..a17d3972d5
--- /dev/null
+++ b/database/migrations/2026_08_15_000000_create_integration_tokens_table.php
@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('integration_tokens', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->foreignId('team_id')->constrained()->cascadeOnDelete();
+            $table->string('provider');
+            $table->string('name');
+            $table->text('token');
+            $table->json('capabilities');
+            $table->timestamps();
+
+            $table->index(['team_id', 'provider']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('integration_tokens');
+    }
+};
diff --git a/database/migrations/2026_08_20_000000_create_audit_events_table.php b/database/migrations/2026_08_20_000000_create_audit_events_table.php
new file mode 100644
index 0000000000..0ace21f229
--- /dev/null
+++ b/database/migrations/2026_08_20_000000_create_audit_events_table.php
@@ -0,0 +1,45 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('audit_events', function (Blueprint $table): void {
+            $table->id();
+            $table->unsignedBigInteger('team_id')->nullable();
+            $table->string('event');
+            $table->string('source', 32);
+            $table->string('action', 64);
+            $table->string('actor_type', 32);
+            $table->unsignedBigInteger('actor_id')->nullable();
+            $table->string('actor_name')->nullable();
+            $table->string('actor_email')->nullable();
+            $table->unsignedBigInteger('actor_token_id')->nullable();
+            $table->string('actor_token_name')->nullable();
+            $table->string('resource_type')->nullable();
+            $table->string('resource_uuid')->nullable();
+            $table->string('resource_name')->nullable();
+            $table->text('description');
+            $table->json('metadata')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->string('user_agent', 200)->nullable();
+            $table->timestamp('created_at')->useCurrent();
+
+            $table->index('created_at');
+            $table->index(['team_id', 'created_at', 'id']);
+            $table->index(['team_id', 'action', 'created_at', 'id']);
+            $table->index(['team_id', 'source', 'created_at', 'id']);
+            $table->index(['team_id', 'resource_type', 'resource_uuid', 'created_at']);
+            $table->index(['team_id', 'actor_id', 'created_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('audit_events');
+    }
+};
diff --git a/database/migrations/2026_08_23_000000_add_secret_manager_integrations.php b/database/migrations/2026_08_23_000000_add_secret_manager_integrations.php
new file mode 100644
index 0000000000..744697628f
--- /dev/null
+++ b/database/migrations/2026_08_23_000000_add_secret_manager_integrations.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('integration_tokens', function (Blueprint $table) {
+            $table->json('metadata')->nullable()->after('capabilities');
+        });
+
+        Schema::create('secret_manager_links', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->string('resourceable_type');
+            $table->unsignedBigInteger('resourceable_id');
+            $table->foreignId('integration_token_id')->constrained()->cascadeOnDelete();
+            $table->json('settings')->nullable();
+            $table->timestamps();
+
+            $table->unique(['resourceable_type', 'resourceable_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('secret_manager_links');
+
+        Schema::table('integration_tokens', function (Blueprint $table) {
+            $table->dropColumn('metadata');
+        });
+    }
+};
diff --git a/database/seeders/OauthSettingSeeder.php b/database/seeders/OauthSettingSeeder.php
index 2e3e63defd..f916c4a9cd 100644
--- a/database/seeders/OauthSettingSeeder.php
+++ b/database/seeders/OauthSettingSeeder.php
@@ -23,6 +23,7 @@ class OauthSettingSeeder extends Seeder
                 'github',
                 'gitlab',
                 'google',
+                'oidc',
                 'authentik',
                 'infomaniak',
                 'zitadel',
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index 0d13dc18f1..c2762f1d85 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -28,7 +28,7 @@ function normalizeShellArgument(argument) {
 }
 
 export function extractSshArgs(commandString) {
-    const sshCommandMatch = commandString.match(/ssh (.+?) 'bash -se'/);
+    const sshCommandMatch = commandString.match(/ssh (.+?) '[^']+' << /);
     if (!sshCommandMatch) return [];
 
     const argsString = sshCommandMatch[1];
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index 21625eece4..e9acda3270 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -63,6 +63,14 @@ test('extractSshArgs preserves proxy command as a single normalized ssh option v
     assert.equal(sshArgs[4], 'root@example.com');
 });
 
+test('extractSshArgs supports the generated bash or sh fallback command', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o StrictHostKeyChecking=no 'root'@'10.0.0.5' 'if command -v bash >/dev/null 2>&1; then exec bash -se; else exec sh -se; fi' << \\\\$abc\necho hi\nabc"
+    );
+
+    assert.equal(extractTargetHost(sshArgs), '10.0.0.5');
+});
+
 test('isAuthorizedTargetHost matches normalized hosts against plain allowlist values', () => {
     assert.equal(isAuthorizedTargetHost("'10.0.0.5'", ['10.0.0.5']), true);
     assert.equal(isAuthorizedTargetHost('"host.docker.internal"', ['host.docker.internal']), true);
diff --git a/lang/de.json b/lang/de.json
index 7c43300e67..cbc2237a75 100644
--- a/lang/de.json
+++ b/lang/de.json
@@ -7,6 +7,7 @@
     "auth.login.github": "Mit GitHub anmelden",
     "auth.login.gitlab": "Mit GitLab anmelden",
     "auth.login.google": "Mit Google anmelden",
+    "auth.login.oidc": "Mit SSO anmelden",
     "auth.login.infomaniak": "Mit Infomaniak anmelden",
     "auth.login.zitadel": "Mit Zitadel anmelden",
     "auth.already_registered": "Bereits registriert?",
diff --git a/lang/en.json b/lang/en.json
index 12c21b6665..b97a10d629 100644
--- a/lang/en.json
+++ b/lang/en.json
@@ -8,6 +8,7 @@
     "auth.login.github": "Login with GitHub",
     "auth.login.gitlab": "Login with Gitlab",
     "auth.login.google": "Login with Google",
+    "auth.login.oidc": "Login with SSO",
     "auth.login.infomaniak": "Login with Infomaniak",
     "auth.login.zitadel": "Login with Zitadel",
     "auth.already_registered": "Already registered?",
diff --git a/lang/pl.json b/lang/pl.json
index bcd8e23937..b05437ac4e 100644
--- a/lang/pl.json
+++ b/lang/pl.json
@@ -8,6 +8,7 @@
     "auth.login.github": "Zaloguj się przez GitHub",
     "auth.login.gitlab": "Zaloguj się przez Gitlab",
     "auth.login.google": "Zaloguj się przez Google",
+    "auth.login.oidc": "Zaloguj się przez SSO",
     "auth.login.infomaniak": "Zaloguj się przez Infomaniak",
     "auth.login.zitadel": "Zaloguj się przez Zitadel",
     "auth.already_registered": "Już zarejestrowany?",
diff --git a/public/svgs/oidc.svg b/public/svgs/oidc.svg
new file mode 100644
index 0000000000..9c542584ef
--- /dev/null
+++ b/public/svgs/oidc.svg
@@ -0,0 +1,5 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+    <title>OpenID Connect</title>
+    <path fill-rule="evenodd" d="M10 5.5a7.5 7.5 0 1 0 7.5 7.5c0-.9-.16-1.77-.45-2.57l-2.78 1.04c.15.48.23.99.23 1.53a4.5 4.5 0 1 1-4.5-4.5c.54 0 1.05.09 1.53.26l1.05-2.8A7.48 7.48 0 0 0 10 5.5Z" clip-rule="evenodd"/>
+    <path d="M16.5 1 12 5.5h3V10h3V5.5h3L16.5 1Z"/>
+</svg>
diff --git a/resources/css/app.css b/resources/css/app.css
index 199f904d08..b5219badf2 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1870,6 +1870,61 @@ html[data-theme="custom"] textarea:disabled {
     flex-shrink: 0;
 }
 
+.split-action {
+    display: inline-flex;
+}
+
+.split-action-main,
+.split-action-caret {
+    @apply button-highlighted;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.375rem;
+    height: 2rem;
+    font-size: 13px;
+    font-weight: 500;
+    white-space: nowrap;
+    cursor: pointer;
+}
+
+.split-action-main {
+    flex: 1 1 auto;
+    min-width: 0;
+    padding: 0 0.625rem;
+    border-radius: 6px 0 0 6px;
+}
+
+.split-action-caret {
+    flex-shrink: 0;
+    width: 1.75rem;
+    border-left: 1px solid rgba(255, 255, 255, 0.25);
+    border-radius: 0 6px 6px 0;
+}
+
+.split-action > .split-action-main:only-of-type {
+    border-radius: 6px;
+}
+
+.split-action-main:disabled,
+.split-action-caret:disabled {
+    cursor: not-allowed;
+    opacity: 0.45;
+}
+
+.split-action-main:focus-visible,
+.split-action-caret:focus-visible {
+    outline: none;
+    position: relative;
+    z-index: 1;
+    box-shadow: 0 0 0 1px var(--color-accent);
+}
+
+.application-heading-actions .split-action-main,
+.application-heading-actions .split-action-caret {
+    height: 1.75rem;
+}
+
 /* Custom listbox (replaces native <select>) */
 .listbox-trigger {
     display: flex;
diff --git a/resources/js/app.js b/resources/js/app.js
index 11681efa03..9315daa449 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1,3 +1,4 @@
+import { initializeCopyButtonComponent } from './copy-button.js';
 import { initializeTerminalComponent } from './terminal.js';
 import { registerLivewireRequestFailureHandler } from './livewire-request-failure.js';
 
@@ -17,6 +18,7 @@ document.addEventListener('livewire:navigated', () => {
 // Keeping this registration independent from the current route also makes it
 // available before Alpine processes terminal markup after wire:navigate.
 document.addEventListener('alpine:init', initializeTerminalComponent);
+document.addEventListener('alpine:init', initializeCopyButtonComponent);
 
 /**
  * Smooth-scroll a settings section into view, then flash its border for 500ms
diff --git a/resources/js/copy-button.js b/resources/js/copy-button.js
new file mode 100644
index 0000000000..0ce8d5d67d
--- /dev/null
+++ b/resources/js/copy-button.js
@@ -0,0 +1,35 @@
+// Alpine data provider for the <x-copy-button> component (x-data="copyButton").
+export function initializeCopyButtonComponent() {
+    window.Alpine.data('copyButton', () => ({
+        copied: false,
+        async copy(value) {
+            if (value === null || value === undefined) {
+                window.toast('Value is not available.', { type: 'warning' });
+                return;
+            }
+            try {
+                if (navigator.clipboard?.writeText && window.isSecureContext) {
+                    await navigator.clipboard.writeText(value);
+                } else {
+                    // Deprecated, but the only copy path on plain http (non-secure contexts).
+                    const textarea = document.createElement('textarea');
+                    textarea.value = value;
+                    textarea.setAttribute('readonly', '');
+                    textarea.style.position = 'fixed';
+                    textarea.style.left = '-9999px';
+                    document.body.appendChild(textarea);
+                    textarea.select();
+                    const ok = document.execCommand('copy');
+                    document.body.removeChild(textarea);
+                    if (!ok) {
+                        throw new Error('Copy command was rejected.');
+                    }
+                }
+                this.copied = true;
+                setTimeout(() => (this.copied = false), 1200);
+            } catch (e) {
+                window.toast('Could not copy to clipboard.', { type: 'warning' });
+            }
+        },
+    }));
+}
diff --git a/resources/views/auth/login.blade.php b/resources/views/auth/login.blade.php
index 829a26cad3..12eb57867c 100644
--- a/resources/views/auth/login.blade.php
+++ b/resources/views/auth/login.blade.php
@@ -80,11 +80,15 @@
 
             @if ($enabled_oauth_providers->isNotEmpty())
                 <div class="auth-divider"><span>Or continue with</span></div>
-                <div class="grid gap-2 sm:grid-cols-2">
+                <div class="flex flex-col gap-2">
                     @foreach ($enabled_oauth_providers as $provider_setting)
                         <x-forms.button class="w-full justify-center" type="button"
                             onclick="document.location.href='/auth/{{ $provider_setting->provider }}/redirect'">
-                            {{ __("auth.login.$provider_setting->provider") }}
+                            @if ($provider_setting->provider !== 'oidc')
+                                <img class="size-5 shrink-0 dark:invert"
+                                    src="{{ asset('svgs/'.$provider_setting->provider.'.svg') }}" alt="" aria-hidden="true">
+                            @endif
+                            {{ $provider_setting->loginLabel() }}
                         </x-forms.button>
                     @endforeach
                 </div>
diff --git a/resources/views/components/copy-button.blade.php b/resources/views/components/copy-button.blade.php
index dfdceef20b..3333a62bfa 100644
--- a/resources/views/components/copy-button.blade.php
+++ b/resources/views/components/copy-button.blade.php
@@ -1,22 +1,20 @@
 @props([
-    'value',
+    'value' => null,
+    'resolve' => null,
     'label' => 'Copy to clipboard',
 ])
 
-<button type="button"
-    x-data="{ copied: false }"
-    x-on:click.prevent.stop="await window.copyToClipboard({{ Js::from($value) }}); copied = true; setTimeout(() => copied = false, 1000)"
-    {{ $attributes->class('inline-flex size-6 shrink-0 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black disabled:pointer-events-none disabled:opacity-40 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-white') }}
-    title="{{ $label }}" aria-label="{{ $label }}" @disabled(blank($value))>
-    <svg x-show="!copied" class="size-3.5" viewBox="0 0 24 24" fill="none" stroke="currentColor"
-        aria-hidden="true">
-        <path d="M8 8.75H6.5A2.25 2.25 0 0 0 4.25 11v6.5a2.25 2.25 0 0 0 2.25 2.25H13a2.25 2.25 0 0 0 2.25-2.25V16"
-            stroke-width="1.5" stroke-linecap="round" />
-        <rect x="8.75" y="4.25" width="11" height="11" rx="2.25" stroke-width="1.5" />
-    </svg>
-    <svg x-show="copied" x-cloak class="size-3.5 text-green-500" viewBox="0 0 24 24" fill="none"
-        stroke="currentColor" aria-hidden="true">
-        <path d="m6.75 12.25 3.5 3.5 7-7" stroke-width="1.5" stroke-linecap="round"
-            stroke-linejoin="round" />
-    </svg>
+@php
+    $valueExpression = $resolve ?? \Illuminate\Support\Js::from($value);
+@endphp
+
+<button type="button" title="{{ $label }}" aria-label="{{ $label }}"
+    {{ $attributes->class(['icon-button group shrink-0']) }} @disabled($resolve === null && blank($value))
+    x-data="copyButton" @click="copy(await ({{ $valueExpression }}))">
+    <span class="inline-flex transition-transform duration-150 ease-out group-active:scale-75">
+        <x-reicon name="copy" x-show="!copied" class="size-3.5" />
+        <x-reicon name="check" x-cloak x-show="copied" class="size-3.5 text-success"
+            x-transition:enter="transition-transform duration-200 ease-out"
+            x-transition:enter-start="scale-50" x-transition:enter-end="scale-100" />
+    </span>
 </button>
diff --git a/resources/views/components/forms/copy-button.blade.php b/resources/views/components/forms/copy-button.blade.php
deleted file mode 100644
index e299610eb2..0000000000
--- a/resources/views/components/forms/copy-button.blade.php
+++ /dev/null
@@ -1,28 +0,0 @@
-@props(['text', 'label' => null])
-
-<div class="w-full" x-data="{ copied: false }">
-    @if ($label)
-        <label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white">{{ $label }}</label>
-    @endif
-    <div class="relative">
-        <input type="text" value="{{ $text }}"
-            class="input input-with-copy-button bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
-            readonly
-            @keydown.prevent @paste.prevent @cut.prevent @drop.prevent
-            @focus="$event.target.select()">
-        <button
-            type="button"
-            @click.prevent="await window.copyToClipboard({{ Js::from($text) }}); copied = true; setTimeout(() => copied = false, 1000)"
-            class="copy-button flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer text-neutral-500 transition-colors hover:text-black focus-visible:ring-2 focus-visible:ring-coollabs focus-visible:ring-offset-2 dark:text-neutral-400 dark:hover:text-white dark:focus-visible:ring-warning dark:focus-visible:ring-offset-base"
-            title="Copy to clipboard"
-            aria-label="Copy to clipboard">
-            <svg x-show="!copied" class="size-[18px]" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                    d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
-            </svg>
-            <svg x-show="copied" class="size-[18px] text-green-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
-            </svg>
-        </button>
-    </div>
-</div>
diff --git a/resources/views/components/forms/copy-input.blade.php b/resources/views/components/forms/copy-input.blade.php
new file mode 100644
index 0000000000..d31fac0bca
--- /dev/null
+++ b/resources/views/components/forms/copy-input.blade.php
@@ -0,0 +1,15 @@
+@props(['text', 'label' => null])
+
+<div class="w-full">
+    @if ($label)
+        <label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white">{{ $label }}</label>
+    @endif
+    <div class="relative">
+        <input type="text" value="{{ $text }}"
+            class="input input-with-copy-button bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
+            readonly
+            @keydown.prevent @paste.prevent @cut.prevent @drop.prevent
+            @focus="$event.target.select()">
+        <x-copy-button :value="$text" class="absolute top-1/2 right-2 -translate-y-1/2" />
+    </div>
+</div>
diff --git a/resources/views/components/forms/env-var-input.blade.php b/resources/views/components/forms/env-var-input.blade.php
index 378a3947e3..41a29fbbdb 100644
--- a/resources/views/components/forms/env-var-input.blade.php
+++ b/resources/views/components/forms/env-var-input.blade.php
@@ -20,13 +20,32 @@
             cursorPosition: 0,
             currentScope: null,
             availableVars: @js($availableVars),
+            hasVaultSource: @js($hasVaultSource),
+            vaultKeysLoading: false,
             get availableScopes() {
                 // Only include scopes that have at least one variable
                 const allScopes = ['team', 'project', 'environment', 'server'];
-                return allScopes.filter(scope => {
+                const scopes = allScopes.filter(scope => {
                     const vars = this.availableVars[scope];
                     return vars && vars.length > 0;
                 });
+                // The vault scope is offered whenever a secret manager source is
+                // configured; its keys are fetched lazily on first use.
+                if (this.hasVaultSource) {
+                    scopes.push('vault');
+                }
+                return scopes;
+            },
+            loadVaultKeys() {
+                if (this.vaultKeysLoading) return;
+                this.vaultKeysLoading = true;
+                this.$wire.fetchSecretManagerKeys().then(keys => {
+                    this.availableVars['vault'] = keys || [];
+                    this.vaultKeysLoading = false;
+                    this.handleInput();
+                }).catch(() => {
+                    this.vaultKeysLoading = false;
+                });
             },
             scopeUrls: @js($scopeUrls),
 
@@ -84,6 +103,15 @@
                     }
 
                     this.currentScope = scope;
+
+                    // Vault keys are fetched from the secret manager on first use.
+                    if (scope === 'vault' && this.availableVars['vault'] === undefined) {
+                        this.loadVaultKeys();
+                        this.suggestions = [];
+                        this.showDropdown = true;
+                        return;
+                    }
+
                     const scopeVars = this.availableVars[scope] || [];
                     const filtered = scopeVars.filter(v =>
                         v.toLowerCase().includes((partial || '').toLowerCase())
@@ -214,6 +242,7 @@
                 wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]"
             @endif
             wire:loading.attr="disabled"
+            wire:target.except="fetchSecretManagerKeys"
             @disabled($disabled)
             @if ($type !== 'password')
                 type="{{ $type }}"
@@ -236,7 +265,14 @@
         <div x-show="showDropdown" x-cloak x-transition.origin.top
             class="listbox-panel top-full! z-[60]! mt-1! w-full! min-w-0! max-w-full!" role="listbox">
 
-            <template x-if="suggestions.length === 0 && currentScope">
+            <template x-if="suggestions.length === 0 && currentScope === 'vault'">
+                <div class="px-2 py-2 text-sm text-neutral-500 dark:text-fg-dim">
+                    <span x-show="vaultKeysLoading">Loading keys from the secret manager…</span>
+                    <span x-show="!vaultKeysLoading">No matching keys in the secret manager.</span>
+                </div>
+            </template>
+
+            <template x-if="suggestions.length === 0 && currentScope && currentScope !== 'vault'">
                 <div class="px-2 py-2 text-sm text-neutral-500 dark:text-fg-dim">
                     <div>No shared variables found in <span class="font-semibold" x-text="currentScope"></span> scope.</div>
                     <a :href="getScopeUrl(currentScope)"
diff --git a/resources/views/components/forms/input.blade.php b/resources/views/components/forms/input.blade.php
index f49864ddfb..4a94d3e02e 100644
--- a/resources/views/components/forms/input.blade.php
+++ b/resources/views/components/forms/input.blade.php
@@ -37,7 +37,7 @@
                 @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
                 name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
                 aria-placeholder="{{ $attributes->get('placeholder') }}"
-                @if ($autofocus) x-ref="autofocusInput" @endif>
+                @if ($autofocus) x-ref="autofocusInput" autofocus @endif>
             @if ($allowToPeak)
                 <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
                     class="password-toggle flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer text-neutral-500 hover:text-black dark:text-neutral-400 dark:hover:text-white"
@@ -60,7 +60,7 @@
             maxlength="{{ $attributes->get('maxlength') }}"
             @if ($htmlId !== 'null') id={{ $htmlId }} @endif name="{{ $name }}"
             placeholder="{{ $attributes->get('placeholder') }}"
-            @if ($autofocus) x-ref="autofocusInput" @endif>
+            @if ($autofocus) x-ref="autofocusInput" autofocus @endif>
     @endif
     @if (!$label && $helper)
         <x-helper :helper="$helper" />
diff --git a/resources/views/components/modal-confirmation.blade.php b/resources/views/components/modal-confirmation.blade.php
index d63c1953f2..d0778dce4f 100644
--- a/resources/views/components/modal-confirmation.blade.php
+++ b/resources/views/components/modal-confirmation.blade.php
@@ -287,17 +287,8 @@
                                     <div class="relative mb-2" x-data="{ decodedText: confirmationText }">
                                         <div class="relative">
                                             <input type="text" x-model="decodedText" readonly class="input">
-                                            <button x-show="window.isSecureContext"
-                                                @click.prevent="navigator.clipboard.writeText(decodedText); $el.innerHTML = '<svg class=\'w-5 h-5 text-green-500\' fill=\'none\' stroke=\'currentColor\' viewBox=\'0 0 24 24\'><path stroke-linecap=\'round\' stroke-linejoin=\'round\' stroke-width=\'2\' d=\'M5 13l4 4L19 7\' /></svg>'; setTimeout(() => $el.innerHTML = '<svg class=\'w-5 h-5\' fill=\'none\' stroke=\'currentColor\' viewBox=\'0 0 24 24\'><path stroke-linecap=\'round\' stroke-linejoin=\'round\' stroke-width=\'2\' d=\'M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z\' /></svg>', 1000)"
-                                                class="absolute right-2 top-1/2 -translate-y-1/2 p-1.5 text-gray-400 hover:text-gray-300 transition-colors"
-                                                title="Copy to clipboard">
-                                                <svg class="w-5 h-5" fill="none" stroke="currentColor"
-                                                    viewBox="0 0 24 24">
-                                                    <path stroke-linecap="round" stroke-linejoin="round"
-                                                        stroke-width="2"
-                                                        d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
-                                                </svg>
-                                            </button>
+                                            <x-copy-button resolve="decodedText"
+                                                class="absolute top-1/2 right-2 -translate-y-1/2" />
                                         </div>
                                     </div>
 
diff --git a/resources/views/components/page-size-select.blade.php b/resources/views/components/page-size-select.blade.php
index 63bd02da96..5d0f7056be 100644
--- a/resources/views/components/page-size-select.blade.php
+++ b/resources/views/components/page-size-select.blade.php
@@ -3,8 +3,15 @@
     'livewire' => false,
     'options' => [10, 25, 50, 100],
     'storageKey' => null,
+    'canGate' => null,
+    'canResource' => null,
 ])
 
+@php
+    $disabled = $canGate && $canResource
+        && ! Illuminate\Support\Facades\Gate::allows($canGate, $canResource);
+@endphp
+
 <div class="mb-0! flex h-7 items-center gap-1.5 text-[11px] text-neutral-500 dark:text-fg-dim"
     x-data="{
         selectedPageSize: @js((int) $options[0]),
@@ -36,6 +43,7 @@
         <x-table.dropdown panel-class="min-w-24!">
             <x-slot:trigger>
                 <button type="button" aria-label="Items per page" aria-haspopup="listbox" :aria-expanded="open"
+                    @disabled($disabled)
                     class="inline-flex h-7! w-12! items-center justify-between border-0 px-1 text-[11px]! leading-none! tabular-nums text-neutral-500 transition-colors hover:text-black dark:text-fg-dim dark:hover:text-fg">
                     <span x-text="selectedPageSize"></span>
                     <x-reicon name="chevron-down" class="size-3 text-neutral-400 dark:text-fg-faint" />
@@ -43,6 +51,7 @@
             </x-slot:trigger>
             @foreach ($options as $option)
                 <button type="button" class="listbox-option" role="option"
+                    @disabled($disabled)
                     :aria-selected="selectedPageSize === {{ (int) $option }}"
                     x-on:click="applyPageSize({{ (int) $option }})">
                     <span>{{ $option }}</span>
@@ -50,6 +59,7 @@
                 </button>
             @endforeach
             <button type="button" class="listbox-option" role="option"
+                @disabled($disabled)
                 x-on:click="customizingPageSize = true; $nextTick(() => $refs.customPageSize.focus())">
                 Custom…
             </button>
@@ -58,6 +68,6 @@
     <input x-cloak x-show="customizingPageSize" x-ref="customPageSize" x-model.number="customPageSize"
         x-on:keydown.enter.prevent="applyPageSize(customPageSize)" x-on:keydown.escape.prevent="customizingPageSize = false"
         x-on:blur="if (customizingPageSize) applyPageSize(customPageSize)" type="number" min="1" max="100" inputmode="numeric"
-        aria-label="Custom items per page"
+        aria-label="Custom items per page" @disabled($disabled)
         class="mb-0! h-7! w-14! rounded-md! border-neutral-200! bg-transparent! px-1.5! py-0! text-[11px]! tabular-nums shadow-none! focus:border-neutral-300! focus:ring-0! dark:border-white/[0.08]! dark:text-fg-dim!" />
 </div>
diff --git a/resources/views/components/reicon.blade.php b/resources/views/components/reicon.blade.php
index 04471497f5..a46e4194cf 100644
--- a/resources/views/components/reicon.blade.php
+++ b/resources/views/components/reicon.blade.php
@@ -63,6 +63,7 @@
         'upload' => '<path d="M11.4697 3.46967C11.7626 3.17678 12.2374 3.17678 12.5303 3.46967L16.5303 7.46967C16.8232 7.76256 16.8232 8.23744 16.5303 8.53033C16.2374 8.82322 15.7626 8.82322 15.4697 8.53033L12.75 5.81066V14C12.75 14.4142 12.4142 14.75 12 14.75C11.5858 14.75 11.25 14.4142 11.25 14V5.81066L8.53033 8.53033C8.23744 8.82322 7.76256 8.82322 7.46967 8.53033C7.17678 8.23744 7.17678 7.76256 7.46967 7.46967L11.4697 3.46967Z" fill="currentColor"/><path d="M4 14.25C4.41421 14.25 4.75 14.5858 4.75 15V17C4.75 18.5188 5.98122 19.75 7.5 19.75H16.5C18.0188 19.75 19.25 18.5188 19.25 17V15C19.25 14.5858 19.5858 14.25 20 14.25C20.4142 14.25 20.75 14.5858 20.75 15V17C20.75 19.3472 18.8472 21.25 16.5 21.25H7.5C5.15279 21.25 3.25 19.3472 3.25 17V15C3.25 14.5858 3.58579 14.25 4 14.25Z" fill="currentColor"/>',
         'x' => '<path d="M18.4697 19.5303C18.7626 19.8232 19.2374 19.8232 19.5303 19.5303C19.8232 19.2374 19.8232 18.7626 19.5303 18.4697L13.0607 12L19.5303 5.53033C19.8232 5.23744 19.8232 4.76256 19.5303 4.46967C19.2374 4.17678 18.7626 4.17678 18.4697 4.46967L12 10.9393L5.53033 4.46967C5.23744 4.17678 4.76256 4.17678 4.46967 4.46967C4.17678 4.76256 4.17678 5.23744 4.46967 5.53033L10.9393 12L4.46967 18.4697C4.17678 18.7626 4.17678 19.2374 4.46967 19.5303C4.76256 19.8232 5.23744 19.8232 5.53033 19.5303L12 13.0607L18.4697 19.5303Z" fill="currentColor"/>',
         'check' => '<path d="M21.5303 5.46967C21.8232 5.76256 21.8232 6.23744 21.5303 6.53033L9.53033 18.5303C9.23744 18.8232 8.76256 18.8232 8.46967 18.5303L2.46967 12.5303C2.17678 12.2374 2.17678 11.7626 2.46967 11.4697C2.76256 11.1768 3.23744 11.1768 3.53033 11.4697L9 16.9393L20.4697 5.46967C20.7626 5.17678 21.2374 5.17678 21.5303 5.46967Z" fill="currentColor"/>',
+        'copy' => '<path d="M8 8.75H6.5A2.25 2.25 0 0 0 4.25 11v6.5a2.25 2.25 0 0 0 2.25 2.25H13a2.25 2.25 0 0 0 2.25-2.25V16" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><rect x="8.75" y="4.25" width="11" height="11" rx="2.25" stroke="currentColor" stroke-width="1.5"/>',
         'chevron-down' => '<g transform="scale(1.33333)"><polyline points="15.25 6.5 9 12.75 2.75 6.5" fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-width="1.5"></polyline></g>',
         'trash' => '<path fill-rule="evenodd" clip-rule="evenodd" d="M15.0924 1.25H8.90788C7.33861 1.24998 6.08032 1.24996 5.10577 1.38767C4.09802 1.53007 3.25979 1.83575 2.64218 2.55292C2.02457 3.27008 1.84661 4.14438 1.85528 5.1621C1.86366 6.1463 2.05033 7.39066 2.28314 8.94256L3.49937 17.0508C3.67587 18.2275 3.81878 19.1804 4.02849 19.9262C4.24683 20.7027 4.56045 21.3453 5.13662 21.8415C5.71279 22.3377 6.39485 22.5525 7.19513 22.6533C7.96377 22.75 8.92732 22.75 10.1173 22.75H13.883C15.073 22.75 16.0365 22.75 16.8052 22.6533C17.6054 22.5525 18.2875 22.3377 18.8637 21.8415C19.4398 21.3453 19.7535 20.7027 19.9718 19.9262C20.1815 19.1805 20.3244 18.2276 20.5009 17.0509L21.7172 8.94253C21.95 7.39065 22.1366 6.14629 22.145 5.1621C22.1537 4.14438 21.9757 3.27008 21.3581 2.55292C20.7405 1.83575 19.9023 1.53007 18.8945 1.38767C17.92 1.24996 16.6617 1.24998 15.0924 1.25ZM3.77879 3.53175C4.05882 3.20658 4.47927 2.9911 5.31565 2.87292C6.17295 2.75177 7.32479 2.75 8.96727 2.75H15.033C16.6755 2.75 17.8273 2.75177 18.6846 2.87292C19.521 2.9911 19.9415 3.20658 20.2215 3.53175C20.5015 3.85692 20.6523 4.30468 20.6451 5.14933C20.6448 5.18248 20.6443 5.21604 20.6435 5.25H20.5005C20.5003 5.25 20.5007 5.25 20.5005 5.25H7.00045C7.00025 5.25 7.00065 5.25 7.00045 5.25H3.35678C3.35603 5.21603 3.35551 5.18248 3.35522 5.14933C3.34803 4.30468 3.49876 3.85692 3.77879 3.53175ZM5.18949 6.75H3.48546C3.53687 7.15852 3.60161 7.61096 3.67631 8.1155L3.75015 8.18934L5.18949 6.75ZM4.05013 10.6106L4.6686 14.7338L6.37599 12.9365L4.05013 10.6106ZM5.15659 17.9593C5.17275 18.0594 5.18872 18.1563 5.20463 18.25H5.39887L5.15659 17.9593ZM6.99527 19.75C6.99879 19.75 7.00232 19.75 7.00584 19.75H13.9972C13.9991 19.75 14.0009 19.75 14.0027 19.75H18.4577C18.299 20.2287 18.1176 20.5044 17.8848 20.7049C17.6171 20.9355 17.261 21.0841 16.6178 21.165C15.9538 21.2486 15.0849 21.25 13.833 21.25H10.1673C8.91538 21.25 8.04651 21.2486 7.38247 21.165C6.73934 21.0841 6.38321 20.9355 6.11546 20.7049C5.88266 20.5044 5.70127 20.2287 5.54256 19.75H6.99527ZM15.7131 18.25H18.1895L16.9018 16.9623L15.7131 18.25ZM19.0007 16.9399C19.0087 16.8869 19.0168 16.8332 19.0249 16.7788L19.404 14.2515L17.92 15.8592L19.0007 16.9399ZM19.856 11.2381L20.2249 8.77879C20.3197 8.14673 20.4033 7.5881 20.4704 7.09045L18.16 9.40079L19.856 11.2381ZM18.6895 6.75H15.7131L17.1418 8.2977L18.6895 6.75ZM12.2532 6.75H8.81081L10.5761 8.51531L12.2532 6.75ZM11.6895 18.25H9.31081L10.5002 17.0607L11.6895 18.25ZM7.40946 11.8486L4.81081 9.25L7.00015 7.06066L9.54266 9.60317L7.40946 11.8486ZM8.47047 12.9097L10.6037 10.6642L12.6895 12.75L10.5002 14.9393L8.47047 12.9097ZM11.5608 16L13.7502 13.8107L15.8403 15.9008L13.7385 18.1777L11.5608 16ZM14.8108 12.75L16.8585 14.7977L18.9795 12.5L17.0985 10.4623L14.8108 12.75ZM13.7502 11.6893L16.0803 9.35921L13.9923 7.09721L11.6371 9.57632L13.7502 11.6893ZM7.437 13.9975L9.43949 16L7.27782 18.1617L5.50363 16.0326L7.437 13.9975Z" fill="currentColor"/>',
         'external-link' => '<path d="M13 11L21.2 2.80005" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M22 6.8V2H17.2" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/><path d="M11 2H9C4 2 2 4 2 9V15C2 20 4 22 9 22H15C20 22 22 20 22 15V13" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>',
diff --git a/resources/views/components/security/settings-layout.blade.php b/resources/views/components/security/settings-layout.blade.php
index d2b3e30a6f..a17b0b96a6 100644
--- a/resources/views/components/security/settings-layout.blade.php
+++ b/resources/views/components/security/settings-layout.blade.php
@@ -12,6 +12,12 @@
             'active' => request()->routeIs('security.cloud-tokens*'),
             'icon' => 'cloud',
         ] : null,
+        auth()->user()?->can('viewAny', App\Models\IntegrationToken::class) ? [
+            'label' => 'Integration Tokens',
+            'route' => 'security.integration-tokens',
+            'active' => request()->routeIs('security.integration-tokens'),
+            'icon' => 'network',
+        ] : null,
         auth()->user()?->can('viewAny', App\Models\CloudInitScript::class) ? [
             'label' => 'Cloud-Init Scripts',
             'route' => 'security.cloud-init-scripts',
diff --git a/resources/views/components/settings/sidebar.blade.php b/resources/views/components/settings/sidebar.blade.php
index 0e0de551fd..dbe381e050 100644
--- a/resources/views/components/settings/sidebar.blade.php
+++ b/resources/views/components/settings/sidebar.blade.php
@@ -12,6 +12,24 @@
             'active' => $activeMenu === 'advanced',
             'icon' => 'grid',
         ],
+        [
+            'label' => 'Authentication',
+            'route' => 'settings.oauth',
+            'active' => $activeMenu === 'oauth',
+            'icon' => 'keys',
+        ],
+        [
+            'label' => 'Transactional Email',
+            'route' => 'settings.email',
+            'active' => $activeMenu === 'email',
+            'icon' => 'notifications',
+        ],
+        [
+            'label' => 'Instance Backup',
+            'route' => 'settings.backup',
+            'active' => $activeMenu === 'backup',
+            'icon' => 'database',
+        ],
         [
             'label' => 'Updates',
             'route' => 'settings.updates',
diff --git a/resources/views/components/split-action.blade.php b/resources/views/components/split-action.blade.php
new file mode 100644
index 0000000000..c27525166c
--- /dev/null
+++ b/resources/views/components/split-action.blade.php
@@ -0,0 +1,19 @@
+<div {{ $attributes->class(['split-action relative']) }} x-data="{ open: false }"
+    x-effect="$dispatch('resource-actions-toggled', { open })" @click.outside="open = false"
+    @keydown.escape.window="open = false">
+    <button type="button" {{ $main->attributes->class(['split-action-main']) }}>
+        {{ $main }}
+    </button>
+    @if ($slot->hasActualContent())
+        <button type="button" class="split-action-caret" @click="open = !open" :aria-expanded="open"
+            aria-haspopup="menu" aria-label="More actions">
+            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
+                <x-reicon name="chevron-down" class="size-3" />
+            </span>
+        </button>
+        <div x-cloak x-show="open" x-transition.origin.top
+            class="listbox-panel right-0! xl:left-auto! xl:min-w-60! xl:max-w-96!" role="menu">
+            {{ $slot }}
+        </div>
+    @endif
+</div>
diff --git a/resources/views/components/team/settings-layout.blade.php b/resources/views/components/team/settings-layout.blade.php
index e9a5fbd9b0..3b6db03c3a 100644
--- a/resources/views/components/team/settings-layout.blade.php
+++ b/resources/views/components/team/settings-layout.blade.php
@@ -12,6 +12,12 @@
             'active' => request()->routeIs('team.member.index'),
             'icon' => 'teams',
         ],
+        auth()->user()->isAdminOfTeam(currentTeam()->id) ? [
+            'label' => 'Audit log',
+            'route' => 'team.audit-log',
+            'active' => request()->routeIs('team.audit-log'),
+            'icon' => 'time-back',
+        ] : null,
         isInstanceAdmin() ? [
             'label' => 'Admin View',
             'route' => 'team.admin-view',
diff --git a/resources/views/layouts/base.blade.php b/resources/views/layouts/base.blade.php
index a97d8c1df7..82b8cbcbdb 100644
--- a/resources/views/layouts/base.blade.php
+++ b/resources/views/layouts/base.blade.php
@@ -225,30 +225,6 @@
         let checkHealthInterval = null;
         let checkIfIamDeadInterval = null;
 
-        async function copyToClipboard(text) {
-            try {
-                if (navigator.clipboard?.writeText && window.isSecureContext) {
-                    await navigator.clipboard.writeText(text);
-                } else {
-                    const textarea = document.createElement('textarea');
-                    textarea.value = text;
-                    textarea.setAttribute('readonly', '');
-                    textarea.style.position = 'fixed';
-                    textarea.style.left = '-9999px';
-                    document.body.appendChild(textarea);
-                    textarea.select();
-                    const copied = document.execCommand('copy');
-                    document.body.removeChild(textarea);
-                    if (!copied) {
-                        throw new Error('Copy command was rejected.');
-                    }
-                }
-                window.Livewire.dispatch('success', 'Copied to clipboard.');
-            } catch (error) {
-                window.Livewire.dispatch('error', 'Failed to copy to clipboard.');
-            }
-        }
-        window.copyToClipboard = copyToClipboard;
         document.addEventListener('livewire:init', () => {
             window.Livewire.on('reloadWindow', (timeout) => {
                 if (timeout) {
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index 4e6b777093..cc8c094b1e 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -134,15 +134,22 @@
                     <div class="flex items-end gap-2">
                         <x-forms.input id="email" label="Email" readonly />
                         <x-forms.button @click="openEmailModal()" type="button"
-                            x-bind:disabled="emailModalOpen">
+                            :disabled="$uses_sso" x-bind:disabled="emailModalOpen || @js($uses_sso)">
                             Change
                         </x-forms.button>
                     </div>
                 </div>
-            </section>
-        </form>
+             </section>
+         </form>
 
-        <template x-teleport="body">
+         @if ($uses_sso)
+             <x-callout type="info" title="Email managed by SSO">
+                 Signed in with SSO @if ($sso_provider_label) ({{ $sso_provider_label }}) @endif. Email is managed by your SSO provider.
+             </x-callout>
+         @endif
+
+         @if (! $uses_sso)
+         <template x-teleport="body">
             <div x-show="emailModalOpen" x-cloak
                 class="fixed inset-0 z-99 flex h-screen w-screen items-center justify-center p-4">
                 <div class="absolute inset-0 h-full w-full bg-black/55 backdrop-blur-[3px]"></div>
@@ -191,7 +198,8 @@
                     @endif
                 </div>
             </div>
-        </template>
+         </template>
+         @endif
 
