diff --git a/.env.development.example b/.env.development.example
index 380f10a446..56c17128ce 100644
--- a/.env.development.example
+++ b/.env.development.example
@@ -53,3 +53,4 @@ DUSK_DRIVER_URL=http://selenium:4444
 BUNNY_API_KEY=
 # For asset uploads
 BUNNY_STORAGE_API_KEY=
+AVATAR_CDN_URL=
diff --git a/.env.windows-docker-desktop.example b/.env.windows-docker-desktop.example
index b067b4c5c0..626d76ff63 100644
--- a/.env.windows-docker-desktop.example
+++ b/.env.windows-docker-desktop.example
@@ -11,3 +11,4 @@ REDIS_PASSWORD=coolify
 PUSHER_APP_ID=coolify
 PUSHER_APP_KEY=coolify
 PUSHER_APP_SECRET=coolify
+AVATAR_CDN_URL=
diff --git a/.github/workflows/coolify-helper.yml b/.github/workflows/coolify-helper.yml
index f5d0c3f0ad..de0cf3b8d7 100644
--- a/.github/workflows/coolify-helper.yml
+++ b/.github/workflows/coolify-helper.yml
@@ -1,6 +1,7 @@
 name: Coolify Helper Image
 
 on:
+  workflow_dispatch:
   push:
     branches: [ "main" ]
     paths:
diff --git a/AGENTS.md b/AGENTS.md
index 4d78dfd938..f9f8ca563a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -148,6 +148,11 @@ Because the "server" and the test share one PHP process, they share the phpunit
 - Custom gates: `createAnyResource`, `canAccessTerminal`
 - Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
 - Multi-tenancy via Teams — team auto-initializes notification settings on creation
+- Authorize every server-side read and mutation where access can vary by user, role, team, or resource. Use policies, gates, or `$this->authorize(...)`; never rely on hidden Blade/Livewire controls such as `@can` for security.
+- Scope queries to the current team before returning records. Treat route and model identifiers as untrusted, and prevent users from reading or changing resources owned by another team.
+- Apply authorization consistently across Livewire actions, API and web controllers, actions, downloads, exports, search, event listeners, and any other path that exposes or changes protected data.
+- Default to denying access when a policy or ownership relationship is missing or ambiguous. Members must not gain access to administrative, credential, security, billing, or instance-wide data merely because they belong to the team.
+- Add authorization regression tests for protected changes. Cover permitted access, member restrictions where applicable, and cross-team access; verify unauthorized reads and writes return `403` or otherwise reveal no protected data.
 
 ### Event Broadcasting
 - Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
@@ -191,6 +196,23 @@ Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentin
 - Exception handler: `app/Exceptions/Handler.php`
 - Service providers in `app/Providers/`
 
+## Livewire conventions
+
+### Dynamic lists and snapshot errors
+
+When an add, delete, or conversion leaves controls unresponsive and the browser reports `Snapshot missing on Livewire component`, inspect both component keys and refresh events. Stable keys alone may not fix it.
+
+- Give every Livewire component rendered in a loop a stable key based on the record ID, UUID, filename, or another immutable identity. Never include a collection count, `$loop->index`, or a reindexed array position in the key.
+- Pass the same stable identity to edit/delete actions. A keyed row can survive reordering while a `wire:ignore` or teleported Alpine modal keeps its original `submitAction`; an action such as `removeItem($index)` then targets a stale position after the first deletion. Resolve the current row server-side from an ID, UUID, or stable row hash instead.
+- Do not broadcast one refresh event to both a parent list component and children that the parent may insert, remove, or hide during the same operation. This can queue a child update after its snapshot has been removed from the DOM.
+- Split refresh responsibilities into targeted events. Refresh the parent for counts and tab visibility, and refresh an existing child list with a separate event. Use `$this->dispatch('event')->to(Component::class)` instead of a page-wide event when possible.
+- Before targeting a child list, confirm that it existed before the mutation, still exists afterward, and is on the active tab. A newly inserted child loads current data during `mount()` and does not need an immediate refresh. A removed or hidden child must not receive one.
+- A child that deletes itself should finish its own update, then target only the parent to refresh counts. The parent should not send a refresh back to that child when the list became empty.
+- Apply the same pattern to file, directory, conversion, and external reload paths such as Compose edits. One remaining broad event can reproduce the race.
+- Add regression tests that assert the scoped event names, assert the old broad event is not dispatched, and verify that keys do not depend on counts or positions. Manually repeat add/delete operations while watching the browser console.
+
+The persistent-storage implementation is the reference pattern: `Project\Service\Storage` handles `storageCountsChanged`, while `Project\Shared\Storages\All` handles `refreshVolumeList`.
+
 ## Key Conventions
 
 - Use `php artisan make:*` commands with `--no-interaction` to create files
diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index 66ceb95f64..3feb5117d8 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -13,8 +13,9 @@ class StopApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true)
+    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true, bool $removeContainers = true): ?string
     {
+        $containerPresent = ! $removeContainers;
         $servers = collect([$application->destination->server]);
         if ($application?->additional_servers?->count() > 0) {
             $servers = $servers->merge($application->additional_servers);
@@ -26,6 +27,7 @@ class StopApplication
                 }
 
                 if ($server->isSwarm()) {
+                    $containerPresent = false;
                     instant_remote_process(["docker stack rm {$application->uuid}"], $server);
 
                     continue;
@@ -39,13 +41,17 @@ class StopApplication
                 $timeout = $application->settings->stopGracePeriodSeconds();
 
                 foreach ($containersToStop as $containerName) {
-                    instant_remote_process(command: [
-                        dockerStopCommand($timeout, $containerName, $server),
-                        "docker rm -f $containerName",
-                    ], server: $server, throwError: false);
+                    $commands = [dockerStopCommand($timeout, $containerName, $server)];
+                    if ($removeContainers) {
+                        $commands[] = "docker rm -f $containerName";
+                    } else {
+                        array_unshift($commands, "docker update --restart=no $containerName");
+                    }
+
+                    instant_remote_process(command: $commands, server: $server, throwError: false);
                 }
 
-                if ($application->build_pack === 'dockercompose') {
+                if ($removeContainers && $application->build_pack === 'dockercompose') {
                     $application->deleteConnectedNetworks();
                 }
 
@@ -57,12 +63,16 @@ class StopApplication
             }
         }
 
-        $status = ['status' => 'exited'];
+        $status = [
+            'status' => 'exited',
+            'container_present' => $containerPresent,
+        ];
         if ($resetRestartCount) {
             $status = array_merge($status, [
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
+                'restart_limit_reached' => false,
             ]);
         }
         $application->update($status);
diff --git a/app/Actions/Application/StopApplicationPreview.php b/app/Actions/Application/StopApplicationPreview.php
new file mode 100644
index 0000000000..af5f3fc0f0
--- /dev/null
+++ b/app/Actions/Application/StopApplicationPreview.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Actions\Application;
+
+use App\Events\ServiceStatusChanged;
+use App\Models\ApplicationPreview;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class StopApplicationPreview
+{
+    use AsAction;
+
+    public function handle(ApplicationPreview $preview, bool $resetRestartCount = true, bool $removeContainer = true): void
+    {
+        $application = $preview->application;
+        $server = $application->destination->server;
+        $containers = getCurrentApplicationContainerStatus($server, $application->id, $preview->pull_request_id);
+
+        foreach ($containers->pluck('Names') as $containerName) {
+            $commands = [dockerStopCommand($application->settings->stopGracePeriodSeconds(), $containerName, $server)];
+            if ($removeContainer) {
+                $commands[] = "docker rm -f $containerName";
+            } else {
+                array_unshift($commands, "docker update --restart=no $containerName");
+            }
+            instant_remote_process($commands, $server, false);
+        }
+
+        $preview->update(['status' => 'exited']);
+        if ($resetRestartCount) {
+            $preview->resetRestartLimit();
+        }
+
+        ServiceStatusChanged::dispatch($application->environment->project->team->id);
+    }
+}
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index 3487bc9a42..c7fbff37b5 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -32,6 +32,7 @@ class StartDatabase
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
+        $database->resetRestartLimit();
 
         $activity = activity()
             ->withProperties([
@@ -48,6 +49,7 @@ class StartDatabase
 
         if ($activity === null) {
             return 'Database start could not be queued because activity logging is disabled.';
+
         }
 
         DatabaseStartJob::dispatch(
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index a3a7f16ef0..f3c591acfc 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -4,6 +4,7 @@ namespace App\Actions\Database;
 
 use App\Actions\Server\CleanupDocker;
 use App\Events\ServiceStatusChanged;
+use App\Models\BaseModel;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -18,7 +19,7 @@ class StopDatabase
 {
     use AsAction;
 
-    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database, bool $dockerCleanup = true)
+    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database, bool $dockerCleanup = true, bool $resetRestartCount = true, bool $removeContainer = true): string
     {
         try {
             $server = $database->destination->server;
@@ -26,15 +27,13 @@ class StopDatabase
                 return 'Server is not functional';
             }
 
-            $this->stopContainer($database, $database->uuid, 30);
+            $this->stopContainer($database, $database->uuid, 30, $removeContainer);
 
             // Reset restart tracking when database is manually stopped
-            $database->update([
-                'status' => 'exited',
-                'restart_count' => 0,
-                'last_restart_at' => null,
-                'last_restart_type' => null,
-            ]);
+            $database->update(['status' => 'exited']);
+            if ($resetRestartCount) {
+                $database->resetRestartLimit();
+            }
 
             if ($dockerCleanup) {
                 CleanupDocker::dispatch($server, false, false);
@@ -53,12 +52,15 @@ class StopDatabase
 
     }
 
-    private function stopContainer($database, string $containerName, int $timeout = 30): void
+    private function stopContainer(BaseModel $database, string $containerName, int $timeout = 30, bool $removeContainer = true): void
     {
         $server = $database->destination->server;
-        instant_remote_process(command: [
-            dockerStopCommand($timeout, $containerName, $server),
-            "docker rm -f $containerName",
-        ], server: $server, throwError: false);
+        $commands = [dockerStopCommand($timeout, $containerName, $server)];
+        if ($removeContainer) {
+            $commands[] = "docker rm -f $containerName";
+        } else {
+            array_unshift($commands, "docker update --restart=no $containerName");
+        }
+        instant_remote_process(command: $commands, server: $server, throwError: false);
     }
 }
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index 904885dfc5..be098e481c 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -3,15 +3,20 @@
 namespace App\Actions\Docker;
 
 use App\Actions\Application\StopApplication;
+use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
+use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
+use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
 use App\Events\ServiceChecked;
+use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\Server;
 use App\Models\ServiceDatabase;
 use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Services\ContainerStatusAggregator;
+use App\Services\RestartCountTracker;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
@@ -37,8 +42,12 @@ class GetContainersStatus
 
     protected ?Collection $applicationContainerRestartCounts;
 
+    protected ?Collection $previewContainerRestartCounts;
+
     protected ?Collection $serviceContainerStatuses;
 
+    protected ?Collection $serviceContainerRestartCounts;
+
     public function handle(Server $server, ?Collection $containers = null, ?Collection $containerReplicates = null)
     {
         $this->containers = $containers;
@@ -117,6 +126,9 @@ class GetContainersStatus
                 $containerStatus = "$containerStatus:$healthSuffix";
             }
             $labels = Arr::undot(format_docker_labels_to_json($labels));
+            if (filter_var(data_get($labels, 'com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)) {
+                continue;
+            }
             $applicationId = data_get($labels, 'coolify.applicationId');
             if ($applicationId) {
                 $pullRequestId = data_get($labels, 'coolify.pullRequestId');
@@ -133,6 +145,12 @@ class GetContainersStatus
                         } else {
                             $preview->update(['last_online_at' => now()]);
                         }
+                        $key = $applicationId.':'.$pullRequestId;
+                        $this->previewContainerRestartCounts ??= collect();
+                        $this->previewContainerRestartCounts->push([
+                            'key' => $key,
+                            'count' => (int) data_get($container, 'RestartCount', 0),
+                        ]);
                     } else {
                         // Notify user that this container should not be there.
                     }
@@ -140,6 +158,9 @@ class GetContainersStatus
                     $application = $this->applications->where('id', $applicationId)->first();
                     if ($application) {
                         $foundApplications[] = $application->id;
+                        if ($application->container_present !== true) {
+                            $application->update(['container_present' => true]);
+                        }
                         // Store container status for aggregation
                         if (! isset($this->applicationContainerStatuses)) {
                             $this->applicationContainerStatuses = collect();
@@ -220,23 +241,19 @@ class GetContainersStatus
 
                             // Track restart count for databases (single-container)
                             $restartCount = data_get($container, 'RestartCount', 0);
-                            $previousRestartCount = $database->restart_count ?? 0;
-
                             if ($statusFromDb !== $containerStatus) {
                                 $updateData = ['status' => $containerStatus];
                             } else {
                                 $updateData = ['last_online_at' => now()];
                             }
 
-                            // Update restart tracking if restart count increased
-                            if ($restartCount > $previousRestartCount) {
-                                $updateData['restart_count'] = $restartCount;
-                                $updateData['last_restart_at'] = now();
-                                $updateData['last_restart_type'] = 'crash';
-                            }
-
                             $database->update($updateData);
 
+                            if ($database->trackRestartCount((int) $restartCount)) {
+                                StopDatabase::dispatch($database, false, false, false);
+                                $database->team()?->notify(new ApplicationRestartLimitReached($database));
+                            }
+
                             if ($isPublic) {
                                 $foundTcpProxy = $this->containers->filter(function ($value, $key) use ($uuid) {
                                     if ($this->server->isSwarm()) {
@@ -292,6 +309,11 @@ class GetContainersStatus
                 $containerName = data_get($labels, 'com.docker.compose.service');
                 if ($containerName) {
                     $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                    $this->serviceContainerRestartCounts ??= collect();
+                    if (! $this->serviceContainerRestartCounts->has($key)) {
+                        $this->serviceContainerRestartCounts->put($key, collect());
+                    }
+                    $this->serviceContainerRestartCounts->get($key)->put($containerName, (int) data_get($container, 'RestartCount', 0));
                 }
 
                 // Mark service as found
@@ -335,46 +357,35 @@ class GetContainersStatus
                 continue;
             }
 
-            $name = data_get($exitedService, 'name');
-            $fqdn = data_get($exitedService, 'fqdn');
-            if ($name) {
-                if ($fqdn) {
-                    $containerName = "$name, available at $fqdn";
-                } else {
-                    $containerName = $name;
-                }
-            } else {
-                if ($fqdn) {
-                    $containerName = $fqdn;
-                } else {
-                    $containerName = null;
-                }
+            if (! $exitedService->stoppedAfterRestartLimit()) {
+                $exitedService->update([
+                    'status' => 'exited',
+                    'restart_count' => 0,
+                    'restart_limit_reached' => false,
+                    'last_restart_at' => null,
+                    'last_restart_type' => null,
+                ]);
             }
-            $projectUuid = data_get($service, 'environment.project.uuid');
-            $serviceUuid = data_get($service, 'uuid');
-            $environmentName = data_get($service, 'environment.name');
-
-            if ($projectUuid && $serviceUuid && $environmentName) {
-                $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/service/'.$serviceUuid;
-            } else {
-                $url = null;
-            }
-            // $this->server->team?->notify(new ContainerStopped($containerName, $this->server, $url));
-            $exitedService->update(['status' => 'exited']);
         }
 
         $notRunningApplications = $this->applications->pluck('id')->diff($foundApplications);
         foreach ($notRunningApplications as $applicationId) {
             $application = $this->applications->where('id', $applicationId)->first();
-            if (str($application->status)->startsWith('exited')) {
-                continue;
-            }
 
             // Only protection: If no containers at all, Docker query might have failed
             if ($this->containers->isEmpty()) {
                 continue;
             }
 
+            if (str($application->status)->startsWith('exited')) {
+                $application->update([
+                    'container_present' => false,
+                    'restart_limit_reached' => false,
+                ]);
+
+                continue;
+            }
+
             // If container was recently restarting (crash loop), keep it as degraded for a grace period
             // This prevents false "exited" status during the brief moment between container removal and recreation
             $recentlyRestarted = $application->restart_count > 0 &&
@@ -388,9 +399,11 @@ class GetContainersStatus
                 // Reset restart count when application exits completely
                 $application->update([
                     'status' => 'exited',
+                    'container_present' => false,
                     'restart_count' => 0,
                     'last_restart_at' => null,
                     'last_restart_type' => null,
+                    'restart_limit_reached' => false,
                 ]);
             }
         }
@@ -411,6 +424,9 @@ class GetContainersStatus
         $notRunningDatabases = $databases->pluck('id')->diff($foundDatabases);
         foreach ($notRunningDatabases as $database) {
             $database = $databases->where('id', $database)->first();
+            if ($database->stoppedAfterRestartLimit()) {
+                continue;
+            }
             if (str($database->status)->startsWith('exited')) {
                 continue;
             }
@@ -426,6 +442,7 @@ class GetContainersStatus
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
+                'restart_limit_reached' => false,
             ]);
 
             // Stop proxy if database was public
@@ -433,23 +450,10 @@ class GetContainersStatus
                 StopDatabaseProxy::run($database);
             }
 
-            $name = data_get($database, 'name');
-            $fqdn = data_get($database, 'fqdn');
-
-            $containerName = $name;
-
-            $projectUuid = data_get($database, 'environment.project.uuid');
-            $environmentName = data_get($database, 'environment.name');
-            $databaseUuid = data_get($database, 'uuid');
-
-            if ($projectUuid && $databaseUuid && $environmentName) {
-                $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/database/'.$databaseUuid;
-            } else {
-                $url = null;
-            }
-            // $this->server->team?->notify(new ContainerStopped($containerName, $this->server, $url));
         }
 
+        $this->trackPreviewRestartCounts($previews);
+
         // Aggregate multi-container application statuses
         if (isset($this->applicationContainerStatuses) && $this->applicationContainerStatuses->isNotEmpty()) {
             foreach ($this->applicationContainerStatuses as $applicationId => $containerStatuses) {
@@ -470,21 +474,21 @@ class GetContainersStatus
 
                 DB::transaction(function () use ($application, $maxRestartCount, $containerStatuses, &$restartLimitReached) {
                     $previousRestartCount = $application->restart_count ?? 0;
+                    $restartState = (new RestartCountTracker)->evaluate(
+                        previousRestartCount: $previousRestartCount,
+                        observedRestartCount: $maxRestartCount,
+                        maxRestartCount: $application->max_restart_count ?? 0,
+                    );
 
-                    if ($maxRestartCount > $previousRestartCount) {
-                        // Restart count increased - this is a crash restart
+                    if ($restartState['restart_count_changed']) {
+                        $hasCrashRestarts = $restartState['restart_count'] > 0;
                         $application->update([
-                            'restart_count' => $maxRestartCount,
-                            'last_restart_at' => now(),
-                            'last_restart_type' => 'crash',
+                            'restart_count' => $restartState['restart_count'],
+                            'last_restart_at' => $hasCrashRestarts ? now() : null,
+                            'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
                         ]);
-
-                        // Check if restart limit has been reached
-                        $maxAllowedRestarts = $application->max_restart_count ?? 0;
-                        if ($maxAllowedRestarts > 0 && $maxRestartCount >= $maxAllowedRestarts && $previousRestartCount < $maxAllowedRestarts) {
-                            $restartLimitReached = true;
-                        }
                     }
+                    $restartLimitReached = $restartState['restart_limit_reached'];
 
                     // Aggregate status after tracking restart counts
                     $aggregatedStatus = $this->aggregateApplicationStatus($application, $containerStatuses, $maxRestartCount);
@@ -499,9 +503,22 @@ class GetContainersStatus
                 });
 
                 if ($restartLimitReached) {
-                    $application->refresh();
-                    StopApplication::dispatch($application, false, true, false);
-                    $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    $restartLimitClaimed = Application::query()
+                        ->whereKey($application->getKey())
+                        ->where('restart_limit_reached', false)
+                        ->update(['restart_limit_reached' => true]) === 1;
+
+                    if ($restartLimitClaimed) {
+                        $application->refresh();
+                        StopApplication::dispatch(
+                            application: $application,
+                            previewDeployments: false,
+                            dockerCleanup: false,
+                            resetRestartCount: false,
+                            removeContainers: false,
+                        );
+                        $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    }
                 }
             }
         }
@@ -562,6 +579,16 @@ class GetContainersStatus
                 continue;
             }
 
+            $restartCount = isset($this->serviceContainerRestartCounts)
+                ? ($this->serviceContainerRestartCounts->get($key)?->max() ?? 0)
+                : 0;
+            if ($subResource->trackRestartCount($restartCount)) {
+                StopServiceApplication::dispatch($subResource, false, false);
+                $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
+
+                continue;
+            }
+
             // Parse docker compose from service to check for excluded containers
             $dockerComposeRaw = data_get($service, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -602,4 +629,24 @@ class GetContainersStatus
             }
         }
     }
+
+    private function trackPreviewRestartCounts(Collection $previews): void
+    {
+        if (! isset($this->previewContainerRestartCounts)) {
+            return;
+        }
+
+        $this->previewContainerRestartCounts
+            ->groupBy('key')
+            ->each(function (Collection $counts, string $key) use ($previews): void {
+                [$applicationId, $pullRequestId] = explode(':', $key);
+                $preview = $previews->first(fn (ApplicationPreview $preview): bool => (string) $preview->application_id === $applicationId
+                    && (string) $preview->pull_request_id === $pullRequestId
+                );
+                if ($preview?->trackRestartCount((int) $counts->max('count'))) {
+                    StopApplicationPreview::dispatch($preview, false, false);
+                    $preview->application->environment->project->team?->notify(new ApplicationRestartLimitReached($preview));
+                }
+            });
+    }
 }
diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php
index d437a3a176..c69863c572 100644
--- a/app/Actions/Fortify/CreateNewUser.php
+++ b/app/Actions/Fortify/CreateNewUser.php
@@ -2,9 +2,9 @@
 
 namespace App\Actions\Fortify;
 
+use App\Jobs\SendVerificationEmailJob;
 use App\Models\Team;
 use App\Models\User;
-use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Validator;
@@ -22,8 +22,6 @@ class CreateNewUser implements CreatesNewUsers
 
     private const REGISTRATION_EMAIL_IDENTITY_DECAY_SECONDS = 3600;
 
-    public function __construct(private readonly Request $request) {}
-
     /**
      * Validate and create a newly registered user.
      *
@@ -77,7 +75,7 @@ class CreateNewUser implements CreatesNewUsers
             ]);
             $team = $user->teams()->first();
             if (isCloud()) {
-                $user->sendVerificationEmail();
+                SendVerificationEmailJob::dispatch($user);
             } else {
                 $user->markEmailAsVerified();
             }
@@ -95,7 +93,7 @@ class CreateNewUser implements CreatesNewUsers
     {
         $keys = [
             [
-                'key' => 'registration:ip:'.sha1($this->realIp()),
+                'key' => 'registration:ip:'.sha1(auth_rate_limit_ip(request())),
                 'max' => self::REGISTRATION_IP_MAX_ATTEMPTS,
                 'decay' => self::REGISTRATION_IP_DECAY_SECONDS,
             ],
@@ -120,9 +118,4 @@ class CreateNewUser implements CreatesNewUsers
             RateLimiter::hit($limit['key'], $limit['decay']);
         }
     }
-
-    private function realIp(): string
-    {
-        return $this->request->server('REMOTE_ADDR') ?? $this->request->ip();
-    }
 }
diff --git a/app/Actions/Server/StartSentinel.php b/app/Actions/Server/StartSentinel.php
index cec90288e1..3a37a7328b 100644
--- a/app/Actions/Server/StartSentinel.php
+++ b/app/Actions/Server/StartSentinel.php
@@ -48,7 +48,7 @@ class StartSentinel
         }
         $dockerEnvironments = implode(' ', array_map(fn ($key, $value) => '-e '.escapeshellarg("$key=$value"), array_keys($environments), $environments));
         $dockerLabels = implode(' ', array_map(fn ($key, $value) => "$key=$value", array_keys($labels), $labels));
-        $dockerCommand = "docker run -d $dockerEnvironments --name coolify-sentinel -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db --pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
+        $dockerCommand = "docker run -d $dockerEnvironments --name coolify-sentinel -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db --pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-start-period 120s --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
 
         instant_remote_process([
             'docker rm -f coolify-sentinel || true',
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 463a8ad5bf..13371d1265 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -24,6 +24,8 @@ class StartService
         }
         $service->saveComposeConfigs();
         $service->isConfigurationChanged(save: true);
+        $service->applications()->get()->each->resetRestartLimit();
+        $service->databases()->get()->each->resetRestartLimit();
         $workdir = $service->workdir();
         // $commands[] = "cd {$workdir}";
         $commands[] = "echo 'Saved configuration files to {$workdir}.'";
diff --git a/app/Actions/Service/StopService.php b/app/Actions/Service/StopService.php
index 5e34c8e6a2..341687d0d2 100644
--- a/app/Actions/Service/StopService.php
+++ b/app/Actions/Service/StopService.php
@@ -49,8 +49,14 @@ class StopService
                 $this->stopContainersInParallel($containersToStop, $server);
             }
 
-            $applications->each->update(['status' => 'exited']);
-            $dbs->each->update(['status' => 'exited']);
+            $applications->each(function ($application): void {
+                $application->update(['status' => 'exited']);
+                $application->resetRestartLimit();
+            });
+            $dbs->each(function ($database): void {
+                $database->update(['status' => 'exited']);
+                $database->resetRestartLimit();
+            });
 
             if ($deleteConnectedNetworks) {
                 $service->deleteConnectedNetworks();
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index 184dcb4919..fa93a78807 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -13,17 +13,26 @@ class StopServiceApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(ServiceApplication|ServiceDatabase $serviceApplication): void
+    public function handle(ServiceApplication|ServiceDatabase $serviceApplication, bool $resetRestartCount = true, bool $removeContainer = false): void
     {
         $service = $serviceApplication->service;
         $server = $service->destination->server;
         $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
 
-        instant_remote_process([
-            "docker stop {$containerName}",
-        ], $server);
+        if ($removeContainer) {
+            $commands = ["docker rm -f {$containerName}"];
+        } else {
+            $commands = [
+                "docker update --restart=no {$containerName}",
+                "docker stop {$containerName}",
+            ];
+        }
+        instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
         $serviceApplication->update(['status' => 'exited']);
+        if ($resetRestartCount) {
+            $serviceApplication->resetRestartLimit();
+        }
         ServiceStatusChanged::dispatch($service->environment->project->team->id);
     }
 }
diff --git a/app/Actions/Service/UpdateServiceApplicationFromApi.php b/app/Actions/Service/UpdateServiceApplicationFromApi.php
index 123b752c0f..004403975b 100644
--- a/app/Actions/Service/UpdateServiceApplicationFromApi.php
+++ b/app/Actions/Service/UpdateServiceApplicationFromApi.php
@@ -56,7 +56,7 @@ class UpdateServiceApplicationFromApi
                 }
             }
 
-            $serviceApplication->fqdn = $parsed['normalized'];
+            $serviceApplication->setEditableUrls($parsed['normalized']);
         }
 
         if (array_key_exists('noindex_domains', $payload)) {
diff --git a/app/Console/Commands/CleanupStuckedResources.php b/app/Console/Commands/CleanupStuckedResources.php
index 165a3ae219..0874970fb6 100644
--- a/app/Console/Commands/CleanupStuckedResources.php
+++ b/app/Console/Commands/CleanupStuckedResources.php
@@ -13,7 +13,6 @@ use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
-use App\Models\SslCertificate;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -39,13 +38,14 @@ class CleanupStuckedResources extends Command
     private function cleanup_stucked_resources()
     {
         try {
-            $teams = Team::all()->filter(function ($team) {
-                return $team->members()->count() === 0 && $team->servers()->count() === 0;
-            });
+            $teams = Team::query()
+                ->whereDoesntHave('members')
+                ->whereDoesntHave('servers')
+                ->lazyById();
             foreach ($teams as $team) {
                 $team->delete();
             }
-            $servers = Server::all()->filter(function ($server) {
+            $servers = Server::query()->with('team.subscription')->lazyById()->filter(function ($server) {
                 return $server->isFunctional();
             });
             if (isCloud()) {
@@ -60,7 +60,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stucked resources: {$e->getMessage()}\n";
         }
         try {
-            $servers = Server::onlyTrashed()->get();
+            $servers = Server::onlyTrashed()->lazyById();
             foreach ($servers as $server) {
                 echo "Force deleting stuck server: {$server->name}\n";
                 $server->forceDelete();
@@ -69,7 +69,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck servers: {$e->getMessage()}\n";
         }
         try {
-            $applicationsDeploymentQueue = ApplicationDeploymentQueue::get();
+            $applicationsDeploymentQueue = ApplicationDeploymentQueue::query()->lazyById();
             foreach ($applicationsDeploymentQueue as $applicationDeploymentQueue) {
                 if (is_null($applicationDeploymentQueue->application)) {
                     echo "Deleting stuck application deployment queue: {$applicationDeploymentQueue->id}\n";
@@ -80,7 +80,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck application deployment queue: {$e->getMessage()}\n";
         }
         try {
-            $applications = Application::withTrashed()->whereNotNull('deleted_at')->get();
+            $applications = Application::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($applications as $application) {
                 echo "Deleting stuck application: {$application->name}\n";
                 DeleteResourceJob::dispatch($application);
@@ -89,18 +89,18 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck application: {$e->getMessage()}\n";
         }
         try {
-            $applicationsPreviews = ApplicationPreview::get();
+            $applicationsPreviews = ApplicationPreview::query()
+                ->whereDoesntHave('application')
+                ->lazyById();
             foreach ($applicationsPreviews as $applicationPreview) {
-                if (! data_get($applicationPreview, 'application')) {
-                    echo "Deleting stuck application preview: {$applicationPreview->uuid}\n";
-                    DeleteResourceJob::dispatch($applicationPreview);
-                }
+                echo "Deleting stuck application preview: {$applicationPreview->uuid}\n";
+                DeleteResourceJob::dispatch($applicationPreview);
             }
         } catch (\Throwable $e) {
             echo "Error in cleaning stuck application: {$e->getMessage()}\n";
         }
         try {
-            $applicationsPreviews = ApplicationPreview::withTrashed()->whereNotNull('deleted_at')->get();
+            $applicationsPreviews = ApplicationPreview::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($applicationsPreviews as $applicationPreview) {
                 echo "Deleting stuck application preview: {$applicationPreview->fqdn}\n";
                 DeleteResourceJob::dispatch($applicationPreview);
@@ -109,7 +109,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck application: {$e->getMessage()}\n";
         }
         try {
-            $postgresqls = StandalonePostgresql::withTrashed()->whereNotNull('deleted_at')->get();
+            $postgresqls = StandalonePostgresql::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($postgresqls as $postgresql) {
                 echo "Deleting stuck postgresql: {$postgresql->name}\n";
                 DeleteResourceJob::dispatch($postgresql);
@@ -118,7 +118,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck postgresql: {$e->getMessage()}\n";
         }
         try {
-            $rediss = StandaloneRedis::withTrashed()->whereNotNull('deleted_at')->get();
+            $rediss = StandaloneRedis::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($rediss as $redis) {
                 echo "Deleting stuck redis: {$redis->name}\n";
                 DeleteResourceJob::dispatch($redis);
@@ -127,7 +127,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck redis: {$e->getMessage()}\n";
         }
         try {
-            $keydbs = StandaloneKeydb::withTrashed()->whereNotNull('deleted_at')->get();
+            $keydbs = StandaloneKeydb::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($keydbs as $keydb) {
                 echo "Deleting stuck keydb: {$keydb->name}\n";
                 DeleteResourceJob::dispatch($keydb);
@@ -136,7 +136,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck keydb: {$e->getMessage()}\n";
         }
         try {
-            $dragonflies = StandaloneDragonfly::withTrashed()->whereNotNull('deleted_at')->get();
+            $dragonflies = StandaloneDragonfly::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($dragonflies as $dragonfly) {
                 echo "Deleting stuck dragonfly: {$dragonfly->name}\n";
                 DeleteResourceJob::dispatch($dragonfly);
@@ -145,7 +145,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck dragonfly: {$e->getMessage()}\n";
         }
         try {
-            $clickhouses = StandaloneClickhouse::withTrashed()->whereNotNull('deleted_at')->get();
+            $clickhouses = StandaloneClickhouse::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($clickhouses as $clickhouse) {
                 echo "Deleting stuck clickhouse: {$clickhouse->name}\n";
                 DeleteResourceJob::dispatch($clickhouse);
@@ -154,7 +154,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck clickhouse: {$e->getMessage()}\n";
         }
         try {
-            $mongodbs = StandaloneMongodb::withTrashed()->whereNotNull('deleted_at')->get();
+            $mongodbs = StandaloneMongodb::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($mongodbs as $mongodb) {
                 echo "Deleting stuck mongodb: {$mongodb->name}\n";
                 DeleteResourceJob::dispatch($mongodb);
@@ -163,7 +163,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck mongodb: {$e->getMessage()}\n";
         }
         try {
-            $mysqls = StandaloneMysql::withTrashed()->whereNotNull('deleted_at')->get();
+            $mysqls = StandaloneMysql::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($mysqls as $mysql) {
                 echo "Deleting stuck mysql: {$mysql->name}\n";
                 DeleteResourceJob::dispatch($mysql);
@@ -172,7 +172,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck mysql: {$e->getMessage()}\n";
         }
         try {
-            $mariadbs = StandaloneMariadb::withTrashed()->whereNotNull('deleted_at')->get();
+            $mariadbs = StandaloneMariadb::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($mariadbs as $mariadb) {
                 echo "Deleting stuck mariadb: {$mariadb->name}\n";
                 DeleteResourceJob::dispatch($mariadb);
@@ -181,7 +181,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck mariadb: {$e->getMessage()}\n";
         }
         try {
-            $services = Service::withTrashed()->whereNotNull('deleted_at')->get();
+            $services = Service::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($services as $service) {
                 echo "Deleting stuck service: {$service->name}\n";
                 DeleteResourceJob::dispatch($service);
@@ -190,7 +190,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck service: {$e->getMessage()}\n";
         }
         try {
-            $serviceApps = ServiceApplication::withTrashed()->whereNotNull('deleted_at')->get();
+            $serviceApps = ServiceApplication::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($serviceApps as $serviceApp) {
                 echo "Deleting stuck serviceapp: {$serviceApp->name}\n";
                 $serviceApp->forceDelete();
@@ -199,7 +199,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck serviceapp: {$e->getMessage()}\n";
         }
         try {
-            $serviceDbs = ServiceDatabase::withTrashed()->whereNotNull('deleted_at')->get();
+            $serviceDbs = ServiceDatabase::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($serviceDbs as $serviceDb) {
                 echo "Deleting stuck serviceapp: {$serviceDb->name}\n";
                 $serviceDb->forceDelete();
@@ -208,19 +208,27 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck serviceapp: {$e->getMessage()}\n";
         }
         try {
-            $scheduled_tasks = ScheduledTask::all();
+            $scheduled_tasks = ScheduledTask::query()
+                ->where(function ($query): void {
+                    $query->where(function ($query): void {
+                        $query->whereNull('application_id')->whereNull('service_id');
+                    })->orWhere(function ($query): void {
+                        $query->whereNotNull('application_id')->whereDoesntHave('application');
+                    })->orWhere(function ($query): void {
+                        $query->whereNotNull('service_id')->whereDoesntHave('service');
+                    });
+                })
+                ->lazyById();
             foreach ($scheduled_tasks as $scheduled_task) {
-                if (! $scheduled_task->service && ! $scheduled_task->application) {
-                    echo "Deleting stuck scheduledtask: {$scheduled_task->name}\n";
-                    $scheduled_task->delete();
-                }
+                echo "Deleting stuck scheduledtask: {$scheduled_task->name}\n";
+                $scheduled_task->delete();
             }
         } catch (\Throwable $e) {
             echo "Error in cleaning stuck scheduledtasks: {$e->getMessage()}\n";
         }
 
         try {
-            $scheduled_backups = ScheduledDatabaseBackup::all();
+            $scheduled_backups = ScheduledDatabaseBackup::query()->lazyById();
             foreach ($scheduled_backups as $scheduled_backup) {
                 try {
                     $server = $scheduled_backup->server();
@@ -238,7 +246,7 @@ class CleanupStuckedResources extends Command
 
         // Cleanup any resources that are not attached to any environment or destination or server
         try {
-            $applications = Application::all();
+            $applications = Application::query()->lazyById();
             foreach ($applications as $application) {
                 if (! data_get($application, 'environment')) {
                     echo 'Application without environment: '.$application->name.'\n';
@@ -263,7 +271,7 @@ class CleanupStuckedResources extends Command
             echo "Error in application: {$e->getMessage()}\n";
         }
         try {
-            $postgresqls = StandalonePostgresql::all()->where('id', '!=', 0);
+            $postgresqls = StandalonePostgresql::query()->where('id', '!=', 0)->lazyById();
             foreach ($postgresqls as $postgresql) {
                 if (! data_get($postgresql, 'environment')) {
                     echo 'Postgresql without environment: '.$postgresql->name.'\n';
@@ -288,7 +296,7 @@ class CleanupStuckedResources extends Command
             echo "Error in postgresql: {$e->getMessage()}\n";
         }
         try {
-            $redis = StandaloneRedis::all();
+            $redis = StandaloneRedis::query()->lazyById();
             foreach ($redis as $redis) {
                 if (! data_get($redis, 'environment')) {
                     echo 'Redis without environment: '.$redis->name.'\n';
@@ -314,7 +322,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $mongodbs = StandaloneMongodb::all();
+            $mongodbs = StandaloneMongodb::query()->lazyById();
             foreach ($mongodbs as $mongodb) {
                 if (! data_get($mongodb, 'environment')) {
                     echo 'Mongodb without environment: '.$mongodb->name.'\n';
@@ -340,7 +348,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $mysqls = StandaloneMysql::all();
+            $mysqls = StandaloneMysql::query()->lazyById();
             foreach ($mysqls as $mysql) {
                 if (! data_get($mysql, 'environment')) {
                     echo 'Mysql without environment: '.$mysql->name.'\n';
@@ -366,7 +374,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $mariadbs = StandaloneMariadb::all();
+            $mariadbs = StandaloneMariadb::query()->lazyById();
             foreach ($mariadbs as $mariadb) {
                 if (! data_get($mariadb, 'environment')) {
                     echo 'Mariadb without environment: '.$mariadb->name.'\n';
@@ -392,7 +400,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $services = Service::all();
+            $services = Service::query()->lazyById();
             foreach ($services as $service) {
                 if (! data_get($service, 'environment')) {
                     echo 'Service without environment: '.$service->name.'\n';
@@ -417,43 +425,23 @@ class CleanupStuckedResources extends Command
             echo "Error in service: {$e->getMessage()}\n";
         }
         try {
-            $serviceApplications = ServiceApplication::all();
+            $serviceApplications = ServiceApplication::query()->whereDoesntHave('service')->lazyById();
             foreach ($serviceApplications as $service) {
-                if (! data_get($service, 'service')) {
-                    echo 'ServiceApplication without service: '.$service->name.'\n';
-                    $service->forceDelete();
-
-                    continue;
-                }
+                echo 'ServiceApplication without service: '.$service->name.'\n';
+                $service->forceDelete();
             }
         } catch (\Throwable $e) {
             echo "Error in serviceApplications: {$e->getMessage()}\n";
         }
         try {
-            $serviceDatabases = ServiceDatabase::all();
+            $serviceDatabases = ServiceDatabase::query()->whereDoesntHave('service')->lazyById();
             foreach ($serviceDatabases as $service) {
-                if (! data_get($service, 'service')) {
-                    echo 'ServiceDatabase without service: '.$service->name.'\n';
-                    $service->forceDelete();
-
-                    continue;
-                }
+                echo 'ServiceDatabase without service: '.$service->name.'\n';
+                $service->forceDelete();
             }
         } catch (\Throwable $e) {
             echo "Error in ServiceDatabases: {$e->getMessage()}\n";
         }
 
-        try {
-            $orphanedCerts = SslCertificate::whereNotIn('server_id', function ($query) {
-                $query->select('id')->from('servers');
-            })->get();
-
-            foreach ($orphanedCerts as $cert) {
-                echo "Deleting orphaned SSL certificate: {$cert->id} (server_id: {$cert->server_id})\n";
-                $cert->delete();
-            }
-        } catch (\Throwable $e) {
-            echo "Error in cleaning orphaned SSL certificates: {$e->getMessage()}\n";
-        }
     }
 }
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index e6dc323838..8d4d017c81 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -46,6 +46,10 @@ class Kernel extends ConsoleKernel
             ->hourly()
             ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
+        $this->scheduleInstance->command('cleanup:stucked-resources')
+            ->daily()
+            ->onOneServer()
+            ->withoutOverlapping(60);
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 784751caf0..727f34f801 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -23,6 +23,7 @@ use App\Rules\DockerImageFormat;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Services\DockerImageParser;
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -2487,6 +2488,256 @@ class ApplicationsController extends Controller
         ]);
     }
 
+    #[OA\Patch(
+        summary: 'Update Preview Domains',
+        description: 'Replace domains for a preview deployment. Use domains for regular applications or docker_compose_domains for Docker Compose applications. Ports are stored as internal overrides while public domains remain portless.',
+        path: '/applications/{uuid}/previews/{pull_request_id}',
+        operationId: 'update-preview-domains-by-pull-request-id',
+        security: [['bearerAuth' => []]],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'pull_request_id', in: 'path', required: true, schema: new OA\Schema(type: 'integer')),
+        ],
+        requestBody: new OA\RequestBody(required: true, content: new OA\JsonContent(
+            properties: [
+                new OA\Property(property: 'domains', type: 'string', nullable: true, example: 'https://pr.example.com:3000'),
+                new OA\Property(
+                    property: 'docker_compose_domains',
+                    type: 'array',
+                    nullable: true,
+                    items: new OA\Items(properties: [
+                        new OA\Property(property: 'name', type: 'string'),
+                        new OA\Property(property: 'domain', type: 'string', nullable: true),
+                        new OA\Property(property: 'redirect', type: 'string', nullable: true, enum: ['www', 'non-www', 'both']),
+                    ], type: 'object'),
+                ),
+                new OA\Property(property: 'force_domain_override', type: 'boolean', default: false),
+            ],
+        )),
+        responses: [
+            new OA\Response(response: 200, description: 'Preview domains updated.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, ref: '#/components/responses/403'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 409, description: 'Domain conflict.'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function update_preview_by_pull_request_id(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $pullRequestIdRaw = $request->route('pull_request_id');
+        if (! ctype_digit((string) $pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+            return response()->json(['message' => 'Invalid pull_request_id.'], 422);
+        }
+
+        $preview = ApplicationPreview::where('application_id', $application->id)
+            ->where('pull_request_id', (int) $pullRequestIdRaw)
+            ->first();
+        if (! $preview) {
+            return response()->json(['message' => 'Preview not found.'], 404);
+        }
+
+        $isCompose = $application->build_pack === BuildPackTypes::DOCKERCOMPOSE->value;
+        $validationRules = ['force_domain_override' => 'boolean'];
+        if ($isCompose) {
+            $validationRules = array_merge($validationRules, [
+                'domains' => 'missing',
+                'docker_compose_domains' => 'present|array',
+                'docker_compose_domains.*' => 'array:name,domain,redirect',
+                'docker_compose_domains.*.name' => 'required|string|distinct',
+                'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
+                'docker_compose_domains.*.redirect' => 'nullable|string|in:www,non-www,both',
+            ]);
+        } else {
+            $validationRules['domains'] = ['present', ...ValidationPatterns::applicationDomainRules()];
+            $validationRules['docker_compose_domains'] = 'missing';
+        }
+
+        $validator = Validator::make($request->all(), $validationRules);
+        if ($validator->fails()) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $validator->errors()], 422);
+        }
+
+        $dockerComposeDomains = null;
+        $dockerComposeDomainsResponse = null;
+        if ($isCompose) {
+            try {
+                $compose = Yaml::parse($application->docker_compose_raw ?? '');
+            } catch (\Throwable) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'The Docker Compose configuration could not be parsed.'],
+                ], 422);
+            }
+
+            $services = data_get($compose, 'services');
+            if (! is_array($services) || $services === []) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'The Docker Compose configuration must define at least one service.'],
+                ], 422);
+            }
+
+            $composeServices = collect($services)
+                ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
+                ->keys()
+                ->map(fn (mixed $name): string => (string) $name)
+                ->values();
+            $requestedServices = collect($request->input('docker_compose_domains'))->pluck('name');
+            if ($requestedServices->diff($composeServices)->isNotEmpty()) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'One or more Docker Compose services are invalid.'],
+                ], 422);
+            }
+
+            $existingComposeDomains = json_decode($preview->docker_compose_domains ?? '[]', true) ?: [];
+            $dockerComposeDomains = $composeServices
+                ->mapWithKeys(function (string $service) use ($existingComposeDomains): array {
+                    $entry = ['domain' => ''];
+                    $redirect = $existingComposeDomains[$service]['redirect'] ?? null;
+                    if (in_array($redirect, ['www', 'non-www', 'both'], true)) {
+                        $entry['redirect'] = $redirect;
+                    }
+
+                    return [$service => $entry];
+                })
+                ->all();
+            foreach ($request->input('docker_compose_domains') as $item) {
+                $entry = ['domain' => ValidationPatterns::normalizeApplicationDomains(data_get($item, 'domain')) ?? ''];
+                $redirect = array_key_exists('redirect', $item)
+                    ? data_get($item, 'redirect')
+                    : ($existingComposeDomains[data_get($item, 'name')]['redirect'] ?? null);
+                if (in_array($redirect, ['www', 'non-www', 'both'], true)) {
+                    $entry['redirect'] = $redirect;
+                }
+                $dockerComposeDomains[data_get($item, 'name')] = $entry;
+            }
+            $domains = collect($dockerComposeDomains)
+                ->pluck('domain')
+                ->filter()
+                ->implode(',') ?: null;
+        } else {
+            $domains = ValidationPatterns::normalizeApplicationDomains($request->input('domains'));
+        }
+
+        $submittedUrls = collect(ValidationPatterns::applicationDomainList($domains))
+            ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain));
+        if ($submittedUrls->duplicates()->isNotEmpty()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [
+                    $isCompose ? 'docker_compose_domains' : 'domains' => 'The same domain cannot be configured more than once.',
+                ],
+            ], 422);
+        }
+
+        $normalized = DomainPortOverrides::normalize($domains, null);
+        $portlessDomains = $normalized['fqdn'];
+        if ($isCompose) {
+            foreach ($dockerComposeDomains as $service => $entry) {
+                $dockerComposeDomains[$service]['domain'] = collect(ValidationPatterns::applicationDomainList($entry['domain']))
+                    ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                    ->implode(',');
+            }
+            $dockerComposeDomainsResponse = collect($dockerComposeDomains)
+                ->map(fn (array $entry, string $name): array => ['name' => $name, ...$entry])
+                ->values()
+                ->all();
+        }
+        $urls = collect(ValidationPatterns::applicationDomainList($portlessDomains));
+        $conflicts = checkIfDomainIsAlreadyUsedViaAPI($urls, $teamId);
+        if (isset($conflicts['error'])) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [$isCompose ? 'docker_compose_domains' : 'domains' => $conflicts['error']],
+            ], 422);
+        }
+        if ($conflicts['hasConflicts'] && ! $request->boolean('force_domain_override')) {
+            return response()->json([
+                'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                'conflicts' => $conflicts['conflicts'],
+                'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+            ], 409);
+        }
+
+        $hostCandidates = $urls
+            ->map(fn (string $url): string => (string) parse_url($url, PHP_URL_HOST))
+            ->filter();
+        $conflictingPreview = null;
+        if ($hostCandidates->isNotEmpty()) {
+            $conflictingPreview = ApplicationPreview::query()
+                ->whereIn('application_id', Application::ownedByCurrentTeamAPI($teamId)
+                    ->withoutGlobalScope('withRelations')
+                    ->reorder()
+                    ->select('applications.id'))
+                ->whereKeyNot($preview->id)
+                ->whereNotNull('fqdn')
+                ->where(function ($query) use ($hostCandidates): void {
+                    foreach ($hostCandidates as $host) {
+                        $query->orWhere('fqdn', 'like', '%'.$host.'%');
+                    }
+                })
+                ->get(['uuid', 'pull_request_id', 'fqdn'])
+                ->first(fn (ApplicationPreview $otherPreview): bool => collect(ValidationPatterns::applicationDomainList($otherPreview->fqdn))
+                    ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                    ->intersect($urls)
+                    ->isNotEmpty());
+        }
+
+        if ($conflictingPreview && ! $request->boolean('force_domain_override')) {
+            return response()->json([
+                'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                'conflicts' => [[
+                    'domain' => collect(ValidationPatterns::applicationDomainList($conflictingPreview->fqdn))
+                        ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                        ->intersect($urls)
+                        ->first(),
+                    'resource_name' => 'Preview deployment #'.$conflictingPreview->pull_request_id,
+                    'resource_uuid' => $conflictingPreview->uuid,
+                    'resource_type' => 'application',
+                    'message' => 'Domain is already in use by another preview deployment.',
+                ]],
+                'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+            ], 409);
+        }
+
+        $preview->domain_port_overrides = $normalized['overrides'];
+        $preview->fqdn = $portlessDomains;
+        if ($isCompose) {
+            $preview->docker_compose_domains = json_encode($dockerComposeDomains);
+        }
+        $preview->save();
+
+        auditLog('api.application.preview_updated', [
+            'team_id' => $teamId,
+            'application_uuid' => $application->uuid,
+            'pull_request_id' => $preview->pull_request_id,
+            'changed_fields' => [$isCompose ? 'docker_compose_domains' : 'domains'],
+        ]);
+
+        return response()->json([
+            'uuid' => $preview->uuid,
+            'pull_request_id' => $preview->pull_request_id,
+            'domains' => $preview->fqdn,
+            'docker_compose_domains' => $dockerComposeDomainsResponse,
+            'domain_port_overrides' => $preview->domain_port_overrides,
+        ]);
+    }
+
     #[OA\Delete(
         summary: 'Delete',
         description: 'Delete application by UUID.',
@@ -2560,6 +2811,8 @@ class ApplicationsController extends Controller
 