         <form wire:submit="resetPassword">
             <section class="application-settings-section">
@@ -241,17 +249,18 @@
                                 </p>
                             </div>
                             <form action="/user/confirmed-two-factor-authentication" method="POST"
-                                class="flex items-end gap-2">
+                                class="flex items-end gap-2"
+                                x-init="$nextTick(() => $el.querySelector('input[name=code]')?.focus())">
                                 @csrf
-                                <x-forms.input type="text" inputmode="numeric" pattern="[0-9]*" id="code"
+                                <x-forms.input name="code" type="text" inputmode="numeric" pattern="[0-9]*" id="code"
                                     label="One-time code" required />
                                 <x-forms.button type="submit">Validate 2FA</x-forms.button>
                             </form>
                             <div x-data="{ showCode: false }">
                                 <div x-cloak x-show="showCode" class="space-y-2 pb-3">
-                                    <x-forms.copy-button
+                                    <x-forms.copy-input
                                         text="{{ decrypt(request()->user()->two_factor_secret) }}" />
-                                    <x-forms.copy-button text="{{ request()->user()->twoFactorQrCodeUrl() }}" />
+                                    <x-forms.copy-input text="{{ request()->user()->twoFactorQrCodeUrl() }}" />
                                 </div>
                                 <x-forms.button type="button" x-on:click="showCode = !showCode">
                                     <span x-text="showCode ? 'Hide manual setup' : 'Show manual setup'"></span>
diff --git a/resources/views/livewire/project/application/configuration.blade.php b/resources/views/livewire/project/application/configuration.blade.php
index 41127287c4..a822e5fb83 100644
--- a/resources/views/livewire/project/application/configuration.blade.php
+++ b/resources/views/livewire/project/application/configuration.blade.php
@@ -20,6 +20,7 @@
                 <livewire:project.application.advanced :application="$application" />
             @elseif ($currentRoute === 'project.application.environment-variables')
                 <livewire:project.shared.environment-variable.all :resource="$application" />
+                <livewire:project.shared.secret-manager-links :resource="$application" />
             @elseif ($currentRoute === 'project.application.persistent-storage')
                 <livewire:project.service.storage :resource="$application" />
             @elseif ($currentRoute === 'project.application.source' && $application->git_based())
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 15181987ce..f01f19ce30 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -43,110 +43,69 @@
         <div class="w-full xl:hidden">
             @if (!($application->build_pack === 'dockercompose' && is_null($application->docker_compose_raw)))
                 @can('deploy', $application)
-                <div id="application-mobile-actions" class="relative mb-3"
-                    x-data="{ open: false }" @click.outside="open = false"
-                    @keydown.escape.window="open = false">
-                    <button type="button" class="button w-full justify-between" @click="open = !open"
-                        :aria-expanded="open" aria-haspopup="menu">
-                        <span class="inline-flex items-center gap-2">
-                            Actions
-                        </span>
-                        <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                            <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                        </span>
-                    </button>
-
-                    <div x-cloak x-show="open" x-transition.origin.top.left
-                        class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
-                        @if (!str($application->status)->startsWith('exited'))
+                    <x-split-action id="application-mobile-actions" class="mb-3 flex w-full">
+                        @if (str($application->status)->startsWith('exited'))
+                            <x-slot:main wire:click="deploy">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
+                            </x-slot:main>
                             @if (!$application->destination->server->isSwarm())
-                                @can('deploy', $application)
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        wire:click="deploy" @click="open = false" role="menuitem">
-                                        <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                        Deploy
-                                    </button>
-                                @else
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                        role="menuitem">
-                                        <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                        Deploy
-                                    </button>
-                                @endcan
-                            @endif
-                            @if ($application->build_pack !== 'dockercompose')
-                                @if ($application->destination->server->isSwarm())
-                                    @can('deploy', $application)
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            wire:click="deploy" @click="open = false" role="menuitem">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Update Service
-                                        </button>
-                                    @else
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                            role="menuitem">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Update Service
-                                        </button>
-                                    @endcan
-                                @else
-                                    @can('deploy', $application)
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
-                                            role="menuitem">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                            Restart
-                                        </button>
-                                    @else
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                            role="menuitem">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                            Restart
-                                        </button>
-                                    @endcan
-                                @endif
-                            @endif
-                        @else
-                            @can('deploy', $application)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    wire:click="deploy" @click="open = false" role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
-                                </button>
-                            @endcan
-                        @endif
-                        @if (!$application->destination->server->isSwarm())
-                            @can('deploy', $application)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    wire:click="{{ $application->status === 'running' ? 'force_deploy_without_cache' : 'deploy(true)' }}"
+                                <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="deploy(true)"
                                     @click="open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                     {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
                                 </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
+                            @endif
+                            @if ($application->container_present !== false)
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()" role="menuitem">
+                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                    Remove container
                                 </button>
-                            @endcan
+                            @endif
+                        @else
+                            @if ($application->destination->server->isSwarm())
+                                @if ($application->build_pack !== 'dockercompose')
+                                    <x-slot:main wire:click="deploy">
+                                        <x-reicon name="refresh" class="size-3.5" />
+                                        Update Service
+                                    </x-slot:main>
+                                @else
+                                    <x-slot:main @click="document.getElementById('application-mobile-stop-trigger')?.click()">
+                                        <x-reicon name="stop-circle" class="size-3.5" />
+                                        Stop
+                                    </x-slot:main>
+                                @endif
+                            @else
+                                <x-slot:main wire:click="deploy">
+                                    <x-reicon name="refresh" class="size-3.5" />
+                                    Redeploy
+                                </x-slot:main>
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    wire:click="{{ str($application->status)->startsWith('running') ? 'force_deploy_without_cache' : 'deploy(true)' }}"
+                                    @click="open = false" role="menuitem">
+                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                    {{ str($application->status)->startsWith('running') ? 'Redeploy (without cache)' : 'Deploy (without cache)' }}
+                                </button>
+                                @if ($application->build_pack !== 'dockercompose')
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
+                                        role="menuitem">
+                                        <x-reicon name="restart" class="size-3.5 opacity-70" />
+                                        Restart
+                                    </button>
+                                @endif
+                            @endif
+                            @unless ($application->destination->server->isSwarm() && $application->build_pack === 'dockercompose')
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
+                                    role="menuitem">
+                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                    Stop
+                                </button>
+                            @endunless
                         @endif
-                        @if (!str($application->status)->startsWith('exited') || $application->container_present !== false)
-                            <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
-                                role="menuitem">
-                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                {{ str($application->status)->startsWith('exited') ? 'Remove container' : 'Stop' }}
-                            </button>
-                        @endif
-                    </div>
-                </div>
+                    </x-split-action>
                 @endcan
             @endif
             <div class="hidden" aria-hidden="true">
@@ -188,108 +147,69 @@
                             <x-applications.links :application="$application" />
                         </div>
                         @can('deploy', $application)
-                        <div id="application-desktop-actions" class="relative" x-data="{ open: false }"
-                            x-effect="$dispatch('resource-actions-toggled', { open })"
-                            @click.outside="open = false" @keydown.escape.window="open = false">
-                            <button type="button" class="button button-highlighted" @click="open = !open" :aria-expanded="open"
-                                aria-haspopup="menu">
-                                Actions
-                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                            </button>
-
-                            <div x-cloak x-show="open" x-transition.origin.top.right
-                                class="listbox-panel top-full! right-0! left-auto! mt-1! w-60! min-w-0!" role="menu">
+                            <x-split-action id="application-desktop-actions">
                                 @if (str($application->status)->startsWith('exited'))
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @disabled(!auth()->user()->can('deploy', $application))
-                                        wire:click="deploy" @click="open = false" role="menuitem">
-                                        <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                    <x-slot:main wire:click="deploy">
+                                        <x-reicon name="play-circle" class="size-3.5" />
                                         {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
-                                    </button>
+                                    </x-slot:main>
                                     @if (!$application->destination->server->isSwarm())
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $application))
-                                            wire:click="deploy(true)" @click="open = false" role="menuitem">
+                                        <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="deploy(true)"
+                                            @click="open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                             {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
                                         </button>
                                     @endif
                                     @if ($application->container_present !== false)
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
-                                            role="menuitem">
+                                            @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()" role="menuitem">
                                             <x-reicon name="stop-circle" class="size-3.5 text-error" />
                                             Remove container
                                         </button>
                                     @endif
                                 @else
-                                    @if (!$application->destination->server->isSwarm())
-                                        @can('deploy', $application)
-                                            <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                wire:click="deploy" @click="open = false" role="menuitem">
-                                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                Redeploy
-                                            </button>
+                                    @if ($application->destination->server->isSwarm())
+                                        @if ($application->build_pack !== 'dockercompose')
+                                            <x-slot:main wire:click="deploy">
+                                                <x-reicon name="refresh" class="size-3.5" />
+                                                Update Service
+                                            </x-slot:main>
                                         @else
-                                            <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                Redeploy
-                                            </button>
-                                        @endcan
+                                            <x-slot:main @click="document.getElementById('application-mobile-stop-trigger')?.click()">
+                                                <x-reicon name="stop-circle" class="size-3.5" />
+                                                Stop
+                                            </x-slot:main>
+                                        @endif
+                                    @else
+                                        <x-slot:main wire:click="deploy">
+                                            <x-reicon name="refresh" class="size-3.5" />
+                                            Redeploy
+                                        </x-slot:main>
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $application))
                                             wire:click="{{ str($application->status)->startsWith('running') ? 'force_deploy_without_cache' : 'deploy(true)' }}"
                                             @click="open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                             {{ str($application->status)->startsWith('running') ? 'Redeploy (without cache)' : 'Deploy (without cache)' }}
                                         </button>
-                                    @endif
-                                    @if ($application->build_pack !== 'dockercompose')
-                                        @if ($application->destination->server->isSwarm())
-                                            @can('deploy', $application)
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                    wire:click="deploy" @click="open = false" role="menuitem">
-                                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                    Update Service
-                                                </button>
-                                            @else
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                    Update Service
-                                                </button>
-                                            @endcan
-                                        @else
-                                            @can('deploy', $application)
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                    @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
-                                                    role="menuitem">
-                                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                                    Restart
-                                                </button>
-                                            @else
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                                    Restart
-                                                </button>
-                                            @endcan
+                                        @if ($application->build_pack !== 'dockercompose')
+                                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                                @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
+                                                role="menuitem">
+                                                <x-reicon name="restart" class="size-3.5 opacity-70" />
+                                                Restart
+                                            </button>
                                         @endif
                                     @endif
-                                    @can('deploy', $application)
+                                    @unless ($application->destination->server->isSwarm() && $application->build_pack === 'dockercompose')
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
                                             @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
                                             role="menuitem">
                                             <x-reicon name="stop-circle" class="size-3.5 text-error" />
                                             Stop
                                         </button>
-                                    @else
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                            <x-reicon name="stop-circle" class="size-3.5 opacity-70" />
-                                            Stop
-                                        </button>
-                                    @endcan
+                                    @endunless
                                 @endif
-                            </div>
-                        </div>
+                            </x-split-action>
                         @endcan
                     @endif
                 </div>
diff --git a/resources/views/livewire/project/application/internal-access.blade.php b/resources/views/livewire/project/application/internal-access.blade.php
index 8ab1442ba5..6997b766b8 100644
--- a/resources/views/livewire/project/application/internal-access.blade.php
+++ b/resources/views/livewire/project/application/internal-access.blade.php
@@ -15,7 +15,7 @@
     <h3 class="mb-4 text-sm font-semibold text-black dark:text-fg">Internal access</h3>
     <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
         @if ($currentInternalHostname)
-            <x-forms.copy-button label="Internal hostname" :text="$currentInternalHostname" />
+            <x-forms.copy-input label="Internal hostname" :text="$currentInternalHostname" />
         @else
             <div class="w-full">
                 <label class="mb-1 flex items-center gap-1 text-sm font-medium text-black dark:text-white">Internal hostname</label>
@@ -25,9 +25,9 @@
                     readonly aria-live="polite">
             </div>
         @endif
-        <x-forms.copy-button label="Docker network" :text="$application->destination->network" />
-        <x-forms.copy-button label="Exposed ports" :text="$exposedPorts ?: 'None'" />
-        <x-forms.copy-button label="Network aliases" :text="$networkAliases->implode(', ') ?: 'None'" />
+        <x-forms.copy-input label="Docker network" :text="$application->destination->network" />
+        <x-forms.copy-input label="Exposed ports" :text="$exposedPorts ?: 'None'" />
+        <x-forms.copy-input label="Network aliases" :text="$networkAliases->implode(', ') ?: 'None'" />
     </div>
     <div class="mt-4 flex flex-col gap-3 border-t border-neutral-200 pt-4 sm:flex-row sm:items-center sm:justify-between dark:border-white/[0.07]">
         <p class="text-sm text-neutral-500 dark:text-fg-dim">
diff --git a/resources/views/livewire/project/database/configuration.blade.php b/resources/views/livewire/project/database/configuration.blade.php
index fb32c18ba4..5f7f4c5797 100644
--- a/resources/views/livewire/project/database/configuration.blade.php
+++ b/resources/views/livewire/project/database/configuration.blade.php
@@ -31,6 +31,7 @@
                     @endif
                 @elseif ($currentRoute === 'project.database.environment-variables')
                     <livewire:project.shared.environment-variable.all :resource="$database" />
+                    <livewire:project.shared.secret-manager-links :resource="$database" />
                 @elseif ($currentRoute === 'project.database.servers')
                     <livewire:project.shared.destination :resource="$database" />
                 @elseif ($currentRoute === 'project.database.persistent-storage')
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index ad1c43889a..2d28510165 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -75,64 +75,24 @@
         <div class="w-full xl:hidden">
             @if ($database->destination->server->isFunctional())
                 @can('manage', $database)
-                <div id="database-mobile-actions" class="relative mb-3"
-                    x-data="{ open: false }" @click.outside="open = false"
-                    @keydown.escape.window="open = false">
-                    <button type="button" class="button w-full justify-between" @click="open = !open"
-                        :aria-expanded="open" aria-haspopup="menu">
-                        <span class="inline-flex items-center gap-2">
-                            Actions
-                        </span>
-                        <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                            <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                        </span>
-                    </button>
-
-                    <div x-cloak x-show="open" x-transition.origin.top.left
-                        class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
+                    <x-split-action id="database-mobile-actions" class="mb-3 flex w-full">
                         @if (! $databaseStatus->startsWith('exited'))
-                            @can('manage', $database)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('database-restart-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart
-                                </button>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('database-stop-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop" class="size-3.5 text-error" />
-                                    Stop
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart
-                                </button>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="stop" class="size-3.5 opacity-70" />
-                                    Stop
-                                </button>
-                            @endcan
+                            <x-slot:main @click="document.getElementById('database-restart-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart
+                            </x-slot:main>
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                @click="open = false; document.getElementById('database-stop-trigger')?.click()" role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop
+                            </button>
                         @else
-                            @can('manage', $database)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; $wire.dispatch('startEvent')" role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Start
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Start
-                                </button>
-                            @endcan
+                            <x-slot:main @click="$wire.dispatch('startEvent')">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                Start
+                            </x-slot:main>
                         @endif
-                    </div>
-                </div>
+                    </x-split-action>
                 @endcan
             @endif
 
@@ -145,25 +105,24 @@
                 <div class="resource-heading-actions flex shrink-0 items-center gap-0.5">
                     @if ($database->destination->server->isFunctional())
                         @can('manage', $database)
-                        <div id="database-desktop-actions" class="flex items-center gap-0.5">
-                            @if (! $databaseStatus->startsWith('exited'))
-                                <button type="button" class="button button-highlighted"
-                                    @disabled(!auth()->user()->can('manage', $database))
-                                    @click="document.getElementById('database-restart-trigger')?.click()">
-                                    Restart
-                                </button>
-                                <button type="button" class="button"
-                                    @disabled(!auth()->user()->can('manage', $database))
-                                    @click="document.getElementById('database-stop-trigger')?.click()">
-                                    Stop
-                                </button>
-                            @else
-                                <x-forms.button class="button-highlighted" canGate="manage" :canResource="$database"
-                                    @click="$wire.dispatch('startEvent')">
-                                    Start
-                                </x-forms.button>
-                            @endif
-                        </div>
+                            <x-split-action id="database-desktop-actions">
+                                @if (! $databaseStatus->startsWith('exited'))
+                                    <x-slot:main @click="document.getElementById('database-restart-trigger')?.click()">
+                                        <x-reicon name="restart" class="size-3.5" />
+                                        Restart
+                                    </x-slot:main>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @click="open = false; document.getElementById('database-stop-trigger')?.click()" role="menuitem">
+                                        <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                        Stop
+                                    </button>
+                                @else
+                                    <x-slot:main @click="$wire.dispatch('startEvent')">
+                                        <x-reicon name="play-circle" class="size-3.5" />
+                                        Start
+                                    </x-slot:main>
+                                @endif
+                            </x-split-action>
                         @endcan
                     @else
                         <x-status-badge status="Server unavailable" type="error" />
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index bb50575353..e3d0e5e24d 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -180,6 +180,7 @@
                     <livewire:project.service.domains :service="$service" />
                 @elseif ($currentRoute === 'project.service.environment-variables')
                     <livewire:project.shared.environment-variable.all :resource="$service" />
+                    <livewire:project.shared.secret-manager-links :resource="$service" />
                 @elseif ($currentRoute === 'project.service.storages')
                     <div class="space-y-6">
                         <div
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 22ce7dab3e..8c6531f3bc 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -72,8 +72,7 @@
                     {{ $service->name }}
                 </h1>
                 <div class="relative flex w-full min-w-0 items-center gap-2">
-                    <x-status-summary :status="$displayStatus" :title="$selectedResource ? 'Resource status' : 'Service status'"
-                        :container-name="$selectedResource ? 'Container' : 'Containers'" />
+                    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
                     <x-services.links :service="$service" compact />
                 </div>
                 <div class="flex w-full flex-wrap gap-1">
@@ -87,92 +86,45 @@
         <div class="w-full xl:hidden">
             @if ($service->isDeployable)
                 @can('deploy', $service)
-                <div id="service-mobile-actions" class="relative mb-3"
-                    x-data="{ open: false }" @click.outside="open = false"
-                    @keydown.escape.window="open = false">
-                    <button type="button" class="button w-full justify-between" x-bind:disabled="deploying"
-                        @click="open = !open"
-                        :aria-expanded="open" aria-haspopup="menu">
-                        <span class="inline-flex items-center gap-2">
-                            <x-loading-on-button x-show="deploying" x-cloak />
-                            <span x-text="deploying ? 'Deploying…' : 'Actions'">Actions</span>
-                        </span>
-                        <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                            <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                        </span>
-                    </button>
-
-                    <div x-cloak x-show="open" x-transition.origin.top.left
-                        class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
+                    <x-split-action id="service-mobile-actions" class="mb-3 flex w-full">
                         @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
-                            <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                @click="open = false; document.getElementById('selected-resource-remove-trigger')?.click()"
-                                role="menuitem">
-                                <x-reicon name="trash" class="size-3.5 text-error" />
+                            <x-slot:main @click="document.getElementById('selected-resource-remove-trigger')?.click()">
+                                <x-reicon name="trash" class="size-3.5" />
                                 Remove container
-                            </button>
+                            </x-slot:main>
                         @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
-                            @can('deploy', $service)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('service-restart-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart current version
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart current version
-                                </button>
-                            @endcan
+                            <x-slot:main x-bind:disabled="deploying"
+                                @click="document.getElementById('service-restart-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart
+                            </x-slot:main>
                             @if ($serviceStatus->contains('running'))
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @disabled(!auth()->user()->can('deploy', $service))
-                                    @click="$wire.dispatch('pullAndRestartEvent'); open = false"
-                                    role="menuitem">
+                                    @click="$wire.dispatch('pullAndRestartEvent'); open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Pull latest and restart
+                                    Restart (pull latest)
                                 </button>
-                            @else
+                            @endif
+                            @if ($serviceStatus->contains('degraded'))
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @disabled(!auth()->user()->can('deploy', $service))
-                                    @click="$wire.dispatch('forceDeployEvent'); open = false"
-                                    role="menuitem">
+                                    @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                     Force Restart
                                 </button>
                             @endif
-                            @can('stop', $service)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('service-stop-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    Stop
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 opacity-70" />
-                                    Stop
-                                </button>
-                            @endcan
-                        @else
-                            @can('deploy', $service)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; deploying = true; $wire.dispatch('startEvent')" role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
-                                </button>
-                            @endcan
                             <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                @disabled(!auth()->user()->can('deploy', $service))
+                                @disabled(!auth()->user()->can('stop', $service))
+                                @click="open = false; document.getElementById('service-stop-trigger')?.click()" role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop
+                            </button>
+                        @else
+                            <x-slot:main x-bind:disabled="deploying" @click="deploying = true; $wire.dispatch('startEvent')">
+                                <x-loading-on-button x-show="deploying" x-cloak />
+                                <x-reicon name="play-circle" class="size-3.5" x-show="!deploying" />
+                                <span x-text="deploying ? 'Deploying…' : 'Deploy'">Deploy</span>
+                            </x-slot:main>
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
                                 @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
                                 <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                 Force Deploy
@@ -184,8 +136,7 @@
                                 Force Cleanup Containers
                             </button>
                         @endif
-                    </div>
-                </div>
+                    </x-split-action>
                 @endcan
             @else
                 @can('deploy', $service)
@@ -225,79 +176,57 @@
                             <x-services.links :service="$service" />
                         </div>
                         @can('deploy', $service)
-                        <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
-                                x-effect="$dispatch('resource-actions-toggled', { open })"
-                                @click.outside="open = false" @keydown.escape.window="open = false">
-                                <button type="button" class="button button-highlighted" @click="open = !open" :aria-expanded="open">
-                                    Actions
-                                    <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                                </button>
-                                <div x-cloak x-show="open" x-transition.origin.top.right
-                                    class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="menu">
-                                    @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <x-split-action id="service-desktop-actions">
+                                @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <x-slot:main @click="document.getElementById('selected-resource-remove-trigger')?.click()">
+                                <x-reicon name="trash" class="size-3.5" />
+                                Remove container
+                            </x-slot:main>
+                        @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                                    <x-slot:main x-bind:disabled="deploying"
+                                        @click="document.getElementById('service-restart-trigger')?.click()">
+                                        <x-reicon name="restart" class="size-3.5" />
+                                        Restart
+                                    </x-slot:main>
+                                    @if ($serviceStatus->contains('running'))
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @click="open = false; document.getElementById('selected-resource-remove-trigger')?.click()"
-                                            role="menuitem">
-                                            <x-reicon name="trash" class="size-3.5 text-error" />
-                                            Remove container
+                                            @click="$wire.dispatch('pullAndRestartEvent'); open = false" role="menuitem">
+                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                            Restart (pull latest)
                                         </button>
-                                    @else
-                                    @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="open = false; document.getElementById('service-restart-trigger')?.click()">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                            Restart
-                                        </button>
-                                        @if ($serviceStatus->contains('running'))
-                                            <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                @disabled(!auth()->user()->can('deploy', $service))
-                                                @click="$wire.dispatch('pullAndRestartEvent'); open = false">
-                                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                Restart (pull latest)
-                                            </button>
-                                        @endif
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('stop', $service))
-                                            @click="open = false; document.getElementById('service-stop-trigger')?.click()">
-                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                            Stop
-                                        </button>
-                                    @elseif (! $serviceStatus->contains('running'))
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="deploying = true; $wire.dispatch('startEvent'); open = false">
-                                            <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                            Deploy
-                                        </button>
-                                    @endif
-                                    @if (! $serviceStatus->contains('running'))
-                                        <div class="my-1 border-t border-coolgray-200 dark:border-coolgray-300" role="separator"></div>
                                     @endif
                                     @if ($serviceStatus->contains('degraded'))
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="$wire.dispatch('forceDeployEvent'); open = false">
+                                            @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                             Force Restart
                                         </button>
-                                    @elseif (! $serviceStatus->contains('running'))
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="$wire.dispatch('forceDeployEvent'); open = false">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Force Deploy
-                                        </button>
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('stop', $service))
-                                            @click="$wire.dispatch('cleanupEvent'); open = false">
-                                            <x-reicon name="trash" class="size-3.5 opacity-70" />
-                                            Force Cleanup Containers
-                                        </button>
                                     @endif
-                                    @endif
-                                </div>
-                        </div>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @disabled(!auth()->user()->can('stop', $service))
+                                        @click="open = false; document.getElementById('service-stop-trigger')?.click()" role="menuitem">
+                                        <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                        Stop
+                                    </button>
+                                @else
+                                    <x-slot:main x-bind:disabled="deploying" @click="deploying = true; $wire.dispatch('startEvent')">
+                                        <x-loading-on-button x-show="deploying" x-cloak />
+                                        <x-reicon name="play-circle" class="size-3.5" x-show="!deploying" />
+                                        <span x-text="deploying ? 'Deploying…' : 'Deploy'">Deploy</span>
+                                    </x-slot:main>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
+                                        <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                        Force Deploy
+                                    </button>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @disabled(!auth()->user()->can('stop', $service))
+                                        @click="$wire.dispatch('cleanupEvent'); open = false" role="menuitem">
+                                        <x-reicon name="trash" class="size-3.5 opacity-70" />
+                                        Force Cleanup Containers
+                                    </button>
+                                @endif
+                            </x-split-action>
                         @endcan
                     @else
                         @can('deploy', $service)
diff --git a/resources/views/livewire/project/service/storage.blade.php b/resources/views/livewire/project/service/storage.blade.php
index e2749aad06..43608188d1 100644
--- a/resources/views/livewire/project/service/storage.blade.php
+++ b/resources/views/livewire/project/service/storage.blade.php
@@ -116,25 +116,9 @@
                                                 <p class="text-[13px] leading-5 text-neutral-500 dark:text-fg-dim">
                                                     Mount a Docker volume inside the container.
                                                 </p>
-                                                @if ($isSwarm)
-                                                    <div class="text-warning">Swarm Mode detected: You need to set a shared
-                                                        volume
-                                                        (EFS/NFS/etc) on all the worker nodes if you would like to use a
-                                                        persistent
-                                                        volumes.</div>
-                                                @endif
                                                 <div class="flex flex-col gap-4">
                                                     <x-forms.input canGate="update" :canResource="$resource" placeholder="pv-name"
                                                         id="name" label="Name" required helper="Volume name." />
-                                                    @if ($isSwarm)
-                                                        <x-forms.input canGate="update" :canResource="$resource"
-                                                            placeholder="/root" id="host_path" label="Source Path" required
-                                                            helper="Directory on the host system." />
-                                                    @else
-                                                        <x-forms.input canGate="update" :canResource="$resource"
-                                                            placeholder="/root" id="host_path" label="Source Path"
-                                                            helper="Directory on the host system." />
-                                                    @endif
                                                     <x-forms.input canGate="update" :canResource="$resource"
                                                         placeholder="/tmp/root" id="mount_path" label="Destination Path"
                                                         required helper="Directory inside the container." />
diff --git a/resources/views/livewire/project/shared/environment-variable/add.blade.php b/resources/views/livewire/project/shared/environment-variable/add.blade.php
index 0b13cccee4..1d10980bd5 100644
--- a/resources/views/livewire/project/shared/environment-variable/add.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/add.blade.php
@@ -14,7 +14,9 @@
         <template x-if="!isMultiline">
             <div wire:key="env-value-input">
                 <x-forms.env-var-input placeholder="production" id="value" label="Value" required
+                    canGate="manageEnvironment" :canResource="$resource"
                     :availableVars="$shared ? [] : $this->availableSharedVariables"
+                    :hasVaultSource="$this->hasSecretManagerSource()"
                     :projectUuid="data_get($parameters, 'project_uuid')"
                     :environmentUuid="data_get($parameters, 'environment_uuid')"
                     :serverUuid="data_get($parameters, 'server_uuid')" />
diff --git a/resources/views/livewire/project/shared/environment-variable/all.blade.php b/resources/views/livewire/project/shared/environment-variable/all.blade.php
index 923514efcc..ae95ef6806 100644
--- a/resources/views/livewire/project/shared/environment-variable/all.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/all.blade.php
@@ -168,7 +168,7 @@
                                 Add
                             </button>
                         </x-slot:content>
-                        <livewire:project.shared.environment-variable.add />
+                        <livewire:project.shared.environment-variable.add :resource="$resource" />
                     </x-modal-input>
                 @endcan
         </x-table.toolbar>
@@ -219,7 +219,8 @@
                             @else
                                 <livewire:project.shared.environment-variable.show-hardcoded
                                     wire:key="{{ $row['id'] }}" :env="$row['environmentVariable']"
-                                    :isPreview="$row['scope'] === 'preview'" :showEnvironmentType="$showEnvironmentType" />
+                                    :isPreview="$row['scope'] === 'preview'" :showEnvironmentType="$showEnvironmentType"
+                                    :resourceableType="get_class($resource)" :resourceableId="$resource->id" />
                             @endif
                             @endforeach
                             </div>
diff --git a/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php b/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php
index 84d03c0fe8..5492d33f90 100644
--- a/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show-hardcoded.blade.php
@@ -28,7 +28,10 @@
         <span class="data-table-cell-dash">-</span>
         <span class="data-table-cell-dash">-</span>
         <span class="data-table-cell-dash">-</span>
-        <div class="justify-self-end">
+        <div class="flex items-center gap-0.5 justify-self-end">
+            @unless (auth()->user()?->isMember() ?? true)
+                <x-copy-button resolve="$wire.copyValue()" label="Copy value" />
+            @endunless
             <x-modal-input title="Environment variable details" :closeOutside="false">
                 <x-slot:content>
                     <button type="button" data-env-settings-trigger class="icon-button shrink-0"
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index a2231ff49c..30ef3f6598 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -83,7 +83,10 @@
                 @endif
             @endforeach
         @endif
-        <div class="justify-self-end">
+        <div class="flex items-center gap-0.5 justify-self-end">
+            @if (! $isLocked && ! $isValueHidden)
+                <x-copy-button resolve="$wire.copyValue()" label="Copy value" />
+            @endif
             {{-- Open modal immediately (Alpine); decrypt value in a follow-up Livewire request. --}}
             <x-modal-input title="Edit environment variable" :closeOutside="false" :wireIgnore="false"
                 wireOpen="editorOpen">
@@ -153,8 +156,10 @@
                                             defaultClass="input input-with-password-toggle" />
                                     @else
                                         <x-forms.env-var-input id="value" type="password"
+                                            canGate="manageEnvironment" :canResource="$this->resource"
                                             :required="$is_redis_credential" :disabled="!$canEditValue"
                                             :availableVars="$isSharedVariable ? [] : $this->availableSharedVariables"
+                                            :hasVaultSource="$this->hasSecretManagerSource()"
                                             :projectUuid="data_get($parameters, 'project_uuid')"
                                             :environmentUuid="data_get($parameters, 'environment_uuid')"
                                             :serverUuid="data_get($parameters, 'server_uuid')" />
diff --git a/resources/views/livewire/project/shared/partials/dns-copy-cell.blade.php b/resources/views/livewire/project/shared/partials/dns-copy-cell.blade.php
index 7394cbd8bd..be1cbf4ca7 100644
--- a/resources/views/livewire/project/shared/partials/dns-copy-cell.blade.php
+++ b/resources/views/livewire/project/shared/partials/dns-copy-cell.blade.php
@@ -2,44 +2,7 @@
     $break = $break ?? false;
     $label = $label ?? 'Copy';
 @endphp
-<div class="flex min-w-0 items-center gap-1.5"
-    x-data="{
-        copied: false,
-        async copy(text) {
-            try {
-                if (navigator.clipboard?.writeText) {
-                    await navigator.clipboard.writeText(text);
-                } else {
-                    const el = document.createElement('textarea');
-                    el.value = text;
-                    el.setAttribute('readonly', '');
-                    el.style.position = 'fixed';
-                    el.style.left = '-9999px';
-                    document.body.appendChild(el);
-                    el.select();
-                    document.execCommand('copy');
-                    document.body.removeChild(el);
-                }
-                this.copied = true;
-                setTimeout(() => this.copied = false, 1000);
-            } catch (e) {
-                console.error('Copy failed', e);
-            }
-        }
-    }">
+<div class="flex min-w-0 items-center gap-1.5">
     <span @class(['min-w-0', 'break-all' => $break])>{{ $text }}</span>
-    <button type="button"
-        @click.prevent.stop="copy(@js($text))"
-        class="inline-flex size-7 shrink-0 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-dim dark:hover:bg-coolgray-200 dark:hover:text-white"
-        title="{{ $label }}"
-        aria-label="{{ $label }}">
-        <svg x-show="!copied" class="size-3.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" aria-hidden="true">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
-                d="M8 16H6a2 2 0 01-2-2V6a2 2 0 012-2h8a2 2 0 012 2v2m-6 12h8a2 2 0 002-2v-8a2 2 0 00-2-2h-8a2 2 0 00-2 2v8a2 2 0 002 2z" />
-        </svg>
-        <svg x-show="copied" x-cloak class="size-3.5 text-green-500" fill="none" stroke="currentColor"
-            viewBox="0 0 24 24" aria-hidden="true">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7" />
-        </svg>
-    </button>
+    <x-copy-button :value="$text" :label="$label" />
 </div>
diff --git a/resources/views/livewire/project/shared/resource-details.blade.php b/resources/views/livewire/project/shared/resource-details.blade.php
index 2e92c73146..1a032f6964 100644
--- a/resources/views/livewire/project/shared/resource-details.blade.php
+++ b/resources/views/livewire/project/shared/resource-details.blade.php
@@ -3,8 +3,8 @@
         <div>
             <h3>Resource</h3>
             <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
-                <x-forms.copy-button label="Name" :text="$resource->name ?? ''" />
-                <x-forms.copy-button label="UUID" :text="$resource->uuid ?? ''" />
+                <x-forms.copy-input label="Name" :text="$resource->name ?? ''" />
+                <x-forms.copy-input label="UUID" :text="$resource->uuid ?? ''" />
             </div>
         </div>
 
@@ -12,8 +12,8 @@
             <div>
                 <h3>Environment</h3>
                 <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
-                    <x-forms.copy-button label="Name" :text="$environment_name ?? ''" />
-                    <x-forms.copy-button label="UUID" :text="$environment_uuid" />
+                    <x-forms.copy-input label="Name" :text="$environment_name ?? ''" />
+                    <x-forms.copy-input label="UUID" :text="$environment_uuid" />
                 </div>
             </div>
         @endif
@@ -22,8 +22,8 @@
             <div>
                 <h3>Project</h3>
                 <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
-                    <x-forms.copy-button label="Name" :text="$project_name ?? ''" />
-                    <x-forms.copy-button label="UUID" :text="$project_uuid" />
+                    <x-forms.copy-input label="Name" :text="$project_name ?? ''" />
+                    <x-forms.copy-input label="UUID" :text="$project_uuid" />
                 </div>
             </div>
         @endif
@@ -32,8 +32,8 @@
             <div>
                 <h3>Server</h3>
                 <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
-                    <x-forms.copy-button label="Name" :text="$server_name ?? ''" />
-                    <x-forms.copy-button label="UUID" :text="$server_uuid" />
+                    <x-forms.copy-input label="Name" :text="$server_name ?? ''" />
+                    <x-forms.copy-input label="UUID" :text="$server_uuid" />
                 </div>
             </div>
         @endif
@@ -43,10 +43,10 @@
                 <h3>Stack Sub-Resources</h3>
                 <div class="pt-2 grid grid-cols-1 gap-3 md:grid-cols-2">
                     @foreach ($stack_applications as $item)
-                        <x-forms.copy-button :label="'Application: ' . $item['name']" :text="$item['uuid']" />
+                        <x-forms.copy-input :label="'Application: ' . $item['name']" :text="$item['uuid']" />
                     @endforeach
                     @foreach ($stack_databases as $item)
-                        <x-forms.copy-button :label="'Database: ' . $item['name']" :text="$item['uuid']" />
+                        <x-forms.copy-input :label="'Database: ' . $item['name']" :text="$item['uuid']" />
                     @endforeach
                 </div>
             </div>
diff --git a/resources/views/livewire/project/shared/secret-manager-links.blade.php b/resources/views/livewire/project/shared/secret-manager-links.blade.php
new file mode 100644
index 0000000000..3fa283c9f8
--- /dev/null
+++ b/resources/views/livewire/project/shared/secret-manager-links.blade.php
@@ -0,0 +1,125 @@
+<div class="mt-8">
+    @php
+        $secretManagerDescription = 'Reference remote secrets in your environment variables with {{vault.KEY}}. Values are fetched at deployment time and are never stored in the Coolify database. Changing the source does not re-check existing references — missing keys fail the next deployment.';
+        $removeSourceWarning = 'Existing {{vault.*}} reference variables will fail the next deployment until they are removed too.';
+    @endphp
+    <x-application.settings-section title="Secret manager" :description="$secretManagerDescription">
+
+        @if (! $link && $availableTokens->isEmpty())
+            <x-empty title="No secret manager tokens"
+                description="Add a Doppler, Infisical, or HashiCorp Vault token under Keys & Tokens > Integration Tokens first."
+                icon-name="keys" size="sm" />
+        @else
+            @can('update', $resource)
+                <div class="application-settings-form flex w-full flex-col gap-4">
+                    <div class="flex items-end gap-2">
+                        <x-forms.listbox id="integration_token_uuid" label="Integration token" :live="true"
+                            placeholder="Select a secret manager token" :options="$availableTokens
+                                ->map(fn ($token) => [
+                                    'value' => $token->uuid,
+                                    'label' => $token->name.' ('.$token->providerName().')',
+                                ])
+                                ->all()" />
+                        @if ($link)
+                            <x-modal-confirmation title="Remove secret manager source?" isErrorButton
+                                buttonTitle="Remove" submitAction="removeSource"
+                                :actions="[$removeSourceWarning]"
+                                :confirmWithText="false" :confirmWithPassword="false"
+                                step1ButtonText="Remove source" />
+                        @endif
+                    </div>
+
+                    @if ($link)
+                        @if ($selectedToken?->provider === 'doppler')
+                            @if ($selectedToken->dopplerTokenType() === 'service_account')
+                                <div class="grid gap-4 lg:grid-cols-2">
+                                    <x-forms.input required id="settings.project" label="Project (required)"
+                                        wire:blur="saveSettings" />
+                                    <x-forms.input required id="settings.config" label="Config (required)" placeholder="prd"
+                                        wire:blur="saveSettings" />
+                                </div>
+                            @else
+                                <p class="text-[12px] text-neutral-500 dark:text-fg-dim">
+                                    Project and config are fixed by this service token.
+                                </p>
+                            @endif
+                        @elseif ($selectedToken?->provider === 'infisical')
+                            <div class="grid gap-4 lg:grid-cols-3">
+                                <x-forms.input required id="settings.project_id" label="Project ID"
+                                    wire:blur="saveSettings" />
+                                <x-forms.input required id="settings.environment" label="Environment slug"
+                                    placeholder="prod" wire:blur="saveSettings" />
+                                <x-forms.input id="settings.secret_path" label="Secret path" placeholder="/"
+                                    wire:blur="saveSettings" />
+                            </div>
+                        @elseif ($selectedToken?->provider === 'vault')
+                            <div class="grid gap-4 lg:grid-cols-2">
+                                <x-forms.input required id="settings.mount" label="KV v2 mount" placeholder="secret"
+                                    wire:blur="saveSettings" />
+                                <x-forms.input required id="settings.path" label="Secret path"
+                                    placeholder="my-app/production" wire:blur="saveSettings" />
+                            </div>
+                        @endif
+
+                        <div class="flex flex-col gap-3">
+                            <div class="flex items-center gap-2">
+                                <x-forms.button wire:click="loadKeys" wire:target="loadKeys">
+                                    {{ $keysLoaded ? 'Reload keys' : 'Browse keys' }}
+                                </x-forms.button>
+                                @if ($keysLoaded)
+                                    <x-forms.button wire:click="importAll" wire:target="importAll" isHighlighted>
+                                        Import all keys
+                                    </x-forms.button>
+                                @endif
+                            </div>
+
+                            @if ($keysLoaded)
+                                @if (count($keys) === 0)
+                                    <div class="text-[12px] text-neutral-500 dark:text-fg-dim">
+                                        No secrets found at this source.
+                                    </div>
+                                @else
+                                    <x-forms.input label="Search keys" placeholder="Filter key names"
+                                        wire:model.live.debounce.300ms="search" />
+                                    <div class="divide-y divide-neutral-200 rounded-lg border border-neutral-200 dark:divide-white/[0.07] dark:border-white/[0.08]">
+                                        @forelse ($filteredKeys as $key)
+                                            <div wire:key="secret-key-{{ $key }}"
+                                                class="flex items-center justify-between gap-3 px-3 py-2">
+                                                <div class="flex min-w-0 flex-col">
+                                                    <span class="font-mono text-[12px] text-black dark:text-fg">{{ $key }}</span>
+                                                    <span class="font-mono text-[11px] text-neutral-400 dark:text-fg-dim">{{ '{{vault.'.$key.'}'.'}' }}</span>
+                                                </div>
+                                                <x-forms.button wire:click="addReference({{ \Illuminate\Support\Js::from($key) }})"
+                                                    wire:target="addReference({{ \Illuminate\Support\Js::from($key) }})">
+                                                    Add as variable
+                                                </x-forms.button>
+                                            </div>
+                                        @empty
+                                            <div class="px-3 py-2 text-[12px] text-neutral-500 dark:text-fg-dim">
+                                                No keys match the search.
+                                            </div>
+                                        @endforelse
+                                    </div>
+                                    <p class="text-[11px] text-neutral-500 dark:text-fg-dim">
+                                        Key names only — values stay in the secret manager. "Add as variable" creates
+                                        <span class="font-mono">KEY={{ '{{vault.KEY}'.'}' }}</span>; you can also paste a reference
+                                        into any variable value, including inside a longer string.
+                                    </p>
+                                @endif
+                            @endif
+                        </div>
+                    @endif
+                </div>
+            @else
+                @if ($link)
+                    <div class="px-1 py-2 text-[13px] text-black dark:text-fg">
+                        {{ $link->integrationToken->providerName() }}
+                        <span class="text-neutral-500 dark:text-fg-dim">
+                            {{ $link->integrationToken->name }} &middot; {{ $link->sourceSummary() }}
+                        </span>
+                    </div>
+                @endif
+            @endcan
+        @endif
+    </x-application.settings-section>
+</div>
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index 98521c8204..a6d207d60c 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -163,7 +163,24 @@
 
                             <div class="volumes-col-source min-w-0">
                                 <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                                <x-forms.input id="forms.{{ $id }}.hostPath" placeholder="Host path (optional)" />
+                                @if (filled($form['hostPath']))
+                                    <div class="flex items-center gap-1.5">
+                                        <div class="min-w-0 flex-1">
+                                            <x-forms.input id="forms.{{ $id }}.hostPath" />
+                                        </div>
+                                        <x-modal-confirmation title="Remove Source Path?" isErrorButton
+                                            canGate="update" :canResource="$resource"
+                                            buttonTitle="Remove" submitAction="clearHostPath({{ $id }})"
+                                            :actions="[
+                                                'Are you sure you want to remove the source path?',
+                                                'The next deployment will use a named Docker volume instead.',
+                                                'Data from the existing host directory will not be copied to the named volume.',
+                                                'Use a Directory Mount when you need to mount a host directory.',
+                                            ]" />
+                                    </div>
+                                @else
+                                    <span class="data-table-cell-dash">-</span>
+                                @endif
                             </div>
 