         $this->authorize('delete', $application);
 
+        $application->delete();
+
         DeleteResourceJob::dispatch(
             resource: $application,
             deleteVolumes: $request->boolean('delete_volumes', true),
@@ -2816,6 +3069,7 @@ class ApplicationsController extends Controller
             'http_basic_auth_username' => 'string',
             'http_basic_auth_password' => 'string',
             'include_source_commit_in_build' => 'boolean',
+            'ports_exposes' => 'nullable|string|regex:/^(\d+)(,\d+)*$/',
         ];
         $validationRules = array_merge(sharedDataApplications(), $validationRules);
         $validationMessages = [
@@ -2824,10 +3078,10 @@ class ApplicationsController extends Controller
         $validator = Validator::make($request->all(), $validationRules, $validationMessages);
 
         // Validate ports_exposes
-        if ($request->has('ports_exposes')) {
+        if ($request->filled('ports_exposes')) {
             $ports = explode(',', $request->ports_exposes);
             foreach ($ports as $port) {
-                if (! is_numeric($port)) {
+                if (! is_numeric($port) || (int) $port < 1 || (int) $port > 65535) {
                     return response()->json([
                         'message' => 'Validation failed.',
                         'errors' => [
@@ -5150,7 +5404,7 @@ class ApplicationsController extends Controller
         $this->authorize('delete', $application);
 
         $pullRequestIdRaw = $request->route('pull_request_id');
-        if (! is_numeric($pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+        if (! ctype_digit((string) $pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
             return response()->json(['message' => 'Invalid pull_request_id.'], 422);
         }
         $pullRequestId = (int) $pullRequestIdRaw;
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 7b62b4980a..aeb69ac8b4 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -2586,6 +2586,8 @@ class DatabasesController extends Controller
 
         $this->authorize('delete', $database);
 
+        $database->delete();
+
         DeleteResourceJob::dispatch(
             resource: $database,
             deleteVolumes: $request->boolean('delete_volumes', true),
diff --git a/app/Http/Controllers/Api/NotificationsController.php b/app/Http/Controllers/Api/NotificationsController.php
index f5493d0249..1cca69a663 100644
--- a/app/Http/Controllers/Api/NotificationsController.php
+++ b/app/Http/Controllers/Api/NotificationsController.php
@@ -15,6 +15,7 @@ use App\Rules\ValidHostname;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
 use OpenApi\Attributes as OA;
 
 class NotificationsController extends Controller
@@ -45,6 +46,7 @@ class NotificationsController extends Controller
                     'deployment_success_email_notifications' => 'sometimes|boolean',
                     'deployment_failure_email_notifications' => 'sometimes|boolean',
                     'status_change_email_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_email_notifications' => 'sometimes|boolean',
                     'backup_success_email_notifications' => 'sometimes|boolean',
                     'backup_failure_email_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_email_notifications' => 'sometimes|boolean',
@@ -66,6 +68,7 @@ class NotificationsController extends Controller
                     'deployment_success_discord_notifications' => 'sometimes|boolean',
                     'deployment_failure_discord_notifications' => 'sometimes|boolean',
                     'status_change_discord_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_discord_notifications' => 'sometimes|boolean',
                     'backup_success_discord_notifications' => 'sometimes|boolean',
                     'backup_failure_discord_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_discord_notifications' => 'sometimes|boolean',
@@ -88,6 +91,7 @@ class NotificationsController extends Controller
                     'deployment_success_slack_notifications' => 'sometimes|boolean',
                     'deployment_failure_slack_notifications' => 'sometimes|boolean',
                     'status_change_slack_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_slack_notifications' => 'sometimes|boolean',
                     'backup_success_slack_notifications' => 'sometimes|boolean',
                     'backup_failure_slack_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_slack_notifications' => 'sometimes|boolean',
@@ -110,6 +114,7 @@ class NotificationsController extends Controller
                     'deployment_success_telegram_notifications' => 'sometimes|boolean',
                     'deployment_failure_telegram_notifications' => 'sometimes|boolean',
                     'status_change_telegram_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_telegram_notifications' => 'sometimes|boolean',
                     'backup_success_telegram_notifications' => 'sometimes|boolean',
                     'backup_failure_telegram_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_telegram_notifications' => 'sometimes|boolean',
@@ -124,6 +129,7 @@ class NotificationsController extends Controller
                     'telegram_notifications_deployment_success_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_deployment_failure_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_status_change_thread_id' => 'sometimes|nullable|string|max:255',
+                    'telegram_notifications_restart_limit_reached_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_backup_success_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_backup_failure_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_scheduled_task_success_thread_id' => 'sometimes|nullable|string|max:255',
@@ -146,6 +152,7 @@ class NotificationsController extends Controller
                     'deployment_success_pushover_notifications' => 'sometimes|boolean',
                     'deployment_failure_pushover_notifications' => 'sometimes|boolean',
                     'status_change_pushover_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_pushover_notifications' => 'sometimes|boolean',
                     'backup_success_pushover_notifications' => 'sometimes|boolean',
                     'backup_failure_pushover_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_pushover_notifications' => 'sometimes|boolean',
@@ -167,6 +174,7 @@ class NotificationsController extends Controller
                     'deployment_success_webhook_notifications' => 'sometimes|boolean',
                     'deployment_failure_webhook_notifications' => 'sometimes|boolean',
                     'status_change_webhook_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_webhook_notifications' => 'sometimes|boolean',
                     'backup_success_webhook_notifications' => 'sometimes|boolean',
                     'backup_failure_webhook_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_webhook_notifications' => 'sometimes|boolean',
@@ -249,7 +257,7 @@ class NotificationsController extends Controller
         $body = $request->json()->all();
         $config = $this->channelConfig($channel);
 
-        $validator = customApiValidator($body, $config['rules']);
+        $validator = Validator::make($body, $config['rules']);
 
         $extraFields = array_diff(array_keys($body), $allowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
diff --git a/app/Http/Controllers/Api/SentinelController.php b/app/Http/Controllers/Api/SentinelController.php
index b3685daa4b..81b932365d 100644
--- a/app/Http/Controllers/Api/SentinelController.php
+++ b/app/Http/Controllers/Api/SentinelController.php
@@ -138,7 +138,7 @@ class SentinelController extends Controller
     /**
      * Build a stable hash of container state.
      *
-     * Covers [name, state] only — metrics, filesystem_usage_root, and
+     * Covers [name, state, restart_count] only — metrics, filesystem_usage_root, and
      * health_status are excluded on purpose. Disk % churns constantly, and
      * health checks can flap between starting/healthy/unhealthy while the
      * container lifecycle state remains unchanged. Both would otherwise defeat
@@ -153,6 +153,7 @@ class SentinelController extends Controller
             ->map(fn ($c) => [
                 'name' => data_get($c, 'name'),
                 'state' => data_get($c, 'state'),
+                'restart_count' => data_get($c, 'restart_count'),
             ])
             ->sortBy('name')
             ->values()
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index d7d4953f9c..9bfcfd8539 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -1020,6 +1020,8 @@ class ServicesController extends Controller
 
         $this->authorize('delete', $service);
 
+        $service->delete();
+
         DeleteResourceJob::dispatch(
             resource: $service,
             deleteVolumes: $request->boolean('delete_volumes', true),
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index a70d917815..0887e7e864 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -45,6 +45,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     public const BUILD_TIME_ENV_PATH = '/artifacts/build-time.env';
 
+    public const BUILD_TIME_SHELL_ENV_PATH = '/artifacts/build-time-shell.env';
+
+    public const BUILD_TIME_ENV_LAUNCHER_PATH = '/artifacts/run-with-build-time-env';
+
     private const BUILD_SCRIPT_PATH = '/artifacts/build.sh';
 
     private const NIXPACKS_PLAN_PATH = '/artifacts/thegameplan.json';
@@ -205,6 +209,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private bool $dockerSecretsSupported = false;
 
+    private bool $dockerSecretsAvailable = false;
+
+    private bool $useBuildtimeEnvironmentLauncher = false;
+
     private bool $skip_build = false;
 
     private Collection|string $build_secrets;
@@ -265,14 +273,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $this->configuration_dir = application_configuration_dir()."/{$this->application->uuid}";
         $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
 
-        $this->container_name = generateApplicationContainerName($this->application, $this->pull_request_id);
-        if ($this->application->settings->custom_internal_name && ! $this->application->settings->is_consistent_container_name_enabled) {
-            if ($this->pull_request_id === 0) {
-                $this->container_name = $this->application->settings->custom_internal_name;
-            } else {
-                $this->container_name = addPreviewDeploymentSuffix($this->application->settings->custom_internal_name, $this->pull_request_id);
-            }
-        }
+        $this->container_name = $this->resolveContainerName();
 
         $this->saved_outputs = collect();
 
@@ -429,6 +430,11 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private function detectBuildKitCapabilities(): void
     {
+        $this->dockerBuildkitSupported = false;
+        $this->dockerBuildxAvailable = false;
+        $this->dockerSecretsSupported = false;
+        $this->dockerSecretsAvailable = false;
+
         $serverToCheck = $this->use_build_server ? $this->build_server : $this->server;
         $serverName = $this->use_build_server ? "build server ({$serverToCheck->name})" : "deployment server ({$serverToCheck->name})";
 
@@ -479,18 +485,19 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
-            // If build secrets are enabled and BuildKit is available, verify --secret flag support
-            if ($this->application->settings->use_build_secrets && $this->dockerBuildkitSupported) {
+            if ($this->dockerBuildkitSupported) {
                 $secretsTest = instant_remote_process(
                     ["docker build --help 2>&1 | grep -q 'secret' && echo 'supported' || echo 'not-supported'"],
                     $serverToCheck
                 );
 
                 if (trim($secretsTest) === 'supported') {
-                    $this->dockerSecretsSupported = true;
-                    $this->application_deployment_queue->addLogEntry('Build secrets are enabled and will be used for enhanced security.');
-                } else {
-                    $this->dockerSecretsSupported = false;
+                    $this->dockerSecretsAvailable = true;
+                    if ($this->application->settings->use_build_secrets) {
+                        $this->dockerSecretsSupported = true;
+                        $this->application_deployment_queue->addLogEntry('Build secrets are enabled and will be used for enhanced security.');
+                    }
+                } elseif ($this->application->settings->use_build_secrets) {
                     $this->application_deployment_queue->addLogEntry("Docker on {$serverName} does not support build secrets. Using traditional build arguments.");
                 }
             }
@@ -498,6 +505,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $this->dockerBuildkitSupported = false;
             $this->dockerBuildxAvailable = false;
             $this->dockerSecretsSupported = false;
+            $this->dockerSecretsAvailable = false;
             $this->application_deployment_queue->addLogEntry("Could not detect BuildKit capabilities on {$serverName}: {$e->getMessage()}");
         }
     }
@@ -1757,11 +1765,14 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 }
 
                 foreach ($planVariables as $key => $value) {
+                    $key = (string) $key;
+
                     // Skip COOLIFY_* and SERVICE_* - they'll be added later with higher priority
                     if (str_starts_with($key, 'COOLIFY_') || str_starts_with($key, 'SERVICE_')) {
                         continue;
                     }
 
+                    $key = $this->validatedBuildtimeEnvironmentVariableKey($key, 'the Nixpacks plan');
                     $escapedValue = escapeBashEnvValue($value);
                     $envs_dict[$key] = $escapedValue;
 
@@ -1961,6 +1972,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         // Convert dictionary back to collection in KEY=VALUE format
         $envs = collect([]);
         foreach ($envs_dict as $key => $value) {
+            $key = $this->validatedBuildtimeEnvironmentVariableKey((string) $key, 'the build-time environment');
             $envs->push($key.'='.$value);
         }
 
@@ -1974,45 +1986,132 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         return $envs;
     }
 
-    private function save_buildtime_environment_variables()
+    private function validatedBuildtimeEnvironmentVariableKey(string $key, string $origin): string
     {
-        // Generate build-time environment variables locally
-        $environment_variables = $this->generate_buildtime_environment_variables();
 
-        // Save .env file for build phase in /artifacts to prevent it from being copied into Docker images
-        if ($environment_variables->isNotEmpty()) {
-            $envs_base64 = base64_encode($environment_variables->implode("\n"));
+        try {
+            if (! ValidationPatterns::isValidEnvironmentVariableKey($key)) {
+                throw new \InvalidArgumentException('Invalid build-time environment variable key.');
 
-            $this->application_deployment_queue->addLogEntry('Creating build-time .env file in /artifacts (outside Docker context).', hidden: true);
-
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee ".self::BUILD_TIME_ENV_PATH.' > /dev/null'),
-                    'skip_command_log' => true,
-                ]
-            );
-
-            if (isDev()) {
-                $this->execute_remote_command(
-                    [
-                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
-                        'hidden' => true,
-                    ]
-                );
             }
-        } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
-            // For build packs that source the build-time .env file, create an empty file even if there are no build-time variables
-            // This ensures the file exists when referenced in build commands
-            $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
 
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, 'touch '.self::BUILD_TIME_ENV_PATH),
-                ]
+            return $key;
+        } catch (\InvalidArgumentException $exception) {
+            $this->logInvalidBuildtimeEnvironmentVariableKey($key, $origin);
+
+            throw new DeploymentException(
+                "Invalid environment variable name from {$origin}: ".ValidationPatterns::displayShellEnvironmentVariableKey($key).'. Names must start with a letter or underscore and contain only letters, numbers, underscores, and dots.',
+                previous: $exception,
             );
         }
     }
 
+    private function logInvalidBuildtimeEnvironmentVariableKey(string $key, string $origin): void
+    {
+        $displayKey = ValidationPatterns::displayShellEnvironmentVariableKey($key);
+
+        $this->application_deployment_queue->addLogEntry('----------------------------------------', 'stderr');
+        $this->application_deployment_queue->addLogEntry("⚠️ Invalid environment variable name from {$origin}: {$displayKey}", 'stderr');
+        $this->application_deployment_queue->addLogEntry('Build-time variable names must start with a letter or underscore and contain only letters, numbers, underscores, and dots.', 'stderr');
+        $this->application_deployment_queue->addLogEntry('💡 How to fix:', type: 'info');
+
+        if ($origin === 'the Nixpacks plan') {
+            $this->application_deployment_queue->addLogEntry('   1. Open nixpacks.toml and check the [variables] section. Quoted keys can contain characters that are not valid environment variable names.', type: 'info');
+            $this->application_deployment_queue->addLogEntry('   2. Rename the key to a plain name like MY_VARIABLE (no spaces, shell syntax, or command substitutions).', type: 'info');
+            $this->logSuggestedShellEnvironmentVariableKey($key);
+            $this->application_deployment_queue->addLogEntry('   3. Commit, push, and redeploy.', type: 'info');
+            $this->application_deployment_queue->addLogEntry('Docs: https://nixpacks.com/docs/configuration/file', type: 'info');
+        } else {
+            $this->application_deployment_queue->addLogEntry('   Rename the environment variable to use only letters, numbers, and underscores, then redeploy.', type: 'info');
+            $this->logSuggestedShellEnvironmentVariableKey($key);
+        }
+
+        $this->application_deployment_queue->addLogEntry('----------------------------------------', 'stderr');
+    }
+
+    private function logSuggestedShellEnvironmentVariableKey(string $key): void
+    {
+        $suggestedKey = str_replace('.', '_', $key);
+        if ($suggestedKey === $key || preg_match(ValidationPatterns::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $suggestedKey) !== 1) {
+            return;
+        }
+
+        $displaySuggestedKey = ValidationPatterns::displayShellEnvironmentVariableKey($suggestedKey);
+
+        $this->application_deployment_queue->addLogEntry("   Suggested name: {$displaySuggestedKey}", type: 'info');
+    }
+
+    private function save_buildtime_environment_variables()
+    {
+        $environment_variables = $this->generate_buildtime_environment_variables();
+        [$shell_environment_variables, $dotted_environment_variables] = $environment_variables->partition(function (string $environmentVariable): bool {
+            [$key] = explode('=', $environmentVariable, 2);
+
+            return preg_match(ValidationPatterns::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $key) === 1;
+        });
+
+        if ($dotted_environment_variables->isEmpty()) {
+            $this->useBuildtimeEnvironmentLauncher = false;
+
+            if ($environment_variables->isNotEmpty()) {
+                $envs_base64 = base64_encode($environment_variables->implode("\n"));
+
+                $this->application_deployment_queue->addLogEntry('Creating build-time .env file in /artifacts (outside Docker context).', hidden: true);
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee ".self::BUILD_TIME_ENV_PATH.' > /dev/null'),
+                ]);
+
+                if (isDev()) {
+                    $this->execute_remote_command([
+                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
+                        'hidden' => true,
+                    ]);
+                }
+            } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
+                $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, 'touch '.self::BUILD_TIME_ENV_PATH),
+                ]);
+            }
+
+            return;
+        }
+
+        $this->useBuildtimeEnvironmentLauncher = true;
+
+        $launcher = [
+            '#!/bin/bash',
+            'set -a',
+            'source '.self::BUILD_TIME_SHELL_ENV_PATH,
+            'set +a',
+        ];
+
+        $launcher[] = 'exec env \\';
+        foreach ($dotted_environment_variables as $environmentVariable) {
+            $launcher[] = "    {$environmentVariable} \\";
+        }
+        $launcher[] = '    "$@"';
+
+        $files = [
+            self::BUILD_TIME_ENV_PATH => $environment_variables->implode("\n"),
+            self::BUILD_TIME_SHELL_ENV_PATH => $shell_environment_variables->implode("\n"),
+            self::BUILD_TIME_ENV_LAUNCHER_PATH => implode("\n", $launcher)."\n",
+        ];
+
+        $this->application_deployment_queue->addLogEntry('Creating build-time environment files in /artifacts (outside Docker context).', hidden: true);
+
+        foreach ($files as $path => $contents) {
+            $contents_base64 = base64_encode($contents);
+            $this->execute_remote_command([
+                executeInDocker($this->deployment_uuid, "echo '$contents_base64' | base64 -d | tee {$path} > /dev/null"),
+            ]);
+        }
+
+        $this->execute_remote_command([
+            executeInDocker($this->deployment_uuid, 'chmod 700 '.self::BUILD_TIME_ENV_LAUNCHER_PATH),
+        ]);
+    }
+
     private function elixir_finetunes()
     {
         if ($this->pull_request_id === 0) {
@@ -2118,6 +2217,19 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function resolveContainerName(): string
+    {
+        if (str($this->application->settings->custom_internal_name)->isEmpty()) {
+            return generateApplicationContainerName($this->application, $this->pull_request_id);
+        }
+
+        if ($this->pull_request_id === 0) {
+            return $this->application->settings->custom_internal_name;
+        }
+
+        return addPreviewDeploymentSuffix($this->application->settings->custom_internal_name, $this->pull_request_id);
+    }
+
     private function health_check()
     {
         try {
@@ -2406,9 +2518,9 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $fqdn = $this->preview->fqdn;
         }
         if (isset($fqdn)) {
-            $url = Url::fromString($fqdn);
-            $fqdn = $url->getHost();
-            $url = $url->withHost($fqdn)->withPort(null)->__toString();
+            $domains = str($fqdn)->explode(',')->map(fn (string $domain) => trim($domain))->filter();
+            $url = $domains->map(fn (string $domain) => Url::fromString($domain)->withPort(null)->__toString())->implode(',');
+            $fqdn = $domains->map(fn (string $domain) => Url::fromString($domain)->getHost())->implode(',');
             if ((int) $this->application->compose_parsing_version >= 3) {
                 $this->coolify_variables .= 'COOLIFY_URL='.escapeShellValue($url).' ';
                 $this->coolify_variables .= 'COOLIFY_FQDN='.escapeShellValue($fqdn).' ';
@@ -3443,6 +3555,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         // Always use .env file
         $docker_compose['services'][$this->container_name]['env_file'] = ['.env'];
 
+        if ($this->application->settings->stop_grace_period !== null) {
+            $docker_compose['services'][$this->container_name]['stop_grace_period'] = $this->application->settings->stopGracePeriodSeconds().'s';
+        }
+
         // Only add Coolify healthcheck if no custom HEALTHCHECK found in Dockerfile
         // If custom_healthcheck_found is true, the Dockerfile's HEALTHCHECK will be used
         // If healthcheck is disabled, no healthcheck will be added
@@ -3565,24 +3681,22 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         if ($this->pull_request_id === 0) {
             $custom_compose = convertDockerRunToCompose($this->application->custom_docker_run_options);
             if ((bool) $this->application->settings->is_consistent_container_name_enabled) {
-                if (! $this->application->settings->custom_internal_name) {
-                    $docker_compose['services'][$this->application->uuid] = $docker_compose['services'][$this->container_name];
-                    if (count($custom_compose) > 0) {
-                        $ipv4 = data_get($custom_compose, 'ip.0');
-                        $ipv6 = data_get($custom_compose, 'ip6.0');
-                        data_forget($custom_compose, 'ip');
-                        data_forget($custom_compose, 'ip6');
-                        if ($ipv4 || $ipv6) {
-                            data_forget($docker_compose['services'][$this->application->uuid], 'networks');
-                        }
-                        if ($ipv4) {
-                            $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv4_address'] = $ipv4;
-                        }
-                        if ($ipv6) {
-                            $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv6_address'] = $ipv6;
-                        }
-                        $docker_compose['services'][$this->application->uuid] = array_merge_recursive($docker_compose['services'][$this->application->uuid], $custom_compose);
+                $docker_compose['services'][$this->application->uuid] = $docker_compose['services'][$this->container_name];
+                if ($this->container_name !== $this->application->uuid) {
+                    unset($docker_compose['services'][$this->container_name]);
+                }
+                if (count($custom_compose) > 0) {
+                    $ipv4 = data_get($custom_compose, 'ip.0');
+                    $ipv6 = data_get($custom_compose, 'ip6.0');
+                    data_forget($custom_compose, 'ip');
+                    data_forget($custom_compose, 'ip6');
+                    if ($ipv4) {
+                        $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv4_address'] = $ipv4;
                     }
+                    if ($ipv6) {
+                        $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv6_address'] = $ipv6;
+                    }
+                    $docker_compose['services'][$this->application->uuid] = array_merge_recursive($docker_compose['services'][$this->application->uuid], $custom_compose);
                 }
             } else {
                 if (count($custom_compose) > 0) {
@@ -3787,7 +3901,13 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
      */
     private function wrap_build_command_with_env_export(string $build_command): string
     {
-        return "cd {$this->workdir} && set -a && source ".self::BUILD_TIME_ENV_PATH." && set +a && {$build_command}";
+        if (! $this->useBuildtimeEnvironmentLauncher) {
+            return "cd {$this->workdir} && set -a && source ".self::BUILD_TIME_ENV_PATH." && set +a && {$build_command}";
+        }
+
+        $escapedBuildCommand = escapeBashEnvValue($build_command);
+
+        return "cd {$this->workdir} && bash ".self::BUILD_TIME_ENV_LAUNCHER_PATH." /bin/bash -c {$escapedBuildCommand}";
     }
 
     private function build_image()
@@ -4170,7 +4290,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->application_deployment_queue->addLogEntry('Removing old containers.');
             if ($this->newVersionIsHealthy || $force) {
                 if ($this->application->settings->is_consistent_container_name_enabled || str($this->application->settings->custom_internal_name)->isNotEmpty()) {
-                    $this->graceful_shutdown_container($this->container_name);
+                    $containers = getCurrentApplicationContainerStatus($this->server, $this->application->id, $this->pull_request_id);
+                    $this->containerNamesToRemove($containers)->each(function (string $containerName) {
+                        $this->graceful_shutdown_container($containerName);
+                    });
                 } else {
                     $containers = getCurrentApplicationContainerStatus($this->server, $this->application->id, $this->pull_request_id);
                     if ($this->pull_request_id === 0) {
@@ -4209,6 +4332,16 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         }
     }
 
+    private function containerNamesToRemove(Collection $containers): Collection
+    {
+        return $containers
+            ->pluck('Names')
+            ->push($this->container_name)
+            ->filter()
+            ->unique()
+            ->values();
+    }
+
     private function start_by_compose_file()
     {
         try {
@@ -4297,6 +4430,21 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->analyzeBuildTimeVariables($variables);
         }
 
+        $requiresDottedEnvironmentSecrets = $this->application->build_pack === 'nixpacks'
+            && $variables->keys()->contains(fn ($key): bool => str_contains((string) $key, '.'));
+
+        if ($requiresDottedEnvironmentSecrets) {
+            if (! $this->dockerSecretsAvailable) {
+                $dottedKeys = $variables->keys()
+                    ->filter(fn ($key): bool => str_contains((string) $key, '.'))
+                    ->implode(', ');
+
+                throw new DeploymentException("Dotted Nixpacks build-time environment variable names require Docker BuildKit secret support: {$dottedKeys}. Rename these keys to use underscores instead of dots, or upgrade Docker on the build server.");
+            }
+
+            $this->dockerSecretsSupported = true;
+        }
+
         if ($this->dockerSecretsSupported) {
             $this->generate_build_secrets($variables);
             $this->build_args = '';
@@ -4560,7 +4708,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
     private function modify_dockerfile_for_secrets($dockerfile_path)
     {
         // Only process if build secrets are enabled and we have secrets to mount
-        if (! $this->application->settings->use_build_secrets || empty($this->build_secrets)) {
+        if (empty($this->build_secrets)) {
             return;
         }
 