                             <div class="volumes-cell-dest min-w-0">
diff --git a/resources/views/livewire/project/shared/storages/show.blade.php b/resources/views/livewire/project/shared/storages/show.blade.php
deleted file mode 100644
index 3662568087..0000000000
--- a/resources/views/livewire/project/shared/storages/show.blade.php
+++ /dev/null
@@ -1,156 +0,0 @@
-@php
-    $showActionsColumn = $resource instanceof \App\Models\Application;
-    $gridClass = match (true) {
-        $supportsPreviewSuffix => 'volumes-table-grid-with-pr',
-        $showActionsColumn => 'volumes-table-grid',
-        default => 'volumes-table-grid-readonly',
-    };
-    $canUpdate = auth()->user()?->can('update', $resource) ?? false;
-    $inputsReadonly = $isReadOnly || ! $canUpdate;
-    $displayHostPath = filled($hostPath) ? $hostPath : '—';
-@endphp
-
-@if ($inputsReadonly)
-    {{-- Read-only: plain data-table row (service / compose / no permission) --}}
-    <div class="env-table-item" wire:key="storage-row-{{ $storage->id }}">
-        <div class="data-table-row {{ $gridClass }} text-[13px] text-neutral-700 dark:text-fg-dim">
-            <div class="volumes-cell-name min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Volume Name</span>
-                <div class="flex min-w-0 items-center gap-2">
-                    <span class="min-w-0 truncate text-[13px] font-medium text-neutral-950 dark:text-fg"
-                        title="{{ $name }}">{{ $name }}</span>
-                    @if ($hasEnabledBackup)
-                        @if ($backupUrl)
-                            <a href="{{ $backupUrl }}"
-                                class="table-badge table-badge-success shrink-0 underline-offset-2 hover:underline"
-                                title="Volume backup is enabled">
-                                Backup
-                            </a>
-                        @else
-                            <span class="table-badge table-badge-success shrink-0" title="Volume backup is enabled">
-                                Backup
-                            </span>
-                        @endif
-                    @endif
-                </div>
-            </div>
-
-            <div class="volumes-col-source min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                <span class="block min-w-0 truncate text-[13px]" title="{{ $hostPath }}">
-                    {{ $displayHostPath }}
-                </span>
-            </div>
-
-            <div class="volumes-cell-dest min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Destination Path</span>
-                <span class="block min-w-0 truncate text-[13px] text-neutral-950 dark:text-fg"
-                    title="{{ $mountPath }}">{{ $mountPath }}</span>
-            </div>
-
-            @if ($supportsPreviewSuffix)
-                <div class="volumes-col-pr min-w-0">
-                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                    <span>{{ $isPreviewSuffixEnabled ? 'Add suffix' : 'Share volume' }}</span>
-                </div>
-            @endif
-
-            @if ($showActionsColumn)
-                <div class="volumes-col-actions volumes-cell-actions flex flex-wrap items-center justify-end gap-1.5">
-                    @if ($canUpdate)
-                        @if ($showBackupModal)
-                            <x-modal-input buttonTitle="Backup" title="Configure Volume Backup" :wireIgnore="false"
-                                wireOpen="showBackupModal">
-                                <livewire:project.application.backup.create :application="$resource"
-                                    :selected-target-key="'volume:' . $storage->id"
-                                    wire:key="configure-readonly-volume-backup-{{ $storage->id }}" />
-                            </x-modal-input>
-                        @else
-                            <x-forms.button type="button" wire:click="openBackupModal" class="!px-2.5 !text-xs">
-                                Backup
-                            </x-forms.button>
-                        @endif
-                    @else
-                        <span class="text-neutral-400 dark:text-fg-faint">—</span>
-                    @endif
-                </div>
-            @endif
-        </div>
-    </div>
-@else
-    {{-- Editable volume row --}}
-    <form wire:submit="submit" class="env-table-item" wire:key="storage-row-{{ $storage->id }}">
-        <div class="data-table-row {{ $gridClass }}">
-            <div class="volumes-cell-name min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Volume Name</span>
-                <div class="flex min-w-0 items-center gap-2">
-                    <div class="min-w-0 flex-1">
-                        <x-forms.input id="name" required />
-                    </div>
-                    @if ($hasEnabledBackup)
-                        @if ($backupUrl)
-                            <a href="{{ $backupUrl }}"
-                                class="table-badge table-badge-success shrink-0 underline-offset-2 hover:underline"
-                                title="Volume backup is enabled">
-                                Backup
-                            </a>
-                        @else
-                            <span class="table-badge table-badge-success shrink-0" title="Volume backup is enabled">
-                                Backup
-                            </span>
-                        @endif
-                    @endif
-                </div>
-            </div>
-
-            <div class="volumes-col-source min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                <x-forms.input id="hostPath" placeholder="Host path (optional)" />
-            </div>
-
-            <div class="volumes-cell-dest min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Destination Path</span>
-                <x-forms.input id="mountPath" required placeholder="/path/in/container" />
-            </div>
-
-            @if ($supportsPreviewSuffix)
-                <div class="volumes-col-pr min-w-0">
-                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                    <x-forms.listbox id="isPreviewSuffixEnabled" onChange="instantSave" :options="[
-                        ['value' => true, 'label' => 'Add suffix'],
-                        ['value' => false, 'label' => 'Share volume'],
-                    ]" />
-                </div>
-            @endif
-
-            <div class="volumes-col-actions volumes-cell-actions flex flex-wrap items-center justify-end gap-1.5">
-                <x-forms.button type="submit" class="!px-2.5 !text-xs">
-                    Update
-                </x-forms.button>
-
-                @if ($resource instanceof \App\Models\Application)
-                    @if ($showBackupModal)
-                        <x-modal-input buttonTitle="Backup" title="Configure Volume Backup" :wireIgnore="false"
-                            wireOpen="showBackupModal">
-                            <livewire:project.application.backup.create :application="$resource"
-                                :selected-target-key="'volume:' . $storage->id"
-                                wire:key="configure-volume-backup-{{ $storage->id }}" />
-                        </x-modal-input>
-                    @else
-                        <x-forms.button type="button" wire:click="openBackupModal" class="!px-2.5 !text-xs">
-                            Backup
-                        </x-forms.button>
-                    @endif
-                @endif
-
-                <x-modal-confirmation title="Confirm persistent storage deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete" :actions="[
-                        'The selected persistent storage/volume will be permanently deleted.',
-                        'If the persistent storage/volume is actvily used by a resource data will be lost.',
-                    ]" confirmationText="{{ $storage->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
-                    shortConfirmationLabel="Storage Name" />
-            </div>
-        </div>
-    </form>
-@endif
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
index 784843f6f0..40ea7b7e09 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/executions.blade.php
@@ -71,7 +71,7 @@
                             </span>
 
                             <span class="min-w-0">
-                                <x-forms.copy-button :text="$execution->filename ?? 'No archive name'" />
+                                <x-forms.copy-input :text="$execution->filename ?? 'No archive name'" />
                             </span>
 
                             <span class="text-[11px] text-neutral-500 dark:text-fg-faint">
diff --git a/resources/views/livewire/project/shared/webhooks.blade.php b/resources/views/livewire/project/shared/webhooks.blade.php
index c8c42763fa..6c87e3098d 100644
--- a/resources/views/livewire/project/shared/webhooks.blade.php
+++ b/resources/views/livewire/project/shared/webhooks.blade.php
@@ -39,7 +39,7 @@
                         <x-external-link />
                     </a>
                 </x-slot:actions>
-                <x-forms.copy-button label="Deploy webhook URL" :text="$deploywebhook ?? ''" />
+                <x-forms.copy-input label="Deploy webhook URL" :text="$deploywebhook ?? ''" />
             </x-application.settings-section>
 
             @if ($githubManualWebhook && $gitlabManualWebhook)
@@ -70,7 +70,7 @@
                                         </p>
                                     </div>
                                     <div class="grid gap-4 md:grid-cols-2">
-                                        <x-forms.copy-button label="Webhook URL" :text="$provider['url'] ?? ''" />
+                                        <x-forms.copy-input label="Webhook URL" :text="$provider['url'] ?? ''" />
                                         @can('update', $resource)
                                             <x-forms.input type="password" :id="$provider['secret']"
                                                 label="Webhook secret"
@@ -106,7 +106,7 @@
                         <x-external-link />
                     </a>
                 </x-slot:actions>
-                <x-forms.copy-button label="Deploy webhook URL" :text="$deploywebhook ?? ''" />
+                <x-forms.copy-input label="Deploy webhook URL" :text="$deploywebhook ?? ''" />
             </x-application.settings-section>
         </div>
     @endif
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index acc36f5269..ddffd51094 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -112,7 +112,12 @@
                         <p class="text-sm text-neutral-500 dark:text-fg-dim">
                             This value will not be shown again after you leave this page.
                         </p>
-                        <x-forms.copy-button :text="session('token')" />
+                        <div class="relative">
+                            <input type="text" value="{{ session('token') }}" readonly
+                                class="input w-full pr-12! font-mono text-[12px] text-black dark:text-fg">
+                            <x-copy-button :value="session('token')" label="Copy token"
+                                class="absolute top-1/2 right-2 -translate-y-1/2" />
+                        </div>
                     </div>
                 </x-application.settings-section>
             @endif
diff --git a/resources/views/livewire/security/integration-token-editor.blade.php b/resources/views/livewire/security/integration-token-editor.blade.php
new file mode 100644
index 0000000000..ea06cbbb9b
--- /dev/null
+++ b/resources/views/livewire/security/integration-token-editor.blade.php
@@ -0,0 +1,75 @@
+<div class="w-full">
+    <form class="application-settings-form flex w-full flex-col gap-4" wire:submit="save">
+        <div class="grid gap-4 lg:grid-cols-2">
+            <x-forms.input required id="name" label="Token name" />
+            <x-forms.input readonly label="Provider" value="{{ $integrationToken->providerName() }}" />
+            <div class="lg:col-span-2">
+                <x-forms.input type="password" id="newToken"
+                    label="{{ $integrationToken->provider === 'infisical' ? 'New client secret' : 'New API token' }}"
+                    placeholder="Leave blank to keep the current token"
+                    helper="Paste a replacement token to rotate this credential." />
+            </div>
+        </div>
+
+        @if ($integrationToken->provider === 'infisical')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://app.infisical.com" />
+                <x-forms.input required id="metadata.client_id" label="Client ID" />
+            </div>
+        @elseif ($integrationToken->provider === 'vault')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://vault.example.com:8200" />
+                <x-forms.input id="metadata.namespace" label="Namespace (optional)" />
+            </div>
+        @endif
+
+        @if ($integrationToken->provider === 'cloudflare')
+            <fieldset>
+                <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
+                <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
+                    <x-forms.checkbox id="edit-dns-capability" label="DNS" domValue="dns" fullWidth
+                        wire:model.live="capabilities" />
+                    <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                        Manage Cloudflare DNS records.
+                    </p>
+                </div>
+                @error('capabilities')
+                    <span class="text-xs text-red-500">{{ $message }}</span>
+                @enderror
+            </fieldset>
+        @else
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Capability: Secrets (read-only)</div>
+                <p>Coolify reads secrets from this provider at deployment time. Secret values are never stored in
+                    the Coolify database.</p>
+            </div>
+        @endif
+
+        @if ($integrationToken->provider === 'cloudflare' && in_array('dns', $capabilities, true))
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Required Cloudflare permissions</div>
+                <ul class="list-inside list-disc">
+                    <li>Zone - DNS - Edit</li>
+                    <li>Zone - Zone - Read</li>
+                </ul>
+                <a href="https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management"
+                    target="_blank" rel="noopener noreferrer"
+                    class="font-medium text-coollabs hover:underline dark:text-warning">
+                    Create a replacement token in Cloudflare
+                </a>
+            </div>
+        @endif
+
+        <div class="flex items-center justify-between gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+            <x-modal-confirmation title="Delete integration token?" isErrorButton buttonTitle="Delete"
+                submitAction="delete" :actions="['This integration token will be permanently deleted.']"
+                confirmationText="{{ $integrationToken->name }}" :confirmWithPassword="false"
+                step2ButtonText="Delete token" />
+            <x-forms.button type="submit" wire:target="save" isHighlighted>
+                Validate and save
+            </x-forms.button>
+        </div>
+    </form>
+</div>
diff --git a/resources/views/livewire/security/integration-token-form.blade.php b/resources/views/livewire/security/integration-token-form.blade.php
new file mode 100644
index 0000000000..83d4f17c60
--- /dev/null
+++ b/resources/views/livewire/security/integration-token-form.blade.php
@@ -0,0 +1,102 @@
+<div class="w-full">
+    <form class="application-settings-form flex w-full flex-col gap-4" wire:submit="addToken">
+        <x-forms.listbox required id="provider" label="Provider" :live="true" :options="[
+            ['value' => 'cloudflare', 'label' => 'Cloudflare'],
+            ['value' => 'doppler', 'label' => 'Doppler'],
+            ['value' => 'infisical', 'label' => 'Infisical'],
+            ['value' => 'vault', 'label' => 'HashiCorp Vault'],
+        ]" />
+
+        @if ($provider === 'infisical')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="name" label="Token name" placeholder="Production secrets" />
+                <x-forms.input required id="metadata.client_id" label="Client ID"
+                    placeholder="Machine identity client ID" />
+                <x-forms.input required type="password" id="token" label="Client secret"
+                    placeholder="Paste the machine identity client secret" />
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://app.infisical.com"
+                    helper="Use the URL of your self-hosted Infisical instance, or the Infisical cloud URL." />
+            </div>
+        @else
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="name" label="Token name"
+                    placeholder="{{ $provider === 'cloudflare' ? 'Production DNS' : 'Production secrets' }}" />
+                <x-forms.input required type="password" id="token"
+                    label="{{ $provider === 'vault' ? 'Vault token' : 'API token' }}"
+                    placeholder="Paste the provider token" />
+            </div>
+        @endif
+
+        @if ($provider === 'vault')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://vault.example.com:8200" />
+                <x-forms.input id="metadata.namespace" label="Namespace (optional)"
+                    placeholder="admin/team-a" helper="Only for Vault Enterprise / HCP Vault." />
+            </div>
+        @endif
+
+        @if ($provider === 'cloudflare')
+            <fieldset>
+                <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
+                <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
+                    <x-forms.checkbox id="dns-capability" label="DNS" domValue="dns" fullWidth
+                        wire:model.live="capabilities" />
+                    <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                        Manage Cloudflare DNS records.
+                    </p>
+                </div>
+                @error('capabilities')
+                    <span class="text-xs text-red-500">{{ $message }}</span>
+                @enderror
+            </fieldset>
+        @else
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Capability: Secrets (read-only)</div>
+                <p>Coolify reads secrets from this provider at deployment time and writes them into the generated
+                    <code>.env</code> file. Secret values are never stored in the Coolify database.</p>
+            </div>
+        @endif
+
+        @if ($provider === 'cloudflare' && in_array('dns', $capabilities, true))
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Required Cloudflare permissions</div>
+                <ul class="list-inside list-disc">
+                    <li>Zone - DNS - Edit</li>
+                    <li>Zone - Zone - Read</li>
+                </ul>
+                <p>Limit zone resources to the zones Coolify should manage.</p>
+                <a href="https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management"
+                    target="_blank" rel="noopener noreferrer"
+                    class="font-medium text-coollabs hover:underline dark:text-warning">
+                    Create this token in Cloudflare
+                </a>
+            </div>
+        @elseif ($provider === 'doppler')
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Recommended Doppler token</div>
+                <p>Use a read-only <span class="font-medium">Service Token</span> (dp.st.*). It is pinned to one
+                    project and config. Create it in Doppler under Project &gt; Config &gt; Access.</p>
+            </div>
+        @elseif ($provider === 'infisical')
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Infisical machine identity</div>
+                <p>Create a machine identity with Universal Auth and read access to your project. Paste the client
+                    ID above and the client secret in the secret field.</p>
+            </div>
+        @elseif ($provider === 'vault')
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Vault token</div>
+                <p>Use a token with read access to your KV v2 secrets. Prefer a periodic or long-lived token —
+                    deployments fail when the token expires.</p>
+            </div>
+        @endif
+
+        <div class="flex justify-end border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+            <x-forms.button type="submit" wire:target="addToken" isHighlighted>
+                Validate and add
+            </x-forms.button>
+        </div>
+    </form>
+</div>
diff --git a/resources/views/livewire/security/integration-tokens.blade.php b/resources/views/livewire/security/integration-tokens.blade.php
new file mode 100644
index 0000000000..4ac77ee503
--- /dev/null
+++ b/resources/views/livewire/security/integration-tokens.blade.php
@@ -0,0 +1,84 @@
+<div>
+    <x-slot:title>
+        Integration Tokens | Coolify
+    </x-slot>
+
+    <x-security.settings-layout>
+        <div class="application-settings-form">
+            <x-application.settings-section title="Integration tokens"
+                description="Credentials used by third-party integrations such as DNS providers and secret managers." flush>
+                <x-slot:actions>
+                    @can('create', App\Models\IntegrationToken::class)
+                        <x-modal-input title="New Integration Token">
+                            <x-slot:content>
+                                <button type="button" class="button button-highlighted">
+                                    <x-reicon name="plus" class="size-3.5" />
+                                    New token
+                                </button>
+                            </x-slot:content>
+                            <livewire:security.integration-token-form :modal_mode="true"
+                                wire:key="new-integration-token" />
+                        </x-modal-input>
+                    @endcan
+                </x-slot:actions>
+
+                @if ($tokens->isEmpty())
+                    <x-empty title="No integration tokens"
+                        description="Add a provider token to connect a third-party integration."
+                        icon-name="keys" size="sm" />
+                @else
+                    <div class="divide-y divide-neutral-200 dark:divide-white/[0.07]">
+                        @foreach ($tokens as $savedToken)
+                            <div wire:key="integration-token-{{ $savedToken->id }}"
+                                x-data="{
+                                    visible: true,
+                                    tokenName: @js($savedToken->name),
+                                    tokenCapabilities: @js($savedToken->capabilities),
+                                }"
+                                x-show="visible"
+                                x-on:integration-token-updated.window="
+                                    if ($event.detail.uuid === @js($savedToken->uuid)) {
+                                        tokenName = $event.detail.name;
+                                        tokenCapabilities = $event.detail.capabilities;
+                                    }
+                                "
+                                x-on:integration-token-deleted.window="
+                                    if ($event.detail.uuid === @js($savedToken->uuid)) visible = false
+                                ">
+                            <x-modal-input title="Edit Integration Token" isFullWidth :wireIgnore="false"
+                                :contentClicks="false"
+                                class="border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
+                                <x-slot:content>
+                                    <div class="grid min-h-14 w-full grid-cols-[minmax(0,1fr)_8rem_minmax(0,1fr)_2rem] items-center gap-3 px-4 py-2.5 text-left transition-colors hover:bg-neutral-50 dark:hover:bg-white/[0.025]">
+                                        <div class="min-w-0">
+                                            <h3 class="truncate text-[13px]! font-semibold! text-black dark:text-fg">
+                                                <span x-text="tokenName"></span>
+                                            </h3>
+                                        </div>
+                                        <div class="text-center text-[12px] text-neutral-500 dark:text-fg-dim">
+                                            {{ $savedToken->providerName() }}
+                                        </div>
+                                        <div class="flex flex-wrap gap-1">
+                                            <template x-for="capability in tokenCapabilities" :key="capability">
+                                                <span x-text="capability"
+                                                    class="rounded-full bg-neutral-100 px-2 py-0.5 text-[10px] font-medium uppercase text-neutral-600 dark:bg-white/[0.06] dark:text-fg-dim"></span>
+                                            </template>
+                                        </div>
+                                        <button type="button" class="icon-button" title="Edit integration token"
+                                            :aria-label="`Edit ${tokenName}`" @click="modalOpen=true">
+                                            <x-reicon name="settings" class="size-3.5" />
+                                        </button>
+                                    </div>
+                                </x-slot:content>
+                                <livewire:security.integration-token-editor
+                                    :integration_token_uuid="$savedToken->uuid"
+                                    :key="'integration-token-editor-'.$savedToken->uuid" />
+                            </x-modal-input>
+                            </div>
+                        @endforeach
+                    </div>
+                @endif
+            </x-application.settings-section>
+        </div>
+    </x-security.settings-layout>
+</div>
diff --git a/resources/views/livewire/server/ca-certificate/show.blade.php b/resources/views/livewire/server/ca-certificate/show.blade.php
index 94d2050dc2..2279e62e39 100644
--- a/resources/views/livewire/server/ca-certificate/show.blade.php
+++ b/resources/views/livewire/server/ca-certificate/show.blade.php
@@ -34,7 +34,7 @@
 
                 <div class="mt-4">
                     <p class="mb-1.5 text-xs font-medium text-neutral-500 dark:text-fg-dim">Read-only bind mount</p>
-                    <x-forms.copy-button
+                    <x-forms.copy-input
                         text="- /data/coolify/ssl/coolify-ca.crt:/etc/ssl/certs/coolify-ca.crt:ro" />
                 </div>
             </x-application.settings-section>
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index e75f77b5b4..ac25ca2c1d 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -156,8 +156,17 @@
                     class="min-w-0 truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $server->name }}
                 </h1>
-                <x-server.status-summary :server="$server" :proxy-status="$proxyStatus"
-                    :show-sentinel-status="$showSentinelStatus" />
+                <div class="flex w-full min-w-0 items-center gap-2">
+                    <x-server.status-summary :server="$server" :proxy-status="$proxyStatus"
+                        :show-sentinel-status="$showSentinelStatus" />
+                    @if ($traefikDashboardAvailable)
+                        <a target="_blank" href="http://{{ $serverIp }}:8080" title="Open Traefik dashboard"
+                            class="inline-flex h-6 shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium leading-none text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white">
+                            <x-reicon name="external-link" class="size-3" />
+                            Traefik
+                        </a>
+                    @endif
+                </div>
             </div>
         </div>
 
@@ -165,66 +174,31 @@
         <div class="w-full xl:hidden">
             @if ($server->proxySet())
                 @can('manageProxy', $server)
-                    <div id="server-mobile-actions" class="relative mb-3"
-                        x-data="{ open: false }" @click.outside="open = false"
-                        @keydown.escape.window="open = false">
-                        <button type="button" class="button w-full justify-between" @click="open = !open"
-                            :aria-expanded="open" aria-haspopup="menu">
-                            <span class="inline-flex items-center gap-2">
-                                Actions
-                            </span>
-                            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                            </span>
-                        </button>
-
-                        <div x-cloak x-show="open" x-transition.origin.top.left
-                            class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
-                            @if ($proxyCanBeStopped)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()"
-                                    role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="restart" class="size-3.5 text-orange-500 dark:text-warning" />
-                                    </span>
-                                    Restart Proxy
-                                </button>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
-                                    role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                        <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    </span>
-                                    Stop Proxy
-                                </button>
-                                @if ($traefikDashboardAvailable)
-                                    <a class="listbox-option justify-start! gap-2.5!" target="_blank"
-                                        href="http://{{ $serverIp }}:8080" @click="open = false" role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                        <x-reicon name="external-link" class="size-3! opacity-70" />
-                                        </span>
-                                        Traefik Dashboard
-                                    </a>
-                                @endif
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; $wire.dispatch('checkProxyEvent')" role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="play-circle" class="size-3.5 text-warning" />
-                                    </span>
-                                    Start Proxy
-                                </button>
-                            @endif
+                    <x-split-action id="server-mobile-actions" class="mb-3 flex w-full">
+                        @if ($proxyCanBeStopped)
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
+                                @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart Proxy
+                            </x-slot:main>
                             <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                wire:click="checkProxyStatus" wire:loading.attr="disabled"
-                                @click="open = false" role="menuitem">
-                                <span class="flex size-4 shrink-0 items-center justify-center">
-                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                </span>
-                                Refresh Proxy Status
+                                @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
+                                role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop Proxy
                             </button>
-                        </div>
-                    </div>
+                        @else
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                Start Proxy
+                            </x-slot:main>
+                        @endif
+                        <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
+                            wire:loading.attr="disabled" @click="open = false" role="menuitem">
+                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                            Refresh Proxy Status
+                        </button>
+                    </x-split-action>
 
                     {{-- Programmatic open only (clicked from the Actions menu). Keep fully
                          display:none so the modal shells never reserve a layout row. --}}
@@ -299,66 +273,40 @@
 
                 @if ($server->proxySet())
                     @can('manageProxy', $server)
-                        <div id="server-desktop-actions" class="resource-heading-actions relative shrink-0"
-                            x-data="{ open: false }" x-effect="$dispatch('resource-actions-toggled', { open })"
-                            @click.outside="open = false"
-                            @keydown.escape.window="open = false">
-                            <button type="button" class="button button-highlighted" @click="open = !open" :aria-expanded="open"
-                                aria-haspopup="menu" wire:loading.attr="disabled" wire:loading.class="is-loading"
-                                wire:target="checkProxy,startProxy">
-                                Actions
-                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                            </button>
-
-                            <div x-cloak x-show="open" x-transition.origin.top.right
-                                class="listbox-panel top-full! right-0! left-auto! mt-1! w-60! min-w-0!" role="menu">
-                                @if ($proxyCanBeStopped)
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()"
-                                        role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                        </span>
-                                        Restart Proxy
-                                    </button>
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
-                                        role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                        </span>
-                                        Stop Proxy
-                                    </button>
-                                @else
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @click="open = false; $wire.dispatch('checkProxyEvent')" role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                        </span>
-                                        Start Proxy
-                                    </button>
-                                @endif
-                                <div class="my-1 border-t border-coolgray-200 dark:border-coolgray-300"
-                                    role="separator"></div>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    wire:click="checkProxyStatus" wire:loading.attr="disabled"
-                                    @click="open = false" role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    </span>
-                                    Refresh Proxy Status
-                                </button>
-                                @if ($traefikDashboardAvailable)
-                                    <a class="listbox-option justify-start! gap-2.5!" target="_blank"
-                                        href="http://{{ $serverIp }}:8080" @click="open = false" role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="external-link" class="size-3! opacity-70" />
-                                        </span>
-                                        Traefik Dashboard
-                                    </a>
-                                @endif
+                        @if ($traefikDashboardAvailable)
+                            <div class="resource-heading-menus shrink-0">
+                                <a class="app-tab shrink-0 gap-1" target="_blank" title="Open Traefik dashboard"
+                                    href="http://{{ $serverIp }}:8080">
+                                    <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+                                    Traefik Dashboard
+                                </a>
                             </div>
-                        </div>
+                        @endif
+                        <x-split-action id="server-desktop-actions" class="resource-heading-actions shrink-0">
+                            @if ($proxyCanBeStopped)
+                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
+                                    @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                                    <x-reicon name="restart" class="size-3.5" />
+                                    Restart Proxy
+                                </x-slot:main>
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
+                                    role="menuitem">
+                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                    Stop Proxy
+                                </button>
+                            @else
+                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
+                                    <x-reicon name="play-circle" class="size-3.5" />
+                                    Start Proxy
+                                </x-slot:main>
+                            @endif
+                            <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
+                                wire:loading.attr="disabled" @click="open = false" role="menuitem">
+                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                Refresh Proxy Status
+                            </button>
+                        </x-split-action>
                     @endcan
                 @endif
             </div>
diff --git a/resources/views/livewire/server/security/patches.blade.php b/resources/views/livewire/server/security/patches.blade.php
index d490b6f1db..f1e4fc3f7a 100644
--- a/resources/views/livewire/server/security/patches.blade.php
+++ b/resources/views/livewire/server/security/patches.blade.php
@@ -35,8 +35,8 @@
                 </x-slot:actions>
 
                 <x-callout type="info" title="Supported package managers">
-                    Automated package discovery currently supports apt, dnf, and zypper. Weekly status notifications
-                    can be managed from
+                    Automated package discovery currently supports apk, apt, dnf, pacman, and zypper. Weekly status
+                    notifications can be managed from
                     <a class="font-medium underline" href="{{ route('notifications.email') }}"
                         {{ wireNavigate() }}>notification settings</a>.
                 </x-callout>
diff --git a/resources/views/livewire/settings-oauth.blade.php b/resources/views/livewire/settings-oauth.blade.php
index 97822b9251..822c035b31 100644
--- a/resources/views/livewire/settings-oauth.blade.php
+++ b/resources/views/livewire/settings-oauth.blade.php
@@ -5,76 +5,126 @@
 
     <x-settings.layout>
         <x-slot:submenu>
-        <div
-            x-data="{ activeProvider: location.hash.slice(1).replace('-oauth-section', '') || '{{ $oauth_settings_map[0]['provider'] ?? '' }}' }"
-            @hashchange.window="activeProvider = location.hash.slice(1).replace('-oauth-section', '')">
-            <nav aria-label="OAuth providers"
-                class="grid gap-0.5 py-1">
-                @foreach ($oauth_settings_map as $oauth_setting)
-                    @php
-                        $provider = $oauth_setting['provider'];
-                        $providerLabel = str($provider)->headline();
-                    @endphp
-                    <a href="#{{ $provider }}-oauth-section" class="menu-item min-h-8! py-1! text-[12px]!"
-                        :class="{ 'menu-item-active': activeProvider === '{{ $provider }}' }"
-                        @click.prevent="activeProvider = '{{ $provider }}'; history.replaceState(null, '', '#{{ $provider }}-oauth-section'); window.scrollToSettingsSection?.('{{ $provider }}-oauth-section')">
-                        <span class="menu-item-icon bg-current"
-                            style="mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat;"></span>
-                        <span class="menu-item-label">{{ $providerLabel }}</span>
-                    </a>
-                @endforeach
-            </nav>
-        </div>
+            <div
+                x-data="{ activeProvider: location.hash.slice(1).replace('-oauth-section', '') || @js($selectedProvider ?? array_key_first($oauth_settings_map)) }"
+                @hashchange.window="activeProvider = location.hash.slice(1).replace('-oauth-section', '')">
+                <nav aria-label="OAuth providers" class="grid gap-0.5 py-1">
+                    @foreach ($oauth_settings_map as $provider => $oauth_setting)
+                        <a href="#{{ $provider }}-oauth-section" class="menu-item min-h-8! py-1! text-[12px]!"
+                            :class="{ 'menu-item-active': activeProvider === '{{ $provider }}' }"
+                            @click.prevent="activeProvider = '{{ $provider }}'; history.replaceState(null, '', '#{{ $provider }}-oauth-section'); window.scrollToSettingsSection?.('{{ $provider }}-oauth-section')">
+                            <span class="menu-item-icon bg-current"
+                                style="mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat; -webkit-mask: url('{{ asset('svgs/' . $provider . '.svg') }}') center / contain no-repeat;"></span>
+                            <span class="menu-item-label">{{ $oauth_setting['label'] }}</span>
+                        </a>
+                    @endforeach
+                </nav>
+            </div>
         </x-slot:submenu>
+
         <form wire:submit="submit" class="application-settings-form flex w-full min-w-0 flex-col gap-6">
             <x-unsaved-bar action="submit" />
-            @foreach ($oauth_settings_map as $oauth_setting)
-                @php
-                    $provider = $oauth_setting['provider'];
-                    $providerLabel = str($provider)->headline();
-                @endphp
 
+            <x-application.settings-section title="Registration"
+                description="Control password registration when an OAuth provider is available.">
+                <x-forms.checkbox canGate="update" :canResource="$settings"
+                    id="disable_registration_when_oauth_enabled"
+                    label="Disable password registration when OAuth is enabled"
+                    helper="OAuth providers can still create users when registration is enabled for that provider."
+                    instantSave="saveRegistrationPolicy" />
+            </x-application.settings-section>
+
+            @foreach ($oauth_settings_map as $provider => $oauth_setting)
                 <x-application.settings-section id="{{ $provider }}-oauth-section" class="scroll-mt-28"
-                    title="{{ $providerLabel }}">
+                    title="{{ $oauth_setting['label'] }}">
                     <x-slot:actions>
                         <div x-data="{ enabled: @js((bool) $oauth_setting['enabled']), provider: @js($provider) }">
-                            <x-forms.button type="button" :isHighlighted="!$oauth_setting['enabled']"
+                            <x-forms.button canGate="update" :canResource="$settings" type="button"
+                                :isHighlighted="!$oauth_setting['enabled']"
                                 x-on:click="
-                                if (!enabled) {
-                                    const invalidField = [...$el.closest('section').querySelectorAll('[required]')]
-                                        .find(field => !field.checkValidity());
-                                    if (invalidField) { invalidField.reportValidity(); return; }
-                                }
-                                $wire.toggleProvider(provider);
-                            ">
+                                    if (!enabled) {
+                                        const invalidField = [...$el.closest('section').querySelectorAll('[required]')]
+                                            .find(field => !field.checkValidity());
+                                        if (invalidField) { invalidField.reportValidity(); return; }
+                                    }
+                                    $wire.toggleProvider(provider);
+                                ">
                                 {{ $oauth_setting['enabled'] ? 'Disable' : 'Enable' }}
                             </x-forms.button>
                         </div>
                     </x-slot:actions>
-                    <div class="grid gap-4 lg:grid-cols-2">
-                        <x-forms.input id="oauth_settings_map.{{ $provider }}.redirect_uri"
-                            placeholder="{{ route('auth.callback', $provider) }}" label="Redirect URI" />
 
-                        <x-forms.input id="oauth_settings_map.{{ $provider }}.client_id"
-                            label="Client ID" required />
-                        <x-forms.input id="oauth_settings_map.{{ $provider }}.client_secret"
-                            type="password" label="Client secret" autocomplete="new-password" required />
+                    <div class="grid gap-4 lg:grid-cols-2">
+                        @if ($provider === 'oidc')
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.redirect_uri"
+                                placeholder="{{ route('auth.callback', $provider) }}" label="Redirect URI" />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.base_url" label="Issuer URL" required
+                                helper="OpenID Provider issuer URL, for example https://example.okta.com. Coolify uses it to discover the authorization, token, userinfo, and JWKS endpoints." />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.client_id" label="Client ID" required />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.client_secret" type="password"
+                                label="Client secret" autocomplete="new-password" required />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.scopes" label="Scopes"
+                                helper="Must include openid. Common scopes are openid email profile groups." />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.clock_skew_seconds" type="number"
+                                label="Clock skew (seconds)" />
+                            <div class="lg:col-span-2">
+                                <x-forms.input canGate="update" :canResource="$settings"
+                                    id="oauth_settings_map.{{ $provider }}.custom_label" label="Login button label"
+                                    placeholder="Login with SSO" />
+                            </div>
+                        @else
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.redirect_uri"
+                                placeholder="{{ route('auth.callback', $provider) }}" label="Redirect URI" />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.client_id" label="Client ID" required />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.client_secret" type="password"
+                                label="Client secret" autocomplete="new-password" required />
+                        @endif
 
                         @if ($provider === 'azure')
-                            <x-forms.input id="oauth_settings_map.{{ $provider }}.tenant"
-                                label="Tenant" required />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.tenant" label="Tenant" required />
                         @endif
 
                         @if ($provider === 'google')
-                            <x-forms.input id="oauth_settings_map.{{ $provider }}.tenant"
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.tenant"
                                 helper="Optional hosted domain supplied to Google as a login hint."
                                 label="Hosted domain" />
                         @endif
 
                         @if (in_array($provider, ['authentik', 'clerk', 'zitadel', 'gitlab'], true))
-                            <x-forms.input id="oauth_settings_map.{{ $provider }}.base_url"
-                                label="Base URL" :required="in_array($provider, ['authentik', 'clerk'], true)" />
+                            <x-forms.input canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.base_url" label="Base URL"
+                                :required="in_array($provider, ['authentik', 'clerk'], true)" />
                         @endif
+
+                    </div>
+
+                    <div class="mt-4 grid gap-3 lg:grid-cols-2">
+                        @if ($provider === 'oidc')
+                            <x-forms.checkbox canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.allow_registration"
+                                label="Allow OIDC user creation"
+                                helper="Allow a successful OIDC login to create a user when password registration is disabled." />
+                            <x-forms.checkbox canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.require_email_verified"
+                                label="Require verified email" />
+                            <x-forms.checkbox canGate="update" :canResource="$settings"
+                                id="oauth_settings_map.{{ $provider }}.use_pkce" label="Use PKCE" />
+                        @endif
+                        <x-forms.checkbox canGate="update" :canResource="$settings"
+                            id="oauth_settings_map.{{ $provider }}.auto_join_root_team"
+                            label="Auto-join new users to Root team"
+                            helper="Add newly-created OAuth users to the Root team as members without creating a personal team." />
                     </div>
                 </x-application.settings-section>
             @endforeach
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index 4c11cb41d4..0e6242d572 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -13,12 +13,19 @@
 
             <x-application.settings-section id="access-section" title="Access">
                 <div class="grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="is_registration_enabled" label="Registration"
+                     <x-forms.listbox id="is_registration_enabled" label="Registration"
                         helper="Allow users to create their own account. When disabled, only administrators can create accounts."
                         onChange="instantSave" :options="[
                             ['value' => true, 'label' => 'Anyone can register'],
                             ['value' => false, 'label' => 'Registration disabled'],
-                        ]" />
+                         ]" />
+                     <x-forms.listbox canGate="update" :canResource="$settings"
+                         id="disable_registration_when_oauth_enabled" label="Password registration with OAuth"
+                         helper="Hide password registration whenever at least one OAuth provider is enabled."
+                         onChange="instantSave" :options="[
+                             ['value' => false, 'label' => 'Allow password registration'],
+                             ['value' => true, 'label' => 'Disable when OAuth is enabled'],
+                         ]" />
                     <x-forms.listbox id="disable_two_step_confirmation" label="Destructive action confirmation"
                         helper="Choose whether destructive actions require password and text confirmation."
                         onChange="instantSave" :options="[
diff --git a/resources/views/livewire/team/audit-log.blade.php b/resources/views/livewire/team/audit-log.blade.php
new file mode 100644
index 0000000000..b81de272c5
--- /dev/null
+++ b/resources/views/livewire/team/audit-log.blade.php
@@ -0,0 +1,105 @@
+<div>
+    <x-slot:title>
+        Team Audit Log | Coolify
+    </x-slot>
+
+    <x-team.settings-layout>
+        <div class="application-settings-form">
+            <x-application.settings-section title="Audit log"
+                description="Activity from the last 90 days for the current team." flush>
+                <div
+                    class="flex flex-col gap-2 border-b border-neutral-200 p-3 sm:flex-row sm:items-center dark:border-white/[0.08]">
+                    <div class="relative min-w-0 flex-1 sm:max-w-sm">
+                        <x-reicon name="search"
+                            class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                        <input wire:model.live.debounce.300ms="search" type="search"
+                            placeholder="Search activity" aria-label="Search activity"
+                            class="h-8! w-full rounded-lg! border-neutral-200! bg-white! py-0! pr-8! pl-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint">
+                    </div>
+                    <div class="grid grid-cols-2 gap-2 sm:flex">
+                        <div class="sm:w-36">
+                            <x-forms.listbox id="action" live canGate="viewAdmin" :canResource="currentTeam()"
+                                :options="$actionOptions" />
+                        </div>
+                        <div class="sm:w-36">
+                            <x-forms.listbox id="source" live canGate="viewAdmin" :canResource="currentTeam()" :options="[
+                                ['value' => 'all', 'label' => 'All sources'],
+                                ['value' => 'ui', 'label' => 'Web UI'],
+                                ['value' => 'api', 'label' => 'API'],
+                                ['value' => 'mcp', 'label' => 'MCP'],
+                                ['value' => 'webhook', 'label' => 'Webhook'],
+                            ]" />
+                        </div>
+                    </div>
+                </div>
+
+                @if ($events->isNotEmpty())
+                    <div class="overflow-x-auto">
+                        <div class="data-table transition-opacity" wire:loading.class="opacity-50 pointer-events-none"
+                            wire:target="search,action,source,setPage,previousPage,nextPage">
+                        <div class="grid min-w-[760px] grid-cols-[14rem_minmax(0,1fr)_12rem_9rem] gap-4 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium uppercase tracking-wide text-neutral-500 dark:border-white/[0.07] dark:text-fg-faint">
+                            <span>Actor</span>
+                            <span>Activity</span>
+                            <span>Source</span>
+                            <span class="text-right">Time</span>
+                        </div>
+                        @foreach ($events as $event)
+                            <div wire:key="audit-event-{{ $event->id }}"
+                                class="grid min-w-[760px] grid-cols-[14rem_minmax(0,1fr)_12rem_9rem] gap-4 border-b border-neutral-200 px-4 py-3 last:border-b-0 dark:border-white/[0.07]">
+                                <div class="min-w-0">
+                                    <div class="truncate text-[12px] font-medium text-black dark:text-fg">
+                                        {{ $event->actor_name ?: Str::headline($event->actor_type) }}
+                                    </div>
+                                    @if ($event->actor_email)
+                                        <div class="truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                            {{ $event->actor_email }}
+                                        </div>
+                                    @endif
+                                    @if ($event->actor_token_name)
+                                        <div class="truncate text-[11px] text-neutral-500 dark:text-fg-faint"
+                                            title="Token: {{ $event->actor_token_name }}">
+                                            Token: {{ $event->actor_token_name }}
+                                        </div>
+                                    @endif
+                                </div>
+                                <div class="min-w-0">
+                                    <div class="truncate text-[13px] font-medium text-black dark:text-fg">
+                                        {{ $event->description }}
+                                    </div>
+                                    <div class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                        {{ $event->event }}
+                                    </div>
+                                </div>
+                                <div class="flex items-center gap-2 text-[12px] text-neutral-500 dark:text-fg-dim">
+                                    <span class="rounded-md bg-neutral-100 px-2 py-1 dark:bg-white/[0.06]">
+                                        {{ Str::upper($event->source) }}
+                                    </span>
+                                    <span>{{ Str::headline($event->action) }}</span>
+                                </div>
+                                <time datetime="{{ $event->created_at->toIso8601String() }}"
+                                    title="{{ $event->created_at->toDayDateTimeString() }}"
+                                    class="self-center text-right text-[11px] text-neutral-500 dark:text-fg-faint">
+                                    {{ $event->created_at->diffForHumans() }}
+                                </time>
+                            </div>
+                        @endforeach
+                    </div>
+                    </div>
+
+                    <x-table-pagination :from="$events->firstItem() ?? 0" :to="$events->lastItem() ?? 0"
+                        :total="$events->total()" :current-page="$events->currentPage()"
+                        :last-page="$events->lastPage()" wire-target="setPage,previousPage,nextPage"
+                        previous-action="previousPage" next-action="nextPage">
+                        <x-slot:pageSize>
+                            <x-page-size-select model="perPage" livewire storage-key="coolify.page-size.audit-log"
+                                canGate="viewAdmin" :canResource="currentTeam()" />
+                        </x-slot:pageSize>
+                    </x-table-pagination>
+                @else
+                    <x-empty title="No activity found"
+                        description="Team actions will appear here as they happen." icon-name="time-back" size="sm" />
+                @endif
+            </x-application.settings-section>
+        </div>
+    </x-team.settings-layout>
+</div>
diff --git a/resources/views/livewire/team/invitations.blade.php b/resources/views/livewire/team/invitations.blade.php
index e777ae058e..f9a3f2442e 100644
--- a/resources/views/livewire/team/invitations.blade.php
+++ b/resources/views/livewire/team/invitations.blade.php
@@ -29,14 +29,7 @@
                                     <span
                                         class="min-w-0 truncate font-mono text-[12px] text-neutral-500 dark:text-fg-dim"
                                         title="{{ $invite->link }}">{{ $invite->link }}</span>
-                                    <button type="button"
-                                        class="button h-7! shrink-0 px-2!"
-                                        title="Copy invitation link"
-                                        aria-label="Copy invitation link"
-                                        x-data
-                                        x-on:click.prevent="window.copyToClipboard(@js($invite->link))">
-                                        <x-reicon name="file-content" class="size-3.5" />
-                                    </button>
+                                    <x-copy-button :value="$invite->link" label="Copy invitation link" />
                                 </div>
                                 <div class="text-right">
                                     <button type="button"
diff --git a/routes/api.php b/routes/api.php
index e7ee9d4ec2..177c82f3ce 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -1,6 +1,8 @@
 <?php
 
 use App\Http\Controllers\Api\ApplicationsController;
+use App\Http\Controllers\Api\ApplicationSecretManagerController;
+use App\Http\Controllers\Api\AuditEventsController;
 use App\Http\Controllers\Api\CloudInitScriptsController;
 use App\Http\Controllers\Api\CloudProviderTokensController;
 use App\Http\Controllers\Api\DatabasesController;
@@ -11,6 +13,7 @@ use App\Http\Controllers\Api\GithubController;
 use App\Http\Controllers\Api\GitlabController;
 use App\Http\Controllers\Api\HetznerController;
 use App\Http\Controllers\Api\InstanceEmailSettingsController;
+use App\Http\Controllers\Api\IntegrationTokensController;
 use App\Http\Controllers\Api\NotificationsController;
 use App\Http\Controllers\Api\OtherController;
 use App\Http\Controllers\Api\ProjectController;
@@ -64,6 +67,7 @@ Route::group([
 ], function () {
 