@@ -4584,18 +4732,51 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->generate_env_variables();
         }
 
-        $variables = $this->env_args;
+        $variables = $this->application->build_pack === 'nixpacks'
+            ? collect($this->nixpacks_plan_json->get('variables'))
+            : $this->env_args;
         if ($variables->isEmpty()) {
             return;
         }
 
+        $dottedKeys = $variables->keys()
+            ->map(fn ($key): string => (string) $key)
+            ->filter(fn (string $key): bool => str_contains($key, '.'));
+
+        if ($dottedKeys->isNotEmpty()) {
+            $originalDockerfile = $dockerfile;
+            $dockerfile = $dockerfile->map(function (string $line) use ($dottedKeys): ?string {
+                $trimmedLine = trim($line);
+
+                if (! str_starts_with($trimmedLine, 'ARG ') && ! str_starts_with($trimmedLine, 'ENV ')) {
+                    return $line;
+                }
+
+                [$instruction, $arguments] = explode(' ', $trimmedLine, 2);
+                $filteredArguments = collect(preg_split('/\s+/', $arguments))
+                    ->reject(function (string $argument) use ($dottedKeys): bool {
+                        $key = str($argument)->before('=')->toString();
+
+                        return $dottedKeys->contains($key);
+                    });
+
+                if ($filteredArguments->isEmpty()) {
+                    return null;
+                }
+
+                return $instruction.' '.$filteredArguments->implode(' ');
+            })->filter()->values();
+
+            $modified = $dockerfile->all() !== $originalDockerfile->values()->all();
+        }
+
         // Generate mount strings for all secrets
         $mountStrings = $variables->map(fn ($value, $key) => "--mount=type=secret,id={$key},env={$key}")->implode(' ');
 
         // Add mount for the secrets hash to ensure cache invalidation
         $mountStrings .= ' --mount=type=secret,id=COOLIFY_BUILD_SECRETS_HASH,env=COOLIFY_BUILD_SECRETS_HASH';
 
-        $modified = false;
+        $modified ??= false;
         $dockerfile = $dockerfile->map(function ($line) use ($mountStrings, &$modified) {
             $trimmed = ltrim($line);
 
@@ -5092,11 +5273,21 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         // Reset restart count after successful deployment
         // This is done here (not in Livewire) to avoid race conditions
         // with GetContainersStatus reading old container restart counts
-        $this->application->update([
+        $restartState = [
             'restart_count' => 0,
             'last_restart_at' => null,
             'last_restart_type' => null,
-        ]);
+        ];
+
+        if ($this->pull_request_id === 0) {
+            $restartState['restart_limit_reached'] = false;
+        }
+
+        if ($this->pull_request_id === 0) {
+            $this->application->update($restartState);
+        } else {
+            $this->preview?->resetRestartLimit();
+        }
 
         try {
             $this->application->markDeploymentConfigurationApplied($this->application_deployment_queue);
diff --git a/app/Jobs/CheckDomainDnsJob.php b/app/Jobs/CheckDomainDnsJob.php
index 1a7ceaeabc..c013da25a6 100644
--- a/app/Jobs/CheckDomainDnsJob.php
+++ b/app/Jobs/CheckDomainDnsJob.php
@@ -4,6 +4,7 @@ namespace App\Jobs;
 
 use App\Actions\Shared\CheckDomainDns;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Server;
 use App\Models\ServiceApplication;
 use Illuminate\Bus\Queueable;
@@ -23,7 +24,7 @@ class CheckDomainDnsJob implements ShouldBeEncrypted, ShouldQueue
     public int $timeout = 30;
 
     public function __construct(
-        public Application|ServiceApplication $resource,
+        public Application|ApplicationPreview|ServiceApplication $resource,
         public string $statusKey,
         public string $url,
         public ?Server $server,
diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 0b73ed0cf5..b1f2c38b96 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -322,6 +322,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_postgresql($database);
                     } elseif (str($databaseType)->contains('mongo')) {
                         if ($database === '*') {
@@ -343,6 +344,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mongodb($database);
                     } elseif (str($databaseType)->contains('mysql')) {
                         $this->backup_file = "/mysql-dump-$database-".Carbon::now()->timestamp.'.dmp';
@@ -357,6 +359,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mysql($database);
                     } elseif (str($databaseType)->contains('mariadb')) {
                         $this->backup_file = "/mariadb-dump-$database-".Carbon::now()->timestamp.'.dmp';
@@ -371,6 +374,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mariadb($database);
                     } elseif ($this->database instanceof StandaloneClickhouse) {
                         $this->backup_file = '/clickhouse-backup-'.Carbon::now()->timestamp."-{$this->backup_log_uuid}.zip";
@@ -382,6 +386,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_clickhouse($database);
                     } else {
                         throw new \Exception('Unsupported database type');
@@ -480,14 +485,14 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         } catch (Throwable $e) {
             throw $e;
         } finally {
-            if ($this->team) {
-                BackupCreated::dispatch($this->team->id);
-            }
             if ($this->backup_log) {
                 $this->backup_log->update([
                     'finished_at' => Carbon::now()->toImmutable(),
                 ]);
             }
+            if ($this->team) {
+                BackupCreated::dispatch($this->team->id);
+            }
         }
     }
 
diff --git a/app/Jobs/DeleteResourceJob.php b/app/Jobs/DeleteResourceJob.php
index dff7d88de1..d07f346e56 100644
--- a/app/Jobs/DeleteResourceJob.php
+++ b/app/Jobs/DeleteResourceJob.php
@@ -26,7 +26,6 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 
@@ -47,9 +46,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
     public function handle(): void
     {
         if ($this->resource instanceof ApplicationPreview) {
-            DB::transaction(function (): void {
-                $this->deleteApplicationPreview();
-            });
+            $this->deleteApplicationPreview();
 
             return;
         }
@@ -99,17 +96,17 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             ]);
         }
 
-        DB::transaction(function (): void {
-            try {
-                $this->deleteScheduledVolumeBackups();
-            } catch (\Throwable $e) {
-                Log::warning('Remote backup cleanup failed while deleting resource; continuing with local deletion.', [
-                    'resource_id' => $this->resource->id,
-                    'resource_type' => $this->resource->type(),
-                    'error' => $e->getMessage(),
-                ]);
-            }
+        try {
+            $this->deleteScheduledVolumeBackups();
+        } catch (\Throwable $e) {
+            Log::warning('Remote backup cleanup failed while deleting resource; continuing with local deletion.', [
+                'resource_id' => $this->resource->id,
+                'resource_type' => $this->resource->type(),
+                'error' => $e->getMessage(),
+            ]);
+        }
 
+        DB::transaction(function (): void {
             if ($this->resource instanceof Service) {
                 app(DeleteService::class)->deleteLocal($this->resource);
 
@@ -130,7 +127,6 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             $this->resource->forceDelete();
         });
 
-        Artisan::queue('cleanup:stucked-resources');
     }
 
     private function isDatabase(): bool
@@ -163,10 +159,22 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
-    private function deleteApplicationPreview()
+    private function deleteApplicationPreview(): void
     {
         $application = $this->resource->application;
-        $server = $application->destination->server;
+
+        if (! $application) {
+            $this->deleteApplicationPreviewLocally();
+
+            return;
+        }
+
+        $server = $application->destination?->server;
+        if (! $server) {
+            $this->deleteApplicationPreviewLocally();
+
+            return;
+        }
         $pull_request_id = $this->resource->pull_request_id;
 
         // Ensure the preview is soft deleted (may already be done in Livewire component)
@@ -239,6 +247,14 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         $this->resource->forceDelete();
     }
 
+    private function deleteApplicationPreviewLocally(): void
+    {
+        DB::transaction(function (): void {
+            $this->resource->persistentStorages()->delete();
+            ApplicationPreview::withoutEvents(fn () => $this->resource->forceDelete());
+        });
+    }
+
     private function stopPreviewContainers(array $containers, $server, int $timeout = 30)
     {
         if (empty($containers)) {
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index 9c4a2531a9..0e73ee41b2 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -2,11 +2,15 @@
 
 namespace App\Jobs;
 
+use App\Actions\Application\StopApplication;
+use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
+use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
 use App\Actions\Server\StartLogDrain;
+use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
@@ -23,8 +27,10 @@ use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use App\Models\SwarmDocker;
+use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Notifications\Container\ContainerRestarted;
 use App\Services\ContainerStatusAggregator;
+use App\Services\RestartCountTracker;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -95,8 +101,14 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
     public Collection $applicationContainerStatuses;
 
+    public Collection $applicationContainerRestartCounts;
+
     public Collection $serviceContainerStatuses;
 
+    public Collection $previewContainerRestartCounts;
+
+    public Collection $serviceContainerRestartCounts;
+
     public bool $foundProxy = false;
 
     public bool $foundLogDrainContainer = false;
@@ -122,7 +134,10 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         $this->foundApplicationPreviewsIds = collect();
         $this->foundServiceDatabaseIds = collect();
         $this->applicationContainerStatuses = collect();
+        $this->applicationContainerRestartCounts = collect();
         $this->serviceContainerStatuses = collect();
+        $this->previewContainerRestartCounts = collect();
+        $this->serviceContainerRestartCounts = collect();
         $this->allApplicationIds = collect();
         $this->allDatabaseUuids = collect();
         $this->allTcpProxyUuids = collect();
@@ -140,7 +155,10 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
     {
         // Defensive initialization for Collection properties to handle queue deserialization edge cases
         $this->serviceContainerStatuses ??= collect();
+        $this->previewContainerRestartCounts ??= collect();
+        $this->serviceContainerRestartCounts ??= collect();
         $this->applicationContainerStatuses ??= collect();
+        $this->applicationContainerRestartCounts ??= collect();
         $this->foundApplicationIds ??= collect();
         $this->foundDatabaseUuids ??= collect();
         $this->foundServiceApplicationIds ??= collect();
@@ -231,6 +249,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             if (! $coolify_managed) {
                 continue;
             }
+            if (filter_var($labels->get('com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)) {
+                continue;
+            }
 
             $name = data_get($container, 'name');
             if ($name === 'coolify-log-drain' && $this->isRunning($containerStatus)) {
@@ -241,6 +262,10 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 $pullRequestId = $labels->get('coolify.pullRequestId', '0');
                 try {
                     if ($pullRequestId === '0') {
+                        $application = $this->applicationsById->get((string) $applicationId);
+                        if ($application && $application->container_present !== true) {
+                            $application->update(['container_present' => true]);
+                        }
                         if ($this->allApplicationIds->contains($applicationId)) {
                             $this->foundApplicationIds->push($applicationId);
                         }
@@ -251,6 +276,13 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                         $containerName = $labels->get('com.docker.compose.service');
                         if ($containerName) {
                             $this->applicationContainerStatuses->get($applicationId)->put($containerName, $containerStatus);
+                            $restartCount = data_get($container, 'restart_count');
+                            if (is_numeric($restartCount)) {
+                                if (! $this->applicationContainerRestartCounts->has($applicationId)) {
+                                    $this->applicationContainerRestartCounts->put($applicationId, collect());
+                                }
+                                $this->applicationContainerRestartCounts->get($applicationId)->put($containerName, (int) $restartCount);
+                            }
                         }
                     } else {
                         $previewKey = $applicationId.':'.$pullRequestId;
@@ -258,6 +290,13 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                             $this->foundApplicationPreviewsIds->push($previewKey);
                         }
                         $this->updateApplicationPreviewStatus($applicationId, $pullRequestId, $containerStatus);
+                        $restartCount = data_get($container, 'restart_count');
+                        if (is_numeric($restartCount)) {
+                            $this->previewContainerRestartCounts->push([
+                                'key' => $previewKey,
+                                'count' => (int) $restartCount,
+                            ]);
+                        }
                     }
                 } catch (\Exception $e) {
                 }
@@ -278,6 +317,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                     $containerName = $labels->get('com.docker.compose.service');
                     if ($containerName) {
                         $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                        $this->storeServiceRestartCount($key, $containerName, data_get($container, 'restart_count'));
                     }
                 } elseif ($subType === 'database') {
                     $this->foundServiceDatabaseIds->push($subId);
@@ -289,6 +329,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                     $containerName = $labels->get('com.docker.compose.service');
                     if ($containerName) {
                         $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                        $this->storeServiceRestartCount($key, $containerName, data_get($container, 'restart_count'));
                     }
                 }
             } else {
@@ -302,9 +343,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                         $this->foundDatabaseUuids->push($uuid);
                         // TCP proxy should only be started/managed when database is actually running
                         if ($this->allTcpProxyUuids->contains($uuid) && $this->isRunning($containerStatus)) {
-                            $this->updateDatabaseStatus($uuid, $containerStatus, tcpProxy: true);
+                            $this->updateDatabaseStatus($uuid, $containerStatus, data_get($container, 'restart_count'), tcpProxy: true);
                         } else {
-                            $this->updateDatabaseStatus($uuid, $containerStatus, tcpProxy: false);
+                            $this->updateDatabaseStatus($uuid, $containerStatus, data_get($container, 'restart_count'), tcpProxy: false);
                         }
                     }
                 }
@@ -317,6 +358,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
         $this->updateProxyStatus();
 
+        Application::whereIn('id', $this->foundApplicationIds->unique())
+            ->update(['container_present' => true]);
+
         $this->updateNotFoundApplicationStatus();
         $this->updateNotFoundApplicationPreviewStatus();
         $this->updateNotFoundDatabaseStatus();
@@ -324,6 +368,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
         $this->updateAdditionalServersStatus();
 
+        $this->trackPreviewRestartCounts();
+
         // Aggregate multi-container application statuses
         $this->aggregateMultiContainerStatuses();
 
@@ -349,11 +395,18 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                     'uuid',
                     'name',
                     'status',
+                    'container_present',
                     'build_pack',
                     'docker_compose_raw',
+                    'environment_id',
                     'destination_id',
                     'destination_type',
                     'last_online_at',
+                    'restart_count',
+                    'max_restart_count',
+                    'restart_limit_reached',
+                    'last_restart_at',
+                    'last_restart_type',
                 ])
                 ->withCount('additional_servers')
                 ->where(fn ($query) => $this->scopeDestination($query, $standaloneDockerIds, $swarmDockerIds))
@@ -372,11 +425,18 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                         'uuid',
                         'name',
                         'status',
+                        'container_present',
                         'build_pack',
                         'docker_compose_raw',
+                        'environment_id',
                         'destination_id',
                         'destination_type',
                         'last_online_at',
+                        'restart_count',
+                        'max_restart_count',
+                        'restart_limit_reached',
+                        'last_restart_at',
+                        'last_restart_type',
                     ])
                     ->withCount('additional_servers')
                     ->whereIn('id', $additionalApplicationIds)
@@ -402,6 +462,11 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 'pull_request_id',
                 'status',
                 'last_online_at',
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
             ])
             ->whereIn('application_id', $applicationIds)
             ->get();
@@ -417,8 +482,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 'docker_compose_raw',
             ])
             ->with([
-                'applications:id,service_id,status,last_online_at',
-                'databases:id,service_id,status,last_online_at,is_public,name',
+                'applications:id,service_id,status,last_online_at,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
+                'databases:id,service_id,status,last_online_at,is_public,name,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
             ])
             ->get();
     }
@@ -441,6 +506,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             'restart_count',
             'last_restart_at',
             'last_restart_type',
+            'max_restart_count',
+            'restart_limit_reached',
         ];
 
         return collect([
@@ -495,6 +562,53 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 continue;
             }
 
+            $maxRestartCount = 0;
+            $restartCountsAvailable = $this->applicationContainerRestartCounts->has($applicationId);
+            if ($restartCountsAvailable) {
+                $maxRestartCount = $this->applicationContainerRestartCounts->get($applicationId)->max() ?? 0;
+                $restartState = (new RestartCountTracker)->evaluate(
+                    previousRestartCount: $application->restart_count ?? 0,
+                    observedRestartCount: $maxRestartCount,
+                    maxRestartCount: $application->max_restart_count ?? 0,
+                );
+
+                if ($restartState['restart_count_changed']) {
+                    $hasCrashRestarts = $restartState['restart_count'] > 0;
+                    $application->update([
+                        'restart_count' => $restartState['restart_count'],
+                        'last_restart_at' => $hasCrashRestarts ? now() : null,
+                        'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
+                    ]);
+                }
+
+                if ($restartState['restart_limit_reached']) {
+                    $restartLimitClaimed = Application::query()
+                        ->whereKey($application->getKey())
+                        ->where('restart_limit_reached', false)
+                        ->update(['restart_limit_reached' => true]) === 1;
+
+                    if ($restartLimitClaimed) {
+                        $application->refresh();
+                        StopApplication::dispatch(
+                            application: $application,
+                            previewDeployments: false,
+                            dockerCleanup: false,
+                            resetRestartCount: false,
+                            removeContainers: false,
+                        );
+                        $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    }
+                }
+            }
+
+            if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(
+                fn (string $status): bool => str($status)->contains('exited')
+            )) {
+                $application->update(['status' => 'exited']);
+
+                continue;
+            }
+
             // Parse docker compose to check for excluded containers
             $dockerComposeRaw = data_get($application, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -519,7 +633,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             // Use ContainerStatusAggregator service for state machine logic
             // Use preserveRestarting: true so applications show "Restarting" instead of "Degraded"
             $aggregator = new ContainerStatusAggregator;
-            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, 0, preserveRestarting: true);
+            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, $maxRestartCount, preserveRestarting: true);
 
             // Update application status with aggregated result
             if ($aggregatedStatus && $application->status !== $aggregatedStatus) {
@@ -560,6 +674,14 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 continue;
             }
 
+            $restartCount = $this->serviceContainerRestartCounts->get($key)?->max() ?? 0;
+            if ($subResource->trackRestartCount($restartCount)) {
+                StopServiceApplication::dispatch($subResource, false, false);
+                $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
+
+                continue;
+            }
+
             // Parse docker compose from service to check for excluded containers
             $dockerComposeRaw = data_get($service, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -581,10 +703,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             }
 
             // Use ContainerStatusAggregator service for state machine logic
-            // NOTE: Sentinel does NOT provide restart count data, so maxRestartCount is always 0
             // Use preserveRestarting: true so individual sub-resources show "Restarting" instead of "Degraded"
             $aggregator = new ContainerStatusAggregator;
-            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, 0, preserveRestarting: true);
+            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, $restartCount, preserveRestarting: true);
 
             // Update service sub-resource status with aggregated result
             if ($aggregatedStatus && $subResource->status !== $aggregatedStatus) {
@@ -627,8 +748,11 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
         // Batch update: mark all not-found applications as exited (excluding already exited ones)
         Application::whereIn('id', $notFoundApplicationIds)
-            ->where('status', 'not like', 'exited%')
-            ->update(['status' => 'exited']);
+            ->update([
+                'status' => 'exited',
+                'container_present' => false,
+                'restart_limit_reached' => false,
+            ]);
     }
 
     private function updateNotFoundApplicationPreviewStatus()
@@ -687,7 +811,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         }
     }
 
-    private function updateDatabaseStatus(string $databaseUuid, string $containerStatus, bool $tcpProxy = false)
+    private function updateDatabaseStatus(string $databaseUuid, string $containerStatus, mixed $restartCount = null, bool $tcpProxy = false): void
     {
         $database = $this->databasesByUuid->get($databaseUuid);
         if (! $database) {
@@ -697,6 +821,12 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             $database->status = $containerStatus;
             $database->save();
         }
+        if (is_numeric($restartCount) && $database->trackRestartCount((int) $restartCount)) {
+            StopDatabase::dispatch($database, false, false, false);
+            $database->team()?->notify(new ApplicationRestartLimitReached($database));
+
+            return;
+        }
         if (! $this->isCompleteSnapshot()) {
             return;
         }
@@ -719,6 +849,30 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         }
     }
 
+    private function storeServiceRestartCount(string $key, string $containerName, mixed $restartCount): void
+    {
+        if (! is_numeric($restartCount)) {
+            return;
+        }
+        if (! $this->serviceContainerRestartCounts->has($key)) {
+            $this->serviceContainerRestartCounts->put($key, collect());
+        }
+        $this->serviceContainerRestartCounts->get($key)->put($containerName, (int) $restartCount);
+    }
+
+    private function trackPreviewRestartCounts(): void
+    {
+        $this->previewContainerRestartCounts
+            ->groupBy('key')
+            ->each(function (Collection $counts, string $key): void {
+                $preview = $this->previewsByKey->get($key);
+                if ($preview?->trackRestartCount((int) $counts->max('count'))) {
+                    StopApplicationPreview::dispatch($preview, false, false);
+                    $preview->application->environment->project->team?->notify(new ApplicationRestartLimitReached($preview));
+                }
+            });
+    }
+
     private function updateNotFoundDatabaseStatus()
     {
         $notFoundDatabaseUuids = $this->allDatabaseUuids->diff($this->foundDatabaseUuids);
@@ -729,12 +883,16 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {
+                if ($database->stoppedAfterRestartLimit()) {
+                    return;
+                }
                 if (! str($database->status)->startsWith('exited')) {
                     $database->update([
                         'status' => 'exited',
                         'restart_count' => 0,
                         'last_restart_at' => null,
                         'last_restart_type' => null,
+                        'restart_limit_reached' => false,
                     ]);
                 }
                 if ($database->is_public) {
@@ -752,15 +910,17 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         // Batch update service applications
         if ($notFoundServiceApplicationIds->isNotEmpty()) {
             ServiceApplication::whereIn('id', $notFoundServiceApplicationIds)
+                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited']);
+                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
         }
 
         // Batch update service databases
         if ($notFoundServiceDatabaseIds->isNotEmpty()) {
             ServiceDatabase::whereIn('id', $notFoundServiceDatabaseIds)
+                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited']);
+                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
         }
     }
 
diff --git a/app/Jobs/SendVerificationEmailJob.php b/app/Jobs/SendVerificationEmailJob.php
new file mode 100644
index 0000000000..b9d2c8e11e
--- /dev/null
+++ b/app/Jobs/SendVerificationEmailJob.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\User;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+
+class SendVerificationEmailJob implements ShouldQueue
+{
+    use Queueable;
+
+    public $tries = 3;
+
+    public $backoff = 10;
+
+    public function __construct(public User $user)
+    {
+        $this->onQueue('high');
+    }
+
+    /**
+     * Execute the job.
+     */
+    public function handle(): void
+    {
+        $this->user->sendVerificationEmail();
+    }
+}
diff --git a/app/Jobs/ServerConnectionCheckJob.php b/app/Jobs/ServerConnectionCheckJob.php
index fe7a20972c..97d211d247 100644
--- a/app/Jobs/ServerConnectionCheckJob.php
+++ b/app/Jobs/ServerConnectionCheckJob.php
@@ -100,7 +100,10 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
             ]);
 
             if ($this->server->unreachable_count > 0) {
-                $this->server->update(['unreachable_count' => 0]);
+                // Direct assignment: unreachable_count is not mass-assignable,
+                // so update() would silently drop the reset.
+                $this->server->unreachable_count = 0;
+                $this->server->save();
             }
 
             $this->dispatchReachabilityChangedIfNeeded($wasReachable, $wasNotified, true);
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index 03fa2b5109..b0ab4d183e 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -43,7 +43,7 @@ class Show extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -85,7 +85,7 @@ class Show extends Component
             }
             $this->destination->delete();
 
-            return redirect()->route('destination.index');
+            return redirectRoute($this, 'destination.index');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/GlobalSearch.php b/app/Livewire/GlobalSearch.php
index bf64ee8e9d..c6ed818e97 100644
--- a/app/Livewire/GlobalSearch.php
+++ b/app/Livewire/GlobalSearch.php
@@ -1507,8 +1507,7 @@ class GlobalSearch extends Component
                 'type' => 'one-click-service-'.$serviceKey,
                 'category' => 'Services',
                 'resourceType' => 'service',
-                'logo' => data_get($service, 'logo'),
-            ] + array_filter([
+            ] + service_logo_urls(data_get($service, 'logo')) + array_filter([
                 'amd_only' => data_get($service, 'amd_only') ? true : null,
                 'arm_only' => data_get($service, 'arm_only') ? true : null,
             ]));
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index 59ecb06e8e..cb31e6c111 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -34,6 +34,9 @@ class Discord extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeDiscordNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedDiscordNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessDiscordNotifications = false;
 
@@ -82,17 +85,17 @@ class Discord extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->discord_enabled = $this->discordEnabled;
             $this->settings->discord_webhook_url = $this->discordWebhookUrl;
 
             $this->settings->deployment_success_discord_notifications = $this->deploymentSuccessDiscordNotifications;
             $this->settings->deployment_failure_discord_notifications = $this->deploymentFailureDiscordNotifications;
             $this->settings->status_change_discord_notifications = $this->statusChangeDiscordNotifications;
+            $this->settings->restart_limit_reached_discord_notifications = $this->restartLimitReachedDiscordNotifications;
             $this->settings->backup_success_discord_notifications = $this->backupSuccessDiscordNotifications;
             $this->settings->backup_failure_discord_notifications = $this->backupFailureDiscordNotifications;
             $this->settings->scheduled_task_success_discord_notifications = $this->scheduledTaskSuccessDiscordNotifications;
@@ -118,6 +121,7 @@ class Discord extends Component
             $this->deploymentSuccessDiscordNotifications = $this->settings->deployment_success_discord_notifications;
             $this->deploymentFailureDiscordNotifications = $this->settings->deployment_failure_discord_notifications;
             $this->statusChangeDiscordNotifications = $this->settings->status_change_discord_notifications;
+            $this->restartLimitReachedDiscordNotifications = $this->settings->restart_limit_reached_discord_notifications;
             $this->backupSuccessDiscordNotifications = $this->settings->backup_success_discord_notifications;
             $this->backupFailureDiscordNotifications = $this->settings->backup_failure_discord_notifications;
             $this->scheduledTaskSuccessDiscordNotifications = $this->settings->scheduled_task_success_discord_notifications;
@@ -193,6 +197,7 @@ class Discord extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -203,6 +208,7 @@ class Discord extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -212,6 +218,8 @@ class Discord extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 88b3587349..ea626ed57a 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -79,6 +79,9 @@ class Email extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeEmailNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedEmailNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessEmailNotifications = false;
 
@@ -129,12 +132,11 @@ class Email extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
             $this->validate(['smtpEhloDomain' => ['nullable', 'string', new ValidHostname]]);
-            $this->authorize('update', $this->settings);
             $this->settings->smtp_enabled = $this->smtpEnabled;
             $this->settings->smtp_from_address = $this->smtpFromAddress;
             $this->settings->smtp_from_name = $this->smtpFromName;
@@ -155,6 +157,7 @@ class Email extends Component
             $this->settings->deployment_success_email_notifications = $this->deploymentSuccessEmailNotifications;
             $this->settings->deployment_failure_email_notifications = $this->deploymentFailureEmailNotifications;
             $this->settings->status_change_email_notifications = $this->statusChangeEmailNotifications;
+            $this->settings->restart_limit_reached_email_notifications = $this->restartLimitReachedEmailNotifications;
             $this->settings->backup_success_email_notifications = $this->backupSuccessEmailNotifications;
             $this->settings->backup_failure_email_notifications = $this->backupFailureEmailNotifications;
             $this->settings->scheduled_task_success_email_notifications = $this->scheduledTaskSuccessEmailNotifications;
@@ -193,6 +196,7 @@ class Email extends Component
             $this->deploymentSuccessEmailNotifications = $this->settings->deployment_success_email_notifications;
             $this->deploymentFailureEmailNotifications = $this->settings->deployment_failure_email_notifications;
             $this->statusChangeEmailNotifications = $this->settings->status_change_email_notifications;
+            $this->restartLimitReachedEmailNotifications = $this->settings->restart_limit_reached_email_notifications;
             $this->backupSuccessEmailNotifications = $this->settings->backup_success_email_notifications;
             $this->backupFailureEmailNotifications = $this->settings->backup_failure_email_notifications;
             $this->scheduledTaskSuccessEmailNotifications = $this->settings->scheduled_task_success_email_notifications;
@@ -219,6 +223,8 @@ class Email extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         $this->dispatch('success', 'Email notifications settings updated.');
     }
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index b1608c5ea2..cae1c3d689 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -41,6 +41,9 @@ class Pushover extends Component
     #[Validate(['boolean'])]
     public bool $statusChangePushoverNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedPushoverNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessPushoverNotifications = false;
 
@@ -86,11 +89,10 @@ class Pushover extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->pushover_enabled = $this->pushoverEnabled;
             $this->settings->pushover_user_key = $this->pushoverUserKey;
             $this->settings->pushover_api_token = $this->pushoverApiToken;
@@ -98,6 +100,7 @@ class Pushover extends Component
             $this->settings->deployment_success_pushover_notifications = $this->deploymentSuccessPushoverNotifications;
             $this->settings->deployment_failure_pushover_notifications = $this->deploymentFailurePushoverNotifications;
             $this->settings->status_change_pushover_notifications = $this->statusChangePushoverNotifications;
+            $this->settings->restart_limit_reached_pushover_notifications = $this->restartLimitReachedPushoverNotifications;
             $this->settings->backup_success_pushover_notifications = $this->backupSuccessPushoverNotifications;
             $this->settings->backup_failure_pushover_notifications = $this->backupFailurePushoverNotifications;
             $this->settings->scheduled_task_success_pushover_notifications = $this->scheduledTaskSuccessPushoverNotifications;
@@ -125,6 +128,7 @@ class Pushover extends Component
             $this->deploymentSuccessPushoverNotifications = $this->settings->deployment_success_pushover_notifications;
             $this->deploymentFailurePushoverNotifications = $this->settings->deployment_failure_pushover_notifications;
             $this->statusChangePushoverNotifications = $this->settings->status_change_pushover_notifications;
+            $this->restartLimitReachedPushoverNotifications = $this->settings->restart_limit_reached_pushover_notifications;
             $this->backupSuccessPushoverNotifications = $this->settings->backup_success_pushover_notifications;
             $this->backupFailurePushoverNotifications = $this->settings->backup_failure_pushover_notifications;
             $this->scheduledTaskSuccessPushoverNotifications = $this->settings->scheduled_task_success_pushover_notifications;
@@ -190,6 +194,7 @@ class Pushover extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -202,6 +207,7 @@ class Pushover extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -211,6 +217,8 @@ class Pushover extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index c4ca7da802..644252c1a3 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -39,6 +39,9 @@ class Slack extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeSlackNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedSlackNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessSlackNotifications = false;
 
@@ -84,17 +87,17 @@ class Slack extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->slack_enabled = $this->slackEnabled;
             $this->settings->slack_webhook_url = $this->slackWebhookUrl;
 
             $this->settings->deployment_success_slack_notifications = $this->deploymentSuccessSlackNotifications;
             $this->settings->deployment_failure_slack_notifications = $this->deploymentFailureSlackNotifications;
             $this->settings->status_change_slack_notifications = $this->statusChangeSlackNotifications;
+            $this->settings->restart_limit_reached_slack_notifications = $this->restartLimitReachedSlackNotifications;
             $this->settings->backup_success_slack_notifications = $this->backupSuccessSlackNotifications;
             $this->settings->backup_failure_slack_notifications = $this->backupFailureSlackNotifications;
             $this->settings->scheduled_task_success_slack_notifications = $this->scheduledTaskSuccessSlackNotifications;
@@ -118,6 +121,7 @@ class Slack extends Component
             $this->deploymentSuccessSlackNotifications = $this->settings->deployment_success_slack_notifications;
             $this->deploymentFailureSlackNotifications = $this->settings->deployment_failure_slack_notifications;
             $this->statusChangeSlackNotifications = $this->settings->status_change_slack_notifications;
+            $this->restartLimitReachedSlackNotifications = $this->settings->restart_limit_reached_slack_notifications;
             $this->backupSuccessSlackNotifications = $this->settings->backup_success_slack_notifications;
             $this->backupFailureSlackNotifications = $this->settings->backup_failure_slack_notifications;
             $this->scheduledTaskSuccessSlackNotifications = $this->settings->scheduled_task_success_slack_notifications;
@@ -179,6 +183,7 @@ class Slack extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -191,6 +196,7 @@ class Slack extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -200,6 +206,8 @@ class Slack extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index 9f19b22f5f..f999294477 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -41,6 +41,9 @@ class Telegram extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeTelegramNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedTelegramNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessTelegramNotifications = false;
 
@@ -83,6 +86,9 @@ class Telegram extends Component
     #[Validate(['nullable', 'string'])]
     public ?string $telegramNotificationsStatusChangeThreadId = null;
 
+    #[Validate(['nullable', 'string', 'max:255'])]
+    public ?string $telegramNotificationsRestartLimitReachedThreadId = null;
+
     #[Validate(['nullable', 'string'])]
     public ?string $telegramNotificationsBackupSuccessThreadId = null;
 
@@ -128,11 +134,10 @@ class Telegram extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->telegram_enabled = $this->telegramEnabled;
             $this->settings->telegram_token = $this->telegramToken;
             $this->settings->telegram_chat_id = $this->telegramChatId;
@@ -140,6 +145,7 @@ class Telegram extends Component
             $this->settings->deployment_success_telegram_notifications = $this->deploymentSuccessTelegramNotifications;
             $this->settings->deployment_failure_telegram_notifications = $this->deploymentFailureTelegramNotifications;
             $this->settings->status_change_telegram_notifications = $this->statusChangeTelegramNotifications;
+            $this->settings->restart_limit_reached_telegram_notifications = $this->restartLimitReachedTelegramNotifications;
             $this->settings->backup_success_telegram_notifications = $this->backupSuccessTelegramNotifications;
             $this->settings->backup_failure_telegram_notifications = $this->backupFailureTelegramNotifications;
             $this->settings->scheduled_task_success_telegram_notifications = $this->scheduledTaskSuccessTelegramNotifications;
@@ -155,6 +161,7 @@ class Telegram extends Component
             $this->settings->telegram_notifications_deployment_success_thread_id = $this->telegramNotificationsDeploymentSuccessThreadId;
             $this->settings->telegram_notifications_deployment_failure_thread_id = $this->telegramNotificationsDeploymentFailureThreadId;
             $this->settings->telegram_notifications_status_change_thread_id = $this->telegramNotificationsStatusChangeThreadId;
+            $this->settings->telegram_notifications_restart_limit_reached_thread_id = $this->telegramNotificationsRestartLimitReachedThreadId;
             $this->settings->telegram_notifications_backup_success_thread_id = $this->telegramNotificationsBackupSuccessThreadId;
             $this->settings->telegram_notifications_backup_failure_thread_id = $this->telegramNotificationsBackupFailureThreadId;
             $this->settings->telegram_notifications_scheduled_task_success_thread_id = $this->telegramNotificationsScheduledTaskSuccessThreadId;
@@ -173,6 +180,21 @@ class Telegram extends Component
             if (auth()->user()->can('update', $this->settings)) {
                 $this->telegramToken = $this->settings->telegram_token;
                 $this->telegramChatId = $this->settings->telegram_chat_id;
+                $this->telegramNotificationsDeploymentSuccessThreadId = $this->settings->telegram_notifications_deployment_success_thread_id;
+                $this->telegramNotificationsDeploymentFailureThreadId = $this->settings->telegram_notifications_deployment_failure_thread_id;
+                $this->telegramNotificationsStatusChangeThreadId = $this->settings->telegram_notifications_status_change_thread_id;
+                $this->telegramNotificationsRestartLimitReachedThreadId = $this->settings->telegram_notifications_restart_limit_reached_thread_id;
+                $this->telegramNotificationsBackupSuccessThreadId = $this->settings->telegram_notifications_backup_success_thread_id;
+                $this->telegramNotificationsBackupFailureThreadId = $this->settings->telegram_notifications_backup_failure_thread_id;
+                $this->telegramNotificationsScheduledTaskSuccessThreadId = $this->settings->telegram_notifications_scheduled_task_success_thread_id;
+                $this->telegramNotificationsScheduledTaskFailureThreadId = $this->settings->telegram_notifications_scheduled_task_failure_thread_id;
+                $this->telegramNotificationsDockerCleanupSuccessThreadId = $this->settings->telegram_notifications_docker_cleanup_success_thread_id;
+                $this->telegramNotificationsDockerCleanupFailureThreadId = $this->settings->telegram_notifications_docker_cleanup_failure_thread_id;
+                $this->telegramNotificationsServerDiskUsageThreadId = $this->settings->telegram_notifications_server_disk_usage_thread_id;
+                $this->telegramNotificationsServerReachableThreadId = $this->settings->telegram_notifications_server_reachable_thread_id;
+                $this->telegramNotificationsServerUnreachableThreadId = $this->settings->telegram_notifications_server_unreachable_thread_id;
+                $this->telegramNotificationsServerPatchThreadId = $this->settings->telegram_notifications_server_patch_thread_id;
+                $this->telegramNotificationsTraefikOutdatedThreadId = $this->settings->telegram_notifications_traefik_outdated_thread_id;
             } else {
                 $this->telegramToken = null;
                 $this->telegramChatId = null;
@@ -181,6 +203,7 @@ class Telegram extends Component
             $this->deploymentSuccessTelegramNotifications = $this->settings->deployment_success_telegram_notifications;
             $this->deploymentFailureTelegramNotifications = $this->settings->deployment_failure_telegram_notifications;
             $this->statusChangeTelegramNotifications = $this->settings->status_change_telegram_notifications;
+            $this->restartLimitReachedTelegramNotifications = $this->settings->restart_limit_reached_telegram_notifications;
             $this->backupSuccessTelegramNotifications = $this->settings->backup_success_telegram_notifications;
             $this->backupFailureTelegramNotifications = $this->settings->backup_failure_telegram_notifications;
             $this->scheduledTaskSuccessTelegramNotifications = $this->settings->scheduled_task_success_telegram_notifications;
@@ -193,26 +216,13 @@ class Telegram extends Component
             $this->serverPatchTelegramNotifications = $this->settings->server_patch_telegram_notifications;
             $this->traefikOutdatedTelegramNotifications = $this->settings->traefik_outdated_telegram_notifications;
 
-            $this->telegramNotificationsDeploymentSuccessThreadId = $this->settings->telegram_notifications_deployment_success_thread_id;
-            $this->telegramNotificationsDeploymentFailureThreadId = $this->settings->telegram_notifications_deployment_failure_thread_id;
-            $this->telegramNotificationsStatusChangeThreadId = $this->settings->telegram_notifications_status_change_thread_id;
-            $this->telegramNotificationsBackupSuccessThreadId = $this->settings->telegram_notifications_backup_success_thread_id;
-            $this->telegramNotificationsBackupFailureThreadId = $this->settings->telegram_notifications_backup_failure_thread_id;
-            $this->telegramNotificationsScheduledTaskSuccessThreadId = $this->settings->telegram_notifications_scheduled_task_success_thread_id;
-            $this->telegramNotificationsScheduledTaskFailureThreadId = $this->settings->telegram_notifications_scheduled_task_failure_thread_id;
-            $this->telegramNotificationsDockerCleanupSuccessThreadId = $this->settings->telegram_notifications_docker_cleanup_success_thread_id;
-            $this->telegramNotificationsDockerCleanupFailureThreadId = $this->settings->telegram_notifications_docker_cleanup_failure_thread_id;
-            $this->telegramNotificationsServerDiskUsageThreadId = $this->settings->telegram_notifications_server_disk_usage_thread_id;
-            $this->telegramNotificationsServerReachableThreadId = $this->settings->telegram_notifications_server_reachable_thread_id;
-            $this->telegramNotificationsServerUnreachableThreadId = $this->settings->telegram_notifications_server_unreachable_thread_id;
-            $this->telegramNotificationsServerPatchThreadId = $this->settings->telegram_notifications_server_patch_thread_id;
-            $this->telegramNotificationsTraefikOutdatedThreadId = $this->settings->telegram_notifications_traefik_outdated_thread_id;
         }
     }
 
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -225,6 +235,7 @@ class Telegram extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -282,6 +293,8 @@ class Telegram extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Webhook.php b/app/Livewire/Notifications/Webhook.php
index ee07694767..fb537fc7d9 100644
--- a/app/Livewire/Notifications/Webhook.php
+++ b/app/Livewire/Notifications/Webhook.php
@@ -34,6 +34,9 @@ class Webhook extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeWebhookNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedWebhookNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessWebhookNotifications = false;
 
@@ -79,17 +82,17 @@ class Webhook extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->webhook_enabled = $this->webhookEnabled;
             $this->settings->webhook_url = $this->webhookUrl;
 
             $this->settings->deployment_success_webhook_notifications = $this->deploymentSuccessWebhookNotifications;
             $this->settings->deployment_failure_webhook_notifications = $this->deploymentFailureWebhookNotifications;
             $this->settings->status_change_webhook_notifications = $this->statusChangeWebhookNotifications;
+            $this->settings->restart_limit_reached_webhook_notifications = $this->restartLimitReachedWebhookNotifications;
             $this->settings->backup_success_webhook_notifications = $this->backupSuccessWebhookNotifications;
             $this->settings->backup_failure_webhook_notifications = $this->backupFailureWebhookNotifications;
             $this->settings->scheduled_task_success_webhook_notifications = $this->scheduledTaskSuccessWebhookNotifications;
@@ -113,6 +116,7 @@ class Webhook extends Component
             $this->deploymentSuccessWebhookNotifications = $this->settings->deployment_success_webhook_notifications;
             $this->deploymentFailureWebhookNotifications = $this->settings->deployment_failure_webhook_notifications;
             $this->statusChangeWebhookNotifications = $this->settings->status_change_webhook_notifications;
+            $this->restartLimitReachedWebhookNotifications = $this->settings->restart_limit_reached_webhook_notifications;
             $this->backupSuccessWebhookNotifications = $this->settings->backup_success_webhook_notifications;
             $this->backupFailureWebhookNotifications = $this->settings->backup_failure_webhook_notifications;
             $this->scheduledTaskSuccessWebhookNotifications = $this->settings->scheduled_task_success_webhook_notifications;
@@ -171,6 +175,7 @@ class Webhook extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -181,6 +186,7 @@ class Webhook extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -190,6 +196,8 @@ class Webhook extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
 
diff --git a/app/Livewire/Profile/Index.php b/app/Livewire/Profile/Index.php
index ae5d9b3ecd..69f27b0e55 100644
--- a/app/Livewire/Profile/Index.php
+++ b/app/Livewire/Profile/Index.php
@@ -47,7 +47,7 @@ class Index extends Component
 
             $avatarStorage->store(Auth::user(), $this->avatar);
             $this->reset('avatar');
-            $this->dispatch('avatar-updated', url: route('profile.avatar', ['v' => Auth::user()->fresh()->updated_at->timestamp]));
+            $this->dispatch('avatar-updated', url: profile_avatar_url(Auth::user()->fresh()));
             $this->dispatch('success', 'Profile picture updated.');
 
             return true;
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index bf84f385dd..45e284c5dc 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -99,7 +99,7 @@ class Advanced extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 2f9370871c..9f1e7fc176 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -8,6 +8,7 @@ use App\Livewire\Concerns\InteractsWithCloudflareDomainConnect;
 use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Application;
 use App\Models\Server;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -57,7 +58,7 @@ class Domains extends Component
 
     public ?string $editingService = null;
 
-    /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool}> */
+    /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool, internal_port?: ?int, has_port_override?: bool}> */
     public array $domainRows = [];
 
     /** When set, the next addSuggestedDomain call for this index skips the DNS block. */
@@ -70,6 +71,14 @@ class Domains extends Component
 
     public bool $showDomainConflictModal = false;
 
+    public bool $showPortWarningModal = false;
+
+    public bool $forceUseUnknownPort = false;
+
+    public ?int $unrecognizedPort = null;
+
+    public ?string $pendingPortAction = null;
+
     public bool $forceSaveDomains = false;
 
     public bool $forceSaveDns = false;
@@ -485,32 +494,19 @@ class Domains extends Component
 
     /**
      * @param  array<string, array{status?: string, message?: string, expected_ip?: ?string, checked_at?: ?string}>  $stored
-     * @return array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at: ?string, is_suggested: bool, suggested_for: ?string, suggestion_label: ?string, needs_force_add: bool}
+     * @return array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at: ?string, is_suggested: bool, suggested_for: ?string, suggestion_label: ?string, needs_force_add: bool, internal_port: ?int, has_port_override: bool}
      */
     protected function domainRowFromStored(string $url, ?string $service, array $stored): array
     {
         $key = $this->domainDnsStatusKey($url, $service);
         $entry = $stored[$key] ?? null;
+        $port = $this->effectiveDomainInternalPort($url);
 
-        if (is_array($entry) && filled(data_get($entry, 'status'))) {
-            return [
-                'url' => $url,
-                'service' => $service,
-                'dns_status' => (string) data_get($entry, 'status', 'pending'),
-                'dns_message' => (string) data_get($entry, 'message', 'Not checked yet.'),
-                'expected_ip' => data_get($entry, 'expected_ip') ?: $this->serverIp,
-                'checked_at' => data_get($entry, 'checked_at'),
-                'check_id' => data_get($entry, 'check_id'),
-                'is_suggested' => false,
-                'suggested_for' => null,
-                'suggestion_label' => null,
-                'needs_force_add' => false,
-            ];
-        }
-
-        return [
+        $row = [
             'url' => $url,
             'service' => $service,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => 'pending',
             'dns_message' => 'Not checked yet.',
             'expected_ip' => $this->serverIp,
@@ -521,6 +517,104 @@ class Domains extends Component
             'suggestion_label' => null,
             'needs_force_add' => false,
         ];
+
+        if (is_array($entry) && filled(data_get($entry, 'status'))) {
+            $row['dns_status'] = (string) data_get($entry, 'status', 'pending');
+            $row['dns_message'] = (string) data_get($entry, 'message', 'Not checked yet.');
+            $row['expected_ip'] = data_get($entry, 'expected_ip') ?: $this->serverIp;
+            $row['checked_at'] = data_get($entry, 'checked_at');
+            $row['check_id'] = data_get($entry, 'check_id');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    protected function effectiveDomainInternalPort(string $url): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $this->application->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+        $hasMapEntry = array_key_exists($canonical, $overrides);
+
+        if ($hasMapEntry) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($this->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
+        $exposed = $this->application->ports_exposes_array;
+        $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
+            ? (int) $exposed[0]
+            : null;
+
+        return [
+            'internal_port' => $defaultPort,
+            'has_port_override' => false,
+        ];
+    }
+
+    /**
+     * @param  array{scheme: string, host: string, port: string, path: string}  $parts
+     */
+    protected function portFromParts(array $parts): ?int
+    {
+        $port = trim((string) ($parts['port'] ?? ''));
+        if ($port === '' || ! ctype_digit($port) || (int) $port <= 0) {
+            return null;
+        }
+
+        return (int) $port;
+    }
+
+    protected function currentRowPort(string $url): ?int
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $override = ($this->application->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($override) && (int) $override > 0) {
+            return (int) $override;
+        }
+
+        $legacy = DomainUrlParts::split($url)['port'] ?? '';
+
+        return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
+    }
+
+    protected function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    {
+        if ($this->forceUseUnknownPort || $port === null) {
+            return false;
+        }
+        if ($currentPort !== null && $port === $currentPort) {
+            return false;
+        }
+
+        return $this->application->portRequiresConfirmation($port);
+    }
+
+    protected function openPortWarning(?int $port, string $action): void
+    {
+        $this->unrecognizedPort = $port;
+        $this->pendingPortAction = $action;
+        $this->showPortWarningModal = true;
     }
 
     /**
@@ -824,6 +918,31 @@ class Domains extends Component
         $this->addDomain();
     }
 
+    public function confirmUseUnknownPort(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->forceUseUnknownPort = true;
+        $this->showPortWarningModal = false;
+        $action = $this->pendingPortAction;
+        $this->pendingPortAction = null;
+
+        if ($action === 'update') {
+            $this->updateDomain();
+
+            return;
+        }
+
+        $this->addDomain();
+    }
+
+    public function cancelUseUnknownPort(): void
+    {
+        $this->showPortWarningModal = false;
+        $this->forceUseUnknownPort = false;
+        $this->unrecognizedPort = null;
+        $this->pendingPortAction = null;
+    }
+
     /**
      * Clear pending conflict state when the modal is dismissed without confirmation.
      * confirmDomainUsage sets forceSaveDomains before closing the modal.
@@ -848,7 +967,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->newDomainPartsChanged) {
+            if ($this->newDomainPartsChanged || filled($this->newDomainParts['host'] ?? null)) {
                 $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
             }
             $this->validateOnly('newDomain');
@@ -867,15 +986,24 @@ class Domains extends Component
                 ->values()
                 ->all();
             $current = $this->currentDomainList($this->newDomainService);
+            $currentCanonicalDomains = $current->map(
+                fn (string $url): string => DomainPortOverrides::withoutPort($url)
+            );
 
             foreach ($newUrls as $url) {
-                if ($current->contains($url)) {
+                if ($currentCanonicalDomains->contains(DomainPortOverrides::withoutPort($url))) {
                     $this->addError('newDomain', "Domain {$url} is already configured.");
 
                     return;
                 }
             }
 
+            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+                $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
+
+                return;
+            }
+
             $merged = $current->merge($newUrls)->merge($pairedUrls)->unique()->values();
             $this->pendingAction = 'add';
             if (! $this->saveDomainList($merged, $this->newDomainService)) {
@@ -884,6 +1012,7 @@ class Domains extends Component
 