     Route::get('/version', [OtherController::class, 'version'])->middleware(['api.ability:read']);
+    Route::get('/audit-events', [AuditEventsController::class, 'index'])->middleware(['api.ability:read']);
 
     Route::get('/teams', [TeamController::class, 'teams'])->middleware(['api.ability:read']);
     // Token's team
@@ -120,6 +124,7 @@ Route::group([
     Route::get('/security/keys/{uuid}', [SecurityController::class, 'key_by_uuid'])->middleware(['api.ability:read']);
     Route::patch('/security/keys/{uuid}', [SecurityController::class, 'update_key'])->middleware(['api.ability:write']);
     Route::delete('/security/keys/{uuid}', [SecurityController::class, 'delete_key'])->middleware(['api.ability:write']);
+    Route::post('/security/integration-tokens', [IntegrationTokensController::class, 'store'])->middleware(['api.ability:write']);
 
     Route::get('/cloud-tokens', [CloudProviderTokensController::class, 'index'])->middleware(['api.ability:read']);
     Route::post('/cloud-tokens', [CloudProviderTokensController::class, 'store'])->middleware(['api.ability:write']);
@@ -237,6 +242,7 @@ Route::group([
     Route::get('/applications/{uuid}', [ApplicationsController::class, 'application_by_uuid'])->middleware(['api.ability:read']);
     Route::patch('/applications/{uuid}', [ApplicationsController::class, 'update_by_uuid'])->middleware(['api.ability:write']);
     Route::delete('/applications/{uuid}', [ApplicationsController::class, 'delete_by_uuid'])->middleware(['api.ability:write']);
+    Route::patch('/applications/{uuid}/secret-manager', [ApplicationSecretManagerController::class, 'update'])->middleware(['api.ability:write']);
 
     Route::get('/applications/{uuid}/envs', [ApplicationsController::class, 'envs'])->middleware(['api.ability:read']);
     Route::post('/applications/{uuid}/envs', [ApplicationsController::class, 'create_env'])->middleware(['api.ability:write']);
diff --git a/routes/web.php b/routes/web.php
index cdf8161797..be92cde2eb 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -49,6 +49,7 @@ use App\Livewire\Security\CloudInitScript\Show as SecurityCloudInitScriptShow;
 use App\Livewire\Security\CloudInitScripts;
 use App\Livewire\Security\CloudProviderToken\Show as SecurityCloudProviderTokenShow;
 use App\Livewire\Security\CloudTokens;
+use App\Livewire\Security\IntegrationTokens;
 use App\Livewire\Security\PrivateKey\Index as SecurityPrivateKeyIndex;
 use App\Livewire\Security\PrivateKey\Show as SecurityPrivateKeyShow;
 use App\Livewire\Server\Advanced as ServerAdvanced;
@@ -98,6 +99,7 @@ use App\Livewire\Subscription\Index as SubscriptionIndex;
 use App\Livewire\Subscription\Show as SubscriptionShow;
 use App\Livewire\Tags\Show as TagsShow;
 use App\Livewire\Team\AdminView as TeamAdminView;
+use App\Livewire\Team\AuditLog as TeamAuditLog;
 use App\Livewire\Team\DangerZone as TeamDangerZone;
 use App\Livewire\Team\Index as TeamIndex;
 use App\Livewire\Team\Member\Index as TeamMemberIndex;
@@ -168,6 +170,9 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::get('/settings/backup', SettingsBackup::class)->name('settings.backup');
     Route::get('/settings/email', SettingsEmail::class)->name('settings.email');
     Route::get('/settings/oauth', SettingsOauth::class)->name('settings.oauth');
+    Route::get('/settings/oauth/{provider}', SettingsOauth::class)
+        ->where('provider', '[A-Za-z0-9_-]+')
+        ->name('settings.oauth.provider');
     Route::get('/settings/scheduled-jobs', SettingsScheduledJobs::class)->name('settings.scheduled-jobs');
 
     Route::get('/profile', ProfileIndex::class)->name('profile');
@@ -207,6 +212,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::prefix('team')->group(function () {
         Route::get('/', TeamIndex::class)->name('team.index');
         Route::get('/members', TeamMemberIndex::class)->name('team.member.index');
+        Route::get('/audit-log', TeamAuditLog::class)->name('team.audit-log');
         Route::get('/admin', TeamAdminView::class)->name('team.admin-view');
         Route::get('/danger', TeamDangerZone::class)->name('team.danger-zone');
     });
@@ -391,6 +397,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::get('/security/private-key/{private_key_uuid}', SecurityPrivateKeyShow::class)->name('security.private-key.show');
 
     Route::get('/security/cloud-tokens', CloudTokens::class)->name('security.cloud-tokens');
+    Route::get('/security/integration-tokens', IntegrationTokens::class)->name('security.integration-tokens');
     Route::get('/security/cloud-tokens/{cloud_token_uuid}', SecurityCloudProviderTokenShow::class)->name('security.cloud-tokens.show');
     Route::get('/security/cloud-init-scripts', CloudInitScripts::class)->name('security.cloud-init-scripts');
     Route::get('/security/cloud-init-scripts/{cloud_init_script_uuid}', SecurityCloudInitScriptShow::class)->name('security.cloud-init-scripts.show');
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index 3098e52699..c6fc73c60d 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -64,7 +64,7 @@
         "category": "productivity",
         "logo": "svgs/alexandrie.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-07-07T13:24:35+02:00",
+        "template_last_updated_at": "2026-04-05T13:36:24+02:00",
         "port": "8200"
     },
     "anythingllm": {
@@ -1370,7 +1370,7 @@
         "category": "productivity",
         "logo": "svgs/espocrm.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-07-03T15:15:43+03:00",
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "80"
     },
     "evolution-api": {
diff --git a/templates/service-templates.json b/templates/service-templates.json
index 1574f77685..c13c02896d 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -64,7 +64,7 @@
         "category": "productivity",
         "logo": "svgs/alexandrie.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-07-07T13:24:35+02:00",
+        "template_last_updated_at": "2026-04-05T13:36:24+02:00",
         "port": "8200"
     },
     "anythingllm": {
@@ -1370,7 +1370,7 @@
         "category": "productivity",
         "logo": "svgs/espocrm.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-07-03T15:15:43+03:00",
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "80"
     },
     "evolution-api": {
diff --git a/tests/Browser/LoginTest.php b/tests/Browser/LoginTest.php
deleted file mode 100644
index d20e652946..0000000000
--- a/tests/Browser/LoginTest.php
+++ /dev/null
@@ -1,27 +0,0 @@
-<?php
-
-namespace Tests\Browser;
-
-use Laravel\Dusk\Browser;
-use Tests\DuskTestCase;
-use Throwable;
-
-class LoginTest extends DuskTestCase
-{
-    /**
-     * A basic test for the login page.
-     * Login with the test user and assert that the user is redirected to the dashboard.
-     *
-     * @return void
-     *
-     * @throws Throwable
-     */
-    public function test_login()
-    {
-        $this->browse(callback: function (Browser $browser) {
-            $browser->loginWithRootUser()
-                ->assertPathIs('/')
-                ->assertSee('Dashboard');
-        });
-    }
-}
diff --git a/tests/Browser/Project/ProjectAddNewTest.php b/tests/Browser/Project/ProjectAddNewTest.php
deleted file mode 100644
index b03313e4b0..0000000000
--- a/tests/Browser/Project/ProjectAddNewTest.php
+++ /dev/null
@@ -1,34 +0,0 @@
-<?php
-
-namespace Tests\Browser;
-
-use Laravel\Dusk\Browser;
-use Tests\DuskTestCase;
-use Throwable;
-
-class ProjectAddNewTest extends DuskTestCase
-{
-    /**
-     * A basic test for the projects page.
-     * Login with the test user and assert that the user is redirected to the projects page.
-     *
-     * @return void
-     *
-     * @throws Throwable
-     */
-    public function test_login()
-    {
-        $this->browse(function (Browser $browser) {
-            $browser->loginWithRootUser()
-                ->visit('/projects')
-                ->pressAndWaitFor('+ Add', 1)
-                ->assertSee('New Project')
-                ->screenshot('project-add-new-1')
-                ->type('name', 'Test Project')
-                ->screenshot('project-add-new-2')
-                ->press('Continue')
-                ->assertSee('Test Project.')
-                ->screenshot('project-add-new-3');
-        });
-    }
-}
diff --git a/tests/Browser/Project/ProjectSearchTest.php b/tests/Browser/Project/ProjectSearchTest.php
deleted file mode 100644
index 7bc6796d10..0000000000
--- a/tests/Browser/Project/ProjectSearchTest.php
+++ /dev/null
@@ -1,29 +0,0 @@
-<?php
-
-namespace Tests\Browser;
-
-use Laravel\Dusk\Browser;
-use Tests\DuskTestCase;
-use Throwable;
-
-class ProjectSearchTest extends DuskTestCase
-{
-    /**
-     * A basic test for the projects page.
-     * Login with the test user and assert that the user is redirected to the projects page.
-     *
-     * @return void
-     *
-     * @throws Throwable
-     */
-    public function test_login()
-    {
-        $this->browse(function (Browser $browser) {
-            $browser->loginWithRootUser()
-                ->visit('/projects')
-                ->type('[x-model="search"]', 'joi43j4oi32j4o2')
-                ->assertSee('No project found with the search term "joi43j4oi32j4o2".')
-                ->screenshot('project-search-not-found');
-        });
-    }
-}
diff --git a/tests/Browser/Project/ProjectTest.php b/tests/Browser/Project/ProjectTest.php
deleted file mode 100644
index 0d360e4604..0000000000
--- a/tests/Browser/Project/ProjectTest.php
+++ /dev/null
@@ -1,27 +0,0 @@
-<?php
-
-namespace Tests\Browser;
-
-use Laravel\Dusk\Browser;
-use Tests\DuskTestCase;
-use Throwable;
-
-class ProjectTest extends DuskTestCase
-{
-    /**
-     * A basic test for the projects page.
-     * Login with the test user and assert that the user is redirected to the projects page.
-     *
-     * @return void
-     *
-     * @throws Throwable
-     */
-    public function test_login()
-    {
-        $this->browse(function (Browser $browser) {
-            $browser->loginWithRootUser()
-                ->visit('/projects')
-                ->assertSee('Projects');
-        });
-    }
-}
diff --git a/tests/Browser/console/.gitignore b/tests/Browser/console/.gitignore
deleted file mode 100644
index d6b7ef32c8..0000000000
--- a/tests/Browser/console/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*
-!.gitignore
diff --git a/tests/Browser/source/.gitignore b/tests/Browser/source/.gitignore
deleted file mode 100644
index d6b7ef32c8..0000000000
--- a/tests/Browser/source/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-*
-!.gitignore
diff --git a/tests/DuskTestCase.php b/tests/DuskTestCase.php
deleted file mode 100644
index 98e90fa79c..0000000000
--- a/tests/DuskTestCase.php
+++ /dev/null
@@ -1,57 +0,0 @@
-<?php
-
-namespace Tests;
-
-use Facebook\WebDriver\Chrome\ChromeOptions;
-use Facebook\WebDriver\Remote\DesiredCapabilities;
-use Facebook\WebDriver\Remote\RemoteWebDriver;
-use Illuminate\Support\Collection;
-use Laravel\Dusk\TestCase as BaseTestCase;
-
-abstract class DuskTestCase extends BaseTestCase
-{
-    use CreatesApplication;
-
-    /**
-     * Prepare for Dusk test execution.
-     *
-     * @beforeClass
-     */
-    public static function prepare(): void
-    {
-        if (! static::runningInSail()) {
-            static::startChromeDriver();
-        }
-    }
-
-    /**
-     * Create the RemoteWebDriver instance.
-     */
-    protected function driver(): RemoteWebDriver
-    {
-        $options = (new ChromeOptions)->addArguments(collect([
-            $this->shouldStartMaximized() ? '--start-maximized' : '--window-size=1920,1080',
-        ])->unless($this->hasHeadlessDisabled(), function (Collection $items) {
-            return $items->merge([
-                '--disable-gpu',
-                '--headless=new',
-            ]);
-        })->all());
-
-        return RemoteWebDriver::create(
-            'http://localhost:4444',
-            DesiredCapabilities::chrome()->setCapability(
-                ChromeOptions::CAPABILITY,
-                $options
-            )
-        );
-    }
-
-    /**
-     * Determine if the browser window should start maximized.
-     */
-    protected function baseUrl()
-    {
-        return 'http://localhost:8000';
-    }
-}
diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
index 87b3407cb5..afec2fe9fb 100644
--- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
@@ -16,6 +16,68 @@ use Symfony\Component\Process\Process;
 
 uses(RefreshDatabase::class);
 
+it('does not persist environment write commands or generated Dockerfiles in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_SECRET',
+        'value' => 'sensitive-value',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'configuration_dir' => '/data/coolify/applications/test-app',
+        'remote_secrets_cache' => [],
+        'saved_outputs' => [
+            'dockerfile' => "FROM php:8.4-cli\nRUN php -v",
+        ],
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'save_runtime_environment_variables');
+    invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+    invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
+
+    $writeCommands = collect($job->recordedCommands)
+        ->flatMap(fn (array $commands): array => $commands)
+        ->filter(function (mixed $command): bool {
+            if (! is_array($command)) {
+                return false;
+            }
+
+            $commandString = $command['command'] ?? $command[0] ?? null;
+
+            return is_string($commandString) && str_contains($commandString, 'base64 -d | tee');
+        })
+        ->values();
+
+    expect($writeCommands)->toHaveCount(4)
+        ->each->toHaveKey('skip_command_log', true);
+});
+
+it('redacts resolved remote secrets from command output', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'remote_secrets_cache' => ['API_TOKEN' => 'remote-secret-value'],
+    ]);
+
+    expect(invokeDeploymentJobMethod($job, $reflection, 'redact_sensitive_info', 'token=remote-secret-value'))
+        ->toBe('token='.REDACTED);
+});
+
+it('ignores empty and non-string remote secrets when redacting command output', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'remote_secrets_cache' => [
+            'EMPTY_SECRET' => '',
+            'NULL_SECRET' => null,
+            'NUMERIC_SECRET' => 123,
+            'API_TOKEN' => 'remote-secret-value',
+        ],
+    ]);
+
+    expect(invokeDeploymentJobMethod($job, $reflection, 'redact_sensitive_info', 'id=123 token=remote-secret-value'))
+        ->toBe('id=123 token='.REDACTED);
+});
+
 class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
 {
     public array $recordedCommands = [];
@@ -756,10 +818,50 @@ it('filters buildpack control vars from dockerfile arg injection', function () {
     invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
 
     expect($job->writtenDockerfile)->toContain('ARG APP_ENV=production');
+    expect($job->writtenDockerfile)->toContain('ARG COOLIFY_BUILD_SECRETS_HASH=');
     expect($job->writtenDockerfile)->not->toContain('ARG NIXPACKS_NODE_VERSION=');
     expect($job->writtenDockerfile)->not->toContain('ARG RAILPACK_NODE_VERSION=');
 });
 
+it('injects raw escaped remote secrets into Dockerfile args and hashes the same values', function (int $pullRequestId, bool $isPreview) {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SECRET_TOKEN',
+        'value' => '{{vault.API_TOKEN}}',
+        'is_preview' => $isPreview,
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+
+    $secret = "secret\$value'quoted";
+    $escapedSecret = escapeBashEnvValue($secret);
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'pull_request_id' => $pullRequestId,
+        'remote_secrets_cache' => ['API_TOKEN' => $secret],
+        'saved_outputs' => [
+            'dockerfile' => "FROM php:8.4-cli\nRUN php -v",
+        ],
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
+
+    $expectedHash = invokeDeploymentJobMethod(
+        $job,
+        $reflection,
+        'generate_secrets_hash',
+        collect(['SECRET_TOKEN' => $escapedSecret]),
+    );
+
+    expect($job->writtenDockerfile)
+        ->toContain("ARG SECRET_TOKEN={$escapedSecret}")
+        ->toContain("ARG COOLIFY_BUILD_SECRETS_HASH={$expectedHash}")
+        ->not->toContain('$$');
+})->with([
+    'production' => [0, false],
+    'preview' => [99, true],
+]);
+
 it('builds railpack variables from generic buildtime vars railpack vars and coolify vars only', function () {
     [$application, $server] = makeDeploymentControlVarFixture([
         'build_pack' => 'railpack',
diff --git a/tests/Feature/AuditEventsTest.php b/tests/Feature/AuditEventsTest.php
new file mode 100644
index 0000000000..703e70750e
--- /dev/null
+++ b/tests/Feature/AuditEventsTest.php
@@ -0,0 +1,1008 @@
+<?php
+
+use App\Http\Kernel;
+use App\Livewire\Project\Service\Heading;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
+use App\Livewire\Team\AuditLog;
+use App\Livewire\Team\Index as TeamIndex;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\AuditEvent;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use App\Traits\Auditable;
+use Illuminate\Database\QueryException;
+use Illuminate\Foundation\Http\Middleware\InvokeDeferredCallbacks;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    Log::spy();
+});
+
+test('audit inserts are deferred until after the response', function () {
+    $this->withDefer();
+
+    auditLog('ui.project.updated', [
+        'team_id' => $this->team->id,
+        'project_uuid' => 'project-123',
+        'project_name' => 'Website',
+    ]);
+
+    expect(AuditEvent::query()->count())->toBe(0);
+
+    defer()->invoke();
+
+    expect(AuditEvent::query()->count())->toBe(1);
+});
+
+test('multiple audit inserts in one request are all deferred', function () {
+    $this->withDefer();
+
+    auditLog('ui.application.deployed', [
+        'team_id' => $this->team->id,
+        'application_uuid' => 'app-123',
+    ]);
+    auditLog('ui.application.updated', [
+        'team_id' => $this->team->id,
+        'application_uuid' => 'app-123',
+    ]);
+
+    defer()->invoke();
+
+    expect(AuditEvent::query()->pluck('event')->all())->toBe([
+        'ui.application.deployed',
+        'ui.application.updated',
+    ]);
+});
+
+test('http kernel invokes deferred callbacks', function () {
+    $kernel = app(Kernel::class);
+    $middleware = (new ReflectionClass($kernel))->getProperty('middleware')->getValue($kernel);
+
+    expect($middleware)->toContain(InvokeDeferredCallbacks::class);
+});
+
+test('audit persistence failures do not fail the action', function () {
+    Schema::rename('audit_events', 'unavailable_audit_events');
+
+    try {
+        expect(fn () => auditLog('ui.project.updated', ['team_id' => $this->team->id]))
+            ->not->toThrow(Throwable::class);
+
+        Log::shouldHaveReceived('warning')->once()->with(
+            'Audit event persistence failed',
+            Mockery::on(fn (array $context): bool => $context === [
+                'event' => 'ui.project.updated',
+                'exception' => QueryException::class,
+            ]),
+        );
+    } finally {
+        Schema::rename('unavailable_audit_events', 'audit_events');
+    }
+});
+
+test('audit preparation failures log sanitized diagnostics without failing the action', function () {
+    $resourceName = new class
+    {
+        public function __toString(): string
+        {
+            throw new RuntimeException('sensitive audit metadata');
+        }
+    };
+
+    expect(fn () => auditLog('ui.project.updated', [
+        'team_id' => $this->team->id,
+        'project_name' => $resourceName,
+        'secret' => 'must not be logged',
+    ]))->not->toThrow(Throwable::class);
+
+    Log::shouldHaveReceived('warning')->once()->with(
+        'Audit event preparation failed',
+        Mockery::on(fn (array $context): bool => $context === [
+            'event' => 'ui.project.updated',
+            'exception' => RuntimeException::class,
+        ]),
+    );
+});
+
+test('audit log persists a structured event for the current team', function () {
+    auditLog('ui.application.updated', [
+        'application_uuid' => 'app-123',
+        'application_name' => 'Website',
+        'changed' => ['name'],
+    ]);
+
+    $event = AuditEvent::query()->sole();
+
+    expect($event->team_id)->toBe($this->team->id)
+        ->and($event->actor_id)->toBe($this->user->id)
+        ->and($event->actor_email)->toBe($this->user->email)
+        ->and($event->source)->toBe('ui')
+        ->and($event->action)->toBe('updated')
+        ->and($event->resource_type)->toBe('application')
+        ->and($event->resource_uuid)->toBe('app-123')
+        ->and($event->resource_name)->toBe('Website')
+        ->and($event->metadata['changed'])->toBe(['name']);
+});
+
+test('auditable models record authenticated create update and delete actions', function () {
+    $project = Project::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Website project',
+    ]);
+    $project->update(['name' => 'Renamed project']);
+    $project->delete();
+
+    $events = AuditEvent::query()->where('resource_type', 'project')->orderBy('id')->get();
+
+    expect($events->pluck('event')->all())->toBe([
+        'ui.project.created',
+        'ui.project.updated',
+        'ui.project.deleted',
+    ])->and($events[1]->metadata['changed_fields'])->toBe(['name']);
+});
+
+test('deleting a project dispatches deleted events for its environments', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = $project->environments()->sole();
+    AuditEvent::query()->delete();
+
+    $project->delete();
+
+    expect(AuditEvent::query()
+        ->where('event', 'ui.environment.deleted')
+        ->where('resource_uuid', $environment->uuid)
+        ->exists())->toBeTrue();
+});
+
+test('deleting a team dispatches updated events for transferred system-wide sources', function () {
+    Team::factory()->create(['id' => 0]);
+    $githubApp = GithubApp::query()->create([
+        'name' => 'System GitHub source',
+        'team_id' => $this->team->id,
+        'is_system_wide' => true,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+    ]);
+    $gitlabApp = GitlabApp::query()->create([
+        'name' => 'System GitLab source',
+        'team_id' => $this->team->id,
+        'is_system_wide' => true,
+        'api_url' => 'https://gitlab.com/api/v4',
+        'html_url' => 'https://gitlab.com',
+    ]);
+    AuditEvent::query()->delete();
+
+    $this->team->delete();
+
+    expect(AuditEvent::query()
+        ->where('event', 'ui.github_app.updated')
+        ->where('resource_uuid', $githubApp->uuid)
+        ->exists())->toBeTrue()
+        ->and(AuditEvent::query()
+            ->where('event', 'ui.gitlab_app.updated')
+            ->where('resource_uuid', $gitlabApp->uuid)
+            ->exists())->toBeTrue();
+});
+
+test('auditable model mutations succeed when audit persistence fails', function () {
+    Schema::rename('audit_events', 'unavailable_audit_events');
+
+    try {
+        $project = Project::factory()->create([
+            'team_id' => $this->team->id,
+            'name' => 'Persisted project',
+        ]);
+    } finally {
+        Schema::rename('unavailable_audit_events', 'audit_events');
+    }
+
+    expect($project->exists)->toBeTrue()
+        ->and(Project::query()->whereKey($project->id)->exists())->toBeTrue();
+});
+
+test('repeated events for the same resource are each persisted', function () {
+    auditLog('api.project.updated', [
+        'team_id' => $this->team->id,
+        'project_uuid' => 'project-123',
+        'changed_fields' => ['name'],
+    ]);
+    auditLog('api.project.updated', [
+        'team_id' => $this->team->id,
+        'project_uuid' => 'project-123',
+        'changed_fields' => ['description'],
+    ]);
+
+    $events = AuditEvent::query()->orderBy('id')->get();
+
+    expect($events)->toHaveCount(2)
+        ->and($events[0]->metadata['changed_fields'])->toBe(['name'])
+        ->and($events[1]->metadata['changed_fields'])->toBe(['description']);
+});
+
+test('automatic and explicit auditing both preserve their events', function () {
+    $project = Project::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Website project',
+    ]);
+
+    auditLog('ui.project.created', [
+        'team_id' => $this->team->id,
+        'project_uuid' => $project->uuid,
+        'project_name' => $project->name,
+        'audit_description' => 'Project created through the API',
+        'request_field' => 'preserved',
+    ]);
+
+    $events = AuditEvent::query()->where('event', 'ui.project.created')->orderBy('id')->get();
+
+    expect($events)->toHaveCount(2)
+        ->and($events[1]->description)->toBe('Project created through the API')
+        ->and($events[1]->metadata['request_field'])->toBe('preserved');
+});
+
+test('auditable models ignore unauthenticated mutations', function () {
+    auth()->logout();
+
+    Project::factory()->create(['team_id' => $this->team->id]);
+
+    expect(AuditEvent::query()->count())->toBe(0);
+});
+
+test('webhook audits resolve the team from the application', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    AuditEvent::query()->delete();
+    auth()->logout();
+    session()->forget('currentTeam');
+
+    auditLog('webhook.deployment.queued', [
+        'application_uuid' => $application->uuid,
+        'application_name' => $application->name,
+    ]);
+
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'webhook.deployment.queued',
+        'resource_uuid' => $application->uuid,
+    ]);
+});
+
+test('unauthenticated webhook failures without a team are preserved', function () {
+    auth()->logout();
+    session()->forget('currentTeam');
+
+    auditLogWebhookFailure('sentinel', 'token_missing');
+    auditLogWebhookFailure('stripe', 'invalid_signature');
+
+    $events = AuditEvent::query()->orderBy('id')->get();
+
+    expect($events)->toHaveCount(2)
+        ->and($events->pluck('event')->all())->toBe([
+            'webhook.sentinel.signature_failed',
+            'webhook.stripe.signature_failed',
+        ])
+        ->and($events->pluck('team_id')->all())->toBe([null, null]);
+});
+
+test('early Sentinel and Stripe rejections persist unscoped audit events', function () {
+    auth()->logout();
+    session()->forget('currentTeam');
+
+    $this->postJson('/api/v1/sentinel/push', [])->assertUnauthorized();
+
+    config(['subscription.stripe_webhook_secret' => 'whsec_test']);
+    $this->withHeader('Stripe-Signature', 'invalid')
+        ->call('POST', '/webhooks/payments/stripe/events', [], [], [], [], '{}')
+        ->assertBadRequest();
+
+    expect(AuditEvent::query()->orderBy('id')->pluck('event')->all())->toBe([
+        'webhook.sentinel.signature_failed',
+        'webhook.stripe.signature_failed',
+    ])->and(AuditEvent::query()->whereNotNull('team_id')->doesntExist())->toBeTrue();
+});
+
+test('unscoped audit events are only visible to the instance team', function () {
+    AuditEvent::factory()->create([
+        'team_id' => null,
+        'description' => 'Unscoped security failure',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertDontSee('Unscoped security failure');
+
+    $instanceTeam = Team::factory()->create(['id' => 0]);
+    $instanceTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->user->unsetRelation('teams');
+    session(['currentTeam' => $instanceTeam]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('Unscoped security failure');
+});
+
+test('auditable models identify personal access token mutations as api events', function () {
+    $newToken = $this->user->createToken('audit-api');
+    $newToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $this->actingAs($this->user->withAccessToken($newToken->accessToken->fresh()));
+
+    Project::factory()->create(['team_id' => $this->team->id]);
+
+    expect(AuditEvent::query()->where('resource_type', 'project')->firstOrFail()->event)
+        ->toBe('api.project.created');
+});
+
+test('API audit events identify the responsible access token', function () {
+    $firstToken = $this->user->createToken('first-token');
+    $firstToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $secondToken = $this->user->createToken('second-token');
+    $secondToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+
+    foreach ([$firstToken->accessToken->fresh(), $secondToken->accessToken->fresh()] as $token) {
+        $this->actingAs($this->user->withAccessToken($token));
+        auditLog('api.project.updated', ['team_id' => $this->team->id]);
+    }
+
+    $events = AuditEvent::query()->orderBy('id')->get();
+
+    expect($events->pluck('actor_token_id')->all())->toBe([
+        $firstToken->accessToken->id,
+        $secondToken->accessToken->id,
+    ])->and($events->pluck('actor_token_name')->all())->toBe([
+        'first-token',
+        'second-token',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('Token: first-token')
+        ->assertSee('Token: second-token');
+});
+
+test('API model mutations produce one audit event', function () {
+    $this->withoutExceptionHandling();
+    $token = $this->user->createToken('audit-api', ['root']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $response = $this->withToken($token->plainTextToken)->postJson('/api/v1/projects', [
+        'name' => 'Single API audit event',
+    ]);
+
+    $response->assertCreated();
+
+    expect(AuditEvent::query()
+        ->where('event', 'api.project.created')
+        ->where('resource_uuid', $response->json('uuid'))
+        ->count())->toBe(1);
+});
+
+test('API application updates produce one audit event', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    AuditEvent::query()->delete();
+
+    $token = $this->user->createToken('audit-api', ['root']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->patchJson("/api/v1/applications/{$application->uuid}", ['description' => 'Updated through API'])
+        ->assertOk();
+
+    expect(AuditEvent::query()
+        ->where('event', 'api.application.updated')
+        ->where('resource_uuid', $application->uuid)
+        ->count())->toBe(1);
+});
+
+test('deployment queue records rollback and cancellation operations', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    AuditEvent::query()->delete();
+
+    $deployment = ApplicationDeploymentQueue::query()->create([
+        'application_id' => $application->id,
+        'deployment_uuid' => 'rollback-deployment',
+        'commit' => 'abc123',
+        'rollback' => true,
+        'status' => 'queued',
+    ]);
+
+    $deployment->update(['status' => 'cancelled-by-user']);
+
+    expect(AuditEvent::query()->orderBy('id')->pluck('event')->all())->toBe([
+        'ui.application.rollback',
+        'ui.deployment.cancelled',
+    ]);
+});
+
+test('team resource models opt in to automatic auditing', function (string $model) {
+    expect(class_uses_recursive($model))->toContain(Auditable::class);
+})->with([
+    Application::class,
+    Service::class,
+    Server::class,
+    Project::class,
+    Environment::class,
+    EnvironmentVariable::class,
+    SharedEnvironmentVariable::class,
+    PrivateKey::class,
+    StandalonePostgresql::class,
+    StandaloneMysql::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneRedis::class,
+    StandaloneKeydb::class,
+    StandaloneDragonfly::class,
+    StandaloneClickhouse::class,
+]);
+
+test('withoutAuditLogging suppresses mutations until the outer callback ends', function () {
+    $project = Project::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Original project',
+        'description' => 'Original description',
+    ]);
+    AuditEvent::query()->delete();
+
+    $project->withoutAuditLogging(function () use ($project) {
+        $project->update(['name' => 'Outer suppressed']);
+
+        $project->withoutAuditLogging(function () use ($project) {
+            $project->update(['description' => 'Inner suppressed']);
+        });
+
+        $project->update(['name' => 'Still suppressed']);
+    });
+
+    expect(AuditEvent::query()->count())->toBe(0);
+
+    $project->update(['description' => 'Logged after suppression']);
+
+    expect(AuditEvent::query()->pluck('event')->all())->toBe(['ui.project.updated']);
+});
+
+test('status-only database updates do not record last online audit changes', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    foreach ([StandaloneClickhouse::class, StandaloneRedis::class] as $model) {
+        $attributes = [
+            'uuid' => fake()->uuid(),
+            'name' => 'Status test database',
+            'status' => 'exited',
+            'environment_id' => $environment->id,
+            'destination_type' => Server::class,
+            'destination_id' => 0,
+        ];
+        if ($model === StandaloneClickhouse::class) {
+            $attributes['clickhouse_admin_password'] = 'password';
+        }
+
+        $database = $model::create($attributes);
+        AuditEvent::query()->delete();
+
+        $database->update(['status' => 'running']);
+
+        expect(AuditEvent::query()->count())->toBe(0);
+
+        $database->update(['name' => 'Renamed status test database']);
+
+        $event = AuditEvent::query()->sole();
+
+        expect($event->metadata['changed_fields'])->toBe(['name']);
+        AuditEvent::query()->delete();
+    }
+});
+
+test('audit log redacts sensitive metadata', function () {
+    auditLog('api.application.updated', [
+        'team_id' => $this->team->id,
+        'application_uuid' => 'app-123',
+        'token' => 'secret-token',
+        'nested' => ['password' => 'secret-password', 'safe' => 'visible'],
+    ]);
+
+    $metadata = AuditEvent::query()->sole()->metadata;
+
+    expect($metadata['token'])->toBe('[REDACTED]')
+        ->and($metadata['nested']['password'])->toBe('[REDACTED]')
+        ->and($metadata['nested']['safe'])->toBe('visible');
+});
+
+test('audit log redacts common credential metadata keys', function (string $key) {
+    auditLog('api.application.updated', [
+        'team_id' => $this->team->id,
+        $key => 'sensitive-value',
+    ]);
+
+    expect(AuditEvent::query()->sole()->metadata[$key])->toBe('[REDACTED]');
+})->with([
+    'api_key',
+    'access_key',
+    'authorization',
+    'cookie',
+    'client_secret',
+]);
+
+test('audit event classification can use explicit resource and action context', function () {
+    auditLog('mcp.control', [
+        'team_id' => $this->team->id,
+        'resource' => 'application',
+        'action' => 'restart',
+        'resource_uuid' => 'app-123',
+    ]);
+
+    $event = AuditEvent::query()->sole();
+
+    expect($event->resource_type)->toBe('application')
+        ->and($event->action)->toBe('restart')
+        ->and($event->resource_uuid)->toBe('app-123');
+});
+
+test('team invitation audit logs redact the invitation email', function () {
+    auditLog('ui.team_invitation.created', [
+        'team_id' => $this->team->id,
+        'invitation_uuid' => 'invitation-123',
+        'invitation_email' => 'invitee@example.com',
+        'role' => 'member',
+        'via' => 'email',
+    ]);
+
+    $metadata = AuditEvent::query()->sole()->metadata;
+
+    expect($metadata['invitation_email'])->toBe('[REDACTED]')
+        ->and($metadata['invitation_uuid'])->toBe('invitation-123')
+        ->and($metadata['role'])->toBe('member')
+        ->and($metadata['via'])->toBe('email');
+});
+
+test('audit log page only shows events for the current team', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'description' => 'Website created',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => Team::factory()->create()->id,
+        'description' => 'Private app deleted',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('Website created')
+        ->assertDontSee('Private app deleted');
+});
+
+test('audit log is available under team settings', function () {
+    $this->get('/team/audit-log')
+        ->assertSuccessful()
+        ->assertSeeLivewire(AuditLog::class);
+});
+
+test('team members cannot view the audit log page', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get('/team/audit-log')->assertForbidden();
+});
+
+test('demoted team admins cannot make subsequent audit log requests', function () {
+    $component = Livewire::test(AuditLog::class);
+
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    auth()->setUser($this->user->fresh());
+
+    $component->set('search', 'deployment')->assertStatus(403);
+});
+
+test('team admins can query only their team audit events through the api', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'api.project.updated',
+        'source' => 'api',
+        'action' => 'updated',
+        'description' => 'Visible event',
+        'actor_email' => 'owner@example.com',
+        'actor_token_name' => 'production token',
+        'metadata' => ['changed_fields' => ['name']],
+        'ip_address' => '192.0.2.1',
+        'user_agent' => 'Sensitive user agent',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => Team::factory()->create()->id,
+        'event' => 'api.project.updated',
+        'source' => 'api',
+        'action' => 'updated',
+        'description' => 'Other team event',
+    ]);
+
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?source=api&action=updated')
+        ->assertOk()
+        ->assertJsonCount(1, 'data')
+        ->assertJsonPath('data.0.description', 'Visible event')
+        ->assertJsonMissingPath('data.0.actor_email')
+        ->assertJsonMissingPath('data.0.actor_token_id')
+        ->assertJsonMissingPath('data.0.actor_token_name')
+        ->assertJsonMissingPath('data.0.metadata')
+        ->assertJsonMissingPath('data.0.ip_address')
+        ->assertJsonMissingPath('data.0.user_agent');
+});
+
+test('team admins with sensitive read access can query full audit event details', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'actor_email' => 'owner@example.com',
+        'actor_token_name' => 'production token',
+        'metadata' => ['changed_fields' => ['name']],
+        'ip_address' => '192.0.2.1',
+        'user_agent' => 'Sensitive user agent',
+    ]);
+
+    $token = $this->user->createToken('audit-sensitive-read', ['read', 'read:sensitive']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events')
+        ->assertOk()
+        ->assertJsonPath('data.0.actor_email', 'owner@example.com')
+        ->assertJsonPath('data.0.actor_token_name', 'production token')
+        ->assertJsonPath('data.0.metadata.changed_fields.0', 'name')
+        ->assertJsonPath('data.0.ip_address', '192.0.2.1')
+        ->assertJsonPath('data.0.user_agent', 'Sensitive user agent');
+});
+
+test('tokens without sensitive read access cannot search private audit fields', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'actor_email' => 'private-audit@example.com',
+        'description' => 'Public description',
+    ]);
+
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?search=private-audit@example.com')
+        ->assertOk()
+        ->assertJsonCount(0, 'data');
+});
+
+test('team members cannot query audit events through the api', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+    $token = $member->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events')
+        ->assertForbidden();
+});
+
+test('audit events api rejects pagination and filter values outside the allowed bounds', function (string $query, string $field) {
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?'.$query)
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors([$field]);
+})->with([
+    'per_page below minimum' => ['per_page=0', 'per_page'],
+    'per_page above maximum' => ['per_page=101', 'per_page'],
+    'page below minimum' => ['page=0', 'page'],
+    'unsupported source' => ['source=unknown', 'source'],
+    'action longer than 255 characters' => ['action='.str_repeat('a', 256), 'action'],
+]);
+
+test('audit events api accepts valid pagination and filter values', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'api.project.updated',
+        'source' => 'api',
+        'action' => 'updated',
+        'description' => 'Visible event',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'ui.project.created',
+        'source' => 'ui',
+        'action' => 'created',
+        'description' => 'Other event',
+    ]);
+
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?per_page=1&source=api&action=updated&search=Visible')
+        ->assertOk()
+        ->assertJsonCount(1, 'data')
+        ->assertJsonPath('data.0.description', 'Visible event')
+        ->assertJsonPath('per_page', 1);
+});
+
+test('audit source filter omits the unused system source', function () {
+    Livewire::test(AuditLog::class)
+        ->assertSee('All sources')
+        ->assertSee('Web UI')
+        ->assertSee('API')
+        ->assertSee('MCP')
+        ->assertSee('Webhook')
+        ->assertDontSee('System');
+});
+
+test('audit action filter includes actions recorded for the current team', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'action' => 'backup_schedule_deleted',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertViewHas('actionOptions', fn (array $options): bool => in_array([
+            'value' => 'backup_schedule_deleted',
+            'label' => 'Backup Schedule Deleted',
+        ], $options, true));
+});
+
+test('resource clone audit starts only after the destination server capability check', function () {
+    $source = file_get_contents(app_path('Livewire/Project/Shared/ResourceOperations.php'));
+
+    expect(strpos($source, "auditLog('ui.resource.clone_started'"))
+        ->toBeGreaterThan(strpos($source, 'if (! $server->canHostResources())'));
+});
+
+test('pull and restart records the service restart audit event after starting the service', function () {
+    $method = new ReflectionMethod(Heading::class, 'pullAndRestartEvent');
+    $source = file($method->getFileName());
+    $methodSource = implode('', array_slice($source, $method->getStartLine() - 1, $method->getEndLine() - $method->getStartLine() + 1));
+
+    expect($methodSource)
+        ->toContain("auditServiceAction('ui.service.restarted')")
+        ->and(strpos($methodSource, 'StartService::run'))->toBeLessThan(strpos($methodSource, 'auditServiceAction'));
+});
+
+test('critical operational events persist with their source action and actor', function (string $event) {
+    auditLog($event, [
+        'team_id' => $this->team->id,
+        'resource_uuid' => 'resource-123',
+        'resource_name' => 'Test resource',
+    ]);
+
+    $auditEvent = AuditEvent::query()->sole();
+
+    expect($auditEvent->event)->toBe($event)
+        ->and($auditEvent->source)->toBe(str($event)->before('.')->value())
+        ->and($auditEvent->action)->toBe(str($event)->afterLast('.')->value())
+        ->and($auditEvent->actor_email)->toBe($this->user->email);
+})->with([
+    'ui.application.stopped',
+    'ui.application.preview_stopped',
+    'ui.application.destination_stopped',
+    'ui.application.rollback',
+    'ui.deployment.cancelled',
+    'ui.service.started',
+    'ui.service.stopped',
+    'ui.service.restarted',
+    'ui.database.started',
+    'ui.database.stopped',
+    'ui.database.restarted',
+    'ui.proxy.stopped',
+    'ui.proxy.restarted',
+    'ui.database.backup_started',
+    'ui.database.backup_schedule_deleted',
+    'ui.database.import_started',
+    'ui.database.restore_started',
+    'ui.scheduled_task.executed',
+    'ui.api_token.created',
+    'ui.api_token.revoked',
+    'ui.team_member.role_updated',
+    'ui.team_member.removed',
+    'ui.team_invitation.created',
+    'ui.team_invitation.revoked',
+    'ui.server.docker_cleanup_started',
+    'ui.server.imported',
+    'ui.project.clone_started',
+    'ui.resource.clone_started',
+    'api.database.started',
+    'api.database.stopped',
+    'api.database.restarted',
+]);
+
+test('audit log uses the standard horizontally scrollable table layout on mobile', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'actor_name' => 'Visible Actor',
+        'actor_token_name' => 'visible-audit-token',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSeeHtml('class="overflow-x-auto"')
+        ->assertSeeHtml('class="data-table transition-opacity"')
+        ->assertSeeHtml('class="grid min-w-[760px] grid-cols-[14rem_minmax(0,1fr)_12rem_9rem]')
+        ->assertSeeHtml('class="self-center text-right text-[11px]')
+        ->assertSeeHtml('title="Token: visible-audit-token"')
+        ->assertSee('Actor')
+        ->assertSee('Visible Actor');
+});
+
+test('audit log displays source abbreviations in uppercase', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'source' => 'cli',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('CLI');
+});
+
+test('audit log page filters events by search and action', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'action' => 'created',
+        'description' => 'Website created',
+        'resource_name' => 'Website',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'api.server.deleted',
+        'action' => 'deleted',
+        'description' => 'Build server deleted',
+        'resource_name' => 'Build server',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->set('search', 'Website')
+        ->assertSee('Website created')
+        ->assertDontSee('Build server deleted')
+        ->set('search', '')
+        ->set('action', 'deleted')
+        ->assertDontSee('Website created')
+        ->assertSee('Build server deleted');
+});
+
+test('updating team settings records an audit event', function () {
+    Livewire::test(TeamIndex::class)
+        ->set('name', 'Renamed team')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $event = AuditEvent::query()->where('action', 'updated')->sole();
+
+    expect($event->event)->toBe('ui.team.updated')
+        ->and($event->team_id)->toBe($this->team->id)
+        ->and($event->resource_name)->toBe('Renamed team');
+});
+
+test('updating an environment variable records an event without its value', function () {
+    $variable = SharedEnvironmentVariable::create([
+        'team_id' => $this->team->id,
+        'type' => 'team',
+        'key' => 'API_SECRET',
+        'value' => 'old-secret',
+    ]);
+
+    Livewire::test(Show::class, [
+        'env' => $variable,
+        'type' => 'team',
+    ])
+        ->call('loadValues')
+        ->set('value', 'new-secret')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $event = AuditEvent::query()
+        ->where('resource_type', 'shared_environment_variable')
+        ->where('action', 'updated')
+        ->sole();
+
+    expect($event->event)->toBe('ui.shared_environment_variable.updated')
+        ->and($event->resource_name)->toBe('API_SECRET')
+        ->and(json_encode($event->metadata))->not->toContain('new-secret');
+});
+
+test('creating an application environment variable records an audit event', function () {
+    $this->withDefer();
+
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+
+    $application->environment_variables()->create([
+        'key' => 'API_SECRET',
+        'value' => 'secret-value',
+    ]);
+
+    defer()->invoke();
+
+    $event = AuditEvent::query()
+        ->where('resource_type', 'environment_variable')
+        ->where('action', 'created')
+        ->where('resource_name', 'API_SECRET')
+        ->firstOrFail();
+
+    expect($event->team_id)->toBe($this->team->id)
+        ->and($event->resource_name)->toBe('API_SECRET')
+        ->and(json_encode($event->metadata))->not->toContain('secret-value');
+});
+
+test('database cleanup removes audit events older than 90 days', function () {
+    $old = AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'created_at' => now()->subDays(91),
+    ]);
+    $recent = AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'created_at' => now()->subDays(89),
+    ]);
+
+    AuditEvent::pruneExpired();
+
+    expect($old->fresh())->toBeNull()
+        ->and($recent->fresh())->not->toBeNull();
+});
diff --git a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
index c415ff3242..ec78d0f30d 100644
--- a/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
+++ b/tests/Feature/Authorization/EnvironmentVariableValueHidingTest.php
@@ -18,7 +18,7 @@ use Livewire\Livewire;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
 