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
+            $this->forceUseUnknownPort = false;
             $serviceForCheck = $this->newDomainService;
             $this->resetAddDomainForm();
             $this->dispatch('close-modal');
@@ -1007,6 +1136,7 @@ class Domains extends Component
         $skipDns = ! $this->dnsValidationEnabled
             || ! $server
             || $this->application->additional_servers->count() > 0;
+        $indexesToCheck = [];
 
         foreach ($this->domainRows as $index => $row) {
             $url = $row['url'] ?? null;
@@ -1109,6 +1239,11 @@ class Domains extends Component
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $canonical = DomainPortOverrides::withoutPort($this->editingDomain);
+        $savedPort = ($this->application->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->editingDomainPartsChanged = false;
         $this->editingService = $this->domainRows[$index]['service'];
         $this->resetEditDomainDnsGate();
@@ -1226,7 +1361,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->editingDomainPartsChanged) {
+            if ($this->editingDomainPartsChanged || filled($this->editingDomainParts['host'] ?? null)) {
                 $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
             }
             $this->validateOnly('editingDomain');
@@ -1243,13 +1378,29 @@ class Domains extends Component
             $service = $this->editingService;
             $wasNoindexed = $this->application->isDomainNoindexed($oldUrl);
 
+            if (blank(DomainUrlParts::split($newUrl)['port'] ?? null)) {
+                $portOverrides = $this->application->domain_port_overrides ?? [];
+                unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+                unset($portOverrides[DomainPortOverrides::withoutPort($newUrl)]);
+                $this->application->domain_port_overrides = $portOverrides ?: null;
+            }
+
             $current = $this->currentDomainList($service);
-            if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
+            $otherCanonicalDomains = $current
+                ->reject(fn (string $url): bool => $url === $oldUrl)
+                ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url));
+            if ($otherCanonicalDomains->contains(DomainPortOverrides::withoutPort($newUrl))) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured.");
 
                 return;
             }
 
+            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+                $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
+
+                return;
+            }
+
             if (! $this->forceSaveEditDns && $this->shouldValidateDnsForAdd()) {
                 $dnsFailure = $this->findDnsFailureMessage([$newUrl]);
                 if ($dnsFailure !== null) {
@@ -1277,6 +1428,7 @@ class Domains extends Component
 
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
+            $this->forceUseUnknownPort = false;
             $this->cancelEdit();
             $this->dispatch('edit-domain-saved');
             $this->dispatch('success', 'Domain updated.');
@@ -1322,6 +1474,28 @@ class Domains extends Component
         }
     }
 
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => ! ($row['is_suggested'] ?? false)
+                && hash_equals($domainKey, $this->domainRowKey($row))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    /**
+     * @param  array{url: string, service?: ?string}  $row
+     */
+    private function domainRowKey(array $row): string
+    {
+        return hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+    }
+
     public function generateDomain(?string $serviceName = null): void
     {
         try {
@@ -1800,6 +1974,8 @@ class Domains extends Component
             }
         }
 
+        $intendedComposeOverrides = null;
+
         if ($this->isCompose) {
             if (blank($serviceName)) {
                 $this->dispatch('error', 'A service is required for compose domains.');
@@ -1815,6 +1991,15 @@ class Domains extends Component
                 $allDomains = [];
             }
 
+            $previousServiceUrls = $this->currentDomainList($serviceName);
+            $normalizedPorts = DomainPortOverrides::normalize($domainString, $this->application->domain_port_overrides);
+            $domainString = $normalizedPorts['fqdn'];
+            $intendedComposeOverrides = $this->mergeComposeDomainPortOverrides(
+                $previousServiceUrls,
+                $domainString,
+                $normalizedPorts['overrides'] ?? null,
+            );
+
             $existing = is_array($allDomains[$serviceName] ?? null) ? $allDomains[$serviceName] : [];
             // Preserve stored redirect only — pending Direction dropdown values must not
             // persist until setServiceRedirect() runs.
@@ -1823,6 +2008,7 @@ class Domains extends Component
             ]);
 
             $this->application->docker_compose_domains = json_encode($allDomains);
+            $this->application->domain_port_overrides = $intendedComposeOverrides;
             $this->application->fqdn = null;
         } else {
             $this->application->fqdn = $domainString;
@@ -1849,12 +2035,47 @@ class Domains extends Component
         }
 
         $this->application->save();
+
+        if ($this->isCompose && ($this->application->domain_port_overrides ?? null) !== $intendedComposeOverrides) {
+            $this->application->domain_port_overrides = $intendedComposeOverrides;
+            $this->application->save();
+        }
+
         $this->resetDefaultLabels();
         $this->dispatch('configurationChanged');
 
         return true;
     }
 
+    /**
+     * @param  Collection<int, string>  $previousServiceUrls
+     * @param  array<string, int>|null  $incomingOverrides
+     * @return array<string, int>|null
+     */
+    protected function mergeComposeDomainPortOverrides(
+        Collection $previousServiceUrls,
+        ?string $newDomainString,
+        ?array $incomingOverrides,
+    ): ?array {
+        $merged = $this->application->domain_port_overrides ?? [];
+        $newCanonical = collect($this->splitDomains($newDomainString))
+            ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url))
+            ->all();
+
+        foreach ($previousServiceUrls as $url) {
+            $canonical = DomainPortOverrides::withoutPort($url);
+            if (! in_array($canonical, $newCanonical, true)) {
+                unset($merged[$canonical]);
+            }
+        }
+
+        foreach ($incomingOverrides ?? [] as $url => $port) {
+            $merged[$url] = (int) $port;
+        }
+
+        return $merged ?: null;
+    }
+
     protected function resetDefaultLabels(): void
     {
         try {
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 34283cd47f..8f0bb2385d 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Application;
 
 use App\Actions\Application\GenerateConfig;
 use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Project\Service\Storage;
 use App\Models\Application;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
@@ -320,17 +321,6 @@ class General extends Component
             }
         }
         $this->initialDockerComposeLocation = $this->application->docker_compose_location;
-        if ($this->application->build_pack === 'dockercompose' && ! $this->application->docker_compose_raw) {
-            // Only load compose file if user has update permission
-            try {
-                $this->authorize('update', $this->application);
-                $this->initLoadingCompose = true;
-                $this->dispatch('info', 'Loading docker compose file.');
-            } catch (AuthorizationException $e) {
-                // User doesn't have update permission, skip loading compose file
-            }
-        }
-
         if (str($this->application->status)->startsWith('running') && is_null($this->application->config_hash)) {
             $this->dispatch('configurationChanged');
         }
@@ -340,7 +330,7 @@ class General extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -530,7 +520,7 @@ class General extends Component
 
             $showToast && $this->dispatch('success', 'Docker compose file loaded.');
             $this->dispatch('compose_loaded');
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
             $this->dispatch('refreshEnvs');
         } catch (\Throwable $e) {
             // Refresh model to get restored values from Application::loadComposeFile
@@ -607,14 +597,9 @@ class General extends Component
             $this->resetDefaultLabels(false);
         }
         if ($this->buildPack === 'dockercompose') {
-            // Only update if user has permission
-            try {
-                $this->authorize('update', $this->application);
-                $this->fqdn = null;
-                $this->application->fqdn = null;
-                $this->application->settings->save();
-            } catch (AuthorizationException $e) {
-                // User doesn't have update permission, just continue without saving
+            if (blank($this->dockerComposeLocation)) {
+                $this->dockerComposeLocation = '/docker-compose.yaml';
+                $this->application->docker_compose_location = $this->dockerComposeLocation;
             }
         }
         if ($this->buildPack === 'static') {
@@ -666,6 +651,8 @@ class General extends Component
 
     public function resetDefaultLabels($manualReset = false)
     {
+        $this->authorize('update', $this->application);
+
         try {
             if (! $this->isContainerLabelReadonlyEnabled && ! $manualReset) {
                 return;
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
new file mode 100644
index 0000000000..21296978f7
--- /dev/null
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -0,0 +1,609 @@
+<?php
+
+namespace App\Livewire\Project\Application;
+
+use App\Actions\Shared\CheckDomainDns;
+use App\Jobs\CheckDomainDnsJob;
+use App\Models\ApplicationPreview;
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
+use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\DB;
+use Livewire\Component;
+
+class PreviewDomains extends Component
+{
+    use AuthorizesRequests;
+
+    public ApplicationPreview $preview;
+
+    public array $domainRows = [];
+
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public ?string $newDomainService = null;
+
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public ?int $editingIndex = null;
+
+    public bool $showPortWarningModal = false;
+
+    public bool $forceUseUnknownPort = false;
+
+    public ?int $unrecognizedPort = null;
+
+    public ?string $pendingPortAction = null;
+
+    public function mount(): void
+    {
+        $this->refreshDomains();
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            $this->newDomainService = $this->composeServices()[0] ?? null;
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.project.application.preview-domains', [
+            'isCompose' => $this->preview->application->build_pack === 'dockercompose',
+            'composeServices' => $this->composeServices(),
+        ]);
+    }
+
+    public function addDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if ($this->preview->application->build_pack === 'dockercompose'
+            && ($this->newDomainService === null || ! in_array($this->newDomainService, $this->composeServices(), true))) {
+            $this->addError('newDomainService', 'Select a valid Compose service.');
+
+            return;
+        }
+        $domain = $this->validatedDomain($this->newDomainParts, 'newDomainParts.host');
+        if ($domain === null) {
+            return;
+        }
+        $canonicalDomain = DomainPortOverrides::withoutPort($domain);
+        if (collect($this->domainRows)->contains(
+            fn (array $row): bool => DomainPortOverrides::withoutPort($row['url']) === $canonicalDomain
+                && $row['service'] === $this->newDomainService
+        )) {
+            $this->addError('newDomainParts.host', 'This domain is already configured.');
+
+            return;
+        }
+        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+            $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
+
+            return;
+        }
+        $this->domainRows[] = $this->makeRow($domain, $this->newDomainService);
+        $index = array_key_last($this->domainRows);
+        $checkId = new_public_id();
+        $this->domainRows[$index]['dns_status'] = 'checking';
+        $this->domainRows[$index]['dns_message'] = 'Checking DNS...';
+        $this->domainRows[$index]['check_id'] = $checkId;
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $domain = $this->domainRows[$index]['url'] ?? DomainPortOverrides::withoutPort($domain);
+        $this->newDomainParts = DomainUrlParts::empty();
+        $this->newDomainService = $this->preview->application->build_pack === 'dockercompose'
+            ? ($this->composeServices()[0] ?? null)
+            : null;
+        $this->forceUseUnknownPort = false;
+        $this->dispatch('close-modal');
+
+        try {
+            $server = $this->preview->application->destination?->server;
+            CheckDomainDnsJob::dispatch(
+                $this->preview,
+                $this->statusKey($domain, $this->domainRows[$index]['service']),
+                $domain,
+                $server,
+                $server ? serverDnsTargetIp($server) ?? $server->ip : null,
+                $checkId,
+                $this->preview->application->additional_servers->count() > 0,
+            );
+            $this->dispatch('success', 'Domain added. DNS check started.');
+        } catch (\Throwable) {
+            $this->domainRows[$index]['dns_status'] = 'skipped';
+            $this->domainRows[$index]['dns_message'] = 'DNS check could not be started.';
+            $this->domainRows[$index]['check_id'] = null;
+            $this->persistDnsStatuses();
+            $this->dispatch('error', 'Domain added, but the DNS check could not be started. Try again from the preview domains list.');
+        }
+    }
+
+    public function generateDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->preview->refresh();
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            if ($this->newDomainService === null && $this->domainRows === []) {
+                $this->preview->generate_preview_fqdn_compose(generateWithoutApplicationDomain: true);
+            } else {
+                $service = $this->newDomainService ?? data_get($this->domainRows, '0.service');
+                foreach ($this->generateComposeDomains((string) $service) as $domain) {
+                    $alreadyExists = collect($this->domainRows)->contains(
+                        fn (array $row): bool => DomainPortOverrides::withoutPort($row['url']) === DomainPortOverrides::withoutPort($domain)
+                            && $row['service'] === $service
+                    );
+                    if (! $alreadyExists) {
+                        $this->domainRows[] = $this->makeRow($domain, $service);
+                    }
+                }
+
+                if (! $this->persistDomains()) {
+                    return;
+                }
+            }
+        } else {
+            $this->preview->generate_preview_fqdn(generateWithoutApplicationDomain: true);
+        }
+        $this->refreshDomains();
+        $this->dispatch('success', 'Domain generated.');
+    }
+
+    public function startEdit(int $index): void
+    {
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        $this->editingIndex = $index;
+        $this->editingDomainParts = DomainUrlParts::split($this->domainRows[$index]['url']);
+        $canonical = DomainPortOverrides::withoutPort($this->domainRows[$index]['url']);
+        $savedPort = ($this->preview->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
+        $this->dispatch('open-preview-domain-edit');
+    }
+
+    public function updateDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if ($this->editingIndex === null || ! isset($this->domainRows[$this->editingIndex])) {
+            return;
+        }
+        $domain = $this->validatedDomain($this->editingDomainParts, 'editingDomainParts.host');
+        if ($domain === null) {
+            return;
+        }
+        $oldUrl = $this->domainRows[$this->editingIndex]['url'];
+        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+            $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
+
+            return;
+        }
+        if (blank(DomainUrlParts::split($domain)['port'] ?? null)) {
+            $portOverrides = $this->preview->domain_port_overrides ?? [];
+            unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+            unset($portOverrides[DomainPortOverrides::withoutPort($domain)]);
+            $this->preview->domain_port_overrides = $portOverrides ?: null;
+        }
+        $this->domainRows[$this->editingIndex]['url'] = $domain;
+        $this->domainRows[$this->editingIndex]['dns_status'] = 'pending';
+        $this->domainRows[$this->editingIndex]['dns_message'] = 'DNS has not been checked yet.';
+        $index = $this->editingIndex;
+        $this->editingIndex = null;
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->forceUseUnknownPort = false;
+        $this->dispatch('close-preview-domain-edit');
+        $this->dispatch('success', 'Domain updated.');
+        $this->checkDomainDns($index);
+    }
+
+    public function confirmUseUnknownPort(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->forceUseUnknownPort = true;
+        $this->showPortWarningModal = false;
+        $action = $this->pendingPortAction;
+        $this->pendingPortAction = null;
+
+        if ($action === 'update') {
+            $this->updateDomain();
+
+            return;
+        }
+
+        $this->addDomain();
+    }
+
+    public function cancelUseUnknownPort(): void
+    {
+        $this->showPortWarningModal = false;
+        $this->forceUseUnknownPort = false;
+        $this->unrecognizedPort = null;
+        $this->pendingPortAction = null;
+    }
+
+    public function removeDomain(int $index): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        unset($this->domainRows[$index]);
+        $this->domainRows = array_values($this->domainRows);
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->dispatch('success', 'Domain removed.');
+    }
+
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => hash_equals($domainKey, $this->statusKey($row['url'], $row['service']))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    public function checkAllDns(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        foreach (array_keys($this->domainRows) as $index) {
+            $this->applyDnsCheck($index);
+        }
+        $this->persistDnsStatuses();
+    }
+
+    public function checkDomainDns(int $index): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->applyDnsCheck($index);
+        $this->persistDnsStatuses();
+    }
+
+    public function pollDnsChecks(): void
+    {
+        $checkingRows = collect($this->domainRows)
+            ->where('dns_status', 'checking')
+            ->values();
+
+        $this->refreshDomains();
+
+        foreach ($checkingRows as $checkingRow) {
+            $row = collect($this->domainRows)->first(fn (array $row): bool => $row['url'] === $checkingRow['url']
+                && ($row['service'] ?? null) === ($checkingRow['service'] ?? null));
+
+            if (! is_array($row) || $row['dns_status'] === 'checking') {
+                continue;
+            }
+
+            $this->dispatchDnsCheckNotification($row['url'], $row['dns_status']);
+        }
+    }
+
+    private function dispatchDnsCheckNotification(string $url, string $status): void
+    {
+        $host = parse_url($url, PHP_URL_HOST) ?: $url;
+
+        match ($status) {
+            'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
+            'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+            default => $this->dispatch('info', "DNS check skipped for {$host}."),
+        };
+    }
+
+    private function applyDnsCheck(int $index): void
+    {
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        $result = $this->checkUrlDns($this->domainRows[$index]['url'], (string) $index);
+        $this->domainRows[$index]['dns_status'] = $result['status'];
+        $this->domainRows[$index]['dns_message'] = $result['message'];
+    }
+
+    private function checkUrlDns(string $url, string $key = 'domain'): array
+    {
+        $server = $this->preview->application->destination?->server;
+
+        return CheckDomainDns::run(
+            [$key => $url],
+            $server,
+            $server ? serverDnsTargetIp($server) ?? $server->ip : null,
+            $this->preview->application->additional_servers->count() > 0,
+        )[$key];
+    }
+
+    private function refreshDomains(): void
+    {
+        $this->preview->refresh();
+        $statuses = $this->preview->domain_dns_statuses ?? [];
+        $rows = [];
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            foreach (json_decode($this->preview->docker_compose_domains ?: '[]', true) ?: [] as $service => $entry) {
+                foreach ($this->splitDomains(composeDomainEntryString($entry)) as $url) {
+                    $rows[] = $this->makeRow($url, (string) $service, $statuses);
+                }
+            }
+        } else {
+            foreach ($this->splitDomains($this->preview->fqdn) as $url) {
+                $rows[] = $this->makeRow($url, null, $statuses);
+            }
+        }
+        $this->domainRows = $rows;
+    }
+
+    private function persistDomains(): bool
+    {
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            try {
+                $composeServices = $this->composeServices(failOnError: true);
+            } catch (\Throwable) {
+                $this->refreshDomains();
+                $this->dispatch('error', 'Compose configuration could not be parsed. Preview domains were not changed.');
+
+                return false;
+            }
+            $domains = collect($composeServices)
+                ->mapWithKeys(fn (string $service): array => [$service => ['domain' => '']])
+                ->all();
+            $validRows = collect($this->domainRows)
+                ->filter(fn (array $row): bool => in_array($row['service'] ?? null, $composeServices, true));
+            foreach ($validRows->groupBy('service') as $service => $rows) {
+                $domains[$service] = ['domain' => $rows->pluck('url')->implode(',')];
+            }
+            $this->preview->docker_compose_domains = json_encode($domains);
+            $this->preview->fqdn = $validRows->pluck('url')->implode(',') ?: null;
+        } else {
+            $this->preview->fqdn = collect($this->domainRows)->pluck('url')->implode(',') ?: null;
+        }
+        $normalized = DomainPortOverrides::normalize($this->preview->fqdn, $this->preview->domain_port_overrides);
+        $this->preview->fqdn = $normalized['fqdn'];
+        $this->preview->domain_port_overrides = $normalized['overrides'];
+        if ($this->preview->application->build_pack === 'dockercompose' && is_array($domains ?? null)) {
+            foreach ($domains as $service => $entry) {
+                $serviceDomains = $this->splitDomains(composeDomainEntryString($entry));
+                $domains[$service]['domain'] = collect($serviceDomains)
+                    ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url))
+                    ->implode(',');
+            }
+            $this->preview->docker_compose_domains = json_encode($domains);
+        }
+        foreach ($this->domainRows as $index => $row) {
+            $this->domainRows[$index]['url'] = DomainPortOverrides::withoutPort($row['url']);
+        }
+        $this->preview->save();
+        $this->persistDnsStatuses();
+        $this->refreshDomains();
+        $this->dispatch('update_links');
+        $this->dispatch('previewDomainsChanged');
+
+        return true;
+    }
+
+    private function persistDnsStatuses(): void
+    {
+        $statuses = [];
+        foreach ($this->domainRows as $row) {
+            $statuses[$this->statusKey($row['url'], $row['service'])] = [
+                'status' => $row['dns_status'],
+                'message' => $row['dns_message'],
+                'check_id' => $row['check_id'] ?? null,
+            ];
+        }
+
+        DB::transaction(function () use (&$statuses): void {
+            $preview = ApplicationPreview::query()->lockForUpdate()->findOrFail($this->preview->id);
+            $storedStatuses = $preview->domain_dns_statuses ?? [];
+
+            foreach ($statuses as $key => $status) {
+                $storedStatus = $storedStatuses[$key] ?? null;
+                if (! is_array($storedStatus)) {
+                    continue;
+                }
+
+                $localCheckId = $status['check_id'] ?? null;
+                $storedCheckId = $storedStatus['check_id'] ?? null;
+
+                if (($storedCheckId !== null && $localCheckId !== $storedCheckId)
+                    || ($status['status'] === 'checking' && ($storedStatus['status'] ?? null) !== 'checking')) {
+                    $statuses[$key] = $storedStatus;
+                }
+            }
+
+            $preview->domain_dns_statuses = $statuses ?: null;
+            $preview->save();
+        });
+
+        $this->preview->domain_dns_statuses = $statuses ?: null;
+    }
+
+    private function validatedDomain(array $parts, string $errorKey): ?string
+    {
+        $domain = DomainUrlParts::compose(...$parts);
+        $validator = validator(['domain' => $domain], ['domain' => ValidationPatterns::applicationDomainRules()]);
+        if ($validator->fails()) {
+            $this->addError($errorKey, $validator->errors()->first('domain'));
+
+            return null;
+        }
+
+        return ValidationPatterns::normalizeApplicationDomains($domain);
+    }
+
+    private function makeRow(string $url, ?string $service, array $statuses = []): array
+    {
+        $status = $statuses[$this->statusKey($url, $service)] ?? [];
+        $port = $this->effectiveDomainInternalPort($url);
+
+        return [
+            'url' => $url,
+            'service' => $service,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
+            'dns_status' => $status['status'] ?? 'pending',
+            'dns_message' => $status['message'] ?? 'DNS has not been checked yet.',
+            'check_id' => $status['check_id'] ?? null,
+        ];
+    }
+
+    /**
+     * @param  array{scheme: string, host: string, port: string, path: string}  $parts
+     */
+    private function portFromParts(array $parts): ?int
+    {
+        $port = trim((string) ($parts['port'] ?? ''));
+        if ($port === '' || ! ctype_digit($port) || (int) $port <= 0) {
+            return null;
+        }
+
+        return (int) $port;
+    }
+
+    private function currentRowPort(string $url): ?int
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $override = ($this->preview->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($override) && (int) $override > 0) {
+            return (int) $override;
+        }
+
+        $legacy = DomainUrlParts::split($url)['port'] ?? '';
+
+        return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
+    }
+
+    private function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    {
+        if ($this->forceUseUnknownPort || $port === null) {
+            return false;
+        }
+        if ($currentPort !== null && $port === $currentPort) {
+            return false;
+        }
+
+        return $this->preview->application->portRequiresConfirmation($port);
+    }
+
+    private function openPortWarning(?int $port, string $action): void
+    {
+        $this->unrecognizedPort = $port;
+        $this->pendingPortAction = $action;
+        $this->showPortWarningModal = true;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    private function effectiveDomainInternalPort(string $url): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $this->preview->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+        $hasMapEntry = array_key_exists($canonical, $overrides);
+
+        if ($hasMapEntry) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($this->preview->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
+        $exposed = $this->preview->application->ports_exposes_array;
+        $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
+            ? (int) $exposed[0]
+            : null;
+
+        return [
+            'internal_port' => $defaultPort,
+            'has_port_override' => false,
+        ];
+    }
+
+    private function statusKey(string $url, ?string $service): string
+    {
+        return hash('sha256', $url.'|'.($service ?? ''));
+    }
+
+    private function splitDomains(?string $domains): array
+    {
+        return str($domains)->explode(',')->map(fn ($domain) => trim((string) $domain))->filter()->values()->all();
+    }
+
+    private function generateComposeDomains(string $service): array
+    {
+        $applicationDomains = json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: [];
+        $domainString = getComposeServiceDomainString($applicationDomains, $service);
+
+        if (empty($domainString)) {
+            $domainString = generateUrl(
+                server: $this->preview->application->destination->server,
+                random: str($service)->slug().'-'.$this->preview->application->uuid,
+            );
+        }
+
+        return collect($this->splitDomains($domainString))->map(function (string $domain): string {
+            $generated = $this->preview->generatedPreviewDomain($domain);
+            if (filled($generated['port'])) {
+                $overrides = $this->preview->domain_port_overrides ?? [];
+                $overrides[$generated['url']] = $generated['port'];
+                $this->preview->domain_port_overrides = $overrides;
+            }
+
+            return $generated['url'];
+        })->all();
+    }
+
+    private function composeServices(bool $failOnError = false): array
+    {
+        try {
+            $parsedCompose = $this->preview->application->parse(pull_request_id: $this->preview->pull_request_id);
+            $services = data_get($parsedCompose, 'services', []);
+            if (! is_iterable($services)) {
+                return [];
+            }
+
+            $previewSuffix = '-pr-'.$this->preview->pull_request_id;
+            $serviceNames = [];
+            foreach ($services as $serviceName => $service) {
+                if (isDatabaseImage(data_get($service, 'image'))) {
+                    continue;
+                }
+
+                $serviceName = (string) $serviceName;
+                if (str_ends_with($serviceName, $previewSuffix)) {
+                    $serviceName = substr($serviceName, 0, -strlen($previewSuffix));
+                }
+                $serviceNames[] = $serviceName;
+            }
+
+            return array_values(array_unique($serviceNames));
+        } catch (\Throwable $exception) {
+            if ($failOnError) {
+                throw $exception;
+            }
+
+            return [];
+        }
+    }
+}
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index 3944bbe09d..14d9bcdb8d 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -7,7 +7,6 @@ use App\Events\ServiceStatusChanged;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
-use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
@@ -16,6 +15,8 @@ class Previews extends Component
 {
     use AuthorizesRequests;
 
+    protected $listeners = ['previewDomainsChanged' => 'refreshPreviewDomains'];
+
     public Application $application;
 
     public string $deployment_uuid;
@@ -26,16 +27,6 @@ class Previews extends Component
 
     public int $rate_limit_remaining;
 
-    public $domainConflicts = [];
-
-    public $showDomainConflictModal = false;
-
-    public $forceSaveDomains = false;
-
-    public $pendingPreviewId = null;
-
-    public array $previewFqdns = [];
-
     public array $previewDockerTags = [];
 
     public ?int $manualPullRequestId = null;
@@ -43,7 +34,6 @@ class Previews extends Component
     public ?string $manualDockerTag = null;
 
     protected $rules = [
-        'previewFqdns.*' => 'string|nullable',
         'previewDockerTags.*' => 'string|nullable',
         'manualPullRequestId' => 'integer|min:1|nullable',
         'manualDockerTag' => 'string|nullable',
@@ -53,31 +43,23 @@ class Previews extends Component
     {
         $this->pull_requests = collect();
         $this->parameters = get_route_parameters();
-        $this->syncData(false);
+        $this->syncDockerTags();
     }
 
-    private function syncData(bool $toModel = false): void
+    private function syncDockerTags(): void
     {
-        if ($toModel) {
-            foreach ($this->previewFqdns as $key => $fqdn) {
-                $preview = $this->application->previews->get($key);
-                if ($preview) {
-                    $preview->fqdn = $fqdn;
-                    if ($this->application->build_pack === 'dockerimage') {
-                        $preview->docker_registry_image_tag = $this->previewDockerTags[$key] ?? null;
-                    }
-                }
-            }
-        } else {
-            $this->previewFqdns = [];
-            $this->previewDockerTags = [];
-            foreach ($this->application->previews as $key => $preview) {
-                $this->previewFqdns[$key] = $preview->fqdn;
-                $this->previewDockerTags[$key] = $preview->docker_registry_image_tag;
-            }
+        $this->previewDockerTags = [];
+        foreach ($this->application->previews as $key => $preview) {
+            $this->previewDockerTags[$key] = $preview->docker_registry_image_tag;
         }
     }
 
+    public function refreshPreviewDomains(): void
+    {
+        $this->application->refresh();
+        $this->syncDockerTags();
+    }
+
     public function load_prs()
     {
         try {
@@ -92,103 +74,28 @@ class Previews extends Component
         }
     }
 
-    public function confirmDomainUsage()
-    {
-        $this->forceSaveDomains = true;
-        $this->showDomainConflictModal = false;
-        if ($this->pendingPreviewId) {
-            $this->save_preview($this->pendingPreviewId);
-            $this->pendingPreviewId = null;
-        }
-    }
-
     public function save_preview($preview_id)
     {
         try {
             $this->authorize('update', $this->application);
-            $success = true;
             $preview = $this->application->previews->find($preview_id);
 
             if (! $preview) {
                 throw new \Exception('Preview not found');
             }
 
-            // Find the key for this preview in the collection
             $previewKey = $this->application->previews->search(function ($item) use ($preview_id) {
                 return $item->id == $preview_id;
             });
 
-            if ($previewKey !== false && isset($this->previewFqdns[$previewKey])) {
-                $this->validate([
-                    "previewFqdns.{$previewKey}" => ValidationPatterns::applicationDomainRules(),
-                ]);
-
-                $fqdn = $this->previewFqdns[$previewKey];
-
-                if (! empty($fqdn)) {
-                    $fqdn = ValidationPatterns::normalizeApplicationDomains($fqdn);
-                    $this->previewFqdns[$previewKey] = $fqdn;
-
-                    if (! validateDNSEntry($fqdn, $this->application->destination->server)) {
-                        $server = $this->application->destination->server;
-                        $target = serverDnsTargetIp($server) ?? $server->ip;
-                        $guidance = dnsMismatchGuidanceMessage($target, $target);
-                        $this->dispatch('error', 'Validating DNS failed.', "{$guidance}<br><br>Check this <a target='_blank' class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/dns-configuration'>documentation</a> for further help.");
-                        $success = false;
-                    }
-
-                    // Check for domain conflicts if not forcing save
-                    if (! $this->forceSaveDomains) {
-                        $result = checkDomainUsage(resource: $this->application, domain: $fqdn);
-                        if ($result['hasConflicts']) {
-                            $this->domainConflicts = $result['conflicts'];
-                            $this->showDomainConflictModal = true;
-                            $this->pendingPreviewId = $preview_id;
-
-                            return;
-                        }
-                    } else {
-                        // Reset the force flag after using it
-                        $this->forceSaveDomains = false;
-                    }
-                }
+            if ($previewKey === false) {
+                throw new \Exception('Preview not found');
             }
 
-            if ($success) {
-                $this->syncData(true);
-                $preview->save();
-                $this->dispatch('success', 'Preview saved.<br><br>Do not forget to redeploy the preview to apply the changes.');
-            }
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function generate_preview($preview_id)
-    {
-        try {
-            $this->authorize('update', $this->application);
-
-            $preview = $this->application->previews->find($preview_id);
-            if (! $preview) {
-                $this->dispatch('error', 'Preview not found.');
-
-                return;
-            }
-            if ($this->application->build_pack === 'dockercompose') {
-                $preview->generate_preview_fqdn_compose();
-                $this->application->refresh();
-                $this->syncData(false);
-                $this->dispatch('success', 'Domain generated.');
-
-                return;
-            }
-
-            $preview->generate_preview_fqdn();
-            $this->application->refresh();
-            $this->syncData(false);
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain generated.');
+            $this->validateOnly("previewDockerTags.{$previewKey}");
+            $preview->docker_registry_image_tag = $this->previewDockerTags[$previewKey] ?? null;
+            $preview->save();
+            $this->dispatch('success', 'Preview saved.<br><br>Do not forget to redeploy the preview to apply the changes.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -211,7 +118,7 @@ class Previews extends Component
                 }
                 $found->generate_preview_fqdn_compose();
                 $this->application->refresh();
-                $this->syncData(false);
+                $this->syncDockerTags();
             } else {
                 $this->setDeploymentUuid();
                 $found = ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', $pull_request_id)->first();
@@ -227,9 +134,9 @@ class Previews extends Component
                     $found->docker_registry_image_tag = $docker_registry_image_tag;
                     $found->save();
                 }
-                $found->generate_preview_fqdn();
+                $found->generate_preview_fqdn(generateWithoutApplicationDomain: true);
                 $this->application->refresh();
-                $this->syncData(false);
+                $this->syncDockerTags();
                 $this->dispatch('update_links');
                 $this->dispatch('success', 'Preview added.');
             }
diff --git a/app/Livewire/Project/Application/PreviewsCompose.php b/app/Livewire/Project/Application/PreviewsCompose.php
deleted file mode 100644
index 0fdcf46153..0000000000
--- a/app/Livewire/Project/Application/PreviewsCompose.php
+++ /dev/null
@@ -1,165 +0,0 @@
-<?php
-
-namespace App\Livewire\Project\Application;
-
-use App\Models\ApplicationPreview;
-use App\Support\ValidationPatterns;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Component;
-use Spatie\Url\Url;
-
-class PreviewsCompose extends Component
-{
-    use AuthorizesRequests;
-
-    public $service;
-
-    public $serviceName;
-
-    public ApplicationPreview $preview;
-
-    public ?string $domain = null;
-
-    public function mount()
-    {
-        $this->domain = data_get($this->service, 'domain');
-    }
-
-    public function render()
-    {
-        return view('livewire.project.application.previews-compose');
-    }
-
-    public function save()
-    {
-        try {
-            $this->authorize('update', $this->preview->application);
-            $this->validate([
-                'domain' => ValidationPatterns::applicationDomainRules(),
-            ]);
-
-            $this->domain = ValidationPatterns::normalizeApplicationDomains($this->domain);
-            $this->persistPreviewDomain($this->domain);
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain saved.');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function generate()
-    {
-        try {
-            $this->authorize('update', $this->preview->application);
-
-            $applicationDomains = json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: [];
-            $domain_string = getComposeServiceDomainString($applicationDomains, (string) $this->serviceName);
-
-            // If no domain is set in the main application, generate a default domain
-            if (empty($domain_string)) {
-                $server = $this->preview->application->destination->server;
-                $template = $this->preview->application->preview_url_template;
-                $random = new_public_id();
-
-                // Generate a unique domain like main app services do
-                $generated_fqdn = generateUrl(server: $server, random: $random);
-
-                $preview_fqdn = str_replace('{{random}}', $random, $template);
-                $preview_fqdn = str_replace('{{domain}}', str($generated_fqdn)->after('://'), $preview_fqdn);
-                $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
-                $preview_fqdn = str($generated_fqdn)->before('://').'://'.$preview_fqdn;
-            } else {
-                foreach (ValidationPatterns::validateApplicationDomains($domain_string) as $error) {
-                    throw new \InvalidArgumentException($error);
-                }
-
-                // Use the existing domain from the main application
-                // Handle multiple domains separated by commas
-                $domain_list = ValidationPatterns::applicationDomainList($domain_string);
-                $preview_fqdns = [];
-                $template = $this->preview->application->preview_url_template;
-                $random = new_public_id();
-
-                foreach ($domain_list as $single_domain) {
-                    $single_domain = trim($single_domain);
-                    if (empty($single_domain)) {
-                        continue;
-                    }
-
-                    $url = Url::fromString($single_domain);
-                    $host = $url->getHost();
-                    $schema = $url->getScheme();
-                    $portInt = $url->getPort();
-                    $port = $portInt !== null ? ':'.$portInt : '';
-
-                    $preview_fqdn = str_replace('{{random}}', $random, $template);
-                    $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                    $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
-                    $preview_fqdns[] = "$schema://$preview_fqdn{$port}";
-                }
-
-                $preview_fqdn = implode(',', $preview_fqdns);
-            }
-
-            $this->domain = $preview_fqdn;
-            $this->persistPreviewDomain($this->domain);
-
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain generated.');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    private function persistPreviewDomain(?string $domain): void
-    {
-        $docker_compose_domains = json_decode(data_get($this->preview, 'docker_compose_domains') ?: '[]', true) ?: [];
-        $serviceNames = $this->previewServiceNames($docker_compose_domains);
-        $storageKey = findComposeServiceName((string) $this->serviceName, $serviceNames)
-            ?? (string) $this->serviceName;
-
-        $docker_compose_domains = putComposeServiceDomain(
-            $docker_compose_domains,
-            $storageKey,
-            $domain,
-            $serviceNames,
-        );
-        $docker_compose_domains = rekeyComposeDomainsToServiceNames($docker_compose_domains, $serviceNames);
-
-        $this->serviceName = $storageKey;
-        $this->preview->docker_compose_domains = json_encode($docker_compose_domains);
-        $this->preview->save();
-    }
-
-    /**
-     * @param  array<string, mixed>  $previewDomains
-     * @return list<string>
-     */
-    private function previewServiceNames(array $previewDomains): array
-    {
-        $parsedServices = $this->preview->application->parse(pull_request_id: $this->preview->pull_request_id);
-        $fromCompose = collect(data_get($parsedServices, 'services', []))
-            ->keys()
-            ->map(function ($serviceName) {
-                return str((string) $serviceName)
-                    ->replaceLast('-pr-'.$this->preview->pull_request_id, '')
-                    ->toString();
-            })
-            ->all();
-
-        $domainKeys = collect(array_keys($previewDomains))
-            ->merge(array_keys(json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: []))
-            ->map(fn ($name) => (string) $name);
-        $unmapped = $domainKeys
-            ->reject(fn (string $key) => findComposeServiceName($key, $fromCompose) !== null)
-            ->all();
-
-        return collect($fromCompose)
-            ->merge(preferredComposeServiceNamesFromDomainKeys(
-                $fromCompose === [] ? $domainKeys->all() : $unmapped
-            ))
-            ->unique()
-            ->values()
-            ->all();
-    }
-}
diff --git a/app/Livewire/Project/Application/Source.php b/app/Livewire/Project/Application/Source.php
index 29f798d595..60a7955738 100644
--- a/app/Livewire/Project/Application/Source.php
+++ b/app/Livewire/Project/Application/Source.php
@@ -65,7 +65,7 @@ class Source extends Component
         $this->gitCommitSha = trim($this->gitCommitSha);
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/Swarm.php b/app/Livewire/Project/Application/Swarm.php
index 661578fb3d..ac867e69aa 100644
--- a/app/Livewire/Project/Application/Swarm.php
+++ b/app/Livewire/Project/Application/Swarm.php
@@ -31,7 +31,7 @@ class Swarm extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 608d153ebc..1d223b6967 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -128,7 +128,7 @@ class BackupEdit extends Component
         $this->status = $database->status;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->backup->enabled = $this->backupEnabled;
@@ -220,14 +220,14 @@ class BackupEdit extends Component
             if ($database->getMorphClass() === ServiceDatabase::class) {
                 $serviceDatabase = $database;
 
-                return redirect()->route('project.service.database.backups', [
+                return redirectRoute($this, 'project.service.database.backups', [
                     'project_uuid' => $this->parameters['project_uuid'],
                     'environment_uuid' => $this->parameters['environment_uuid'],
                     'service_uuid' => $serviceDatabase->service->uuid,
                     'stack_service_uuid' => $serviceDatabase->uuid,
                 ]);
             } else {
-                return redirect()->route('project.database.backup.index', [
+                return redirectRoute($this, 'project.database.backup.index', [
                     'project_uuid' => $this->parameters['project_uuid'],
                     'environment_uuid' => $this->parameters['environment_uuid'],
                     'database_uuid' => $this->parameters['database_uuid'],
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 73877a945e..2786a45c3d 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -6,7 +6,6 @@ use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class BackupExecutions extends Component
@@ -37,12 +36,12 @@ class BackupExecutions extends Component
 
     public $delete_backup_sftp = false;
 
-    public function getListeners()
+    public function getListeners(): array
     {
-        $userId = Auth::id();
+        $teamId = currentTeam()->id;
 
         return [
-            "echo-private:team.{$userId},BackupCreated" => 'refreshBackupExecutions',
+            "echo-private:team.{$teamId},BackupCreated" => 'refreshBackupExecutions',
         ];
     }
 
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index ad5e45b3fe..1d8354a4fb 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -121,7 +121,7 @@ class General extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -199,6 +199,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 2f5b844845..a8bde2f007 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -115,7 +115,7 @@ class General extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -191,6 +191,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Heading.php b/app/Livewire/Project/Database/Heading.php
index 4b34c5e4ee..993200b578 100644
--- a/app/Livewire/Project/Database/Heading.php
+++ b/app/Livewire/Project/Database/Heading.php
@@ -35,6 +35,12 @@ class Heading extends Component
 
     public function activityFinished()
     {
+        if (auth()->user()->cannot('update', $this->database)) {
+            $this->dispatch('refresh');
+
+            return;
+        }
+
         try {
             // Only set started_at if database is actually running
             if ($this->database->isRunning()) {
diff --git a/app/Livewire/Project/Database/Health.php b/app/Livewire/Project/Database/Health.php
index 8943e6316e..07373bdba2 100644
--- a/app/Livewire/Project/Database/Health.php
+++ b/app/Livewire/Project/Database/Health.php
@@ -34,7 +34,7 @@ class Health extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Database/InitScript.php b/app/Livewire/Project/Database/InitScript.php
index 7074c235d5..eba1c4d8f7 100644
--- a/app/Livewire/Project/Database/InitScript.php
+++ b/app/Livewire/Project/Database/InitScript.php
@@ -22,6 +22,9 @@ class InitScript extends Component
     #[Locked]
     public int $index;
 
+    #[Locked]
+    public string $originalFilename;
+
     #[Validate(['nullable', 'string'])]
     public ?string $filename = null;
 
@@ -33,6 +36,7 @@ class InitScript extends Component
         try {
             $this->index = data_get($this->script, 'index');
             $this->filename = data_get($this->script, 'filename');
+            $this->originalFilename = (string) data_get($this->script, 'filename');
             $this->content = data_get($this->script, 'content');
         } catch (Exception $e) {
             return handleError($e, $this);
@@ -47,7 +51,7 @@ class InitScript extends Component
             $this->script['index'] = $this->index;
             $this->script['content'] = $this->content;
             $this->script['filename'] = $this->filename;
-            $this->dispatch('save_init_script', $this->script);
+            $this->dispatch('save_init_script', $this->script, $this->originalFilename);
         } catch (Exception $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index b2d9bce91b..0398362bbb 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -118,7 +118,7 @@ class General extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -196,6 +196,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index 61280a34b5..4d2dd9d8c2 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -136,7 +136,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -244,6 +244,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index f68ba82c7d..d3545564ee 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -128,7 +128,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -237,6 +237,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index 1adfe2ea79..ce7fc01ecd 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -136,7 +136,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -244,6 +244,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 051fb515d9..3d0406956f 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -149,7 +149,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -240,6 +240,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
@@ -247,16 +248,16 @@ class General extends Component
         }
     }
 
-    public function save_init_script($script)
+    public function save_init_script($script, string $originalFilename)
     {
         $this->authorize('update', $this->database);
 
         $initScripts = collect($this->initScripts ?? []);
 
         $existingScript = $initScripts->firstWhere('filename', $script['filename']);
-        $oldScript = $initScripts->firstWhere('index', $script['index']);
+        $oldScript = $initScripts->firstWhere('filename', $originalFilename);
 
-        if ($existingScript && $existingScript['index'] !== $script['index']) {
+        if ($existingScript && $script['filename'] !== $originalFilename) {
             $this->dispatch('error', 'A script with this filename already exists.');
 
             return;
@@ -285,11 +286,10 @@ class General extends Component
             }
         }
 
-        $index = $initScripts->search(function ($item) use ($script) {
-            return $item['index'] === $script['index'];
-        });
+        $index = $initScripts->search(fn ($item) => $item['filename'] === $originalFilename);
 
         if ($index !== false) {
+            $script['index'] = $oldScript['index'];
             $initScripts[$index] = $script;
         } else {
             $initScripts->push($script);
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index d431b15064..7c6313c8da 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -127,7 +127,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -235,6 +235,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Edit.php b/app/Livewire/Project/Edit.php
index 91b0444f51..0d42c71e94 100644
--- a/app/Livewire/Project/Edit.php
+++ b/app/Livewire/Project/Edit.php
@@ -77,7 +77,7 @@ class Edit extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/EnvironmentEdit.php b/app/Livewire/Project/EnvironmentEdit.php
index 9b9a3670db..35db3167d3 100644
--- a/app/Livewire/Project/EnvironmentEdit.php
+++ b/app/Livewire/Project/EnvironmentEdit.php
@@ -48,7 +48,7 @@ class EnvironmentEdit extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Index.php b/app/Livewire/Project/Index.php
index 2b472a1a20..f43b7542e6 100644
--- a/app/Livewire/Project/Index.php
+++ b/app/Livewire/Project/Index.php
@@ -53,10 +53,7 @@ class Index extends Component
                     'uuid' => $project->uuid,
                     'name' => $project->name,
                     'description' => $project->description,
-                    'iconUrl' => $project->icon_path ? route('project.icon', [
-                        'project_uuid' => $project->uuid,
-                        'v' => $project->updated_at->timestamp,
-                    ]) : null,
+                    'iconUrl' => $project->icon_path ? project_icon_url($project) : null,
                     'href' => $project->navigateTo(),
                     'environmentCount' => $project->environments->count(),
                     'resourceCount' => $resourceCount,
diff --git a/app/Livewire/Project/New/Select.php b/app/Livewire/Project/New/Select.php
index 4cffff8001..ba03041e2b 100644
--- a/app/Livewire/Project/New/Select.php
+++ b/app/Livewire/Project/New/Select.php
@@ -111,38 +111,14 @@ class Select extends Component
         $templateLastUpdatedMap = $this->serviceTemplateLastUpdatedMap($services);
 
         $services = collect($services)->map(function ($service, $key) use ($templateLastUpdatedMap) {
-            $default_logo = 'svgs/default.webp';
-            $logo = data_get($service, 'logo');
-
-            if (is_string($logo) && str_starts_with($logo, 'svg/')) {
-                $normalizedLogo = 'svgs/'.str($logo)->after('svg/');
-                if (file_exists(public_path($normalizedLogo))) {
-                    $logo = $normalizedLogo;
-                }
-            }
-
-            $hasLogo = is_string($logo)
-                && basename($logo) !== basename($default_logo)
-                && file_exists(public_path($logo));
-
-            if (! $hasLogo) {
-                $logo = $default_logo;
-            }
-
-            $local_logo_path = public_path($logo);
             $serviceKey = (string) $key;
 
             return [
                 'id' => $serviceKey,
                 'name' => str($serviceKey)->headline(),
                 'docsSlug' => str($serviceKey)->lower()->value(),
-                'has_logo' => $hasLogo,
-                'logo' => asset($logo),
-                'logo_github_url' => file_exists($local_logo_path)
-                    ? 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo
-                    : asset($default_logo),
                 'templateLastUpdated' => $templateLastUpdatedMap[$serviceKey] ?? null,
-            ] + (array) $service;
+            ] + service_logo_urls(data_get($service, 'logo')) + (array) $service;
         })->all();
 
         // Extract unique categories from services
diff --git a/app/Livewire/Project/Resource/Index.php b/app/Livewire/Project/Resource/Index.php
index 93633246a8..7c375d0e03 100644
--- a/app/Livewire/Project/Resource/Index.php
+++ b/app/Livewire/Project/Resource/Index.php
@@ -187,6 +187,11 @@ class Index extends Component
             'fqdn' => $item->fqdn ?? null,
             'description' => $item->description ?? null,
             'status' => $item->status ?? '',
+            'restartLimitReached' => method_exists($item, 'stoppedAfterRestartLimit') && $item->stoppedAfterRestartLimit(),
+            'restartCount' => method_exists($item, 'stoppedAfterRestartLimit') && $item->stoppedAfterRestartLimit()
+                ? max($item->restart_count ?? 0, $item->max_restart_count ?? 0)
+                : ($item->restart_count ?? 0),
+            'maxRestartCount' => $item->max_restart_count ?? 0,
             'server_status' => $item->server_status ?? null,
             'hrefLink' => $item->hrefLink ?? '',
             'destination' => [
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
new file mode 100644
index 0000000000..87f24fb1da
--- /dev/null
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -0,0 +1,124 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+
+class BackupExecutions extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public bool $executionModalOpen = false;
+
+    public ?array $selectedExecution = null;
+
+    public function getListeners(): array
+    {
+        $teamId = currentTeam()->id;
+
+        return [
+            'modalClosed' => 'closeExecutionModal',
+            "echo-private:team.{$teamId},BackupCreated" => '$refresh',
+        ];
+    }
+
+    public function mount(Service $service): void
+    {
+        abort_unless($service->environment?->project?->team_id === currentTeam()->id, 404);
+        $this->service = $service;
+        $this->authorize('view', $this->service);
+    }
+
+    public function openExecution(string $executionUuid): void
+    {
+        $this->selectedExecution = $this->executions()->firstWhere('uuid', $executionUuid);
+        abort_unless($this->selectedExecution, 404);
+        $this->executionModalOpen = true;
+    }
+
+    public function closeExecutionModal(): void
+    {
+        $this->executionModalOpen = false;
+        $this->selectedExecution = null;
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.backup-executions', [
+            'executions' => $this->executions(),
+        ]);
+    }
+
+    private function executions(): Collection
+    {
+        $databaseScheduleIds = ScheduledDatabaseBackup::query()
+            ->where('database_type', (new ServiceDatabase)->getMorphClass())
+            ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
+            ->pluck('id');
+
+        $databaseExecutions = ScheduledDatabaseBackupExecution::query()
+            ->with('scheduledDatabaseBackup.database')
+            ->whereIn('scheduled_database_backup_id', $databaseScheduleIds)
+            ->latest()
+            ->limit(100)
+            ->get()
+            ->map(fn (ScheduledDatabaseBackupExecution $execution): array => [
+                'id' => 'database:'.$execution->id,
+                'uuid' => $execution->uuid,
+                'target' => $execution->scheduledDatabaseBackup->database->human_name ?: $execution->scheduledDatabaseBackup->database->name,
+                'type' => 'Database',
+                'schedule' => $execution->scheduledDatabaseBackup->frequency,
+                'status' => $execution->status,
+                'started_at' => $execution->created_at,
+                'size' => $execution->size,
+                'message' => $execution->message,
+                'filename' => $execution->filename,
+                'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                    ? route('download.backup', $execution->id)
+                    : null,
+            ]);
+
+        $volumeSchedules = ScheduledVolumeBackup::query()
+            ->with('backupable.resource')
+            ->forService($this->service)
+            ->get()
+            ->keyBy('id');
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->whereIn('scheduled_volume_backup_id', $volumeSchedules->keys())
+            ->latest()
+            ->limit(100)
+            ->get()
+            ->map(function (ScheduledVolumeBackupExecution $execution) use ($volumeSchedules): array {
+                $schedule = $volumeSchedules->get($execution->scheduled_volume_backup_id);
+
+                return [
+                    'id' => 'storage:'.$execution->id,
+                    'uuid' => $execution->uuid,
+                    'target' => $schedule->targetName(),
+                    'type' => $schedule->targetType(),
+                    'schedule' => $schedule->frequency,
+                    'status' => $execution->status,
+                    'started_at' => $execution->created_at,
+                    'size' => $execution->size,
+                    'message' => $execution->message,
+                    'filename' => $execution->filename,
+                    'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                        ? route('download.volume-backup', $execution->id)
+                        : null,
+                ];
+            });
+
+        return $databaseExecutions->concat($volumeExecutions)->sortByDesc('started_at')->values();
+    }
+}
diff --git a/app/Livewire/Project/Service/DatabaseBackups.php b/app/Livewire/Project/Service/DatabaseBackups.php
index 90907abc6e..8535584dd8 100644
--- a/app/Livewire/Project/Service/DatabaseBackups.php
+++ b/app/Livewire/Project/Service/DatabaseBackups.php
@@ -22,8 +22,6 @@ class DatabaseBackups extends Component
 
     public array $query;
 