     $this->team = Team::factory()->create();
 
@@ -103,6 +103,11 @@ test('admin sees unlocked env value in Show component', function () {
         'type' => 'application',
     ]);
 
+    // Values hydrate lazily; the edit modal triggers loadValues() on open.
+    expect($component->get('value'))->toBeNull();
+
+    $component->call('loadValues');
+
     expect($component->get('value'))->toBe('secret-unlocked-value');
 });
 
@@ -246,6 +251,17 @@ test('API hides env values for member even with read:sensitive token', function
         'Authorization' => 'Bearer '.$token->plainTextToken,
     ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
 
+    $response->assertForbidden();
+});
+
+test('API hides env values for member with read token', function () {
+    session(['currentTeam' => $this->team]);
+    $token = $this->member->createToken('member-read', ['read']);
+
+    $response = $this->withHeaders([
+        'Authorization' => 'Bearer '.$token->plainTextToken,
+    ])->getJson("/api/v1/applications/{$this->application->uuid}/envs");
+
     $response->assertOk();
 
     $envs = collect($response->json());
diff --git a/tests/Feature/CopyButtonComponentTest.php b/tests/Feature/CopyButtonComponentTest.php
index a9996a062e..7177da08e8 100644
--- a/tests/Feature/CopyButtonComponentTest.php
+++ b/tests/Feature/CopyButtonComponentTest.php
@@ -1,16 +1,42 @@
 <?php
 
-it('renders a reusable compact copy button', function () {
+it('renders a self-contained clipboard button for backend-provided values', function () {
     $html = $this->blade('<x-copy-button value="backup/path.sql" label="Copy backup path" />');
 
     $html->assertSee('Copy backup path')
         ->assertSee('backup\/path.sql', false)
-        ->assertSee('window.copyToClipboard', false)
-        ->assertSee('size-6', false);
+        ->assertSee('x-data="copyButton"', false)
+        ->assertDontSee('window.copyToClipboard', false);
 });
 
-it('uses the reusable copy button for database backup paths', function () {
-    $view = file_get_contents(resource_path('views/livewire/project/database/backup-executions.blade.php'));
+it('disables the button when no backend value is available', function () {
+    $html = $this->blade('<x-copy-button :value="null" />');
 
-    expect($view)->toContain('<x-copy-button :value="data_get($execution, \'filename\', \'\')" label="Copy backup path" />');
+    $html->assertSee('disabled', false);
+});
+
+it('evaluates a resolve expression at click time instead of a static value', function () {
+    $html = $this->blade('<x-copy-button resolve="$wire.copyValue()" />');
+
+    $html->assertSee('await ($wire.copyValue())', false)
+        ->assertDontSee('disabled', false);
+});
+
+it('is the single clipboard implementation shared by its call sites', function () {
+    expect(file_get_contents(resource_path('js/copy-button.js')))
+        ->toContain("window.Alpine.data('copyButton'");
+
+    expect(file_get_contents(resource_path('js/app.js')))
+        ->toContain('initializeCopyButtonComponent');
+
+    $modalConfirmation = file_get_contents(resource_path('views/components/modal-confirmation.blade.php'));
+    $backupExecutions = file_get_contents(resource_path('views/livewire/project/database/backup-executions.blade.php'));
+
+    expect($modalConfirmation)
+        ->toContain('<x-copy-button resolve="decodedText"')
+        ->not->toContain('navigator.clipboard');
+
+    expect($backupExecutions)
+        ->toContain('<x-copy-button :value="data_get($execution, \'filename\', \'\')" label="Copy backup path"')
+        ->not->toContain('navigator.clipboard');
 });
diff --git a/tests/Feature/DatabaseStartActivityLoggingTest.php b/tests/Feature/DatabaseStartActivityLoggingTest.php
new file mode 100644
index 0000000000..ff8f0e8ec8
--- /dev/null
+++ b/tests/Feature/DatabaseStartActivityLoggingTest.php
@@ -0,0 +1,34 @@
+<?php
+
+use App\Actions\Database\StartDatabase;
+use App\Jobs\DatabaseStartJob;
+use App\Models\Server;
+use App\Models\ServerSetting;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneRedis;
+use Illuminate\Support\Facades\Bus;
+use Spatie\Activitylog\ActivityLogStatus;
+
+it('returns an actionable error when database start activity logging is disabled', function () {
+    config()->set('activitylog.enabled', false);
+    app(ActivityLogStatus::class)->disable();
+    Bus::fake();
+
+    $server = new Server(['ip' => '192.0.2.1']);
+    $server->setRelation('settings', new ServerSetting([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]));
+
+    $destination = new StandaloneDocker;
+    $destination->setRelation('server', $server);
+
+    $database = new StandaloneRedis;
+    $database->setRelation('destination', $destination);
+
+    $result = (new StartDatabase)->handle($database);
+
+    expect($result)->toBe('Database start could not be queued because activity logging is disabled.');
+    Bus::assertNotDispatched(DatabaseStartJob::class);
+});
diff --git a/tests/Feature/EnableActionButtonsTest.php b/tests/Feature/EnableActionButtonsTest.php
new file mode 100644
index 0000000000..01639d4979
--- /dev/null
+++ b/tests/Feature/EnableActionButtonsTest.php
@@ -0,0 +1,179 @@
+<?php
+
+use App\Livewire\Notifications\Discord;
+use App\Livewire\Notifications\Email;
+use App\Livewire\Notifications\Pushover;
+use App\Livewire\Notifications\Slack;
+use App\Livewire\Notifications\Telegram;
+use App\Livewire\Notifications\Webhook;
+use App\Livewire\SettingsEmail;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function actingAsEnableActionOwner(): array
+{
+    $team = Team::factory()->create();
+    $user = User::factory()->create(['email' => 'owner@example.com']);
+    $user->teams()->attach($team, ['role' => 'owner']);
+
+    session(['currentTeam' => $team]);
+    test()->actingAs($user);
+
+    return [$user, $team];
+}
+
+function actingAsEnableActionInstanceAdmin(): User
+{
+    $team = Team::forceCreate(['id' => 0, 'name' => 'Root Team', 'personal_team' => true]);
+    $user = User::factory()->create(['id' => 0, 'email' => 'root-enable-actions@example.com']);
+    if (! $user->teams()->whereKey($team->id)->exists()) {
+        $user->teams()->attach($team, ['role' => 'owner']);
+    }
+
+    session(['currentTeam' => $team]);
+    test()->actingAs($user);
+
+    return $user;
+}
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+});
+
+it('renders settings email enable actions instead of enabled checkboxes', function () {
+    $view = file_get_contents(resource_path('views/livewire/settings-email.blade.php'));
+
+    expect($view)->toContain('Enable SMTP Server')
+        ->and($view)->toContain('Disable SMTP Server')
+        ->and($view)->toContain('Enable Resend')
+        ->and($view)->toContain('Disable Resend')
+        ->and($view)->not->toContain('id="smtpEnabled" label="Enabled"')
+        ->and($view)->not->toContain('id="resendEnabled" label="Enabled"');
+});
+
+it('keeps transactional smtp disabled when enable validation fails', function () {
+    actingAsEnableActionInstanceAdmin();
+
+    Livewire::test(SettingsEmail::class)
+        ->call('toggleSmtp')
+        ->assertDispatched('error')
+        ->assertSet('smtpEnabled', false);
+
+    expect(instanceSettings()->fresh()->smtp_enabled)->toBeFalse();
+});
+
+it('enables transactional smtp only after required fields validate', function () {
+    actingAsEnableActionInstanceAdmin();
+
+    Livewire::test(SettingsEmail::class)
+        ->set('smtpFromAddress', 'mail@example.com')
+        ->set('smtpFromName', 'Coolify')
+        ->set('smtpHost', 'smtp.example.com')
+        ->set('smtpPort', '587')
+        ->set('smtpEncryption', 'starttls')
+        ->call('toggleSmtp')
+        ->assertHasNoErrors()
+        ->assertSet('smtpEnabled', true)
+        ->assertSet('resendEnabled', false);
+
+    expect(instanceSettings()->fresh()->smtp_enabled)->toBeTrue()
+        ->and(instanceSettings()->fresh()->resend_enabled)->toBeFalse();
+});
+
+it('renders notification provider enable actions instead of enabled checkboxes', function (string $view, string $enableLabel, string $checkboxSnippet) {
+    $contents = file_get_contents(resource_path("views/livewire/notifications/{$view}.blade.php"));
+
+    expect($contents)->toContain($enableLabel)
+        ->and($contents)->not->toContain($checkboxSnippet);
+})->with([
+    'discord' => ['discord', 'Enable Discord', 'id="discordEnabled" label="Enabled"'],
+    'slack' => ['slack', 'Enable Slack', 'id="slackEnabled" label="Enabled"'],
+    'telegram' => ['telegram', 'Enable Telegram', 'id="telegramEnabled" label="Enabled"'],
+    'pushover' => ['pushover', 'Enable Pushover', 'id="pushoverEnabled" label="Enabled"'],
+    'webhook' => ['webhook', 'Enable Webhook', 'id="webhookEnabled" label="Enabled"'],
+]);
+
+it('shows notification provider save buttons while disabled', function (string $component) {
+    actingAsEnableActionOwner();
+
+    Livewire::test($component)
+        ->assertSet(str(class_basename($component))->camel()->append('Enabled')->toString(), false)
+        ->assertSee('Save');
+})->with([
+    'discord' => [Discord::class],
+    'slack' => [Slack::class],
+    'telegram' => [Telegram::class],
+    'pushover' => [Pushover::class],
+    'webhook' => [Webhook::class],
+]);
+
+it('hides notification provider test buttons while disabled and shows them when enabled', function (string $component, string $enabledProperty) {
+    actingAsEnableActionOwner();
+
+    Livewire::test($component)
+        ->assertDontSee('Send Test Notification');
+
+    Livewire::test($component)
+        ->set($enabledProperty, true)
+        ->assertSee('Send Test Notification');
+})->with([
+    'discord' => [Discord::class, 'discordEnabled'],
+    'slack' => [Slack::class, 'slackEnabled'],
+    'telegram' => [Telegram::class, 'telegramEnabled'],
+    'pushover' => [Pushover::class, 'pushoverEnabled'],
+    'webhook' => [Webhook::class, 'webhookEnabled'],
+]);
+
+it('hides the email test button while email notifications are disabled', function () {
+    actingAsEnableActionOwner();
+
+    Livewire::test(Email::class)
+        ->assertDontSee('Send Test Email');
+});
+
+it('keeps notification providers disabled when enable validation fails', function (string $component, string $method, string $enabledProperty, string $requiredField, string $settingsRelation, string $settingsColumn) {
+    [, $team] = actingAsEnableActionOwner();
+
+    Livewire::test($component)
+        ->call($method)
+        ->assertDispatched('error')
+        ->assertSet($enabledProperty, false);
+
+    expect($team->{$settingsRelation}->fresh()->{$settingsColumn})->toBeFalse();
+})->with([
+    'discord' => [Discord::class, 'toggleDiscordEnabled', 'discordEnabled', 'discordWebhookUrl', 'discordNotificationSettings', 'discord_enabled'],
+    'slack' => [Slack::class, 'toggleSlackEnabled', 'slackEnabled', 'slackWebhookUrl', 'slackNotificationSettings', 'slack_enabled'],
+    'telegram' => [Telegram::class, 'toggleTelegramEnabled', 'telegramEnabled', 'telegramToken', 'telegramNotificationSettings', 'telegram_enabled'],
+    'pushover' => [Pushover::class, 'togglePushoverEnabled', 'pushoverEnabled', 'pushoverUserKey', 'pushoverNotificationSettings', 'pushover_enabled'],
+    'webhook' => [Webhook::class, 'toggleWebhookEnabled', 'webhookEnabled', 'webhookUrl', 'webhookNotificationSettings', 'webhook_enabled'],
+]);
+
+it('renders notification email and log drain enable actions instead of enabled checkboxes', function () {
+    $notificationEmail = file_get_contents(resource_path('views/livewire/notifications/email.blade.php'));
+    $logDrains = file_get_contents(resource_path('views/livewire/server/log-drains.blade.php'));
+
+    expect($notificationEmail)->toContain('Enable SMTP Server')
+        ->and($notificationEmail)->toContain('Enable Resend')
+        ->and($notificationEmail)->not->toContain('id="smtpEnabled"')
+        ->and($notificationEmail)->not->toContain('id="resendEnabled"')
+        ->and($logDrains)->toContain('Enable New Relic')
+        ->and($logDrains)->toContain('Enable Axiom')
+        ->and($logDrains)->toContain('Enable Custom FluentBit')
+        ->and($logDrains)->not->toContain('label="Enabled"');
+});
+
+it('keeps notification email smtp disabled when enable validation fails', function () {
+    actingAsEnableActionOwner();
+
+    Livewire::test(Email::class)
+        ->call('toggleSmtp')
+        ->assertDispatched('error')
+        ->assertSet('smtpEnabled', false);
+});
diff --git a/tests/Feature/EnvVarInputDesignTest.php b/tests/Feature/EnvVarInputDesignTest.php
index 992c4d8b09..9e1403f282 100644
--- a/tests/Feature/EnvVarInputDesignTest.php
+++ b/tests/Feature/EnvVarInputDesignTest.php
@@ -11,3 +11,54 @@ it('uses the current listbox design for environment variable suggestions', funct
         ->toContain('border-emerald-500/25 bg-emerald-500/10')
         ->not->toContain('dark:bg-coolgray-100');
 });
+
+it('keeps the environment variable input enabled while secret manager keys load', function () {
+    $view = file_get_contents(resource_path('views/components/forms/env-var-input.blade.php'));
+
+    expect($view)->toContain('wire:target.except="fetchSecretManagerKeys"');
+});
+
+it('allows secret manager key loading to retry after a failed request', function () {
+    $view = file_get_contents(resource_path('views/components/forms/env-var-input.blade.php'));
+    $failureHandler = explode('});', explode('.catch(() => {', $view, 2)[1], 2)[0];
+
+    expect($failureHandler)
+        ->toContain('this.vaultKeysLoading = false;')
+        ->not->toContain("this.availableVars['vault'] = [];");
+});
+
+it('authorizes secret-enabled environment variable inputs at the component boundary', function () {
+    $addView = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/add.blade.php'));
+    $showView = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/show.blade.php'));
+
+    foreach ([$addView, $showView] as $view) {
+        preg_match('/<x-forms\.env-var-input[\s\S]*?\/>/', $view, $matches);
+
+        expect($matches[0] ?? '')
+            ->toContain('canGate="manageEnvironment"')
+            ->toContain(':canResource="$resource"');
+    }
+});
+
+it('passes the remove source warning without compiling remote secret syntax as blade', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/secret-manager-links.blade.php'));
+
+    expect($view)
+        ->toContain('with {{vault.KEY}}. Values are fetched')
+        ->not->toContain('{{doppler.KEY}}')
+        ->not->toContain('{{infisical.KEY}}')
+        ->toContain(':actions="[$removeSourceWarning]"')
+        ->not->toContain(':actions="[\'Existing {{vault.*}}');
+});
+
+it('shows secret manager configuration for applications services and databases', function () {
+    $views = [
+        resource_path('views/livewire/project/application/configuration.blade.php'),
+        resource_path('views/livewire/project/service/configuration.blade.php'),
+        resource_path('views/livewire/project/database/configuration.blade.php'),
+    ];
+
+    foreach ($views as $view) {
+        expect(file_get_contents($view))->toContain('livewire:project.shared.secret-manager-links');
+    }
+});
diff --git a/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php b/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
index 2514ae94a6..c299f65350 100644
--- a/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
+++ b/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
@@ -144,6 +144,23 @@ test('is_shared attribute detects variable without spaces', function () {
     expect($env->is_shared)->toBeTrue();
 });
 
+test('is_shared persisted value rejects unsupported reference types', function () {
+    $env = EnvironmentVariable::create([
+        'key' => 'TEST',
+        'value' => '{{vault.KEY}}',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    $env->refresh();
+
+    expect($env->is_shared)->toBeFalse()
+        ->and(EnvironmentVariable::query()
+            ->whereKey($env->id)
+            ->where('is_shared', false)
+            ->exists())->toBeTrue();
+});
+
 test('non-shared variable preserves spaces', function () {
     $env = EnvironmentVariable::create([
         'key' => 'REGULAR',
diff --git a/tests/Feature/EnvironmentVariableAsyncLoadTest.php b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
index 4d83862b6e..d98313a9f8 100644
--- a/tests/Feature/EnvironmentVariableAsyncLoadTest.php
+++ b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
@@ -71,7 +71,7 @@ it('loads environment variables when loadEnvironmentVariables is called', functi
         ->assertSee('Loading environment variables...')
         ->call('loadEnvironmentVariables')
         ->assertSet('readyToLoad', true)
-        ->assertDontSee('Loading environment variables...')
+        ->assertDontSeeText('Loading environment variables...')
         ->assertSee('API_KEY');
 
     expect($component->instance()->environmentVariables->pluck('key')->all())
diff --git a/tests/Feature/EnvironmentVariableCopyValueTest.php b/tests/Feature/EnvironmentVariableCopyValueTest.php
new file mode 100644
index 0000000000..b12105ea84
--- /dev/null
+++ b/tests/Feature/EnvironmentVariableCopyValueTest.php
@@ -0,0 +1,151 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
+use App\Livewire\Project\Shared\EnvironmentVariable\ShowHardcoded;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create(['environment_id' => $this->environment->id]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+function createEnvironmentVariable(array $attributes = []): EnvironmentVariable
+{
+    return EnvironmentVariable::create(array_merge([
+        'key' => 'API_KEY',
+        'value' => 'secret-value',
+        'resourceable_type' => Application::class,
+        'resourceable_id' => test()->application->id,
+    ], $attributes));
+}
+
+function assertCopiedValue(EnvironmentVariable|SharedEnvironmentVariable $env, ?string $expected): void
+{
+    Livewire::test(Show::class, ['env' => $env, 'type' => 'application'])
+        ->call('copyValue')
+        ->assertReturned($expected);
+}
+
+function assertCopiedComposeValue(string $value, ?string $expected): void
+{
+    Livewire::test(ShowHardcoded::class, [
+        'env' => ['key' => 'MYSQL_USER', 'value' => $value],
+        'resourceableType' => Application::class,
+        'resourceableId' => test()->application->id,
+    ])
+        ->call('copyValue')
+        ->assertReturned($expected);
+}
+
+test('copies the plain value', function () {
+    assertCopiedValue(createEnvironmentVariable(), 'secret-value');
+});
+
+test('copies the referenced variable value instead of the reference', function (string $reference) {
+    createEnvironmentVariable(['key' => 'SERVICE_USER_CLASSICPRESS', 'value' => 'classicpress-user']);
+
+    assertCopiedValue(createEnvironmentVariable(['key' => 'MYSQL_USER', 'value' => $reference]), 'classicpress-user');
+})->with(['bare' => '$SERVICE_USER_CLASSICPRESS', 'braced' => '${SERVICE_USER_CLASSICPRESS}']);
+
+test('copies the resolved shared variable value', function () {
+    SharedEnvironmentVariable::create([
+        'key' => 'MY_SECRET',
+        'value' => 'resolved-secret',
+        'type' => 'team',
+        'team_id' => $this->team->id,
+    ]);
+
+    assertCopiedValue(createEnvironmentVariable(['value' => '{{team.MY_SECRET}}']), 'resolved-secret');
+});
+
+test('copies embedded, literal and unknown references as stored', function () {
+    createEnvironmentVariable(['key' => 'SERVICE_PASSWORD_MYSQL', 'value' => 'generated-password']);
+
+    assertCopiedValue(
+        createEnvironmentVariable(['key' => 'DATABASE_URL', 'value' => 'mysql://root:$SERVICE_PASSWORD_MYSQL@db:3306']),
+        'mysql://root:$SERVICE_PASSWORD_MYSQL@db:3306',
+    );
+    assertCopiedValue(
+        createEnvironmentVariable(['key' => 'LITERAL', 'value' => '$SERVICE_PASSWORD_MYSQL', 'is_literal' => true]),
+        '$SERVICE_PASSWORD_MYSQL',
+    );
+    assertCopiedValue(createEnvironmentVariable(['key' => 'UNKNOWN', 'value' => '$DOES_NOT_EXIST']), '$DOES_NOT_EXIST');
+});
+
+test('copies literal values without .env-style quoting', function () {
+    $env = createEnvironmentVariable(['value' => 'pa$$word', 'is_literal' => true]);
+
+    expect($env->real_value)->toBe("'pa\$\$word'");
+    assertCopiedValue($env, 'pa$$word');
+});
+
+test('copies the value of a shared environment variable row', function () {
+    $shared = SharedEnvironmentVariable::create([
+        'key' => 'TEAM_WIDE',
+        'value' => 'team-wide-value',
+        'type' => 'team',
+        'team_id' => $this->team->id,
+    ]);
+
+    assertCopiedValue($shared, 'team-wide-value');
+});
+
+test('members get no copy button and no value', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(Show::class, ['env' => createEnvironmentVariable(), 'type' => 'application'])
+        ->assertDontSeeHtml('Copy value')
+        ->call('copyValue')
+        ->assertReturned(null);
+});
+
+test('locked variables get no copy button and no value', function () {
+    Livewire::test(Show::class, ['env' => createEnvironmentVariable(['is_shown_once' => true]), 'type' => 'application'])
+        ->assertDontSeeHtml('Copy value')
+        ->call('copyValue')
+        ->assertReturned(null);
+});
+
+test('compose-managed rows copy the referenced variable value', function () {
+    createEnvironmentVariable(['key' => 'SERVICE_USER_CLASSICPRESS', 'value' => 'classicpress-user']);
+
+    assertCopiedComposeValue('$SERVICE_USER_CLASSICPRESS', 'classicpress-user');
+    assertCopiedComposeValue('production', 'production');
+});
+
+test('compose-managed rows hide copying from members', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member, ['role' => 'member']);
+    $this->actingAs($member);
+
+    Livewire::test(ShowHardcoded::class, [
+        'env' => ['key' => 'MYSQL_USER', 'value' => '$SERVICE_USER_CLASSICPRESS'],
+        'resourceableType' => Application::class,
+        'resourceableId' => $this->application->id,
+    ])
+        ->assertDontSeeHtml('Copy value')
+        ->call('copyValue')
+        ->assertReturned(null);
+});
diff --git a/tests/Feature/FileStorageMountPathTest.php b/tests/Feature/FileStorageMountPathTest.php
index 0b9e450a29..cd301c2557 100644
--- a/tests/Feature/FileStorageMountPathTest.php
+++ b/tests/Feature/FileStorageMountPathTest.php
@@ -4,7 +4,6 @@ use App\Jobs\ServerStorageSaveJob;
 use App\Livewire\Project\Service\FileStorage;
 use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Shared\Storages\All;
-use App\Livewire\Project\Shared\Storages\Show;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
@@ -247,8 +246,8 @@ test('deleting a volume mount refreshes the configuration warning', function ()
         'resource_type' => $database->getMorphClass(),
     ]);
 
-    Livewire::test(Show::class, ['storage' => $volume, 'resource' => $database])
-        ->call('delete', 'password')
+    Livewire::test(All::class, ['resource' => $database])
+        ->call('delete', $volume->id, 'password')
         ->assertDispatched('configurationChanged');
 
     expect($volume->fresh())->toBeNull();
diff --git a/tests/Feature/LogDrain/LogDrainToggleRollbackTest.php b/tests/Feature/LogDrain/LogDrainToggleRollbackTest.php
new file mode 100644
index 0000000000..994c96398b
--- /dev/null
+++ b/tests/Feature/LogDrain/LogDrainToggleRollbackTest.php
@@ -0,0 +1,45 @@
+<?php
+
+use App\Actions\Server\StartLogDrain;
+use App\Livewire\Server\LogDrains;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = $this->user->teams()->first();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+});
+
+it('reverts the persisted enabled flag when starting the log drain fails', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andThrow(new RuntimeException('runtime boom'));
+
+    expect($this->server->settings->fresh()->is_logdrain_newrelic_enabled)->toBeFalsy();
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainNewRelicLicenseKey', 'abc123')
+        ->set('logDrainNewRelicBaseUri', 'https://log-api.newrelic.com')
+        ->call('toggleLogDrain', 'newrelic')
+        ->assertSet('isLogDrainNewRelicEnabled', false);
+
+    expect($this->server->settings->fresh()->is_logdrain_newrelic_enabled)->toBeFalsy();
+});
+
+it('keeps the enabled flag persisted when starting the log drain succeeds', function () {
+    StartLogDrain::mock()->shouldReceive('handle')->andReturn('ok');
+
+    Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('logDrainNewRelicLicenseKey', 'abc123')
+        ->set('logDrainNewRelicBaseUri', 'https://log-api.newrelic.com')
+        ->call('toggleLogDrain', 'newrelic')
+        ->assertSet('isLogDrainNewRelicEnabled', true);
+
+    expect($this->server->settings->fresh()->is_logdrain_newrelic_enabled)->toBeTruthy();
+});
diff --git a/tests/Feature/LoginPageBrandingTest.php b/tests/Feature/LoginPageBrandingTest.php
index 5d60290abd..ffe7da67ce 100644
--- a/tests/Feature/LoginPageBrandingTest.php
+++ b/tests/Feature/LoginPageBrandingTest.php
@@ -37,6 +37,28 @@ test('auth pages use the Coollabs purple background glow', function () {
         ->not->toMatch('/\.auth-shell\s*\{[^}]*color-mix\(in oklab, var\(--color-accent\) 9%, transparent\)/s');
 });
 
+test('external login providers are centered and full width', function () {
+    $login = file_get_contents(resource_path('views/auth/login.blade.php'));
+
+    expect($login)
+        ->toContain('class="flex flex-col gap-2"')
+        ->toContain('class="w-full justify-center"')
+        ->not->toContain('sm:w-[calc(50%-0.25rem)]');
+});
+
+test('external login providers display their icons except oidc', function () {
+    $login = file_get_contents(resource_path('views/auth/login.blade.php'));
+
+    expect($login)
+        ->toContain("@if (\$provider_setting->provider !== 'oidc')")
+        ->toContain("asset('svgs/'.\$provider_setting->provider.'.svg')")
+        ->toContain('class="size-5 shrink-0 dark:invert"');
+
+    foreach (['authentik', 'azure', 'bitbucket', 'clerk', 'discord', 'github', 'gitlab', 'google', 'infomaniak', 'zitadel'] as $provider) {
+        expect(public_path("svgs/{$provider}.svg"))->toBeFile();
+    }
+});
+
 test('error pages use the Coollabs purple background glow', function () {
     $styles = file_get_contents(resource_path('css/app.css'));
 
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index cdc96c2bb5..0e7bc1d0c7 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -43,7 +43,7 @@ it('hides resource action menus when the user cannot manage the resource', funct
 
     foreach (['mobile', 'desktop'] as $viewport) {
         expect($source)->toMatch(
-            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<div id=\"{$prefix}-{$viewport}-actions\"/"
+            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<x-split-action id=\"{$prefix}-{$viewport}-actions\"/"
         );
     }
 })->with([
diff --git a/tests/Feature/OauthControllerTest.php b/tests/Feature/OauthControllerTest.php
index 1388e29808..4671183ae7 100644
--- a/tests/Feature/OauthControllerTest.php
+++ b/tests/Feature/OauthControllerTest.php
@@ -1,25 +1,35 @@
 <?php
 
 use App\Models\InstanceSettings;
+use App\Models\OauthIdentity;
 use App\Models\OauthSetting;
 use App\Models\User;
+use App\Services\Auth\OauthLoginService;
+use Illuminate\Database\UniqueConstraintViolationException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Once;
 use Laravel\Socialite\Facades\Socialite;
+use Symfony\Component\HttpKernel\Exception\HttpException;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create([
+    InstanceSettings::forceCreate([
         'id' => 0,
         'is_registration_enabled' => false,
     ]);
 
+    Once::flush();
+
     OauthSetting::create([
         'provider' => 'google',
         'client_id' => 'client-id',
         'client_secret' => 'client-secret',
         'redirect_uri' => 'https://coolify.example.com/auth/google/callback',
         'tenant' => 'example.com',
+        'enabled' => true,
     ]);
 });
 
@@ -46,6 +56,75 @@ it('logs in an existing user when the oauth provider returns a mixed-case email'
     $response->assertRedirect('/');
     $this->assertAuthenticatedAs($user);
     expect(User::count())->toBe(1);
+    expect(OauthIdentity::where([
+        'user_id' => $user->id,
+        'provider' => 'google',
+        'provider_user_id' => 'google-user-id',
+    ])->exists())->toBeTrue();
+});
+
+it('never moves an existing oauth identity when the provider email changes', function () {
+    config()->set('app.maintenance.driver', 'file');
+
+    $identityOwner = User::factory()->create(['email' => 'old@example.com']);
+    $otherUser = User::factory()->create(['email' => 'new@example.com']);
+    $identity = OauthIdentity::create([
+        'user_id' => $identityOwner->id,
+        'provider' => 'google',
+        'issuer' => 'google',
+        'provider_user_id' => 'google-user-id',
+        'email' => 'old@example.com',
+    ]);
+
+    $provider = Mockery::mock();
+    $provider->shouldReceive('setConfig')->once()->andReturnSelf();
+    $provider->shouldReceive('with')->once()->with(['hd' => 'example.com'])->andReturnSelf();
+    $provider->shouldReceive('user')->once()->andReturn((object) [
+        'email' => 'new@example.com',
+        'name' => 'Example User',
+        'id' => 'google-user-id',
+    ]);
+
+    Socialite::shouldReceive('driver')->once()->with('google')->andReturn($provider);
+
+    $this->get(route('auth.callback', 'google'))->assertRedirect('/');
+
+    $this->assertAuthenticatedAs($identityOwner);
+    expect($identity->refresh()->user_id)->toBe($identityOwner->id)
+        ->and($identity->email)->toBe('new@example.com')
+        ->and($identity->user_id)->not->toBe($otherUser->id);
+});
+
+it('continues oauth login when another request creates the identity first', function () {
+    $user = User::factory()->create(['email' => 'race@example.com']);
+    $eventName = 'eloquent.creating: '.OauthIdentity::class;
+
+    Event::listen($eventName, function (OauthIdentity $identity): void {
+        $attributes = $identity->getAttributes();
+
+        DB::afterRollBack(fn () => DB::table('oauth_identities')->insert($attributes));
+
+        throw new UniqueConstraintViolationException(
+            DB::getDefaultConnection(),
+            'insert into oauth_identities',
+            [],
+            new PDOException('duplicate identity'),
+        );
+    });
+
+    try {
+        $resolvedUser = app(OauthLoginService::class)->login('google', (object) [
+            'email' => 'race@example.com',
+            'name' => 'Race User',
+            'id' => 'google-race-id',
+        ], OauthSetting::where('provider', 'google')->firstOrFail());
+    } finally {
+        Event::forget($eventName);
+    }
+
+    expect($resolvedUser->is($user))->toBeTrue()
+        ->and(OauthIdentity::where('provider_user_id', 'google-race-id')->count())->toBe(1);
+    $this->assertAuthenticatedAs($user);
 });
 
 it('rejects oauth logins when the provider does not return an email address', function (?string $providerEmail) {
@@ -76,4 +155,37 @@ it('rejects oauth logins when the provider does not return an email address', fu
 })->with([
     'null email' => [null],
     'blank email' => ['   '],
+    'malformed email' => ['not-an-email'],
+    'missing domain' => ['user@'],
+]);
+
+it('rejects oauth logins when the provider does not return a valid user id', function (mixed $invalidId) {
+    $oauthUser = (object) [
+        'email' => 'user@example.edu',
+        'name' => 'Example User',
+    ];
+
+    if ($invalidId !== 'missing') {
+        $oauthUser->id = $invalidId;
+    }
+
+    try {
+        app(OauthLoginService::class)->login('google', $oauthUser, OauthSetting::where('provider', 'google')->firstOrFail());
+    } catch (HttpException $exception) {
+        expect($exception->getStatusCode())->toBe(403)
+            ->and(OauthIdentity::count())->toBe(0)
+            ->and(User::count())->toBe(0);
+
+        return;
+    }
+
+    $this->fail('Expected an invalid OAuth provider user ID to be rejected.');
+})->with([
+    'null id' => [null],
+    'missing id' => ['missing'],
+    'blank id' => ['   '],
+    'non-scalar id' => [[]],
+    'true id' => [true],
+    'false id' => [false],
+    'float id' => [1.0],
 ]);
diff --git a/tests/Feature/OauthRegistrationPolicyTest.php b/tests/Feature/OauthRegistrationPolicyTest.php
new file mode 100644
index 0000000000..86186cca8c
--- /dev/null
+++ b/tests/Feature/OauthRegistrationPolicyTest.php
@@ -0,0 +1,52 @@
+<?php
+
+use App\Actions\Fortify\CreateNewUser;
+use App\Models\InstanceSettings;
+use App\Models\OauthSetting;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'is_registration_enabled' => true,
+        'disable_registration_when_oauth_enabled' => true,
+    ]);
+    Once::flush();
+});
+
+it('blocks password registration when oauth registration policy disables it', function () {
+    OauthSetting::create([
+        'provider' => 'oidc',
+        'enabled' => true,
+        'client_id' => 'client-id',
+        'client_secret' => 'secret',
+        'base_url' => 'https://idp.example.com',
+    ]);
+
+    app(CreateNewUser::class)->create([
+        'name' => 'Password User',
+        'email' => 'password@example.com',
+        'password' => 'password',
+        'password_confirmation' => 'password',
+    ]);
+})->throws(HttpException::class);
+
+it('allows password registration when no oauth provider is enabled', function () {
+    OauthSetting::create([
+        'provider' => 'oidc',
+        'enabled' => false,
+    ]);
+
+    $user = app(CreateNewUser::class)->create([
+        'name' => 'Password User',
+        'email' => 'password@example.com',
+        'password' => 'password',
+        'password_confirmation' => 'password',
+    ]);
+
+    expect($user->email)->toBe('password@example.com');
+});
diff --git a/tests/Feature/OidcOauthControllerTest.php b/tests/Feature/OidcOauthControllerTest.php
new file mode 100644
index 0000000000..084347f66d
--- /dev/null
+++ b/tests/Feature/OidcOauthControllerTest.php
@@ -0,0 +1,275 @@
+<?php
+
+use App\Auth\Oidc\OidcUser;
+use App\Models\InstanceSettings;
+use App\Models\OauthIdentity;
+use App\Models\OauthSetting;
+use App\Models\Team;
+use App\Models\User;
+use App\Services\Auth\OauthLoginService;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Once;
+use Laravel\Socialite\Facades\Socialite;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.driver', 'file');
+
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'is_registration_enabled' => false,
+    ]);
+
+    Once::flush();
+
+    OauthSetting::create([
+        'provider' => 'oidc',
+        'enabled' => true,
+        'client_id' => 'client-id',
+        'client_secret' => 'client-secret',
+        'base_url' => 'https://idp.example.com',
+        'redirect_uri' => 'https://coolify.example.com/auth/oidc/callback',
+        'allow_registration' => false,
+    ]);
+});
+
+function fakeOidcProvider(array $claims = []): void
+{
+    $user = (new OidcUser)->setRaw(array_merge([
+        'iss' => 'https://idp.example.com',
+        'sub' => 'okta-user-1',
+        'email' => 'user@example.com',
+        'email_verified' => true,
+        'name' => 'Okta User',
+    ], $claims))->map([
+        'id' => $claims['sub'] ?? 'okta-user-1',
+        'name' => $claims['name'] ?? 'Okta User',
+        'email' => $claims['email'] ?? 'user@example.com',
+    ]);
+
+    $provider = Mockery::mock();
+    $provider->shouldReceive('setConfig')->andReturnSelf();
+    $provider->shouldReceive('user')->andReturn($user);
+
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($provider);
+}
+
+it('logs in a user through an existing oidc identity', function () {
+    $user = User::factory()->create(['email' => 'existing@example.com']);
+    OauthIdentity::create([
+        'user_id' => $user->id,
+        'provider' => 'oidc',
+        'issuer' => 'https://idp.example.com',
+        'provider_user_id' => 'okta-user-1',
+        'email' => 'existing@example.com',
+    ]);
+
+    fakeOidcProvider(['email' => 'existing@example.com']);
+
+    $response = $this->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/');
+    $this->assertAuthenticatedAs($user);
+});
+
+it('continues oidc login when another request creates the identity first', function () {
+    $user = User::factory()->create(['email' => 'race@example.com']);
+    $eventName = 'eloquent.creating: '.OauthIdentity::class;
+
+    Event::listen($eventName, function (OauthIdentity $identity): void {
+        $attributes = $identity->getAttributes();
+
+        DB::afterRollBack(fn () => DB::table('oauth_identities')->insert($attributes));
+
+        throw new UniqueConstraintViolationException(
+            DB::getDefaultConnection(),
+            'insert into oauth_identities',
+            [],
+            new PDOException('duplicate identity'),
+        );
+    });
+
+    try {
+        $resolvedUser = app(OauthLoginService::class)->login('oidc', (new OidcUser)->setRaw([
+            'iss' => 'https://idp.example.com',
+            'sub' => 'oidc-race-id',
+            'email' => 'race@example.com',
+            'email_verified' => true,
+            'name' => 'Race User',
+        ])->map([
+            'id' => 'oidc-race-id',
+            'name' => 'Race User',
+            'email' => 'race@example.com',
+        ]), OauthSetting::where('provider', 'oidc')->firstOrFail());
+    } finally {
+        Event::forget($eventName);
+    }
+
+    expect($resolvedUser->is($user))->toBeTrue()
+        ->and(OauthIdentity::where('provider_user_id', 'oidc-race-id')->count())->toBe(1);
+    $this->assertAuthenticatedAs($user);
+});
+
+it('creates a new oidc user when provider registration is allowed while normal registration is disabled', function () {
+    OauthSetting::where('provider', 'oidc')->update(['allow_registration' => true]);
+
+    fakeOidcProvider(['email' => 'newuser@example.com']);
+
+    $response = $this->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/');
+    $user = User::whereEmail('newuser@example.com')->first();
+    expect($user)->not->toBeNull()
+        ->and($user->password)->not->toBeNull();
+    $this->assertAuthenticatedAs($user);
+    $this->assertDatabaseHas('oauth_identities', [
+        'user_id' => $user->id,
+        'provider' => 'oidc',
+        'issuer' => 'https://idp.example.com',
+        'provider_user_id' => 'okta-user-1',
+    ]);
+});
+
+it('creates a new oidc user in the root team only when provider root auto-join is enabled', function () {
+    Team::forceCreate(['id' => 0, 'name' => 'Root Team', 'personal_team' => true]);
+    (new User)->forceFill([
+        'id' => 0,
+        'name' => 'Root User',
+        'email' => 'root@example.com',
+        'password' => 'password',
+    ])->save();
+
+    OauthSetting::where('provider', 'oidc')->update([
+        'allow_registration' => true,
+        'auto_join_root_team' => true,
+    ]);
+
+    fakeOidcProvider(['email' => 'root-member@example.com', 'name' => 'Root Member']);
+
+    $response = $this->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/');
+    $user = User::whereEmail('root-member@example.com')->first();
+    expect($user)->not->toBeNull()
+        ->and($user->teams()->count())->toBe(1);
+
+    $rootMembership = $user->teams()->where('teams.id', 0)->first();
+    expect($rootMembership)->not->toBeNull()
+        ->and($rootMembership->pivot->role)->toBe('member');
+
+    $this->assertDatabaseMissing('teams', [
+        'name' => "Root Member's Team",
+    ]);
+    expect(session('currentTeam')->id)->toBe(0);
+    $this->assertAuthenticatedAs($user);
+});
+
+it('rejects linking an unverified oidc email to an existing local account', function () {
+    $user = User::factory()->create(['email' => 'victim@example.com']);
+
+    fakeOidcProvider(['email' => 'victim@example.com', 'email_verified' => false]);
+
+    $response = $this->from('/login')->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/login');
+    $this->assertGuest();
+    $this->assertDatabaseMissing('oauth_identities', [
+        'user_id' => $user->id,
+        'provider' => 'oidc',
+    ]);
+});
+
+it('rejects new oidc users when neither normal nor provider registration is enabled', function () {
+    fakeOidcProvider(['email' => 'blocked@example.com']);
+
+    $response = $this->from('/login')->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/login');
+    expect(User::whereEmail('blocked@example.com')->exists())->toBeFalse();
+});
+
+it('creates the root user when oidc provisions the first account', function () {
+    Team::forceCreate(['id' => 0, 'name' => 'Root Team', 'personal_team' => true]);
+    OauthSetting::where('provider', 'oidc')->update(['allow_registration' => true]);
+
+    fakeOidcProvider(['email' => 'root@example.com', 'name' => 'Root User']);
+
+    $response = $this->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/');
+    $this->assertDatabaseHas('users', ['id' => 0, 'email' => 'root@example.com']);
+    $this->assertDatabaseHas('team_user', ['team_id' => 0, 'user_id' => 0, 'role' => 'owner']);
+    expect(InstanceSettings::find(0)->is_registration_enabled)->toBeFalse();
+});
+
+it('persists raw claims as an array on the oauth identity', function () {
+    OauthSetting::where('provider', 'oidc')->update(['allow_registration' => true]);
+
+    fakeOidcProvider(['email' => 'claims@example.com']);
+
+    $this->get(route('auth.callback', 'oidc'))->assertRedirect('/');
+
+    $identity = OauthIdentity::where('email', 'claims@example.com')->first();
+    expect($identity->raw_claims)->toBeArray()
+        ->and($identity->raw_claims['sub'])->toBe('okta-user-1');
+});
+
+it('stores empty raw claims when the provider returns no user payload', function () {
+    OauthSetting::where('provider', 'oidc')->update(['allow_registration' => true]);
+
+    $user = (new OidcUser)->setIdTokenClaims([
+        'iss' => 'https://idp.example.com',
+        'sub' => 'okta-no-payload',
+        'email_verified' => true,
+    ])->map([
+        'id' => 'okta-no-payload',
+        'name' => 'No Payload',
+        'email' => 'nopayload@example.com',
+    ]);
+    $user->user = null;
+
+    $provider = Mockery::mock();
+    $provider->shouldReceive('setConfig')->andReturnSelf();
+    $provider->shouldReceive('user')->andReturn($user);
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($provider);
+
+    $this->get(route('auth.callback', 'oidc'))->assertRedirect('/');
+
+    $identity = OauthIdentity::where('email', 'nopayload@example.com')->first();
+    expect($identity->raw_claims)->toBe([]);
+});
+
+it('rejects callbacks for disabled oidc provider', function () {
+    OauthSetting::where('provider', 'oidc')->update(['enabled' => false]);
+
+    $response = $this->from('/login')->get(route('auth.callback', 'oidc'));
+
+    $response->assertRedirect('/login');
+});
+
+it('logs callback failures with diagnostic context', function () {
+    Log::spy();
+
+    $provider = Mockery::mock();
+    $provider->shouldReceive('setConfig')->andReturnSelf();
+    $provider->shouldReceive('user')->andThrow(new RuntimeException('Token exchange failed'));
+    Socialite::shouldReceive('driver')->with('oidc')->andReturn($provider);
+
+    $response = $this->from('/login')->get(route('auth.callback', ['provider' => 'oidc', 'code' => 'secret-code', 'state' => 'state-value']));
+
+    $response->assertRedirect('/login');
+    Log::shouldHaveReceived('error')->once()->withArgs(function (string $message, array $context) {
+        return $message === 'OAuth callback failed.'
+            && $context['provider'] === 'oidc'
+            && $context['exception_class'] === RuntimeException::class
+            && $context['exception_message'] === 'Token exchange failed'
+            && $context['has_code'] === true
+            && $context['has_state'] === true
+            && $context['exception'] instanceof RuntimeException;
+    });
+});
diff --git a/tests/Feature/PersistentStoragePerformanceTest.php b/tests/Feature/PersistentStoragePerformanceTest.php
index caad5822a1..6d1df54607 100644
--- a/tests/Feature/PersistentStoragePerformanceTest.php
+++ b/tests/Feature/PersistentStoragePerformanceTest.php
@@ -91,7 +91,7 @@ function createPerfApplicationWithVolumes(int $volumeCount = 5): array
     return [$application, $firstVolume, $team];
 }
 
-it('renders volume rows without nesting Livewire Show components', function () {
+it('renders volume rows inline without nested Livewire row components', function () {
     [$application] = createPerfApplicationWithVolumes(5);
 
     $html = Livewire::test(All::class, ['resource' => $application])->html();
@@ -100,7 +100,6 @@ it('renders volume rows without nesting Livewire Show components', function () {
         ->toContain('data-table')
         ->toContain('openBackupModal')
         ->toContain('wire:submit="submit(')
-        ->not->toContain('livewire:project.shared.storages.show')
         ->not->toContain('shared-configure-volume-backup-');
 });
 
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index 91dcab3d26..a567a6e5c8 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -43,6 +43,7 @@ it('keeps nested storage component keys stable when mounts are added or deleted'
         ->not->toContain('wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"');
 });
 
+use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
 use App\Livewire\Project\Shared\Storages\All;
 use App\Models\Application;
@@ -138,7 +139,6 @@ function createApplicationWithVolume(array $applicationAttributes = [], array $v
 
 it('renders volumes as a data table with shared column headers', function () {
     $allView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
-    $showView = file_get_contents(resource_path('views/livewire/project/shared/storages/show.blade.php'));
     $storageView = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
 
     expect($allView)
@@ -156,17 +156,10 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toContain('data-table-row')
         ->toContain('volumes-mobile-label')
         ->not->toContain('table-badge table-badge-success')
-        ->not->toContain('livewire:project.shared.storages.show')
         ->not->toContain('x-status-badge')
         ->not->toContain('font-mono')
         ->not->toContain('Service volume mounts are read-only here.');
 
-    // Show remains available for isolated embeds/tests but is no longer nested from All.
-    expect($showView)
-        ->toContain('data-table-row')
-        ->toContain('volumes-table-grid')
-        ->not->toContain('font-mono');
-
     // Service stack page: one settings-section card per compose service/resource.
     expect($storageView)
         ->toContain('Str::headline($resource->name)')
@@ -193,7 +186,7 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toMatch('/<x-callout[^>]*title="File-level consistency"[\s\S]*id="stopDuringBackup"[\s\S]*<\/x-callout>/');
     expect(file_get_contents(resource_path('views/livewire/project/shared/storages/volume-backups/executions.blade.php')))
         ->toContain('<span>Time</span>')
-        ->toContain('x-forms.copy-button')
+        ->toContain('x-forms.copy-input')
         ->toContain('col-span-6');
 
     $css = file_get_contents(resource_path('css/app.css'));
@@ -284,6 +277,62 @@ it('uses valid block wrappers around PR suffix helpers', function () {
         ->toBe(3);
 });
 
+it('keeps bind mount source paths out of the add volume form', function () {
+    $storageView = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
+    $volumesView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    expect($storageView)
+        ->not->toContain('id="host_path"')
+        ->not->toContain('Swarm Mode detected')
+        ->and($volumesView)
+        ->toMatch('/<x-modal-confirmation title="Remove Source Path\?"[^>]*canGate="update"[^>]*:canResource="\$resource"/')
+        ->toContain('The next deployment will use a named Docker volume instead.')
+        ->toContain('Data from the existing host directory will not be copied to the named volume.');
+});
+
+it('creates named volumes without a host path in swarm mode', function () {
+    [$application] = createApplicationWithVolume();
+    $application->persistentStorages()->delete();
+
+    Livewire::test(Storage::class, ['resource' => $application])
+        ->set('isSwarm', true)
+        ->set('name', 'storage-app-data')
+        ->set('mount_path', '/data')
+        ->call('submitPersistentVolume')
+        ->assertHasNoErrors();
+
+    expect($application->persistentStorages()->first())
+        ->name->toBe($application->uuid.'-storage-app-data')
+        ->host_path->toBeNull();
+});
+
+it('uses a resource based default name for new volumes', function () {
+    [$application] = createApplicationWithVolume(['name' => 'Storage App']);
+
+    Livewire::test(Storage::class, ['resource' => $application])
+        ->assertSet('name', 'storage-app-data');
+});
+
+it('uses a valid fallback default volume name when the resource name has no slug characters', function () {
+    [$application] = createApplicationWithVolume(['name' => '---']);
+
+    Livewire::test(Storage::class, ['resource' => $application])
+        ->assertSet('name', 'volume-data');
+});
+
+it('removes existing bind mount source paths from the volume table', function () {
+    [$application, $volume] = createApplicationWithVolume(volumeAttributes: [
+        'host_path' => '/srv/storage',
+    ]);
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->assertSet("forms.{$volume->id}.hostPath", '/srv/storage')
+        ->call('clearHostPath', $volume->id)
+        ->assertHasNoErrors();
+
+    expect($volume->refresh()->host_path)->toBeNull();
+});
+
 it('creates and exposes volume backups for service storage', function () {
     $service = Service::factory()->create([
         'environment_id' => $this->environment->id,
@@ -443,16 +492,13 @@ it('hides PR deployment suffix for databases', function () {
 });
 
 it('uses a compact table badge for enabled backups instead of status-badge', function () {
-    $showView = file_get_contents(resource_path('views/livewire/project/shared/storages/show.blade.php'));
+    $allView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
 
-    expect($showView)
-        ->toContain('table-badge-success')
+    expect($allView)
+        ->toContain("'table-badge-success' => \$hasS3Backup")
         ->toContain('Volume backup is enabled')
         ->not->toContain('x-status-badge')
         ->not->toContain('status="Backup enabled"');
-
-    // Badge label is the short "Backup" text, not the old pill-with-label that broke the input row.
-    expect(preg_match('/table-badge-success[^>]*>\s*Backup\s*</', $showView))->toBeGreaterThan(0);
 });
 
 it('gates file storage PR suffix markup behind git_based applications', function () {
diff --git a/tests/Feature/ProfileSsoIndicatorTest.php b/tests/Feature/ProfileSsoIndicatorTest.php
new file mode 100644
index 0000000000..0d48225eb5
--- /dev/null
+++ b/tests/Feature/ProfileSsoIndicatorTest.php
@@ -0,0 +1,91 @@
+<?php
+
+use App\Livewire\Profile\Index as ProfileIndex;
+use App\Models\OauthIdentity;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Notification;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+it('shows when the profile user signed in with sso', function () {
+    $user = User::factory()->create(['name' => 'Profile User']);
+
+    OauthIdentity::create([
+        'user_id' => $user->id,
+        'provider' => 'oidc',
+        'issuer' => 'https://idp.example.com',
+        'provider_user_id' => 'idp-user-1',
+        'email' => $user->email,
+    ]);
+
+    $this->actingAs($user);
+
+    Livewire::test(ProfileIndex::class)
+        ->assertSee('Signed in with SSO')
+        ->assertSee('OIDC');
+});
+
+it('does not show sso status for password-only profile users', function () {
+    $user = User::factory()->create(['name' => 'Profile User']);
+
+    $this->actingAs($user);
+
+    Livewire::test(ProfileIndex::class)
+        ->assertDontSee('Signed in with SSO');
+});
+
+it('prevents sso linked users from opening or requesting profile email changes', function () {
+    $user = User::factory()->create(['name' => 'SSO User', 'email' => 'sso@example.com']);
+
+    OauthIdentity::create([
+        'user_id' => $user->id,
+        'provider' => 'oidc',
+        'issuer' => 'https://idp.example.com',
+        'provider_user_id' => 'idp-user-1',
+        'email' => $user->email,
+    ]);
+
+    $this->actingAs($user);
+
+    Livewire::test(ProfileIndex::class)
+        ->assertSee('Email is managed by your SSO provider.')
+        ->call('showEmailChangeForm')
+        ->assertSet('show_email_change', false)
+        ->assertDispatched('error')
+        ->set('new_email', 'changed@example.com')
+        ->call('requestEmailChange')
+        ->assertSet('show_email_change', false)
+        ->assertSet('show_verification', false)
+        ->assertDispatched('error');
+
+    $user->refresh();
+
+    expect($user->email)->toBe('sso@example.com')
+        ->and($user->pending_email)->toBeNull()
+        ->and($user->email_change_code)->toBeNull()
+        ->and($user->email_change_code_expires_at)->toBeNull();
+});
+
+it('keeps profile email changes available for password-only users', function () {
+    config()->set('constants.coolify.self_hosted', false);
+    Notification::fake();
+
+    $user = User::factory()->create(['name' => 'Password User', 'email' => 'password@example.com']);
+
+    $this->actingAs($user);
+
+    Livewire::test(ProfileIndex::class)
+        ->call('showEmailChangeForm')
+        ->assertSet('show_email_change', true)
+        ->set('new_email', 'changed@example.com')
+        ->call('requestEmailChange')
+        ->assertSet('show_verification', true)
+        ->assertDispatched('success');
+
+    $user->refresh();
+
+    expect($user->pending_email)->toBe('changed@example.com')
+        ->and($user->email_change_code)->not->toBeNull();
+});
diff --git a/tests/Feature/Proxy/RestartProxyTest.php b/tests/Feature/Proxy/RestartProxyTest.php
index 16cddd36ea..0c393c03b5 100644
--- a/tests/Feature/Proxy/RestartProxyTest.php
+++ b/tests/Feature/Proxy/RestartProxyTest.php
@@ -1,16 +1,20 @@
 <?php
 
+use App\Actions\Proxy\StartProxy;
 use App\Enums\ProxyTypes;
+use App\Models\AuditEvent;
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
+use Spatie\Activitylog\Models\Activity;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    $this->withoutDefer();
     InstanceSettings::forceCreate(['id' => 0]);
 });
 
@@ -187,3 +191,20 @@ test('start proxy button shows a loading state while proxy startup actions run',
         ->assertSeeHtml('wire:loading.class="is-loading"')
         ->assertSeeHtml('wire:target="checkProxy,startProxy"');
 });
+
+test('starting a proxy records a team audit event', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    $activity = Activity::create([
+        'description' => 'proxy start',
+        'properties' => ['team_id' => $team->id],
+    ]);
+    StartProxy::shouldRun()->andReturn($activity);
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->call('startProxy');
+
+    expect(AuditEvent::query()->sole()->event)->toBe('ui.proxy.started');
+});
diff --git a/tests/Feature/QueueApplicationDeploymentCommitTest.php b/tests/Feature/QueueApplicationDeploymentCommitTest.php
index ac6be5c9e9..8273a5c61c 100644
--- a/tests/Feature/QueueApplicationDeploymentCommitTest.php
+++ b/tests/Feature/QueueApplicationDeploymentCommitTest.php
@@ -3,17 +3,20 @@
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\AuditEvent;
 use App\Models\Environment;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
+use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Bus;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    $this->withoutDefer();
     Bus::fake([ApplicationDeploymentJob::class]);
 
     $this->team = Team::factory()->create();
@@ -42,6 +45,59 @@ function makeApplication(int $environmentId, int $destinationId, ?string $gitCom
 }
 
 describe('queue_application_deployment commit resolution', function () {
+    test('records a team audit event when a user queues a deployment', function () {
+        $user = User::factory()->create();
+        $this->team->members()->attach($user, ['role' => 'owner']);
+        $this->actingAs($user);
+        session(['currentTeam' => $this->team]);
+        $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+
+        queue_application_deployment($application, 'audit-deploy-uuid');
+
+        $this->assertDatabaseHas('audit_events', [
+            'team_id' => $this->team->id,
+            'event' => 'ui.application.deployed',
+            'resource_uuid' => $application->uuid,
+        ]);
+    });
+
+    test('uses the deployed application team for the audit event', function () {
+        $actorTeam = Team::factory()->create();
+        $user = User::factory()->create();
+        $actorTeam->members()->attach($user, ['role' => 'owner']);
+        $this->actingAs($user);
+        session()->forget('currentTeam');
+        $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+
+        queue_application_deployment($application, 'resource-team-audit-deploy');
+
+        $event = AuditEvent::query()->where('event', 'ui.application.deployed')->sole();
+
+        expect($event->team_id)->toBe($this->team->id)
+            ->and($event->team_id)->not->toBe($actorTeam->id)
+            ->and($event->resource_uuid)->toBe($application->uuid)
+            ->and($event->metadata)->not->toHaveKey('team_id');
+    });
+
+    test('records only the rollback audit event when a user queues a rollback', function () {
+        $user = User::factory()->create();
+        $this->team->members()->attach($user, ['role' => 'owner']);
+        $this->actingAs($user);
+        $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+        AuditEvent::query()->delete();
+
+        queue_application_deployment(
+            application: $application,
+            deployment_uuid: 'audit-rollback-uuid',
+            commit: 'previous-commit',
+            rollback: true,
+        );
+
+        expect(AuditEvent::query()->pluck('event')->all())->toBe([
+            'ui.application.rollback',
+        ]);
+    });
+
     test('uses application git_commit_sha when commit parameter omitted', function () {
         $pinnedSha = 'abc123def456abc123def456abc123def456abc1';
         $application = makeApplication($this->environment->id, $this->destination->id, $pinnedSha);
diff --git a/tests/Feature/ResourceDetailsVisibilityTest.php b/tests/Feature/ResourceDetailsVisibilityTest.php
index 29f611cbaa..e11c86fe99 100644
--- a/tests/Feature/ResourceDetailsVisibilityTest.php
+++ b/tests/Feature/ResourceDetailsVisibilityTest.php
@@ -27,31 +27,29 @@ it('keeps the resource details helper text visible below the modal header', func
     ])->render();
 
     expect($html)
-        ->toContain('Identifiers for this resource. Read-only')
+        ->toContain('readonly')
         ->toContain('pt-1')
         ->not->toContain('-mt-4');
 });
 
 it('renders copy fields as visible readonly controls with an accessible copy action', function () {
-    $html = Blade::render('<x-forms.copy-button label="UUID" text="crashloop" />');
+    $html = Blade::render('<x-forms.copy-input label="UUID" text="crashloop" />');
 
     expect($html)
         ->toContain('label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white"')
         ->toContain('readonly')
-        ->toContain('window.copyToClipboard')
+        ->toContain('x-data="copyButton"')
         ->toContain('input-with-copy-button')
-        ->toContain('copy-button')
         ->toContain('aria-label="Copy to clipboard"')
-        ->toContain('title="Copy to clipboard"')
-        ->toContain('class="size-[18px] text-green-500"');
+        ->toContain('title="Copy to clipboard"');
 });
 
-it('uses the shared copy field for newly issued api tokens', function () {
+it('uses the shared copy button for newly issued api tokens', function () {
     $blade = file_get_contents(resource_path('views/livewire/security/api-tokens.blade.php'));
 
     expect($blade)
-        ->toContain('<x-forms.copy-button :text="session(\'token\')" />')
-        ->not->toContain('navigator.clipboard.writeText(@js(session(\'token\')))');
+        ->toContain('<x-copy-button :value="session(\'token\')"')
+        ->not->toContain('navigator.clipboard');
 });
 
 it('keeps copy button padding above settings-workspace input overrides', function () {
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index f7951e93a0..c04a21fccf 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -181,14 +181,14 @@ it('keeps advanced operations in a dedicated Advanced dropdown', function () {
     expect(substr_count($application, 'resource-heading-navbar'))->toBe(1);
 });
 
-it('groups desktop application lifecycle controls in one Actions dropdown', function () {
+it('groups desktop application lifecycle controls in one split control', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $desktop = str($heading)->after('resource-heading-actions flex')->toString();
 
     expect($desktop)
         ->toContain('application-desktop-actions')
-        ->toContain('Actions')
-        ->toContain('listbox-panel top-full! right-0! left-auto!')
+        ->toContain('<x-split-action')
+        ->toContain('<x-slot:main')
         ->toContain('listbox-option')
         ->toContain('Deploy')
         ->toContain('Restart')
@@ -235,8 +235,8 @@ it('groups service restart options in the Actions dropdown', function () {
     $mobile = str($heading)->before("@teleport('#resource-action-hud-slot')")->toString();
 
     expect($mobile)
-        ->toContain('Restart current version')
-        ->toContain('Pull latest and restart')
+        ->toContain('Restart')
+        ->toContain('Restart (pull latest)')
         ->not->toContain('Pull Latest Images & Restart');
 });
 
@@ -250,21 +250,17 @@ it('orders service restart actions before stop and advanced operations', functio
         ->toBeLessThan(strpos($actions, 'Stop'));
 });
 
-it('groups application lifecycle options in an Actions dropdown', function () {
+it('promotes the primary application action in the desktop split control', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $desktop = str($heading)->after('resource-heading-actions flex')->toString();
-    $trigger = str($desktop)->after('id="application-desktop-actions"')->before('<div x-cloak')->toString();
 
     expect($desktop)
         ->toContain('id="application-desktop-actions"')
-        ->toContain('Actions')
+        ->toContain('<x-slot:main wire:click="deploy">')
         ->toContain('Deploy')
         ->toContain('Deploy (without cache)')
         ->toContain('force_deploy_without_cache')
-        ->toContain('deploy(true)')
-        ->and($trigger)
-        ->toContain('button button-highlighted')
-        ->not->toContain('play-circle');
+        ->toContain('deploy(true)');
 
     $mobile = str($heading)->before("@teleport('#resource-action-hud-slot')")->toString();
 
@@ -314,27 +310,28 @@ it('uses the shared Coollabs gradient for primary resource actions in the deskto
         ->toContain('@apply button-highlighted;');
 });
 
-it('uses iconless highlighted Actions dropdowns for service and proxy lifecycle controls', function () {
+it('promotes a primary action for service and proxy lifecycle controls', function () {
     foreach ([
         resource_path('views/livewire/project/service/heading.blade.php') => 'service-desktop-actions',
         resource_path('views/livewire/server/navbar.blade.php') => 'server-desktop-actions',
     ] as $path => $id) {
         $heading = file_get_contents($path);
-        $trigger = str($heading)->after("id=\"{$id}\"")->before('<div x-cloak')->toString();
+        $control = str($heading)->after("id=\"{$id}\"")->before('</x-split-action>')->toString();
 
-        expect($trigger)
-            ->toContain('button button-highlighted')
-            ->toContain('Actions')
-            ->not->toContain('play-circle');
+        expect($control)
+            ->toContain('<x-slot:main')
+            ->toContain('listbox-option');
     }
 });
 
-it('places the Traefik dashboard last in the server Actions menu', function () {
+it('links the Traefik dashboard beside the server actions instead of inside the dropdown', function () {
     $navbar = file_get_contents(resource_path('views/livewire/server/navbar.blade.php'));
-    $actions = str($navbar)->after('id="server-desktop-actions"')->before('@endcan')->toString();
+    $desktopActions = str($navbar)->after('id="server-desktop-actions"')->before('</x-split-action>')->toString();
+    $mobileActions = str($navbar)->after('id="server-mobile-actions"')->before('</x-split-action>')->toString();
 
-    expect(strpos($actions, 'Refresh Proxy Status'))
-        ->toBeLessThan(strpos($actions, 'Traefik Dashboard'));
+    expect($desktopActions)->not->toContain('Traefik')
+        ->and($mobileActions)->not->toContain('Traefik')
+        ->and($navbar)->toContain('Traefik Dashboard');
 });
 
 it('keeps database lifecycle controls direct and highlights the primary action', function () {
@@ -342,10 +339,10 @@ it('keeps database lifecycle controls direct and highlights the primary action',
     $desktop = str($heading)->after('resource-heading-actions flex')->before('@endteleport')->toString();
 
     expect($desktop)
+        ->toContain('<x-split-action')
+        ->toContain('<x-slot:main')
         ->toContain('Restart')
         ->toContain('Stop')
-        ->toContain('button button-highlighted')
-        ->not->toContain('<x-reicon')
         ->not->toContain('<x-resource-heading-overflow');
 });
 
@@ -535,7 +532,7 @@ it('uses the same mobile heading gap on deployment pages as application settings
     $deploymentShow = file_get_contents(resource_path('views/livewire/project/application/deployment/show.blade.php'));
 
     expect($configuration)->toContain('application-settings-workspace mt-4')
-        ->and($deploymentIndex)->toContain("'mt-4 max-w-[1180px] lg:mt-0' => ! \$embedded")
+        ->and($deploymentIndex)->toContain("'mt-4 max-w-none lg:mt-0' => ! \$embedded")
         ->and($deploymentShow)->toContain('application-settings-workspace mt-4')
         ->toContain('lg:mt-0');
 });
@@ -573,9 +570,9 @@ it('fits the combined deployment history and logs within the desktop viewport',
 
     expect($indexClass)->toContain('$this->defaultTake = 3;')
         ->and($showView)
-        ->toContain('xl:h-[calc(100dvh-7.5rem)]')
-        ->toContain('xl:overflow-hidden')
-        ->toContain('xl:flex-1');
+        ->toContain('min-h-[calc(100dvh-7.5rem)]')
+        ->toContain('xl:h-[32rem] xl:min-h-0 xl:flex-none')
+        ->toContain('overflow-hidden');
 });
 
 it('uses only the healthcheck toggle action to communicate enabled state', function () {
diff --git a/tests/Feature/SecretManagerApiTest.php b/tests/Feature/SecretManagerApiTest.php
new file mode 100644
index 0000000000..22c7ca1faf
--- /dev/null
+++ b/tests/Feature/SecretManagerApiTest.php
@@ -0,0 +1,119 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    config(['app.maintenance.driver' => 'file']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0, 'is_api_enabled' => true]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->bearerToken = $this->user->createToken('secret-manager-api-test', ['*'])->plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function secretManagerApiHeaders(string $token): array
+{
+    return ['Authorization' => 'Bearer '.$token];
+}
+
+test('a secret manager integration token can be created through the api', function () {
+    Http::fake(['https://api.doppler.com/v3/me' => Http::response([], 200)]);
+
+    $response = $this->withHeaders(secretManagerApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/security/integration-tokens', [
+            'provider' => 'doppler',
+            'name' => 'Production secrets',
+            'token' => 'dp.st.secret',
+        ])
+        ->assertCreated()
+        ->assertJsonStructure(['uuid']);
+
+    $token = IntegrationToken::query()->whereUuid($response->json('uuid'))->firstOrFail();
+
+    expect($token->team_id)->toBe($this->team->id)
+        ->and($token->capabilities)->toBe(['secrets']);
+
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'api.integration_token.created',
+        'resource_uuid' => $token->uuid,
+    ]);
+});
+
+test('secret manager provider base urls only accept http and https', function (string $provider, array $metadata) {
+    Http::fake();
+
+    $this->withHeaders(secretManagerApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/security/integration-tokens', [
+            'provider' => $provider,
+            'name' => 'Invalid base URL',
+            'token' => 'token',
+            'metadata' => $metadata,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors('metadata.base_url');
+
+    Http::assertNothingSent();
+})->with([
+    'infisical' => ['infisical', ['base_url' => 'ftp://infisical.example.com', 'client_id' => 'client-1']],
+    'vault' => ['vault', ['base_url' => 'ftp://vault.example.com']],
+]);
+
+test('an application can be configured to use a secret manager through the api', function () {
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Production secrets',
+        'token' => 'dp.sa.secret',
+        'capabilities' => ['secrets'],
+    ]);
+
+    $this->withHeaders(secretManagerApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}/secret-manager", [
+            'integration_token_uuid' => $token->uuid,
+            'settings' => [
+                'project' => 'website',
+                'config' => 'production',
+            ],
+        ])
+        ->assertOk()
+        ->assertJsonPath('integration_token_uuid', $token->uuid)
+        ->assertJsonPath('provider', 'doppler')
+        ->assertJsonPath('settings.project', 'website');
+
+    $link = $this->application->secretManagerLink()->firstOrFail();
+
+    expect($link->integration_token_id)->toBe($token->id)
+        ->and($link->settings)->toBe(['project' => 'website', 'config' => 'production']);
+
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'api.application.secret_manager.updated',
+        'resource_uuid' => $this->application->uuid,
+    ]);
+});
diff --git a/tests/Feature/SecretManagerLinkMigrationTest.php b/tests/Feature/SecretManagerLinkMigrationTest.php
new file mode 100644
index 0000000000..f79b1ef948
--- /dev/null
+++ b/tests/Feature/SecretManagerLinkMigrationTest.php
@@ -0,0 +1,16 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Schema;
+
+uses(RefreshDatabase::class);
+
+test('resourceable columns have one composite unique index', function () {
+    $resourceableIndexes = collect(Schema::getIndexes('secret_manager_links'))
+        ->filter(fn (array $index): bool => $index['columns'] === ['resourceable_type', 'resourceable_id'])
+        ->values();
+
+    expect($resourceableIndexes)
+        ->toHaveCount(1)
+        ->and($resourceableIndexes->first()['unique'])->toBeTrue();
+});
diff --git a/tests/Feature/SecretManagers/SecretManagerLinkTest.php b/tests/Feature/SecretManagers/SecretManagerLinkTest.php
new file mode 100644
index 0000000000..bbf1924dfe
--- /dev/null
+++ b/tests/Feature/SecretManagers/SecretManagerLinkTest.php
@@ -0,0 +1,471 @@
+<?php
+
+use App\Actions\Database\StartRedis;
+use App\Exceptions\DeploymentException;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Security\IntegrationTokens;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use App\Traits\HasSecretManager;
+use Illuminate\Database\QueryException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function createSecretManagerLink(string $provider, array $settings = [], array $metadata = []): SecretManagerLink
+{
+    $token = IntegrationToken::query()->create([
+        'team_id' => test()->team->id,
+        'provider' => $provider,
+        'name' => ucfirst($provider).' token',
+        'token' => 'the-secret-token',
+        'capabilities' => ['secrets'],
+        'metadata' => $metadata ?: null,
+    ]);
+
+    return test()->application->secretManagerLink()->create([
+        'integration_token_id' => $token->id,
+        'settings' => $settings ?: null,
+    ]);
+}
+
+function makeDeploymentJobForSecrets(): ApplicationDeploymentJob
+{
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+
+    $queue = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'secrets-test-'.fake()->uuid(),
+        'status' => 'in_progress',
+        'server_id' => test()->application->destination->server->id,
+        'destination_id' => test()->application->destination->id,
+        'commit' => 'HEAD',
+        'pull_request_id' => 0,
+    ]);
+
+    $properties = [
+        'application' => test()->application,
+        'application_deployment_queue' => $queue,
+        'mainServer' => test()->application->destination->server,
+        'pull_request_id' => 0,
+    ];
+
+    foreach ($properties as $property => $value) {
+        $reflection = new ReflectionProperty($job, $property);
+        $reflection->setValue($job, $value);
+    }
+
+    return $job;
+}
+
+function resolveEnvOnJob(ApplicationDeploymentJob $job, $env): ?string
+{
+    return (new ReflectionMethod($job, 'resolve_environment_variable'))->invoke($job, $env);
+}
+
+function deploymentHasRemoteBuildtimeReferences(ApplicationDeploymentJob $job): bool
+{
+    return (new ReflectionMethod($job, 'has_remote_buildtime_secret_references'))->invoke($job);
+}
+
+test('remote build-time secret references prevent same-commit image reuse', function (string $reference) {
+    $this->application->environment_variables()->create([
+        'key' => 'BUILD_SECRET',
+        'value' => $reference,
+        'is_buildtime' => true,
+    ]);
+
+    expect(deploymentHasRemoteBuildtimeReferences(makeDeploymentJobForSecrets()))->toBeTrue();
+})->with([
+    'provider-neutral reference' => '{{vault.BUILD_SECRET}}',
+]);
+
+test('runtime-only remote secret references still allow same-commit image reuse', function () {
+    $this->application->environment_variables()->create([
+        'key' => 'RUNTIME_SECRET',
+        'value' => '{{vault.RUNTIME_SECRET}}',
+        'is_buildtime' => false,
+    ]);
+
+    expect(deploymentHasRemoteBuildtimeReferences(makeDeploymentJobForSecrets()))->toBeFalse();
+});
+
+test('a doppler link fetches secrets with the stored token', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 's3cret',
+        ]),
+    ]);
+
+    $link = createSecretManagerLink('doppler', ['project' => 'proj', 'config' => 'prd']);
+
+    expect($link->fetchSecrets())->toBe(['DB_PASSWORD' => 's3cret']);
+
+    Http::assertSent(fn ($request) => $request->hasHeader('Authorization', 'Bearer the-secret-token')
+        && str_contains($request->url(), 'project=proj'));
+});
+
+test('a vault link uses the base url and namespace from the token metadata', function () {
+    Http::fake([
+        'https://example.com:8200/v1/kv/data/apps/web' => Http::response([
+            'data' => ['data' => ['KEY' => 'value']],
+        ]),
+    ]);
+
+    $link = createSecretManagerLink('vault',
+        ['mount' => 'kv', 'path' => 'apps/web'],
+        ['base_url' => 'https://example.com:8200', 'namespace' => 'team-a'],
+    );
+
+    expect($link->fetchSecrets())->toBe(['KEY' => 'value']);
+
+    Http::assertSent(fn ($request) => $request->hasHeader('X-Vault-Namespace', 'team-a'));
+});
+
+test('services resolve environment variables from their configured secret manager', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'API_KEY' => 'remote-service-value',
+        ]),
+    ]);
+
+    $service = Service::factory()->create([
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+    ]);
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Service secrets',
+        'token' => 'the-secret-token',
+        'capabilities' => ['secrets'],
+    ]);
+    $service->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    $environmentVariable = $service->environment_variables()->create([
+        'key' => 'API_KEY',
+        'value' => '{{vault.API_KEY}}',
+    ]);
+
+    expect($service->resolveSecretManagerEnvironmentVariable($environmentVariable))->toBe('remote-service-value');
+});
+
+test('redis remote credentials stay deployment-local and use raw values in the start command', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'REDIS_PASSWORD' => 'p4$$word',
+            'REDIS_USERNAME' => 'remote-user',
+        ]),
+    ]);
+
+    $redis = StandaloneRedis::forceCreate([
+        'uuid' => 'redis-secret-test',
+        'name' => 'Redis secret test',
+        'image' => 'redis:7-alpine',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+    ]);
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Redis secrets',
+        'token' => 'the-secret-token',
+        'capabilities' => ['secrets'],
+    ]);
+    $redis->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    $sharedPassword = SharedEnvironmentVariable::query()->create([
+        'key' => 'REDIS_PASSWORD',
+        'value' => '{{vault.REDIS_PASSWORD}}',
+        'type' => 'team',
+        'team_id' => $this->team->id,
+    ]);
+    $password = $redis->runtime_environment_variables()->create([
+        'key' => 'REDIS_PASSWORD',
+        'value' => '{{team.REDIS_PASSWORD}}',
+    ]);
+    $username = $redis->runtime_environment_variables()->create([
+        'key' => 'REDIS_USERNAME',
+        'value' => '{{vault.REDIS_USERNAME}}',
+    ]);
+
+    $action = new StartRedis;
+    $action->database = $redis;
+    $environmentVariables = (new ReflectionMethod($action, 'generate_environment_variables'))->invoke($action);
+    $startCommand = (new ReflectionMethod($action, 'buildStartCommand'))->invoke($action);
+
+    expect($password->fresh()->value)->toBe('{{team.REDIS_PASSWORD}}')
+        ->and($sharedPassword->fresh()->value)->toBe('{{vault.REDIS_PASSWORD}}')
+        ->and($username->fresh()->value)->toBe('{{vault.REDIS_USERNAME}}')
+        ->and($environmentVariables)->toContain('REDIS_PASSWORD=p4$$word')
+        ->and($environmentVariables)->toContain('REDIS_USERNAME=remote-user')
+        ->and($startCommand)->toContain('--requirepass p4$$word');
+});
+
+test('all deployable environment-variable resources support secret managers', function (string $resourceClass) {
+    expect(class_uses_recursive($resourceClass))->toContain(HasSecretManager::class);
+})->with([
+    Application::class,
+    Service::class,
+    StandalonePostgresql::class,
+    StandaloneMysql::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneRedis::class,
+    StandaloneKeydb::class,
+    StandaloneDragonfly::class,
+    StandaloneClickhouse::class,
+]);
+
+test('an application has at most one secret manager source', function () {
+    createSecretManagerLink('doppler');
+
+    $secondToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vault',
+        'name' => 'Vault token',
+        'token' => 'other-token',
+        'capabilities' => ['secrets'],
+        'metadata' => ['base_url' => 'https://vault.internal:8200'],
+    ]);
+
+    expect(fn () => $this->application->secretManagerLink()->create([
+        'integration_token_id' => $secondToken->id,
+    ]))->toThrow(QueryException::class);
+});
+
+test('a secret reference is substituted at deploy time and formatted as a dotenv literal', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'p4$$word',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://app:{{vault.DB_PASSWORD}}@db:5432/app',
+    ]);
+
+    $job = makeDeploymentJobForSecrets();
+
+    expect(resolveEnvOnJob($job, $env))->toBe("'postgres://app:p4\$\$word@db:5432/app'");
+});
+
+test('provider alias references resolve against the single source', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'API_KEY' => 'abc',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'API_KEY',
+        'value' => '{{vault.API_KEY}}',
+    ]);
+
+    expect(resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))->toBe("'abc'");
+});
+
+test('the fetch happens once per deployment even with many references', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'A' => '1',
+            'B' => '2',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $first = $this->application->environment_variables()->create(['key' => 'A', 'value' => '{{vault.A}}']);
+    $second = $this->application->environment_variables()->create(['key' => 'B', 'value' => '{{vault.B}}']);
+
+    $job = makeDeploymentJobForSecrets();
+    resolveEnvOnJob($job, $first);
+    resolveEnvOnJob($job, $second);
+
+    Http::assertSentCount(1);
+});
+
+test('variables without references never contact the secret manager', function () {
+    Http::fake();
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'PLAIN',
+        'value' => 'plain-value',
+    ]);
+
+    expect(resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))->toBe('plain-value');
+
+    Http::assertNothingSent();
+});
+
+test('a null environment variable value remains null', function () {
+    $env = $this->application->environment_variables()->create([
+        'key' => 'EMPTY',
+        'value' => null,
+    ]);
+
+    expect($this->application->resolveSecretManagerEnvironmentVariable($env))->toBeNull();
+});
+
+test('a missing secret key fails the deployment and names the variable', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'OTHER' => 'value',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DB_PASSWORD',
+        'value' => '{{vault.GONE_KEY}}',
+    ]);
+
+    expect(fn () => resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))
+        ->toThrow(DeploymentException::class, 'Missing secret keys: GONE_KEY (referenced by DB_PASSWORD).');
+});
+
+test('a reference without a configured source fails the deployment', function () {
+    Http::fake();
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DB_PASSWORD',
+        'value' => '{{vault.DB_PASSWORD}}',
+    ]);
+
+    expect(fn () => resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))
+        ->toThrow(DeploymentException::class, 'no secret manager source is configured');
+
+    Http::assertNothingSent();
+});
+
+test('a fetch failure stops the deployment with a clear error', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'messages' => ['Invalid Auth token'],
+        ], 401),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DB_PASSWORD',
+        'value' => '{{vault.DB_PASSWORD}}',
+    ]);
+
+    expect(fn () => resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))
+        ->toThrow(DeploymentException::class, 'Could not fetch secrets from Doppler.');
+});
+
+test('import creates reference variables for missing keys only', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'EXISTING' => 'value-a',
+            'NEW_KEY' => 'value-b',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+    $this->application->environment_variables()->create(['key' => 'EXISTING', 'value' => 'local']);
+
+    $imported = $this->application->secretManagerLink->importMissingReferences();
+
+    expect($imported)->toBe(['NEW_KEY']);
+
+    $created = $this->application->environment_variables()->where('key', 'NEW_KEY')->firstOrFail();
+    expect($created->value)->toBe('{{vault.NEW_KEY}}')
+        ->and($this->application->environment_variables()->where('key', 'EXISTING')->firstOrFail()->value)->toBe('local');
+});
+
+test('secret references are not marked as shared variables', function () {
+    $secretRef = $this->application->environment_variables()->create([
+        'key' => 'A',
+        'value' => '{{vault.A}}',
+    ]);
+    $sharedRef = $this->application->environment_variables()->create([
+        'key' => 'B',
+        'value' => '{{team.B}}',
+    ]);
+
+    expect($secretRef->refresh()->is_shared)->toBeFalse()
+        ->and($sharedRef->refresh()->is_shared)->toBeTrue();
+});
+
+test('remote secret values are formatted as dotenv literals', function () {
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $format = fn (string $value) => (new ReflectionMethod($job, 'format_remote_secret_value'))->invoke($job, $value);
+
+    expect($format('simple'))->toBe("'simple'")
+        ->and($format('with $dollar and spaces'))->toBe("'with \$dollar and spaces'")
+        ->and($format("it's quoted"))->toBe('"it\'s quoted"')
+        ->and($format('{"json": true}'))->toBe('\'{"json": true}\'');
+});
+
+test('deleting an integration token is blocked while links exist', function () {
+    $link = createSecretManagerLink('doppler');
+
+    Livewire\Livewire::test(IntegrationTokens::class)
+        ->call('deleteToken', $link->integration_token_id)
+        ->assertDispatched('error');
+
+    expect(IntegrationToken::query()->whereKey($link->integration_token_id)->exists())->toBeTrue();
+
+    $link->delete();
+
+    Livewire\Livewire::test(IntegrationTokens::class)
+        ->call('deleteToken', $link->integration_token_id)
+        ->assertDispatched('success');
+
+    expect(IntegrationToken::query()->whereKey($link->integration_token_id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/SecretManagers/SecretManagerLinksComponentTest.php b/tests/Feature/SecretManagers/SecretManagerLinksComponentTest.php
new file mode 100644
index 0000000000..28a8707b43
--- /dev/null
+++ b/tests/Feature/SecretManagers/SecretManagerLinksComponentTest.php
@@ -0,0 +1,317 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
+use App\Livewire\Project\Shared\SecretManagerLinks;
+use App\Models\Application;
+use App\Models\AuditEvent;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Js;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $this->token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Doppler production',
+        'token' => 'dp.st.token',
+        'capabilities' => ['secrets'],
+    ]);
+});
+
+test('selecting a token in the dropdown saves the source automatically', function () {
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $this->token->uuid)
+        ->assertDispatched('success');
+
+    $this->assertDatabaseHas('secret_manager_links', [
+        'resourceable_type' => $this->application->getMorphClass(),
+        'resourceable_id' => $this->application->id,
+        'integration_token_id' => $this->token->id,
+    ]);
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'ui.application.secret_manager.source_updated',
+        'resource_uuid' => $this->application->uuid,
+    ]);
+});
+
+test('service account settings are required and save automatically on blur', function () {
+    $serviceAccountToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Doppler service account',
+        'token' => 'dp.sa.token',
+        'capabilities' => ['secrets'],
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $serviceAccountToken->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('saveSettings')
+        ->assertHasErrors(['settings.project', 'settings.config']);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('settings', ['project' => 'proj', 'config' => 'prd'])
+        ->call('saveSettings')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->secretManagerLink()->firstOrFail()->settings)
+        ->toBe(['project' => 'proj', 'config' => 'prd']);
+});
+
+test('doppler settings match the selected token type', function () {
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->assertSee('Project and config are fixed by this service token.')
+        ->assertDontSee('Project (required)');
+
+    $serviceAccountToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Doppler service account',
+        'token' => 'dp.sa.token',
+        'capabilities' => ['secrets'],
+    ]);
+
+    $this->application->secretManagerLink()->update([
+        'integration_token_id' => $serviceAccountToken->id,
+    ]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->assertSee('Project (required)')
+        ->assertSee('Config (required)');
+});
+
+test('selecting another token replaces the source and clears provider settings without checking references', function () {
+    $this->application->secretManagerLink()->create([
+        'integration_token_id' => $this->token->id,
+        'settings' => ['project' => 'proj'],
+    ]);
+    $this->application->environment_variables()->create(['key' => 'A', 'value' => '{{vault.A}}']);
+
+    $otherToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vault',
+        'name' => 'Vault',
+        'token' => 'hvs.token',
+        'capabilities' => ['secrets'],
+        'metadata' => ['base_url' => 'https://vault.internal:8200'],
+    ]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $otherToken->uuid)
+        ->assertDispatched('success')
+        ->assertSet('settings', []);
+
+    $this->assertDatabaseCount('secret_manager_links', 1);
+    $this->assertDatabaseHas('secret_manager_links', [
+        'integration_token_id' => $otherToken->id,
+        'settings' => null,
+    ]);
+
+    Http::assertNothingSent();
+});
+
+test('browse keys shows key names only and search filters them', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'super-secret-value',
+            'API_KEY' => 'another-secret',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    $component = Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('loadKeys')
+        ->assertSee('DB_PASSWORD')
+        ->assertSee('API_KEY')
+        ->assertSee('{{vault.DB_PASSWORD}}')
+        ->assertSeeHtml('class="flex min-w-0 flex-col"')
+        ->assertDontSee('{{ $key }}')
+        ->assertDontSee('super-secret-value')
+        ->assertDontSee('another-secret');
+
+    expect($component->get('keys'))->toBe(['API_KEY', 'DB_PASSWORD']);
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.application.secret_manager.keys_viewed')->sole();
+    expect($auditEvent->metadata['key_count'])->toBe(2)
+        ->and($auditEvent->metadata)->not->toHaveKey('keys');
+
+    $component->set('search', 'db_pass')
+        ->assertSee('DB_PASSWORD')
+        ->assertDontSee('API_KEY');
+});
+
+test('browse key actions encode apostrophes and backslashes', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            "TEAM'S_KEY" => 'apostrophe-secret',
+            'TEAM\\KEY' => 'backslash-secret',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    $apostropheExpression = 'addReference('.Js::from("TEAM'S_KEY").')';
+    $backslashExpression = 'addReference('.Js::from('TEAM\\KEY').')';
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('loadKeys')
+        ->assertSeeHtml('wire:click="'.$apostropheExpression.'"')
+        ->assertSeeHtml('wire:target="'.$apostropheExpression.'"')
+        ->assertSeeHtml('wire:click="'.$backslashExpression.'"')
+        ->assertSeeHtml('wire:target="'.$backslashExpression.'"');
+});
+
+test('add reference creates a variable with a secret reference value', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'super-secret-value',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('loadKeys')
+        ->call('addReference', 'DB_PASSWORD')
+        ->assertDispatched('refreshEnvs')
+        ->assertDispatched('success');
+
+    $created = $this->application->environment_variables()->where('key', 'DB_PASSWORD')->firstOrFail();
+    expect($created->value)->toBe('{{vault.DB_PASSWORD}}');
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.application.secret_manager.reference_created')->sole();
+    expect($auditEvent->metadata['secret_key'])->toBe('[REDACTED]');
+});
+
+test('import all creates references for missing keys and skips existing ones', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'EXISTING' => 'a',
+            'NEW_KEY' => 'b',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+    $this->application->environment_variables()->create(['key' => 'EXISTING', 'value' => 'local']);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('importAll')
+        ->assertDispatched('refreshEnvs')
+        ->assertDispatched('success');
+
+    expect($this->application->environment_variables()->where('key', 'NEW_KEY')->firstOrFail()->value)
+        ->toBe('{{vault.NEW_KEY}}')
+        ->and($this->application->environment_variables()->where('key', 'EXISTING')->firstOrFail()->value)
+        ->toBe('local');
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.application.secret_manager.references_imported')->sole();
+    expect($auditEvent->metadata['key_count'])->toBe(1)
+        ->and($auditEvent->metadata['secret_keys'])->toBe('[REDACTED]');
+});
+
+test('the source can be removed', function () {
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('removeSource')
+        ->assertDispatched('success');
+
+    $this->assertDatabaseCount('secret_manager_links', 0);
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'ui.application.secret_manager.source_removed',
+        'resource_uuid' => $this->application->uuid,
+    ]);
+});
+
+test('members without update permission cannot save a source', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $this->token->uuid)
+        ->assertDispatched('error', 'You need at least admin or owner permissions to update this application.');
+
+    $this->assertDatabaseCount('secret_manager_links', 0);
+});
+
+test('the edit modal value autocomplete offers the vault scope with lazy key fetch', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'super-secret-value',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+    $env = $this->application->environment_variables()->create(['key' => 'MY_VAR', 'value' => 'plain']);
+
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application'])
+        ->call('loadValues')
+        ->assertSeeHtml('hasVaultSource: true');
+
+    expect($component->instance()->fetchSecretManagerKeys())->toBe(['DB_PASSWORD']);
+});
+
+test('the edit modal value autocomplete reports secret provider failures', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([], 503),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+    $env = $this->application->environment_variables()->create(['key' => 'MY_VAR', 'value' => 'plain']);
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application']);
+
+    expect(fn () => $component->instance()->fetchSecretManagerKeys())
+        ->toThrow(RuntimeException::class, 'Unable to fetch secret manager keys.');
+});
+
+test('the edit modal value autocomplete has no vault scope without a source', function () {
+    $env = $this->application->environment_variables()->create(['key' => 'MY_VAR', 'value' => 'plain']);
+
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application'])
+        ->call('loadValues')
+        ->assertSeeHtml('hasVaultSource: false');
+
+    expect($component->instance()->fetchSecretManagerKeys())->toBe([]);
+});
diff --git a/tests/Feature/SecretManagers/SecretManagerServicesTest.php b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
new file mode 100644
index 0000000000..c4e4df36b7
--- /dev/null
+++ b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
@@ -0,0 +1,205 @@
+<?php
+
+use App\Services\DopplerService;
+use App\Services\InfisicalService;
+use App\Services\VaultService;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Validation\ValidationException;
+
+describe('DopplerService', function () {
+    test('downloads secrets as a flat key value map', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+                'DATABASE_URL' => 'postgres://user:pass@host/db',
+                'API_KEY' => 'secret-value',
+            ]),
+        ]);
+
+        $secrets = (new DopplerService('dp.st.test'))->fetchSecrets();
+
+        expect($secrets)->toBe([
+            'DATABASE_URL' => 'postgres://user:pass@host/db',
+            'API_KEY' => 'secret-value',
+        ]);
+
+        Http::assertSent(fn ($request) => $request->hasHeader('Authorization', 'Bearer dp.st.test')
+            && str_contains($request->url(), 'format=json')
+            && ! str_contains($request->url(), 'project='));
+    });
+
+    test('sends project and config for service account tokens', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response(['KEY' => 'value']),
+        ]);
+
+        (new DopplerService('dp.sa.test'))->fetchSecrets('my-project', 'prd');
+
+        Http::assertSent(fn ($request) => str_contains($request->url(), 'project=my-project')
+            && str_contains($request->url(), 'config=prd'));
+    });
+
+    test('throws a readable error when the download fails', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+                'messages' => ['Invalid Auth token'],
+            ], 401),
+        ]);
+
+        expect(fn () => (new DopplerService('bad-token'))->fetchSecrets())
+            ->toThrow(RuntimeException::class, 'Doppler API error: Invalid Auth token');
+    });
+
+    test('validates the token against the me endpoint', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/me' => Http::response(['type' => 'service_token']),
+        ]);
+
+        expect((new DopplerService('dp.st.test'))->validate())->toBeTrue();
+    });
+
+    test('validation fails for a rejected token', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/me' => Http::response([], 401),
+        ]);
+
+        expect((new DopplerService('bad'))->validate())->toBeFalse();
+    });
+});
+
+describe('InfisicalService', function () {
+    test('rejects an unapproved endpoint before sending credentials', function () {
+        Http::fake();
+
+        expect(fn () => new InfisicalService('http://127.0.0.1:8080', 'client-id', 'client-secret'))
+            ->toThrow(ValidationException::class);
+
+        Http::assertNothingSent();
+    });
+
+    test('logs in with universal auth and fetches secrets from the v4 endpoint', function () {
+        Http::fake([
+            'https://example.com/infisical/api/v1/auth/universal-auth/login' => Http::response([
+                'accessToken' => 'short-lived-token',
+            ]),
+            'https://example.com/infisical/api/v4/secrets*' => Http::response([
+                'secrets' => [
+                    ['secretKey' => 'DB_PASSWORD', 'secretValue' => 's3cret'],
+                    ['secretKey' => 'API_KEY', 'secretValue' => 'abc'],
+                ],
+            ]),
+        ]);
+
+        $service = new InfisicalService('https://example.com/infisical/', 'client-id', 'client-secret');
+        $secrets = $service->fetchSecrets('project-1', 'prod', '/');
+
+        expect($secrets)->toBe([
+            'DB_PASSWORD' => 's3cret',
+            'API_KEY' => 'abc',
+        ]);
+
+        Http::assertSent(fn ($request) => str_contains($request->url(), '/api/v4/secrets')
+            && $request->hasHeader('Authorization', 'Bearer short-lived-token')
+            && str_contains($request->url(), 'projectId=project-1'));
+    });
+
+    test('falls back to the v3 raw endpoint on older self-hosted instances', function () {
+        Http::fake([
+            'https://example.com/infisical/api/v1/auth/universal-auth/login' => Http::response([
+                'accessToken' => 'short-lived-token',
+            ]),
+            'https://example.com/infisical/api/v4/secrets*' => Http::response([], 404),
+            'https://example.com/infisical/api/v3/secrets/raw*' => Http::response([
+                'secrets' => [
+                    ['secretKey' => 'LEGACY_KEY', 'secretValue' => 'legacy-value'],
+                ],
+            ]),
+        ]);
+
+        $service = new InfisicalService('https://example.com/infisical', 'client-id', 'client-secret');
+
+        expect($service->fetchSecrets('project-1', 'prod'))->toBe(['LEGACY_KEY' => 'legacy-value']);
+
+        Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1'));
+    });
+
+    test('throws when the login fails', function () {
+        Http::fake([
+            'https://example.com/infisical/api/v1/auth/universal-auth/login' => Http::response([
+                'message' => 'Invalid credentials',
+            ], 401),
+        ]);
+
+        $service = new InfisicalService('https://example.com/infisical', 'client-id', 'wrong');
+
+        expect($service->validate())->toBeFalse()
+            ->and(fn () => $service->fetchSecrets('project-1', 'prod'))
+            ->toThrow(RuntimeException::class, 'Infisical login failed: Invalid credentials');
+    });
+});
+
+describe('VaultService', function () {
+    test('rejects an unapproved endpoint before sending the token', function () {
+        Http::fake();
+
+        expect(fn () => new VaultService('http://127.0.0.1:8200', 'hvs.token'))
+            ->toThrow(ValidationException::class);
+
+        Http::assertNothingSent();
+    });
+
+    test('reads a kv v2 secret and stringifies non-string values', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/secret/data/my-app/production' => Http::response([
+                'data' => [
+                    'data' => [
+                        'DB_PASSWORD' => 's3cret',
+                        'REPLICAS' => 3,
+                    ],
+                ],
+            ]),
+        ]);
+
+        $secrets = (new VaultService('https://example.com:8200/vault/', 'hvs.token'))
+            ->fetchSecrets('secret', '/my-app/production/');
+
+        expect($secrets)->toBe([
+            'DB_PASSWORD' => 's3cret',
+            'REPLICAS' => '3',
+        ]);
+
+        Http::assertSent(fn ($request) => $request->hasHeader('X-Vault-Token', 'hvs.token')
+            && ! $request->hasHeader('X-Vault-Namespace'));
+    });
+
+    test('sends the namespace header when configured', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/secret/data/my-app' => Http::response([
+                'data' => ['data' => ['KEY' => 'value']],
+            ]),
+        ]);
+
+        (new VaultService('https://example.com:8200/vault', 'hvs.token', 'admin/team-a'))
+            ->fetchSecrets('secret', 'my-app');
+
+        Http::assertSent(fn ($request) => $request->hasHeader('X-Vault-Namespace', 'admin/team-a'));
+    });
+
+    test('throws a readable error when the read fails', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/secret/data/missing' => Http::response([
+                'errors' => ['permission denied'],
+            ], 403),
+        ]);
+
+        expect(fn () => (new VaultService('https://example.com:8200/vault', 'hvs.token'))->fetchSecrets('secret', 'missing'))
+            ->toThrow(RuntimeException::class, 'Vault API error: permission denied');
+    });
+
+    test('validates the token with lookup-self', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/auth/token/lookup-self' => Http::response(['data' => []]),
+        ]);
+
+        expect((new VaultService('https://example.com:8200/vault', 'hvs.token'))->validate())->toBeTrue();
+    });
+});
diff --git a/tests/Feature/Security/IntegrationTokenFormTest.php b/tests/Feature/Security/IntegrationTokenFormTest.php
new file mode 100644
index 0000000000..2bffb5ae22
--- /dev/null
+++ b/tests/Feature/Security/IntegrationTokenFormTest.php
@@ -0,0 +1,285 @@
+<?php
+
+use App\Livewire\Security\IntegrationTokenEditor;
+use App\Livewire\Security\IntegrationTokenForm;
+use App\Livewire\Security\IntegrationTokens;
+use App\Models\AuditEvent;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+test('a cloudflare dns token is validated with read only requests before it is saved', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => true,
+            'result' => ['status' => 'active'],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [['id' => 'zone-id']],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [],
+        ]),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class, ['modal_mode' => true])
+        ->set('provider', 'cloudflare')
+        ->set('name', 'Production DNS')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', ['dns'])
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('close-modal');
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+    ]);
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'ui.integration_token.created',
+        'resource_name' => 'Production DNS',
+    ]);
+
+    Http::assertSentCount(3);
+    Http::assertSent(fn ($request) => $request->method() === 'GET'
+        && $request->url() === 'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1');
+});
+
+test('deleting an integration token is audited without storing its value', function () {
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Production secrets',
+        'token' => 'dp.st.super-secret',
+        'capabilities' => ['secrets'],
+    ]);
+
+    Livewire::test(IntegrationTokens::class)->call('deleteToken', $token->id);
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.integration_token.deleted')->sole();
+
+    expect($auditEvent->resource_uuid)->toBe($token->uuid)
+        ->and(json_encode($auditEvent->metadata))->not->toContain('dp.st.super-secret');
+});
+
+test('a cloudflare token is not saved when scope validation fails', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => true,
+            'result' => ['status' => 'active'],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
+            'success' => false,
+            'errors' => [['message' => 'Authentication error']],
+        ], 403),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('name', 'Invalid DNS token')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', ['dns'])
+        ->call('addToken')
+        ->assertDispatched('error');
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
+
+test('at least one capability is required when adding a cloudflare token', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('name', 'Account token')
+        ->set('token', 'cloudflare-token')
+        ->set('capabilities', [])
+        ->call('addToken')
+        ->assertHasErrors(['capabilities' => 'required']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+    Http::assertNothingSent();
+});
+
+test('provider validation uses the provider names declared by the model', function () {
+    $component = file_get_contents(app_path('Livewire/Security/IntegrationTokenForm.php'));
+
+    expect($component)
+        ->toContain("implode(',', array_keys(IntegrationToken::PROVIDER_NAMES))")
+        ->not->toContain('in:cloudflare,doppler,infisical,vault');
+});
+
+test('integration tokens page lists saved provider and capabilities', function () {
+    IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'secret',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokens::class)
+        ->assertSee('Production DNS')
+        ->assertSee('Cloudflare')
+        ->assertSee('DNS');
+});
+
+test('cloudflare dns scope guidance and token creation link are shown', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('capabilities', ['dns'])
+        ->assertSee('Zone - DNS - Edit')
+        ->assertSee('Zone - Zone - Read')
+        ->assertSeeHtml('https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D&amp;accountId=%2A&amp;zoneId=all&amp;name=Coolify%20DNS%20Management');
+
+    expect(file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php')))
+        ->toContain('permissionGroupKeys=%5B%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22edit%22%7D%5D');
+});
+
+test('capability selection uses the shared checkbox component', function () {
+    $view = file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php'));
+
+    expect($view)
+        ->toContain('<x-forms.checkbox')
+        ->toContain('class="mt-3 rounded-lg border')
+        ->not->toContain('<input type="checkbox"');
+});
+
+test('submit button uses the shared highlighted loading state', function () {
+    $view = file_get_contents(resource_path('views/livewire/security/integration-token-form.blade.php'));
+
+    expect($view)
+        ->toContain('wire:target="addToken" isHighlighted')
+        ->not->toContain('class="button-highlighted"');
+});
+
+test('saved integration token rows render modal editors with a gear button', function () {
+    IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokens::class)
+        ->assertSee('Edit Integration Token')
+        ->assertSee('Production DNS')
+        ->assertSeeHtml(':aria-label="`Edit ${tokenName}`"');
+});
+
+test('an integration token can be rotated after validating its capabilities', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => true,
+            'result' => ['status' => 'active'],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [['id' => 'zone-id']],
+        ]),
+        'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1' => Http::response([
+            'success' => true,
+            'result' => [],
+        ]),
+    ]);
+
+    $savedToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $savedToken->uuid])
+        ->set('name', 'Rotated DNS')
+        ->set('newToken', 'rotated-token')
+        ->call('save')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    $savedToken->refresh();
+
+    expect($savedToken->name)->toBe('Rotated DNS')
+        ->and($savedToken->token)->toBe('rotated-token');
+});
+
+test('leaving the token field blank keeps the existing integration token', function () {
+    Http::fake();
+
+    $savedToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $savedToken->uuid])
+        ->set('name', 'Renamed DNS')
+        ->set('newToken', '')
+        ->call('save')
+        ->assertHasNoErrors();
+
+    $savedToken->refresh();
+
+    expect($savedToken->name)->toBe('Renamed DNS')
+        ->and($savedToken->token)->toBe('original-token');
+
+    Http::assertNothingSent();
+});
+
+test('an invalid replacement does not rotate the integration token', function () {
+    Http::fake([
+        'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
+            'success' => false,
+        ], 403),
+    ]);
+
+    $savedToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'cloudflare',
+        'name' => 'Production DNS',
+        'token' => 'original-token',
+        'capabilities' => ['dns'],
+    ]);
+
+    Livewire::test(IntegrationTokenEditor::class, ['integration_token_uuid' => $savedToken->uuid])
+        ->set('newToken', 'invalid-token')
+        ->call('save')
+        ->assertDispatched('error');
+
+    expect($savedToken->fresh()->token)->toBe('original-token');
+});
+
+test('editor updates its row without rerendering the teleported parent modal', function () {
+    $component = file_get_contents(app_path('Livewire/Security/IntegrationTokenEditor.php'));
+
+    expect($component)
+        ->toContain("'integration-token-updated'")
+        ->toContain("'integration-token-deleted'")
+        ->not->toContain('integrationTokenChanged');
+});
diff --git a/tests/Feature/Security/IntegrationTokenSecretProvidersTest.php b/tests/Feature/Security/IntegrationTokenSecretProvidersTest.php
new file mode 100644
index 0000000000..794195504a
--- /dev/null
+++ b/tests/Feature/Security/IntegrationTokenSecretProvidersTest.php
@@ -0,0 +1,191 @@
+<?php
+
+use App\Livewire\Security\IntegrationTokenForm;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+test('a doppler token is validated against the doppler api before it is saved', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/me' => Http::response(['type' => 'service_token']),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class, ['modal_mode' => true])
+        ->set('provider', 'doppler')
+        ->set('name', 'Production secrets')
+        ->set('token', 'dp.st.token')
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('close-modal');
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Production secrets',
+    ]);
+});
+
+test('selecting a secret manager provider switches the capability to secrets', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->assertSet('capabilities', ['secrets'])
+        ->set('provider', 'cloudflare')
+        ->assertSet('capabilities', ['dns']);
+});
+
+test('an invalid doppler token is not saved', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/me' => Http::response([], 401),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Bad token')
+        ->set('token', 'dp.st.rejected')
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('error');
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
+
+test('doppler only accepts service and service account tokens', function (string $token) {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Unsupported token')
+        ->set('token', $token)
+        ->call('addToken')
+        ->assertHasErrors(['token']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+})->with([
+    'personal token' => 'dp.pt.token',
+    'unknown token' => 'token',
+]);
+
+test('a doppler service account token is accepted', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/me' => Http::response(['type' => 'service_account']),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Shared secrets')
+        ->set('token', 'dp.sa.token')
+        ->call('addToken')
+        ->assertHasNoErrors();
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'provider' => 'doppler',
+        'name' => 'Shared secrets',
+    ]);
+});
+
+test('an infisical token requires a base url and a client id', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'infisical')
+        ->set('name', 'Infisical')
+        ->set('token', 'client-secret')
+        ->set('metadata', [])
+        ->call('addToken')
+        ->assertHasErrors(['metadata.base_url', 'metadata.client_id']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
+
+test('secret manager provider base urls only accept http and https', function (string $provider, array $metadata) {
+    Http::fake();
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', $provider)
+        ->set('name', 'Invalid base URL')
+        ->set('token', 'token')
+        ->set('metadata', $metadata)
+        ->call('addToken')
+        ->assertHasErrors(['metadata.base_url']);
+
+    Http::assertNothingSent();
+    $this->assertDatabaseCount('integration_tokens', 0);
+})->with([
+    'infisical' => ['infisical', ['base_url' => 'ftp://infisical.example.com', 'client_id' => 'client-1']],
+    'vault' => ['vault', ['base_url' => 'ftp://vault.example.com']],
+]);
+
+test('the infisical fields put the client id before the client secret', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'infisical')
+        ->assertSeeInOrder(['Token name', 'Client ID', 'Client secret', 'Base URL']);
+});
+
+test('an infisical token stores its metadata after a successful login', function () {
+    Http::fake([
+        'https://example.com/api/v1/auth/universal-auth/login' => Http::response([
+            'accessToken' => 'token',
+        ]),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'infisical')
+        ->set('name', 'Infisical')
+        ->set('token', 'client-secret')
+        ->set('metadata', ['base_url' => 'https://example.com', 'client_id' => 'client-1'])
+        ->call('addToken')
+        ->assertHasNoErrors();
+
+    $token = IntegrationToken::query()->where('provider', 'infisical')->firstOrFail();
+
+    expect($token->metadata)->toBe(['base_url' => 'https://example.com', 'client_id' => 'client-1'])
+        ->and($token->capabilities)->toBe(['secrets']);
+});
+
+test('a vault token is validated with lookup-self before it is saved', function () {
+    Http::fake([
+        'https://example.com:8200/v1/auth/token/lookup-self' => Http::response(['data' => []]),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'vault')
+        ->set('name', 'Vault')
+        ->set('token', 'hvs.token')
+        ->set('metadata', ['base_url' => 'https://example.com:8200'])
+        ->call('addToken')
+        ->assertHasNoErrors();
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'provider' => 'vault',
+        'name' => 'Vault',
+    ]);
+});
+
+test('the dns capability is rejected for secret manager providers', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Doppler')
+        ->set('token', 'dp.st.token')
+        ->set('capabilities', ['dns'])
+        ->call('addToken')
+        ->assertHasErrors(['capabilities.0']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
diff --git a/tests/Feature/SecuritySettingsNavigationTest.php b/tests/Feature/SecuritySettingsNavigationTest.php
index e89bf8093a..9eab92cc28 100644
--- a/tests/Feature/SecuritySettingsNavigationTest.php
+++ b/tests/Feature/SecuritySettingsNavigationTest.php
@@ -8,6 +8,7 @@ it('uses shared sidebar navigation for keys and tokens pages', function () {
         'security/private-key/index.blade.php',
         'security/private-key/show.blade.php',
         'security/cloud-tokens.blade.php',
+        'security/integration-tokens.blade.php',
         'security/cloud-provider-token/show.blade.php',
         'security/cloud-init-scripts.blade.php',
         'security/cloud-init-script/show.blade.php',
@@ -22,6 +23,7 @@ it('uses shared sidebar navigation for keys and tokens pages', function () {
         ->toContain('application-settings-navigation')
         ->toContain("'label' => 'Private Keys'")
         ->toContain("'label' => 'Cloud Tokens'")
+        ->toContain("'label' => 'Integration Tokens'")
         ->toContain("'label' => 'Cloud-Init Scripts'")
         ->toContain("'label' => 'API Tokens'");
 
diff --git a/tests/Feature/SettingsEmailProviderExclusivityTest.php b/tests/Feature/SettingsEmailProviderExclusivityTest.php
new file mode 100644
index 0000000000..7e6b6ff232
--- /dev/null
+++ b/tests/Feature/SettingsEmailProviderExclusivityTest.php
@@ -0,0 +1,64 @@
+<?php
+
+use App\Livewire\SettingsEmail;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->settings = new InstanceSettings;
+    $this->settings->id = 0;
+    $this->settings->save();
+    $this->rootTeam = Team::factory()->create(['id' => 0]);
+    $this->user = User::factory()->create();
+    $this->user->teams()->attach($this->rootTeam, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->rootTeam]);
+});
+
+test('enabling SMTP disables Resend in storage', function () {
+    $this->settings->update([
+        'resend_enabled' => true,
+        'resend_api_key' => 're_test_key',
+        'smtp_from_address' => 'from@example.com',
+        'smtp_from_name' => 'Coolify',
+    ]);
+
+    Livewire::test(SettingsEmail::class)
+        ->set('smtpHost', 'smtp.example.com')
+        ->set('smtpPort', '587')
+        ->set('smtpEncryption', 'starttls')
+        ->set('smtpFromAddress', 'from@example.com')
+        ->set('smtpFromName', 'Coolify')
+        ->call('toggleSmtp');
+
+    $this->settings->refresh();
+    expect($this->settings->smtp_enabled)->toBeTrue();
+    expect($this->settings->resend_enabled)->toBeFalse();
+});
+
+test('enabling Resend disables SMTP in storage', function () {
+    $this->settings->update([
+        'smtp_enabled' => true,
+        'smtp_host' => 'smtp.example.com',
+        'smtp_port' => '587',
+        'smtp_encryption' => 'starttls',
+        'smtp_from_address' => 'from@example.com',
+        'smtp_from_name' => 'Coolify',
+    ]);
+
+    Livewire::test(SettingsEmail::class)
+        ->set('resendApiKey', 're_test_key')
+        ->set('smtpFromAddress', 'from@example.com')
+        ->set('smtpFromName', 'Coolify')
+        ->call('toggleResend');
+
+    $this->settings->refresh();
+    expect($this->settings->resend_enabled)->toBeTrue();
+    expect($this->settings->smtp_enabled)->toBeFalse();
+});
diff --git a/tests/Feature/SettingsNavigationTest.php b/tests/Feature/SettingsNavigationTest.php
new file mode 100644
index 0000000000..96b01d8d98
--- /dev/null
+++ b/tests/Feature/SettingsNavigationTest.php
@@ -0,0 +1,52 @@
+<?php
+
+it('keeps backup and transactional email out of the settings top navigation', function () {
+    $this->blade('<x-settings.navbar />')
+        ->assertSeeText('Configuration')
+        ->assertSeeText('OAuth')
+        ->assertSeeText('Scheduled Jobs')
+        ->assertDontSeeText('Instance Backup')
+        ->assertDontSeeText('Transactional Email');
+});
+
+it('shows backup and transactional email in the settings configuration sidebar', function () {
+    $view = $this->blade('<x-settings.sidebar activeMenu="backup" />')
+        ->assertSeeTextInOrder([
+            'General',
+            'Advanced',
+            'Instance Backup',
+            'Transactional Email',
+            'Updates',
+        ]);
+
+    expect((string) $view)
+        ->toContain(route('settings.backup'))
+        ->toContain(route('settings.email'))
+        ->and(substr_count((string) $view, 'menu-item-active'))->toBe(1);
+});
+
+it('renders backup and transactional email pages with the settings configuration sidebar', function () {
+    expect(file_get_contents(resource_path('views/livewire/settings-backup.blade.php')))
+        ->toContain('<x-settings.sidebar activeMenu="backup" />')
+        ->and(file_get_contents(resource_path('views/livewire/settings-email.blade.php')))
+        ->toContain('<x-settings.sidebar activeMenu="email" />');
+});
+
+it('uses the same title and description spacing on backup and transactional email settings pages', function () {
+    expect(file_get_contents(resource_path('views/livewire/settings-backup.blade.php')))
+        ->not->toContain('class="flex items-center gap-2 pb-2"')
+        ->toContain('<div class="pb-4">Instance backup configuration for Coolify instance.</div>')
+        ->and(file_get_contents(resource_path('views/livewire/settings-email.blade.php')))
+        ->not->toContain('class="flex flex-col gap-2 pb-4"')
+        ->toContain('<div class="pb-4">Instance wide email settings for password resets, invitations, etc.</div>');
+});
+
+it('uses instance backup as the backup settings label', function () {
+    expect(file_get_contents(resource_path('views/components/settings/sidebar.blade.php')))
+        ->toContain('<span class="menu-item-label">Instance Backup</span>')
+        ->not->toContain('<span class="menu-item-label">Backup</span>')
+        ->and(file_get_contents(resource_path('views/livewire/settings-backup.blade.php')))
+        ->toContain('<h2>Instance Backup</h2>')
+        ->toContain('Instance backup configuration for Coolify instance.')
+        ->not->toContain('<h2>Backup</h2>');
+});
diff --git a/tests/Feature/SettingsOauthTest.php b/tests/Feature/SettingsOauthTest.php
new file mode 100644
index 0000000000..95ea47e948
--- /dev/null
+++ b/tests/Feature/SettingsOauthTest.php
@@ -0,0 +1,277 @@
+<?php
+
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Livewire\SettingsOauth;
+use App\Models\InstanceSettings;
+use App\Models\OauthSetting;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function actingAsInstanceAdmin(): User
+{
+    $team = Team::forceCreate(['id' => 0, 'name' => 'Root Team', 'personal_team' => true]);
+    $user = User::factory()->create(['id' => 0, 'email' => 'root@example.com', 'email_verified_at' => now()]);
+    if (! $user->teams()->whereKey($team->id)->exists()) {
+        $user->teams()->attach($team, ['role' => 'owner']);
+    }
+    session(['currentTeam' => $team]);
+    test()->actingAs($user);
+
+    return $user;
+}
+
+beforeEach(function () {
+    $this->withoutVite();
+    config()->set('app.maintenance.driver', 'file');
+
+    InstanceSettings::forceCreate(['id' => 0, 'is_registration_enabled' => true]);
+    Once::flush();
+    OauthSetting::create(['provider' => 'oidc']);
+    OauthSetting::create(['provider' => 'authentik']);
+    OauthSetting::create(['provider' => 'bitbucket']);
+});
+
+it('uses the standard settings design and keeps every oauth provider on one page', function () {
+    actingAsInstanceAdmin();
+
+    $this->withoutMiddleware(DecideWhatToDoWithUser::class)
+        ->get(route('settings.oauth'))
+        ->assertSuccessful()
+        ->assertSee('Authentication')
+        ->assertSee('Registration')
+        ->assertSee('Authentik')
+        ->assertSee('Bitbucket')
+        ->assertSee('OpenID Connect')
+        ->assertSee('Disable password registration when OAuth is enabled')
+        ->assertSee('Client secret')
+        ->assertSee('application-settings-form', false)
+        ->assertDontSee(route('settings.oauth.provider', 'authentik'), false);
+});
+
+it('lists openid connect before the other oauth providers', function () {
+    actingAsInstanceAdmin();
+
+    $providers = array_keys(Livewire::test(SettingsOauth::class)->get('oauth_settings_map'));
+
+    expect($providers[0])->toBe('oidc');
+});
+
+it('has an icon for openid connect', function () {
+    expect(public_path('svgs/oidc.svg'))->toBeFile();
+});
+
+it('auto saves registration policy without a general save button', function () {
+    actingAsInstanceAdmin();
+
+    $this->withoutMiddleware(DecideWhatToDoWithUser::class)
+        ->get(route('settings.oauth'))
+        ->assertSuccessful()
+        ->assertSee("wire:click='saveRegistrationPolicy'", false)
+        ->assertDontSee('Save</button>', false);
+
+    Livewire::test(SettingsOauth::class)
+        ->set('disable_registration_when_oauth_enabled', true)
+        ->call('saveRegistrationPolicy')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect(instanceSettings()->fresh()->disable_registration_when_oauth_enabled)->toBeTrue();
+});
+
+it('shows oidc fields with a naked okta issuer url example', function () {
+    actingAsInstanceAdmin();
+
+    $this->withoutMiddleware(DecideWhatToDoWithUser::class)
+        ->get(route('settings.oauth'))
+        ->assertSuccessful()
+        ->assertSee('OpenID Connect')
+        ->assertSee('https://example.okta.com', false)
+        ->assertDontSee('/oauth2/default', false);
+});
+
+it('groups oidc fields in the expected desktop order', function () {
+    $view = file_get_contents(resource_path('views/livewire/settings-oauth.blade.php'));
+    $fields = [
+        'redirect_uri',
+        'base_url',
+        'client_id',
+        'client_secret',
+        'scopes',
+        'clock_skew_seconds',
+        'custom_label',
+    ];
+    $positions = array_map(
+        fn (string $field): int|false => strpos($view, "id=\"oauth_settings_map.{{ \$provider }}.$field\""),
+        $fields,
+    );
+
+    expect($positions)->not->toContain(false)
+        ->and($positions)->toBe(collect($positions)->sort()->values()->all())
+        ->and($view)->toContain('<div class="lg:col-span-2">');
+});
+
+it('shows provider enable controls as settings section actions', function () {
+    actingAsInstanceAdmin();
+
+    $this->withoutMiddleware(DecideWhatToDoWithUser::class)
+        ->get(route('settings.oauth'))
+        ->assertSuccessful()
+        ->assertSee('Enable')
+        ->assertDontSee('label="Enabled"', false)
+        ->assertDontSee('p-4 border dark:border-coolgray-300 border-neutral-200', false);
+});
+
+it('stacks oidc option checkboxes vertically', function () {
+    actingAsInstanceAdmin();
+
+    $this->withoutMiddleware(DecideWhatToDoWithUser::class)
+        ->get(route('settings.oauth'))
+        ->assertSuccessful()
+        ->assertSee('Allow OIDC user creation')
+        ->assertSee('Require verified email')
+        ->assertSee('Use PKCE')
+        ->assertDontSee('flex flex-col gap-2 pt-2 md:flex-row', false);
+});
+
+it('does not show unknown oauth providers', function () {
+    actingAsInstanceAdmin();
+
+    $this->withoutMiddleware(DecideWhatToDoWithUser::class)
+        ->get('/settings/oauth/unknown')
+        ->assertNotFound();
+});
+
+it('defaults oidc user creation and verified email requirement to enabled', function () {
+    $setting = OauthSetting::where('provider', 'oidc')->first();
+
+    expect($setting->allow_registration)->toBeTrue()
+        ->and($setting->require_email_verified)->toBeTrue()
+        ->and($setting->auto_join_root_team)->toBeFalse();
+});
+
+it('persists oidc oauth settings from livewire', function () {
+    actingAsInstanceAdmin();
+
+    Livewire::test(SettingsOauth::class)
+        ->set('oauth_settings_map.oidc.enabled', true)
+        ->set('oauth_settings_map.oidc.client_id', 'client-id')
+        ->set('oauth_settings_map.oidc.client_secret', 'secret')
+        ->set('oauth_settings_map.oidc.redirect_uri', 'https://coolify.example.com/auth/oidc/callback')
+        ->set('oauth_settings_map.oidc.base_url', 'https://idp.example.com')
+        ->set('oauth_settings_map.oidc.scopes', 'openid email profile groups')
+        ->set('oauth_settings_map.oidc.custom_label', 'Login with Okta')
+        ->set('oauth_settings_map.oidc.allow_registration', true)
+        ->set('oauth_settings_map.oidc.auto_join_root_team', true)
+        ->set('oauth_settings_map.oidc.require_email_verified', true)
+        ->set('disable_registration_when_oauth_enabled', true)
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $setting = OauthSetting::where('provider', 'oidc')->first();
+    expect($setting->enabled)->toBeTrue()
+        ->and($setting->redirect_uri)->toBe('https://coolify.example.com/auth/oidc/callback')
+        ->and($setting->base_url)->toBe('https://idp.example.com')
+        ->and($setting->custom_label)->toBe('Login with Okta')
+        ->and($setting->scopeList())->toBe(['openid', 'email', 'profile', 'groups'])
+        ->and($setting->allow_registration)->toBeTrue()
+        ->and($setting->auto_join_root_team)->toBeTrue();
+
+    expect(instanceSettings()->fresh()->disable_registration_when_oauth_enabled)->toBeTrue();
+});
+
+it('saves only the selected provider from provider pages', function () {
+    actingAsInstanceAdmin();
+
+    Livewire::test(SettingsOauth::class, ['provider' => 'authentik'])
+        ->set('oauth_settings_map.oidc.redirect_uri', 'not-a-url')
+        ->set('oauth_settings_map.authentik.enabled', true)
+        ->set('oauth_settings_map.authentik.client_id', 'authentik-client')
+        ->set('oauth_settings_map.authentik.client_secret', 'authentik-secret')
+        ->set('oauth_settings_map.authentik.base_url', 'https://authentik.example.com')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $setting = OauthSetting::where('provider', 'authentik')->first();
+    expect($setting->enabled)->toBeTrue()
+        ->and($setting->client_id)->toBe('authentik-client')
+        ->and($setting->base_url)->toBe('https://authentik.example.com');
+});
+
+it('validates oidc url fields before saving', function (string $field, string $value) {
+    actingAsInstanceAdmin();
+
+    Livewire::test(SettingsOauth::class)
+        ->set('oauth_settings_map.oidc.client_id', 'client-id')
+        ->set('oauth_settings_map.oidc.client_secret', 'secret')
+        ->set('oauth_settings_map.oidc.base_url', 'https://idp.example.com')
+        ->set("oauth_settings_map.oidc.$field", $value)
+        ->call('submit')
+        ->assertHasErrors(["oauth_settings_map.oidc.$field" => 'url']);
+
+    $setting = OauthSetting::where('provider', 'oidc')->first();
+    expect($setting->{$field})->toBeNull();
+})->with([
+    'invalid redirect uri' => ['redirect_uri', 'not-a-url'],
+    'non-http redirect uri' => ['redirect_uri', 'javascript:alert(1)'],
+    'invalid issuer url' => ['base_url', 'not-a-url'],
+    'non-http issuer url' => ['base_url', 'ftp://idp.example.com'],
+]);
+
+it('does not enable oidc without required fields', function () {
+    actingAsInstanceAdmin();
+
+    Livewire::test(SettingsOauth::class)
+        ->set('oauth_settings_map.oidc.enabled', true)
+        ->call('instantSave', 'oidc')
+        ->assertDispatched('error');
+
+    expect(OauthSetting::where('provider', 'oidc')->first()->enabled)->toBeFalse();
+});
+
+it('keeps provider disabled in the ui when enable validation fails', function () {
+    actingAsInstanceAdmin();
+
+    Livewire::test(SettingsOauth::class, ['provider' => 'authentik'])
+        ->call('toggleProvider', 'authentik')
+        ->assertDispatched('error')
+        ->assertSet('oauth_settings_map.authentik.enabled', false);
+
+    expect(OauthSetting::where('provider', 'authentik')->first()->enabled)->toBeFalse();
+});
+
+it('disables an enabled provider gracefully when required fields become incomplete', function () {
+    actingAsInstanceAdmin();
+
+    OauthSetting::where('provider', 'authentik')->first()->forceFill([
+        'enabled' => true,
+        'client_id' => 'authentik-client',
+        'client_secret' => 'authentik-secret',
+        'base_url' => 'https://authentik.example.com',
+    ])->save();
+
+    Livewire::test(SettingsOauth::class, ['provider' => 'authentik'])
+        ->set('oauth_settings_map.authentik.client_secret', '')
+        ->call('submit')
+        ->assertDispatched('error')
+        ->assertSet('oauth_settings_map.authentik.enabled', false);
+
+    expect(OauthSetting::where('provider', 'authentik')->first()->enabled)->toBeFalse();
+});
+
+it('toggles provider enabled state from the action button', function () {
+    actingAsInstanceAdmin();
+
+    Livewire::test(SettingsOauth::class, ['provider' => 'authentik'])
+        ->set('oauth_settings_map.authentik.client_id', 'authentik-client')
+        ->set('oauth_settings_map.authentik.client_secret', 'authentik-secret')
+        ->set('oauth_settings_map.authentik.base_url', 'https://authentik.example.com')
+        ->call('toggleProvider', 'authentik')
+        ->assertHasNoErrors();
+
+    expect(OauthSetting::where('provider', 'authentik')->first()->enabled)->toBeTrue();
+});
diff --git a/tests/Feature/SshMultiplexingLockTest.php b/tests/Feature/SshMultiplexingLockTest.php
index 45e150dfab..272156fbd2 100644
--- a/tests/Feature/SshMultiplexingLockTest.php
+++ b/tests/Feature/SshMultiplexingLockTest.php
@@ -153,7 +153,7 @@ it('adds mux options to ssh commands only after the explicit master is ready', f
         ->toContain('-o ControlMaster=auto')
         ->toContain("-o ControlPath=/var/www/html/storage/app/ssh/mux/mux_{$server->uuid}")
         ->toContain('-o ControlPersist=3600')
-        ->toContain("'bash -se' << \\")
+        ->toContain("'if command -v bash >/dev/null 2>&1; then exec bash -se; else exec sh -se; fi' << \\")
         ->not->toContain('<< $delimiter');
 
     Process::assertRan(fn ($process) => str_contains($process->command, 'ssh -fN '));
diff --git a/tests/Feature/TablePaginationLoadingTest.php b/tests/Feature/TablePaginationLoadingTest.php
index 49bb974001..62142ffe57 100644
--- a/tests/Feature/TablePaginationLoadingTest.php
+++ b/tests/Feature/TablePaginationLoadingTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\Gate;
 
 it('renders the shared page size selector', function () {
     $html = Blade::render('<x-page-size-select model="perPage" livewire storage-key="tests.page-size" />');
@@ -30,6 +31,18 @@ it('renders the shared page size selector', function () {
         ->toContain('max="100"');
 });
 
+it('disables page size controls when the gate denies access', function () {
+    Gate::define('view-audit-log-test', fn (): bool => false);
+
+    $html = Blade::render(<<<'BLADE'
+        <x-page-size-select model="perPage" livewire
+            canGate="view-audit-log-test" :canResource="new stdClass" />
+    BLADE);
+
+    expect($html)->toMatch('/<button[^>]*aria-label="Items per page"[^>]*\sdisabled(?:[=\s>])/')
+        ->toMatch('/<input[^>]*aria-label="Custom items per page"[^>]*\sdisabled(?:[=\s>])/');
+});
+
 it('positions table dropdown panels outside overflowing containers', function () {
     $html = Blade::render(<<<'BLADE'
         <x-table.dropdown>
diff --git a/tests/Feature/TeamInvitationUiTest.php b/tests/Feature/TeamInvitationUiTest.php
index 13b6de23e5..949a301923 100644
--- a/tests/Feature/TeamInvitationUiTest.php
+++ b/tests/Feature/TeamInvitationUiTest.php
@@ -51,27 +51,21 @@ it('renders a real copy button for pending invitation links', function () {
     $view = file_get_contents(resource_path('views/livewire/team/invitations.blade.php'));
 
     expect($view)
-        ->toContain('aria-label="Copy invitation link"')
-        ->toContain('window.copyToClipboard(@js($invite->link))')
-        ->toContain('class="button h-7! shrink-0 px-2!"');
+        ->toContain('<x-copy-button :value="$invite->link" label="Copy invitation link" />');
 
     Livewire::test(Invitations::class, [
         'invitations' => TeamInvitation::ownedByCurrentTeam()->get(),
     ])
         ->assertSee($invitation->link)
         ->assertSeeHtml('aria-label="Copy invitation link"')
-        ->assertSeeHtml('window.copyToClipboard(')
+        ->assertSeeHtml('x-data="copyButton"')
         ->assertSeeHtml('type="button"');
 });
 
-it('exposes a resilient global copyToClipboard helper', function () {
+it('keeps clipboard logic in the shared copy button instead of a global helper', function () {
     $layout = file_get_contents(resource_path('views/layouts/base.blade.php'));
 
-    expect($layout)
-        ->toContain('async function copyToClipboard(text)')
-        ->toContain('window.copyToClipboard = copyToClipboard')
-        ->toContain('document.execCommand(\'copy\')')
-        ->toContain('window.isSecureContext');
+    expect($layout)->not->toContain('copyToClipboard');
 });
 
 it('preserves a provisional user when revoking their invitation fails', function () {
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 36a04cecaa..c1312552a6 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -8,7 +8,7 @@ use App\Livewire\Project\Application\Backup\Create as CreateScheduledVolumeBacku
 use App\Livewire\Project\Service\FileStorage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
 use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
-use App\Livewire\Project\Shared\Storages\Show;
+use App\Livewire\Project\Shared\Storages\All;
 use App\Livewire\Project\Shared\Storages\VolumeBackups;
 use App\Models\Application;
 use App\Models\Environment;
@@ -484,11 +484,8 @@ it('shows the configure backup modal trigger inside the volume card instead of i
     signInForVolumeBackups($this, $team);
     [$application, $volume] = createVolumeBackupApplication($team);
 
-    $component = Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])
-        ->set('isReadOnly', true)
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set("forms.{$volume->id}.isReadOnly", true)
         ->assertSee('Backup')
         ->assertDontSee('Backups made while the application is writing');
 
@@ -498,6 +495,7 @@ it('shows the configure backup modal trigger inside the volume card instead of i
     expect($html)
         ->toContain('Configure Volume Backup')
         ->toContain('data-table-row')
+        ->not->toContain('wire:submit="submit('.$volume->id.')"')
         ->toContain('Backup');
 });
 
@@ -513,10 +511,10 @@ it('only shows the backup enabled badge for an enabled volume backup', function
         'enabled' => false,
     ]);
 
-    $component = Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])->assertDontSee('table-badge-success', false);
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->assertDontSee('Volume backup is enabled');
+
+    expect($component->get("volumeBackupMeta.{$volume->id}.enabled"))->toBeFalse();
 
     $backup->update(['enabled' => true]);
 
@@ -529,17 +527,10 @@ it('only shows the backup enabled badge for an enabled volume backup', function
 
     $component
         ->dispatch('refreshVolumeBackups')
-        ->assertSee('table-badge-success', false)
         ->assertSee('Volume backup is enabled')
         ->assertSee('href="'.$backupUrl.'"', false);
 
-    Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-        'isFirst' => false,
-    ])
-        ->assertSee('table-badge-success', false)
-        ->assertSee('Volume backup is enabled');
+    expect($component->get("volumeBackupMeta.{$volume->id}.url"))->toBe($backupUrl);
 });
 
 it('links the backup enabled badge to a filtered backup list when the application has multiple schedules', function () {
@@ -565,11 +556,7 @@ it('links the backup enabled badge to a filtered backup list when the applicatio
         'search' => $volume->name,
     ]);
 
-    Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])
-        ->assertSee('table-badge-success', false)
+    Livewire::test(All::class, ['resource' => $application])
         ->assertSee('Volume backup is enabled')
         ->assertSee('href="'.$backupUrl.'"', false);
 });
diff --git a/tests/Unit/Actions/Server/AlpinePackageManagerTest.php b/tests/Unit/Actions/Server/AlpinePackageManagerTest.php
new file mode 100644
index 0000000000..d8050c84d9
--- /dev/null
+++ b/tests/Unit/Actions/Server/AlpinePackageManagerTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use App\Actions\Server\CheckUpdates;
+use App\Actions\Server\InstallDocker;
+use App\Actions\Server\InstallPrerequisites;
+
+it('installs Bash while bootstrapping Alpine prerequisites', function () {
+    $method = new ReflectionMethod(InstallPrerequisites::class, 'getAlpinePrerequisiteCommands');
+
+    $commands = $method->invoke(new InstallPrerequisites);
+
+    expect($commands)->toContain('command -v bash >/dev/null || apk add bash');
+});
+
+it('installs every Docker CLI plugin required on Alpine', function () {
+    $method = new ReflectionMethod(InstallDocker::class, 'getAlpineDockerInstallCommand');
+
+    $command = $method->invoke(new InstallDocker);
+
+    expect($command)->toContain('apk add docker docker-cli-buildx docker-cli-compose');
+});
+
+it('uses OpenRC instead of systemd to restart Docker on Alpine', function () {
+    $method = new ReflectionMethod(InstallDocker::class, 'getDockerServiceCommands');
+
+    $action = new InstallDocker;
+    $commands = $method->invoke($action, true);
+
+    expect($commands)
+        ->toBe(['rc-update add docker default', 'rc-service docker restart'])
+        ->each->not->toContain('systemctl')
+        ->and($method->invoke($action, false))
+        ->toBe(['systemctl enable docker >/dev/null 2>&1 || true', 'systemctl restart docker']);
+});
+
+it('parses Alpine package updates', function () {
+    $method = new ReflectionMethod(CheckUpdates::class, 'parseApkOutput');
+    $output = <<<'OUTPUT'
+docker-cli-compose-2.31.0-r5 x86_64 {docker-cli-compose} (Apache-2.0) [upgradable from: docker-cli-compose-2.31.0-r4]
+libcrypto3-3.3.4-r0 aarch64 {openssl} (Apache-2.0) [upgradable from: libcrypto3-3.3.3-r0]
+OUTPUT;
+
+    $result = $method->invoke(new CheckUpdates, $output);
+
+    expect($result)->toBe([
+        'total_updates' => 2,
+        'updates' => [
+            [
+                'package' => 'docker-cli-compose',
+                'new_version' => '2.31.0-r5',
+                'architecture' => 'x86_64',
+                'current_version' => '2.31.0-r4',
+            ],
+            [
+                'package' => 'libcrypto3',
+                'new_version' => '3.3.4-r0',
+                'architecture' => 'aarch64',
+                'current_version' => '3.3.3-r0',
+            ],
+        ],
+    ]);
+});
diff --git a/tests/Unit/ApplicationDeploymentRemoteSecretValueTest.php b/tests/Unit/ApplicationDeploymentRemoteSecretValueTest.php
new file mode 100644
index 0000000000..12329be7df
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentRemoteSecretValueTest.php
@@ -0,0 +1,14 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+
+it('quotes JSON remote secrets so compose treats their contents literally', function (string $value, string $expected) {
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $method = new ReflectionMethod(ApplicationDeploymentJob::class, 'format_remote_secret_value');
+
+    expect($method->invoke($job, $value))->toBe($expected);
+})->with([
+    'object containing a variable reference' => ['{"password":"$ecret"}', '\'{"password":"$ecret"}\''],
+    'array containing a comment marker' => ['["value # not a comment"]', '\'["value # not a comment"]\''],
+    'object containing an apostrophe' => ['{"password":"it\'s $ecret"}', '"{\\"password\\":\\"it\'s $$ecret\\"}"'],
+]);
diff --git a/tests/Unit/DatabaseStartActionResolvedCredentialsTest.php b/tests/Unit/DatabaseStartActionResolvedCredentialsTest.php
new file mode 100644
index 0000000000..7ee295e34f
--- /dev/null
+++ b/tests/Unit/DatabaseStartActionResolvedCredentialsTest.php
@@ -0,0 +1,83 @@
+<?php
+
+it('reuses resolved environment credentials in database startup integrations', function (string $action, array $expected, array $unexpected) {
+    $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
+
+    expect($source)->toContain(...$expected)
+        ->not->toContain(...$unexpected);
+})->with([
+    'clickhouse' => [
+        'StartClickhouse',
+        ['$this->resolvedClickhouseUser', '$this->resolvedClickhousePassword'],
+        ['$this->database->clickhouse_admin_user, \'--password\'', '$this->database->clickhouse_admin_password, \'--query\''],
+    ],
+    'dragonfly' => [
+        'StartDragonfly',
+        ['$this->resolvedRedisPassword'],
+        ['$this->database->dragonfly_password, \'ping\'', 'requirepass {$this->database->dragonfly_password}'],
+    ],
+    'keydb' => [
+        'StartKeydb',
+        ['$this->resolvedRedisPassword'],
+        ['$this->database->keydb_password, \'ping\'', 'requirepass {$this->database->keydb_password}'],
+    ],
+    'mongodb' => [
+        'StartMongodb',
+        ['$this->resolvedMongoDatabase', '$this->resolvedMongoUsername', '$this->resolvedMongoPassword'],
+        ['json_encode($this->database->mongo_initdb_database', 'json_encode($this->database->mongo_initdb_root_username', 'json_encode($this->database->mongo_initdb_root_password'],
+    ],
+    'mysql' => [
+        'StartMysql',
+        ['$this->resolvedMysqlRootPassword'],
+        ['-p{$this->database->mysql_root_password}'],
+    ],
+    'postgresql' => [
+        'StartPostgresql',
+        ['$this->resolvedPostgresUser', '$this->resolvedPostgresDatabase'],
+        ['$this->database->postgres_user, \'-d\'', '$this->database->postgres_db, \'-c\''],
+    ],
+]);
+
+it('runs database start commands without persisting them through remote process', function (string $action) {
+    $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
+
+    expect($source)
+        ->toContain('ExecutesDatabaseStartCommands')
+        ->toContain('executeDatabaseStartCommands(')
+        ->not->toContain('return remote_process(');
+})->with([
+    'StartClickhouse',
+    'StartDragonfly',
+    'StartKeydb',
+    'StartMariadb',
+    'StartMongodb',
+    'StartMysql',
+    'StartPostgresql',
+    'StartRedis',
+]);
+
+it('queues database starts with identifiers instead of generated commands', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartDatabase.php');
+
+    expect($source)
+        ->toContain('DatabaseStartJob::dispatch(')
+        ->not->toContain('StartPostgresql::run(')
+        ->not->toContain('StartRedis::run(');
+});
+
+it('keeps raw secret values separate from compose environment formatting', function (string $action, array $rawAssignments) {
+    $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
+
+    expect($source)
+        ->toContain('$rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);')
+        ->toContain('$resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);')
+        ->toContain('$environment_variables->push($env->key.\'=\'.$resolvedValue);')
+        ->toContain(...$rawAssignments);
+})->with([
+    'clickhouse' => ['StartClickhouse', ['$this->resolvedClickhouseUser = $rawValue;', '$this->resolvedClickhousePassword = $rawValue;']],
+    'dragonfly' => ['StartDragonfly', ['$this->resolvedRedisPassword = $rawValue;', 'escapeshellarg($this->resolvedRedisPassword)']],
+    'keydb' => ['StartKeydb', ['$this->resolvedRedisPassword = $rawValue;', 'escapeshellarg($this->resolvedRedisPassword)']],
+    'mongodb' => ['StartMongodb', ['$this->resolvedMongoUsername = $rawValue;', '$this->resolvedMongoPassword = $rawValue;', '$this->resolvedMongoDatabase = $rawValue;', 'json_encode($this->resolvedMongoPassword']],
+    'mysql' => ['StartMysql', ['$this->resolvedMysqlRootPassword = $rawValue;']],
+    'postgresql' => ['StartPostgresql', ['$this->resolvedPostgresUser = $rawValue;', '$this->resolvedPostgresDatabase = $rawValue;']],
+]);
diff --git a/tests/Unit/DatabaseStartJobTest.php b/tests/Unit/DatabaseStartJobTest.php
new file mode 100644
index 0000000000..e6333ea769
--- /dev/null
+++ b/tests/Unit/DatabaseStartJobTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Events\DatabaseStatusChanged;
+use App\Jobs\DatabaseStartJob;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+it('broadcasts failed database starts to the initiating user even when the activity is missing', function () {
+    Event::fake([DatabaseStatusChanged::class]);
+
+    $job = new DatabaseStartJob(
+        databaseClass: 'MissingDatabase',
+        databaseId: 123,
+        teamId: 456,
+        activityId: 789,
+        userId: 42,
+    );
+
+    $job->failed(new RuntimeException('Database start failed.'));
+
+    Event::assertDispatched(
+        DatabaseStatusChanged::class,
+        fn (DatabaseStatusChanged $event): bool => $event->userId === 42,
+    );
+});
+
+it('targets normal database start status changes to the initiating user', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Jobs/DatabaseStartJob.php');
+
+    expect($source)
+        ->toContain('event(new DatabaseStatusChanged($this->userId));')
+        ->not->toContain('event(new DatabaseStatusChanged($database));');
+});
diff --git a/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php b/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
index b7901abb68..140be57643 100644
--- a/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
+++ b/tests/Unit/DeploymentConfiguration/ApplicationConfigurationSnapshotTest.php
@@ -334,13 +334,13 @@ it('detects environment variable value changes without exposing secret values',
     $change = collect($diff->changes())->firstWhere('label', 'API_TOKEN');
 
     expect($change)->not->toBeNull()
-        ->and($change['display_summary'])->toBe('Changed')
-        ->and($change['old_display_value'])->toBe('••••••••')
-        ->and($change['new_display_value'])->toBe('••••••••')
-        ->and(json_encode($diff->toArray()))->not->toContain('old-secret')->not->toContain('new-secret');
+        ->and($change['display_summary'])->toBeNull()
+        ->and($change['old_display_value'])->toBe('old-secret')
+        ->and($change['new_display_value'])->toBe('new-secret')
+        ->and(json_encode($diff->toArray()))->toContain('old-secret')->toContain('new-secret');
 });
 
-it('describes added environment variables as set without exposing secret values', function () {
+it('describes added unlocked environment variables with their value', function () {
     $application = snapshotTestApplication();
     markSnapshotTestApplicationDeployed($application);
 
@@ -361,6 +361,6 @@ it('describes added environment variables as set without exposing secret values'
     expect($change)->not->toBeNull()
         ->and($change['display_summary'])->toBeNull()
         ->and($change['old_display_value'])->toBe('-')
-        ->and($change['new_display_value'])->toBe('••••••••')
-        ->and(json_encode($diff->toArray()))->not->toContain('new-secret');
+        ->and($change['new_display_value'])->toBe('new-secret')
+        ->and(json_encode($diff->toArray()))->toContain('new-secret');
 });
diff --git a/tests/Unit/OauthSettingTest.php b/tests/Unit/OauthSettingTest.php
new file mode 100644
index 0000000000..48fb50c375
--- /dev/null
+++ b/tests/Unit/OauthSettingTest.php
@@ -0,0 +1,30 @@
+<?php
+
+use App\Models\OauthSetting;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+it('requires issuer url client id and client secret for oidc settings', function () {
+    $setting = new OauthSetting(['provider' => 'oidc']);
+    expect($setting->couldBeEnabled())->toBeFalse();
+
+    $setting->fill([
+        'client_id' => 'client-id',
+        'client_secret' => 'secret',
+        'base_url' => 'https://idp.example.com',
+    ]);
+
+    expect($setting->couldBeEnabled())->toBeTrue();
+});
+
+it('returns configured scopes and custom login label', function () {
+    $setting = new OauthSetting([
+        'provider' => 'oidc',
+        'scopes' => 'openid email profile groups',
+        'custom_label' => 'Login with Okta',
+    ]);
+
+    expect($setting->scopeList())->toBe(['openid', 'email', 'profile', 'groups'])
+        ->and($setting->loginLabel())->toBe('Login with Okta');
+});
diff --git a/tests/Unit/OidcDiscoveryServiceTest.php b/tests/Unit/OidcDiscoveryServiceTest.php
new file mode 100644
index 0000000000..18c358fd13
--- /dev/null
+++ b/tests/Unit/OidcDiscoveryServiceTest.php
@@ -0,0 +1,119 @@
+<?php
+
+use App\Auth\Oidc\Exceptions\OidcDiscoveryException;
+use App\Auth\Oidc\Exceptions\OidcJwksException;
+use App\Auth\Oidc\OidcDiscoveryService;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+it('fetches and caches discovery documents and jwks', function () {
+    Cache::flush();
+    Http::fake([
+        'https://idp.example.com/.well-known/openid-configuration' => Http::response([
+            'issuer' => 'https://idp.example.com',
+            'authorization_endpoint' => 'https://idp.example.com/auth',
+            'token_endpoint' => 'https://idp.example.com/token',
+            'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+            'jwks_uri' => 'https://idp.example.com/jwks',
+        ]),
+        'https://idp.example.com/jwks' => Http::response(['keys' => [['kid' => 'one']]]),
+    ]);
+
+    $service = app(OidcDiscoveryService::class);
+
+    $discovery = $service->discover('https://idp.example.com');
+    $jwks = $service->jwks($discovery->jwksUri);
+
+    expect($discovery->issuer)->toBe('https://idp.example.com')
+        ->and($jwks['keys'][0]['kid'])->toBe('one');
+
+    Http::assertSentCount(2);
+
+    $service->discover('https://idp.example.com');
+    $service->jwks('https://idp.example.com/jwks');
+
+    Http::assertSentCount(2);
+});
+
+it('does not cache discovery documents with mismatched issuers', function () {
+    Cache::flush();
+    Http::fakeSequence('https://idp.example.com/.well-known/openid-configuration')
+        ->push([
+            'issuer' => 'https://evil.example.com',
+            'authorization_endpoint' => 'https://idp.example.com/auth',
+            'token_endpoint' => 'https://idp.example.com/token',
+            'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+            'jwks_uri' => 'https://idp.example.com/jwks',
+        ])
+        ->push([
+            'issuer' => 'https://idp.example.com',
+            'authorization_endpoint' => 'https://idp.example.com/auth',
+            'token_endpoint' => 'https://idp.example.com/token',
+            'userinfo_endpoint' => 'https://idp.example.com/userinfo',
+            'jwks_uri' => 'https://idp.example.com/jwks',
+        ]);
+
+    $service = app(OidcDiscoveryService::class);
+    $cacheKey = 'oidc:discovery:'.hash('sha256', 'https://idp.example.com');
+
+    expect(fn () => $service->discover('https://idp.example.com'))
+        ->toThrow(OidcDiscoveryException::class, 'Discovery issuer does not match the configured issuer URL.')
+        ->and(Cache::has($cacheKey))->toBeFalse()
+        ->and($service->discover('https://idp.example.com')->issuer)->toBe('https://idp.example.com');
+
+    Http::assertSentCount(2);
+});
+
+it('refetches jwks once on forced refresh to pick up rotated keys', function () {
+    Cache::flush();
+    Http::fakeSequence('https://idp.example.com/jwks')
+        ->push(['keys' => [['kid' => 'old']]])
+        ->push(['keys' => [['kid' => 'new']]]);
+
+    $service = app(OidcDiscoveryService::class);
+
+    expect($service->jwks('https://idp.example.com/jwks')['keys'][0]['kid'])->toBe('old');
+
+    // Forced refresh bypasses the cache and sees the rotated key.
+    expect($service->jwks('https://idp.example.com/jwks', true)['keys'][0]['kid'])->toBe('new');
+    Http::assertSentCount(2);
+
+    // Cooldown prevents a second immediate upstream fetch; cached value returned.
+    expect($service->jwks('https://idp.example.com/jwks', true)['keys'][0]['kid'])->toBe('new');
+    Http::assertSentCount(2);
+});
+
+it('rejects invalid discovery and jwks payloads', function () {
+    Cache::flush();
+    Http::fake([
+        'https://bad.example.com/.well-known/openid-configuration' => Http::response(['issuer' => 'https://bad.example.com']),
+    ]);
+
+    app(OidcDiscoveryService::class)->discover('https://bad.example.com');
+})->throws(OidcDiscoveryException::class);
+
+it('rejects jwks responses without keys', function () {
+    Cache::flush();
+    Http::fake([
+        'https://idp.example.com/jwks' => Http::response(['empty' => true]),
+    ]);
+
+    app(OidcDiscoveryService::class)->jwks('https://idp.example.com/jwks');
+})->throws(OidcJwksException::class);
+
+it('rejects non-https issuer urls', function () {
+    Cache::flush();
+    Http::fake();
+
+    app(OidcDiscoveryService::class)->discover('http://idp.example.com');
+})->throws(OidcDiscoveryException::class, 'Issuer URL must be an absolute HTTPS URL.');
+
+it('rejects non-https jwks uris', function () {
+    Cache::flush();
+    Http::fake();
+
+    app(OidcDiscoveryService::class)->jwks('http://idp.example.com/jwks');
+})->throws(OidcJwksException::class, 'JWKS URI must be an absolute HTTPS URL.');
diff --git a/tests/Unit/OidcProviderPkceTest.php b/tests/Unit/OidcProviderPkceTest.php
new file mode 100644
index 0000000000..b92ff58ffe
--- /dev/null
+++ b/tests/Unit/OidcProviderPkceTest.php
@@ -0,0 +1,148 @@
+<?php
+
+use App\Auth\Oidc\Exceptions\OidcException;
+use App\Auth\Oidc\OidcConfig;
+use App\Auth\Oidc\OidcDiscoveryDocument;
+use App\Auth\Oidc\OidcDiscoveryService;
+use App\Auth\Oidc\OidcTokenValidator;
+use App\Auth\Oidc\Socialite\OidcProvider;
+use GuzzleHttp\Client;
+use GuzzleHttp\Handler\MockHandler;
+use GuzzleHttp\HandlerStack;
+use GuzzleHttp\Middleware;
+use GuzzleHttp\Psr7\Response;
+use Illuminate\Http\Request;
+use Illuminate\Session\ArraySessionHandler;
+use Illuminate\Session\Store;
+use Illuminate\Support\Carbon;
+use Mockery\MockInterface;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+class TestOidcProviderWithExposedAuthUrl extends OidcProvider
+{
+    public function authUrlForState(string $state): string
+    {
+        return $this->getAuthUrl($state);
+    }
+}
+
+function oidc_provider_discovery_document(): OidcDiscoveryDocument
+{
+    return new OidcDiscoveryDocument(
+        issuer: 'https://idp.example.com',
+        authorizationEndpoint: 'https://idp.example.com/oauth2/authorize',
+        tokenEndpoint: 'https://idp.example.com/oauth2/token',
+        userinfoEndpoint: 'https://idp.example.com/oauth2/userinfo',
+        jwksUri: 'https://idp.example.com/.well-known/jwks.json',
+    );
+}
+
+function oidc_provider_session(): Store
+{
+    $session = new Store('testing', new ArraySessionHandler(1200));
+    $session->start();
+
+    return $session;
+}
+
+function oidc_provider_request(Store $session, string $state = 'state-value'): Request
+{
+    $request = Request::create('/auth/oidc/callback', 'GET', ['state' => $state]);
+    $request->setLaravelSession($session);
+
+    return $request;
+}
+
+function oidc_provider(Request $request): TestOidcProviderWithExposedAuthUrl
+{
+    /** @var OidcDiscoveryService&MockInterface $discoveryService */
+    $discoveryService = Mockery::mock(OidcDiscoveryService::class);
+    $discoveryService->shouldReceive('discover')
+        ->byDefault()
+        ->with('https://idp.example.com')
+        ->andReturn(oidc_provider_discovery_document());
+
+    /** @var OidcTokenValidator&MockInterface $tokenValidator */
+    $tokenValidator = Mockery::mock(OidcTokenValidator::class);
+
+    return (new TestOidcProviderWithExposedAuthUrl(
+        $request,
+        $discoveryService,
+        $tokenValidator,
+        'client-id',
+        'client-secret',
+        'https://coolify.example.com/auth/oidc/callback',
+    ))->setConfig(new OidcConfig(
+        issuerUrl: 'https://idp.example.com',
+        clientId: 'client-id',
+        clientSecret: 'client-secret',
+        redirectUri: 'https://coolify.example.com/auth/oidc/callback',
+        usePkce: true,
+    ));
+}
+
+it('stores oidc nonce and pkce verifier with a ten minute expiry', function () {
+    Carbon::setTestNow('2026-06-15 12:00:00');
+
+    try {
+        $session = oidc_provider_session();
+        $provider = oidc_provider(oidc_provider_request($session));
+
+        $provider->authUrlForState('state-value');
+
+        $nonceEntry = $session->get('oidc.nonce.state-value');
+        $verifierEntry = $session->get('oidc.code_verifier.state-value');
+
+        expect($nonceEntry)->toBeArray()
+            ->and($nonceEntry['value'])->toBeString()->not->toBeEmpty()
+            ->and($nonceEntry['expires_at'])->toBe(now()->addMinutes(10)->timestamp)
+            ->and($verifierEntry)->toBeArray()
+            ->and($verifierEntry['value'])->toBeString()->not->toBeEmpty()
+            ->and($verifierEntry['expires_at'])->toBe(now()->addMinutes(10)->timestamp);
+    } finally {
+        Carbon::setTestNow();
+    }
+});
+
+it('sends a fresh oidc pkce verifier during token exchange', function () {
+    $session = oidc_provider_session();
+    $session->put('oidc.code_verifier.state-value', [
+        'value' => 'fresh-verifier',
+        'expires_at' => now()->addMinute()->timestamp,
+    ]);
+
+    $provider = oidc_provider(oidc_provider_request($session));
+    $history = [];
+    $handler = HandlerStack::create(new MockHandler([
+        new Response(200, [], json_encode(['access_token' => 'access-token', 'id_token' => 'id-token'], JSON_THROW_ON_ERROR)),
+    ]));
+    $handler->push(Middleware::history($history));
+    $provider->setHttpClient(new Client(['handler' => $handler]));
+
+    $provider->getAccessTokenResponse('authorization-code');
+
+    parse_str((string) $history[0]['request']->getBody(), $tokenRequestFields);
+
+    expect($tokenRequestFields['code_verifier'] ?? null)->toBe('fresh-verifier')
+        ->and($session->has('oidc.code_verifier.state-value'))->toBeFalse();
+});
+
+it('throws a session expired error for an expired oidc pkce verifier during token exchange', function () {
+    $session = oidc_provider_session();
+    $session->put('oidc.code_verifier.state-value', [
+        'value' => 'expired-verifier',
+        'expires_at' => now()->subSecond()->timestamp,
+    ]);
+
+    $provider = oidc_provider(oidc_provider_request($session));
+    $history = [];
+    $handler = HandlerStack::create(new MockHandler([
+        new Response(200, [], json_encode(['access_token' => 'access-token', 'id_token' => 'id-token'], JSON_THROW_ON_ERROR)),
+    ]));
+    $handler->push(Middleware::history($history));
+    $provider->setHttpClient(new Client(['handler' => $handler]));
+
+    $provider->getAccessTokenResponse('authorization-code');
+})->throws(OidcException::class, 'OIDC login session expired. Please try again.');
diff --git a/tests/Unit/OidcTokenValidatorTest.php b/tests/Unit/OidcTokenValidatorTest.php
new file mode 100644
index 0000000000..9b1d9a24c3
--- /dev/null
+++ b/tests/Unit/OidcTokenValidatorTest.php
@@ -0,0 +1,187 @@
+<?php
+
+use App\Auth\Oidc\Exceptions\OidcSigningKeyNotFoundException;
+use App\Auth\Oidc\Exceptions\OidcTokenException;
+use App\Auth\Oidc\OidcDiscoveryDocument;
+use App\Auth\Oidc\OidcTokenValidator;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+function oidc_base64url(string $value): string
+{
+    return rtrim(strtr(base64_encode($value), '+/', '-_'), '=');
+}
+
+function oidc_keyset(string $kid = 'test-key'): array
+{
+    $privateKey = openssl_pkey_new([
+        'private_key_bits' => 2048,
+        'private_key_type' => OPENSSL_KEYTYPE_RSA,
+    ]);
+
+    openssl_pkey_export($privateKey, $privatePem);
+    $details = openssl_pkey_get_details($privateKey);
+
+    return [
+        'private_pem' => $privatePem,
+        'jwks' => [
+            'keys' => [[
+                'kty' => 'RSA',
+                'kid' => $kid,
+                'alg' => 'RS256',
+                'use' => 'sig',
+                'n' => oidc_base64url($details['rsa']['n']),
+                'e' => oidc_base64url($details['rsa']['e']),
+            ]],
+        ],
+    ];
+}
+
+function oidc_token(array $claims, string $privatePem, string $kid = 'test-key', string $algorithm = 'RS256'): string
+{
+    $header = oidc_base64url(json_encode(['alg' => $algorithm, 'typ' => 'JWT', 'kid' => $kid], JSON_THROW_ON_ERROR));
+    $payload = oidc_base64url(json_encode($claims, JSON_THROW_ON_ERROR));
+    $signatureInput = $header.'.'.$payload;
+    openssl_sign($signatureInput, $signature, $privatePem, OPENSSL_ALGO_SHA256);
+
+    return $signatureInput.'.'.oidc_base64url($signature);
+}
+
+function oidc_discovery(): OidcDiscoveryDocument
+{
+    return new OidcDiscoveryDocument(
+        issuer: 'https://idp.example.com',
+        authorizationEndpoint: 'https://idp.example.com/oauth2/authorize',
+        tokenEndpoint: 'https://idp.example.com/oauth2/token',
+        userinfoEndpoint: 'https://idp.example.com/oauth2/userinfo',
+        jwksUri: 'https://idp.example.com/.well-known/jwks.json',
+    );
+}
+
+it('validates a well formed RS256 id token', function () {
+    $keyset = oidc_keyset();
+    $now = time();
+    $token = oidc_token([
+        'iss' => 'https://idp.example.com',
+        'aud' => 'client-id',
+        'sub' => 'okta-user-1',
+        'iat' => $now,
+        'exp' => $now + 600,
+        'nonce' => 'expected-nonce',
+        'email' => 'User@Example.com',
+    ], $keyset['private_pem']);
+
+    $claims = app(OidcTokenValidator::class)->validate(
+        idToken: $token,
+        discovery: oidc_discovery(),
+        jwks: $keyset['jwks'],
+        clientId: 'client-id',
+        expectedNonce: 'expected-nonce',
+    );
+
+    expect($claims['sub'])->toBe('okta-user-1')
+        ->and($claims['email'])->toBe('User@Example.com');
+});
+
+it('rejects invalid token claims', function (array $claimOverrides, string $message) {
+    $keyset = oidc_keyset();
+    $now = time();
+    $claims = array_merge([
+        'iss' => 'https://idp.example.com',
+        'aud' => 'client-id',
+        'sub' => 'okta-user-1',
+        'iat' => $now,
+        'exp' => $now + 600,
+        'nonce' => 'expected-nonce',
+    ], $claimOverrides);
+
+    $token = oidc_token($claims, $keyset['private_pem']);
+
+    app(OidcTokenValidator::class)->validate(
+        idToken: $token,
+        discovery: oidc_discovery(),
+        jwks: $keyset['jwks'],
+        clientId: 'client-id',
+        expectedNonce: 'expected-nonce',
+    );
+})->throws(OidcTokenException::class)->with([
+    'issuer mismatch' => [['iss' => 'https://evil.example.com'], 'issuer'],
+    'audience mismatch' => [['aud' => 'other-client'], 'audience'],
+    'azp missing for multi audience' => [['aud' => ['client-id', 'other-client']], 'azp'],
+    'azp mismatch' => [['aud' => ['client-id', 'other-client'], 'azp' => 'other-client'], 'azp'],
+    'expired token' => [['exp' => time() - 3600], 'expired'],
+    'future issued at' => [['iat' => time() + 3600], 'issued'],
+    'nonce mismatch' => [['nonce' => 'wrong-nonce'], 'nonce'],
+    'missing subject' => [['sub' => null], 'subject'],
+    'empty subject' => [['sub' => ''], 'subject'],
+    'non-string subject' => [['sub' => 123], 'subject'],
+]);
+
+it('rejects a bad signature and unknown key id', function (string $kid) {
+    $keyset = oidc_keyset('test-key');
+    $otherKeyset = oidc_keyset($kid);
+    $now = time();
+    $token = oidc_token([
+        'iss' => 'https://idp.example.com',
+        'aud' => 'client-id',
+        'sub' => 'okta-user-1',
+        'iat' => $now,
+        'exp' => $now + 600,
+        'nonce' => 'expected-nonce',
+    ], $otherKeyset['private_pem'], $kid);
+
+    app(OidcTokenValidator::class)->validate(
+        idToken: $token,
+        discovery: oidc_discovery(),
+        jwks: $keyset['jwks'],
+        clientId: 'client-id',
+        expectedNonce: 'expected-nonce',
+    );
+})->throws(OidcTokenException::class)->with([
+    'same kid with bad signature' => ['test-key'],
+    'unknown kid' => ['other-key'],
+]);
+
+it('rejects disallowed algorithms', function () {
+    $keyset = oidc_keyset();
+    $now = time();
+    $token = oidc_token([
+        'iss' => 'https://idp.example.com',
+        'aud' => 'client-id',
+        'sub' => 'okta-user-1',
+        'iat' => $now,
+        'exp' => $now + 600,
+    ], $keyset['private_pem'], algorithm: 'HS256');
+
+    app(OidcTokenValidator::class)->validate($token, oidc_discovery(), $keyset['jwks'], 'client-id');
+})->throws(OidcTokenException::class);
+
+it('throws a dedicated exception when the signing key is unknown', function () {
+    $keyset = oidc_keyset('current-key');
+    $token = oidc_token([
+        'iss' => 'https://idp.example.com',
+        'aud' => 'client-id',
+        'sub' => 'okta-user-1',
+        'iat' => time(),
+        'exp' => time() + 600,
+    ], $keyset['private_pem'], 'rotated-key');
+
+    app(OidcTokenValidator::class)->validate($token, oidc_discovery(), $keyset['jwks'], 'client-id');
+})->throws(OidcSigningKeyNotFoundException::class);
+
+it('rejects a jwks key not designated for signing', function () {
+    $keyset = oidc_keyset();
+    $keyset['jwks']['keys'][0]['use'] = 'enc';
+    $now = time();
+    $token = oidc_token([
+        'iss' => 'https://idp.example.com',
+        'aud' => 'client-id',
+        'sub' => 'okta-user-1',
+        'iat' => $now,
+        'exp' => $now + 600,
+    ], $keyset['private_pem']);
+
+    // An encryption-only key is dropped from the keyset, so the kid no longer resolves.
+    app(OidcTokenValidator::class)->validate($token, oidc_discovery(), $keyset['jwks'], 'client-id');
+})->throws(OidcTokenException::class);
diff --git a/tests/Unit/RemoteSecretReferencesTest.php b/tests/Unit/RemoteSecretReferencesTest.php
new file mode 100644
index 0000000000..c56a836370
--- /dev/null
+++ b/tests/Unit/RemoteSecretReferencesTest.php
@@ -0,0 +1,47 @@
+<?php
+
+use App\Support\RemoteSecretReferences;
+
+test('detects references only for the vault namespace', function () {
+    expect(RemoteSecretReferences::containsReference('{{vault.DB_PASSWORD}}'))->toBeTrue()
+        ->and(RemoteSecretReferences::containsReference('{{doppler.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{infisical.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{ vault.KEY }}'))->toBeTrue()
+        ->and(RemoteSecretReferences::containsReference('pre-{{vault.KEY}}-post'))->toBeTrue();
+});
+
+test('ignores the secret namespace, shared variables, and plain values', function () {
+    expect(RemoteSecretReferences::containsReference('{{secret.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{team.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{project.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('plain'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('$OTHER_VAR'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference(null))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference(''))->toBeFalse();
+});
+
+test('extracts unique referenced keys in order', function () {
+    $value = 'a={{vault.A}} ignored={{doppler.B}} again={{vault.A}}';
+
+    expect(RemoteSecretReferences::referencedKeys($value))->toBe(['A']);
+});
+
+test('handles padded reference syntax consistently', function () {
+    expect(RemoteSecretReferences::referencedKeys('{{ vault.A }}'))->toBe(['A'])
+        ->and(RemoteSecretReferences::substitute('{{ vault.A }} {{ vault.MISSING }}', ['A' => 'value-a']))
+        ->toBe('value-a {{ vault.MISSING }}')
+        ->and(RemoteSecretReferences::missingKeys('{{ vault.A }} {{ vault.MISSING }}', ['A' => 'value-a']))
+        ->toBe(['MISSING']);
+});
+
+test('substitutes references and leaves unknown keys untouched', function () {
+    $secrets = ['A' => 'value-a'];
+
+    expect(RemoteSecretReferences::substitute('x={{vault.A}} y={{vault.MISSING}}', $secrets))
+        ->toBe('x=value-a y={{vault.MISSING}}');
+});
+
+test('reports missing keys', function () {
+    expect(RemoteSecretReferences::missingKeys('{{vault.A}}-{{vault.B}}', ['A' => '1']))->toBe(['B'])
+        ->and(RemoteSecretReferences::missingKeys('{{vault.A}}', ['A' => '1']))->toBe([]);
+});
diff --git a/tests/Unit/SecretManagerLayoutConsistencyTest.php b/tests/Unit/SecretManagerLayoutConsistencyTest.php
new file mode 100644
index 0000000000..82d7f82c34
--- /dev/null
+++ b/tests/Unit/SecretManagerLayoutConsistencyTest.php
@@ -0,0 +1,15 @@
+<?php
+
+it('shows environment variables before the optional secret manager for every resource type', function (string $view, string $resource) {
+    $source = file_get_contents(__DIR__."/../../resources/views/livewire/project/{$view}/configuration.blade.php");
+    $environmentVariables = '<livewire:project.shared.environment-variable.all :resource="$'.$resource.'" />';
+    $secretManager = '<livewire:project.shared.secret-manager-links :resource="$'.$resource.'" />';
+
+    expect($source)
+        ->toContain($environmentVariables, $secretManager)
+        ->and(strpos($source, $environmentVariables))->toBeLessThan(strpos($source, $secretManager));
+})->with([
+    'application' => ['application', 'application'],
+    'database' => ['database', 'database'],
+    'service' => ['service', 'service'],
+]);
diff --git a/tests/Unit/SshMultiplexingDisableTest.php b/tests/Unit/SshMultiplexingDisableTest.php
index d2d4ae600f..4dedc7a768 100644
--- a/tests/Unit/SshMultiplexingDisableTest.php
+++ b/tests/Unit/SshMultiplexingDisableTest.php
@@ -23,6 +23,16 @@ class SshMultiplexingDisableTest extends TestCase
         );
     }
 
+    public function test_remote_shell_prefers_bash_and_falls_back_to_sh()
+    {
+        $reflection = new \ReflectionMethod(SshMultiplexingHelper::class, 'remoteShellCommand');
+
+        $this->assertSame(
+            'if command -v bash >/dev/null 2>&1; then exec bash -se; else exec sh -se; fi',
+            $reflection->invoke(null)
+        );
+    }
+
     public function test_generate_ssh_command_accepts_disable_multiplexing_parameter()
     {
         $reflection = new \ReflectionMethod(SshMultiplexingHelper::class, 'generateSshCommand');
diff --git a/tests/v4/Feature/DangerDeleteResourceTest.php b/tests/v4/Feature/DangerDeleteResourceTest.php
index af409a3c46..655aec85fe 100644
--- a/tests/v4/Feature/DangerDeleteResourceTest.php
+++ b/tests/v4/Feature/DangerDeleteResourceTest.php
@@ -5,6 +5,7 @@ use App\Livewire\Project\Shared\Danger;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\OauthIdentity;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
@@ -87,6 +88,21 @@ test('delete redirects before dispatching resource cleanup after the response',
     Queue::assertPushed(DeleteResourceJob::class, fn (DeleteResourceJob $job) => $job->resource->is($service));
 });
 
+test('delete succeeds without password for an oauth user', function () {
+    OauthIdentity::create([
+        'user_id' => $this->user->id,
+        'provider' => 'oidc',
+        'issuer' => 'https://idp.example.com',
+        'provider_user_id' => 'oauth-user-id',
+    ]);
+
+    Livewire::test(Danger::class, ['resource' => $this->application])
+        ->call('delete', '')
+        ->assertHasNoErrors();
+
+    expect(Application::find($this->application->id))->toBeNull();
+});
+
 test('delete applies selectedActions from checkbox state', function () {
     $component = Livewire::test(Danger::class, ['resource' => $this->application])
         ->call('delete', 'test-password', ['delete_configurations', 'docker_cleanup']);