-    public bool $isImportSupported = false;
-
     public ?ScheduledDatabaseBackup $backup = null;
 
     public string $section = 'index';
@@ -32,7 +30,7 @@ class DatabaseBackups extends Component
 
     protected $listeners = ['refreshScheduledBackups' => '$refresh'];
 
-    public function mount()
+    public function mount(): mixed
     {
         try {
             $this->parameters = array_filter(
@@ -67,10 +65,13 @@ class DatabaseBackups extends Component
                 return redirect()->route('project.service.index', $this->parameters);
             }
 
-            // Check if import is supported for this database type
-            $dbType = $this->serviceDatabase->databaseType();
-            $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
-            $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
+            if (! request()->route('backup_uuid')) {
+                return redirect()->route('project.service.volume-backups.index', [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'service_uuid' => $this->parameters['service_uuid'],
+                ]);
+            }
 
             if (request()->route('backup_uuid')) {
                 $this->backup = $this->serviceDatabase->scheduledBackups()
@@ -85,6 +86,14 @@ class DatabaseBackups extends Component
                     'project.service.database.backup.danger' => 'danger',
                     default => 'general',
                 };
+
+                $routeParameters = [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'service_uuid' => $this->parameters['service_uuid'],
+                ];
+
+                return redirect()->route('project.service.volume-backups.index', $routeParameters);
             }
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index d932e76494..d5254e093a 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -9,6 +9,7 @@ use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -306,30 +307,15 @@ class Domains extends Component
     {
         $entry = $stored[$url] ?? null;
         $displayName = $app->human_name ?: $app->name;
+        $port = $this->effectiveDomainInternalPort($url, $app);
 
-        if (is_array($entry) && filled(data_get($entry, 'status'))) {
-            return [
-                'service_application_id' => $app->id,
-                'service_name' => $displayName,
-                'service_image' => $app->image,
-                'url' => $url,
-                'dns_status' => (string) data_get($entry, 'status', 'pending'),
-                'dns_message' => (string) data_get($entry, 'message', 'Not checked yet.'),
-                'expected_ip' => data_get($entry, 'expected_ip') ?: $this->serverIp,
-                'checked_at' => data_get($entry, 'checked_at'),
-                'check_id' => data_get($entry, 'check_id'),
-                'is_suggested' => false,
-                'suggested_for' => null,
-                'suggestion_label' => null,
-                'needs_force_add' => false,
-            ];
-        }
-
-        return [
+        $row = [
             'service_application_id' => $app->id,
             'service_name' => $displayName,
             'service_image' => $app->image,
             'url' => $url,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => 'pending',
             'dns_message' => 'Not checked yet.',
             'expected_ip' => $this->serverIp,
@@ -340,6 +326,48 @@ class Domains extends Component
             'suggestion_label' => null,
             'needs_force_add' => false,
         ];
+
+        if (is_array($entry) && filled(data_get($entry, 'status'))) {
+            $row['dns_status'] = (string) data_get($entry, 'status', 'pending');
+            $row['dns_message'] = (string) data_get($entry, 'message', 'Not checked yet.');
+            $row['expected_ip'] = data_get($entry, 'expected_ip') ?: $this->serverIp;
+            $row['checked_at'] = data_get($entry, 'checked_at');
+            $row['check_id'] = data_get($entry, 'check_id');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    protected function effectiveDomainInternalPort(string $url, ServiceApplication $app): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $app->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+
+        if (array_key_exists($canonical, $overrides)) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null && $legacyPort > 0) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        $requiredPort = $app->getRequiredPort();
+
+        return [
+            'internal_port' => ($requiredPort !== null && $requiredPort > 0) ? $requiredPort : null,
+            'has_port_override' => false,
+        ];
     }
 
     /**
@@ -990,8 +1018,11 @@ class Domains extends Component
                     ->all()
                 : [];
             $current = collect($this->splitDomains($app->fqdn));
+            $currentCanonicalDomains = $current->map(
+                fn (string $url): string => DomainPortOverrides::withoutPort($url)
+            );
             foreach ($newUrls as $url) {
-                if ($current->contains($url)) {
+                if ($currentCanonicalDomains->contains(DomainPortOverrides::withoutPort($url))) {
                     $this->addError('newDomain', "Domain {$url} is already configured for this service.");
 
                     return;
@@ -1111,6 +1142,12 @@ class Domains extends Component
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $app = $this->findServiceApp((int) $this->domainRows[$index]['service_application_id']);
+        $canonical = DomainPortOverrides::withoutPort($this->editingDomain);
+        $savedPort = ($app?->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = (int) $this->domainRows[$index]['service_application_id'];
         $this->editDomainDnsFailed = false;
@@ -1144,7 +1181,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->editingDomainPartsChanged) {
+            if ($this->editingDomainPartsChanged || filled($this->editingDomainParts['host'] ?? null)) {
                 $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
             }
             $this->validateOnly('editingDomain');
@@ -1166,7 +1203,17 @@ class Domains extends Component
             $current = collect($this->splitDomains($app->fqdn));
             $wasNoindexed = $app->isDomainNoindexed($oldUrl);
 
-            if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
+            if (blank(DomainUrlParts::split($newUrl)['port'] ?? null)) {
+                $portOverrides = $app->domain_port_overrides ?? [];
+                unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+                unset($portOverrides[DomainPortOverrides::withoutPort($newUrl)]);
+                $app->domain_port_overrides = $portOverrides ?: null;
+            }
+
+            $otherCanonicalDomains = $current
+                ->reject(fn (string $url): bool => $url === $oldUrl)
+                ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url));
+            if ($otherCanonicalDomains->contains(DomainPortOverrides::withoutPort($newUrl))) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured for this service.");
 
                 return;
@@ -1243,6 +1290,28 @@ class Domains extends Component
         }
     }
 
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => ! ($row['is_suggested'] ?? false)
+                && hash_equals($domainKey, $this->domainRowKey($row))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    /**
+     * @param  array{url: string, service_application_id: int|string}  $row
+     */
+    private function domainRowKey(array $row): string
+    {
+        return hash('sha256', $row['url'].'|'.$row['service_application_id']);
+    }
+
     public function addSuggestedDomain(int $index): void
     {
         try {
@@ -1376,8 +1445,9 @@ class Domains extends Component
         if (! $this->forceRemovePort) {
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null && $domainString) {
+                $previousFqdn = $app->getOriginal('fqdn');
                 foreach ($this->splitDomains($domainString) as $fqdn) {
-                    if (ServiceApplication::extractPortFromUrl($fqdn) === null) {
+                    if ($app->portRequiresConfirmation($fqdn, $requiredPort, is_string($previousFqdn) ? $previousFqdn : null)) {
                         $this->requiredPort = $requiredPort;
                         $this->showPortWarningModal = true;
                         $app->refresh();
@@ -1425,6 +1495,7 @@ class Domains extends Component
         $urlSet = array_fill_keys($urls, true);
         $server = $this->service->server;
         $skipDns = ! $this->dnsValidationEnabled || ! $server;
+        $indexesToCheck = [];
 
         foreach ($this->domainRows as $index => $row) {
             $url = $row['url'] ?? null;
diff --git a/app/Livewire/Project/Service/EditCompose.php b/app/Livewire/Project/Service/EditCompose.php
index 46a8ecdc89..2feafe41a2 100644
--- a/app/Livewire/Project/Service/EditCompose.php
+++ b/app/Livewire/Project/Service/EditCompose.php
@@ -78,7 +78,7 @@ class EditCompose extends Component
         try {
             $this->authorize('update', $this->service);
             $this->dispatch('saveCompose', $this->dockerComposeRaw);
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Service/EditDomain.php b/app/Livewire/Project/Service/EditDomain.php
index 96fe6a62c3..f099891534 100644
--- a/app/Livewire/Project/Service/EditDomain.php
+++ b/app/Livewire/Project/Service/EditDomain.php
@@ -46,18 +46,18 @@ class EditDomain extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
 
             // Sync to model
-            $this->application->fqdn = $this->fqdn;
+            $this->application->setEditableUrls($this->fqdn);
 
             $this->application->save();
         } else {
             // Sync from model
-            $this->fqdn = $this->application->fqdn;
+            $this->fqdn = $this->application->url;
         }
     }
 
@@ -84,6 +84,10 @@ class EditDomain extends Component
     public function submit()
     {
         try {
+            $persistedApplication = $this->application->fresh();
+            $previousEditableUrls = $persistedApplication->url;
+            $previousFqdn = $persistedApplication->fqdn;
+            $previousPortOverrides = $persistedApplication->domain_port_overrides;
             $this->authorize('update', $this->application);
             $this->validate();
 
@@ -93,7 +97,7 @@ class EditDomain extends Component
                 $this->dispatch('warning', __('warning.sslipdomain'));
             }
             // Sync to model for domain conflict check (without validation)
-            $this->application->fqdn = $this->fqdn;
+            $this->application->setEditableUrls($this->fqdn);
             // Check for domain conflicts if not forcing save
             if (! $this->forceSaveDomains) {
                 $result = checkDomainUsage(resource: $this->application);
@@ -113,29 +117,21 @@ class EditDomain extends Component
                 $requiredPort = $this->application->getRequiredPort();
 
                 if ($requiredPort !== null) {
-                    // Check if all FQDNs have a port
-                    $fqdns = str($this->fqdn)->trim()->explode(',');
-                    $missingPort = false;
-
-                    foreach ($fqdns as $fqdn) {
-                        $fqdn = trim($fqdn);
-                        if (empty($fqdn)) {
+                    foreach (str($this->fqdn)->trim()->explode(',') as $fqdn) {
+                        $fqdn = trim((string) $fqdn);
+                        if ($fqdn === '') {
                             continue;
                         }
 
-                        $port = ServiceApplication::extractPortFromUrl($fqdn);
-                        if ($port === null) {
-                            $missingPort = true;
-                            break;
+                        if ($this->application->portRequiresConfirmation($fqdn, $requiredPort, $previousEditableUrls)) {
+                            $this->requiredPort = $requiredPort;
+                            $this->showPortWarningModal = true;
+                            $this->application->fqdn = $previousFqdn;
+                            $this->application->domain_port_overrides = $previousPortOverrides;
+
+                            return;
                         }
                     }
-
-                    if ($missingPort) {
-                        $this->requiredPort = $requiredPort;
-                        $this->showPortWarningModal = true;
-
-                        return;
-                    }
                 }
             } else {
                 // Reset the force flag after using it
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 84a0daec8a..d6ab2ac151 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -120,7 +120,7 @@ class FileStorage extends Component
             : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             if ($this->fileStorage->is_too_large) {
@@ -160,7 +160,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -179,7 +179,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -207,7 +207,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -242,7 +242,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
 
         return true;
diff --git a/app/Livewire/Project/Service/Heading.php b/app/Livewire/Project/Service/Heading.php
index 072a56e002..d692a71546 100644
--- a/app/Livewire/Project/Service/Heading.php
+++ b/app/Livewire/Project/Service/Heading.php
@@ -5,8 +5,11 @@ namespace App\Livewire\Project\Service;
 use App\Actions\Docker\GetContainersStatus;
 use App\Actions\Service\StartService;
 use App\Actions\Service\StopService;
+use App\Actions\Service\StopServiceApplication;
 use App\Enums\ProcessStatus;
 use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
@@ -172,6 +175,29 @@ class Heading extends Component
         }
     }
 
+    public function removeSelectedResourceContainer(): void
+    {
+        $resource = $this->selectedResource();
+        if (! $resource) {
+            return;
+        }
+
+        $this->authorize('update', $resource);
+        StopServiceApplication::run($resource, true, true);
+        $this->dispatch('success', 'Container removed.');
+    }
+
+    private function selectedResource(): ServiceApplication|ServiceDatabase|null
+    {
+        $uuid = data_get($this->parameters, 'stack_service_uuid');
+        if (! $uuid) {
+            return null;
+        }
+
+        return $this->service->applications()->whereUuid($uuid)->first()
+            ?? $this->service->databases()->whereUuid($uuid)->first();
+    }
+
     public function pullAndRestartEvent()
     {
         try {
diff --git a/app/Livewire/Project/Service/ImportBackup.php b/app/Livewire/Project/Service/ImportBackup.php
new file mode 100644
index 0000000000..29e8d9f359
--- /dev/null
+++ b/app/Livewire/Project/Service/ImportBackup.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+
+class ImportBackup extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public Collection $databases;
+
+    public ?ServiceDatabase $selectedDatabase = null;
+
+    public string $selectedDatabaseUuid = '';
+
+    public array $parameters;
+
+    public function mount(): mixed
+    {
+        $this->parameters = get_route_parameters();
+        $project = currentTeam()->projects()->whereUuid($this->parameters['project_uuid'])->firstOrFail();
+        $environment = $project->environments()->whereUuid($this->parameters['environment_uuid'])->firstOrFail();
+        $this->service = $environment->services()->whereUuid($this->parameters['service_uuid'])->firstOrFail();
+        $this->authorize('update', $this->service);
+
+        $this->databases = $this->service->databases
+            ->filter(fn (ServiceDatabase $database): bool => $this->supportsImport($database))
+            ->values();
+
+        $databaseUuid = request()->route('stack_service_uuid');
+        if ($databaseUuid) {
+            $selectedDatabase = $this->databases->firstWhere('uuid', $databaseUuid);
+            abort_unless($selectedDatabase instanceof ServiceDatabase, 404);
+            $this->authorize('update', $selectedDatabase);
+            $this->selectedDatabase = $selectedDatabase;
+            $this->selectedDatabaseUuid = $selectedDatabase->uuid;
+
+            if (request()->routeIs('project.service.database.import')) {
+                return redirect()->route('project.service.import-backup.database', $this->parameters);
+            }
+        } elseif ($this->databases->count() === 1) {
+            return redirect()->route('project.service.import-backup.database', [
+                ...$this->parameters,
+                'stack_service_uuid' => $this->databases->first()->uuid,
+            ]);
+        }
+
+        return null;
+    }
+
+    public function updatedSelectedDatabaseUuid(): mixed
+    {
+        $database = $this->databases->firstWhere('uuid', $this->selectedDatabaseUuid);
+        abort_unless($database instanceof ServiceDatabase, 404);
+        $this->authorize('update', $database);
+
+        return redirect()->route('project.service.import-backup.database', [
+            ...$this->parameters,
+            'stack_service_uuid' => $database->uuid,
+        ]);
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.import-backup');
+    }
+
+    private function supportsImport(ServiceDatabase $database): bool
+    {
+        return str($database->databaseType())->contains(['mysql', 'mariadb', 'postgres', 'mongo']);
+    }
+}
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index d93ed7c026..7980e07056 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -59,8 +59,6 @@ class Index extends Component
 
     public bool $isLogDrainEnabled = false;
 
-    public bool $isImportSupported = false;
-
     // Application-specific properties
     public $docker_cleanup = true;
 
@@ -101,10 +99,27 @@ class Index extends Component
         'isStripprefixEnabled' => 'nullable|boolean',
     ];
 
-    public function mount()
+    public function mount(?ServiceApplication $serviceApplication = null)
     {
         try {
             $this->services = collect([]);
+            if ($serviceApplication) {
+                $this->service = $serviceApplication->service;
+                $this->authorize('view', $this->service);
+                $this->parameters = [
+                    'project_uuid' => $this->service->environment->project->uuid,
+                    'environment_uuid' => $this->service->environment->uuid,
+                    'service_uuid' => $this->service->uuid,
+                    'stack_service_uuid' => $serviceApplication->uuid,
+                ];
+                $this->query = request()->query();
+                $this->serviceApplication = $serviceApplication;
+                $this->resourceType = 'application';
+                $this->initializeApplicationProperties();
+                $this->s3s = currentTeam()->s3s;
+
+                return;
+            }
             $this->parameters = get_route_parameters();
             $this->query = request()->query();
             $this->currentRoute = request()->route()->getName();
@@ -153,10 +168,6 @@ class Index extends Component
         $this->refreshFileStorages();
         $this->syncDatabaseData(false);
 
-        // Check if import is supported for this database type
-        $dbType = $this->serviceDatabase->databaseType();
-        $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
-        $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
     }
 
     private function syncDatabaseData(bool $toModel = false): void
@@ -356,7 +367,7 @@ class Index extends Component
         if ($toModel) {
             $this->serviceApplication->human_name = $this->humanName;
             $this->serviceApplication->description = $this->description;
-            $this->serviceApplication->fqdn = $this->fqdn;
+            $this->serviceApplication->setEditableUrls($this->fqdn);
             $this->serviceApplication->image = $this->image;
             $this->serviceApplication->exclude_from_status = $this->excludeFromStatus;
             $this->serviceApplication->is_log_drain_enabled = $this->isLogDrainEnabled;
@@ -365,7 +376,7 @@ class Index extends Component
         } else {
             $this->humanName = $this->serviceApplication->human_name;
             $this->description = $this->serviceApplication->description;
-            $this->fqdn = $this->serviceApplication->fqdn;
+            $this->fqdn = $this->serviceApplication->url;
             $this->image = $this->serviceApplication->image;
             $this->excludeFromStatus = data_get($this->serviceApplication, 'exclude_from_status', false);
             $this->isLogDrainEnabled = data_get($this->serviceApplication, 'is_log_drain_enabled', false);
@@ -428,7 +439,7 @@ class Index extends Component
             $this->serviceApplication->delete();
             $this->dispatch('success', 'Application deleted.');
 
-            return redirect()->route('project.service.configuration', $this->parameters);
+            return redirectRoute($this, 'project.service.configuration', $this->parameters);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -462,7 +473,7 @@ class Index extends Component
                 $serviceApplication->delete();
             });
 
-            return redirect()->route('project.service.configuration', $redirectParams);
+            return redirectRoute($this, 'project.service.configuration', $redirectParams);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -491,6 +502,10 @@ class Index extends Component
     public function submitApplication()
     {
         try {
+            $persistedApplication = $this->serviceApplication->fresh();
+            $previousEditableUrls = $persistedApplication->url;
+            $previousFqdn = $persistedApplication->fqdn;
+            $previousPortOverrides = $persistedApplication->domain_port_overrides;
             $this->authorize('update', $this->serviceApplication);
             $this->validate([
                 'fqdn' => ValidationPatterns::applicationDomainRules(),
@@ -520,28 +535,21 @@ class Index extends Component
                 $requiredPort = $this->serviceApplication->getRequiredPort();
 
                 if ($requiredPort !== null) {
-                    $fqdns = str($this->fqdn)->trim()->explode(',');
-                    $missingPort = false;
-
-                    foreach ($fqdns as $fqdn) {
-                        $fqdn = trim($fqdn);
-                        if (empty($fqdn)) {
+                    foreach (str($this->fqdn)->trim()->explode(',') as $fqdn) {
+                        $fqdn = trim((string) $fqdn);
+                        if ($fqdn === '') {
                             continue;
                         }
 
-                        $port = ServiceApplication::extractPortFromUrl($fqdn);
-                        if ($port === null) {
-                            $missingPort = true;
-                            break;
+                        if ($this->serviceApplication->portRequiresConfirmation($fqdn, $requiredPort, $previousEditableUrls)) {
+                            $this->requiredPort = $requiredPort;
+                            $this->showPortWarningModal = true;
+                            $this->serviceApplication->fqdn = $previousFqdn;
+                            $this->serviceApplication->domain_port_overrides = $previousPortOverrides;
+
+                            return;
                         }
                     }
-
-                    if ($missingPort) {
-                        $this->requiredPort = $requiredPort;
-                        $this->showPortWarningModal = true;
-
-                        return;
-                    }
                 }
             } else {
                 $this->forceRemovePort = false;
diff --git a/app/Livewire/Project/Service/Status.php b/app/Livewire/Project/Service/Status.php
index 192d7ca804..27919f1ae7 100644
--- a/app/Livewire/Project/Service/Status.php
+++ b/app/Livewire/Project/Service/Status.php
@@ -10,6 +10,13 @@ class Status extends Component
 {
     public Service $service;
 
+    public ?string $selectedResourceUuid = null;
+
+    public function mount(): void
+    {
+        $this->selectedResourceUuid = request()->route('stack_service_uuid');
+    }
+
     public function getListeners(): array
     {
         $teamId = auth()->user()->currentTeam()->id;
@@ -27,6 +34,11 @@ class Status extends Component
 
     public function render(): View
     {
-        return view('livewire.project.service.status');
+        $selectedResource = $this->selectedResourceUuid
+            ? $this->service->applications->firstWhere('uuid', $this->selectedResourceUuid)
+                ?? $this->service->databases->firstWhere('uuid', $this->selectedResourceUuid)
+            : null;
+
+        return view('livewire.project.service.status', compact('selectedResource'));
     }
 }
diff --git a/app/Livewire/Project/Service/Storage.php b/app/Livewire/Project/Service/Storage.php
index 6880b5ab09..10079276f2 100644
--- a/app/Livewire/Project/Service/Storage.php
+++ b/app/Livewire/Project/Service/Storage.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Service;
 
+use App\Livewire\Project\Shared\Storages\All as StorageList;
 use App\Models\Application;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
@@ -51,7 +52,7 @@ class Storage extends Component
 
         return [
             "echo-private:team.{$teamId},FileStorageChanged" => 'refreshStoragesFromEvent',
-            'refreshStorages',
+            'storageCountsChanged' => 'refreshStorages',
             'addNewVolume',
         ];
     }
@@ -88,11 +89,17 @@ class Storage extends Component
 
     public function refreshStorages()
     {
+        $hadVolumes = $this->cachedVolumeCount > 0;
+
         // Avoid loading full volume models onto this parent (child All owns that snapshot).
         $this->resource->unsetRelation('persistentStorages');
         $this->loadVolumeCount();
         $this->loadFileStorageMetaCounts();
         $this->loadFileStorageForActiveTab();
+
+        if ($this->activeTab === 'volumes' && $hadVolumes && $this->cachedVolumeCount > 0) {
+            $this->dispatch('refreshVolumeList')->to(StorageList::class);
+        }
     }
 
     public function setActiveTab(string $tab): void
@@ -222,7 +229,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Volume added successfully');
             $this->dispatch('closeStorageModal', 'volume');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -257,7 +263,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'File mount added successfully');
             $this->dispatch('closeStorageModal', 'file');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -292,7 +297,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Host file mount added successfully');
             $this->dispatch('closeStorageModal', 'host-file');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -331,7 +335,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Directory mount added successfully');
             $this->dispatch('closeStorageModal', 'directory');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index 49da9e21f4..e856d1373a 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -2,11 +2,14 @@
 
 namespace App\Livewire\Project\Service\VolumeBackup;
 
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledVolumeBackup;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -20,14 +23,70 @@ class Index extends Component
 
     public string $search = '';
 
-    protected $listeners = ['refreshVolumeBackups' => '$refresh'];
+    public bool $scheduleModalOpen = false;
 
-    public function mount(): void
+    public ?ScheduledDatabaseBackup $selectedDatabaseBackup = null;
+
+    public ?ScheduledVolumeBackup $selectedVolumeBackup = null;
+
+    public ?Collection $s3s = null;
+
+    public function getListeners(): array
     {
-        $this->service = $this->findService();
+        $teamId = currentTeam()->id;
+
+        return [
+            'refreshVolumeBackups' => '$refresh',
+            'modalClosed' => 'closeScheduleModal',
+            "echo-private:team.{$teamId},BackupCreated" => '$refresh',
+        ];
+    }
+
+    public function mount(?Service $service = null): void
+    {
+        $this->service = $service ?? $this->findService();
         $this->authorize('view', $this->service);
         $this->parameters = get_route_parameters();
         $this->search = request()->string('search')->toString();
+
+    }
+
+    public function openSchedule(string $backupUuid): void
+    {
+        $this->loadSelectedSchedule($backupUuid);
+        $this->s3s = currentTeam()->s3s;
+        $this->scheduleModalOpen = true;
+    }
+
+    public function closeScheduleModal(): void
+    {
+        $this->scheduleModalOpen = false;
+        $this->selectedDatabaseBackup = null;
+        $this->selectedVolumeBackup = null;
+    }
+
+    public function backupNow(string $type, string $backupUuid): void
+    {
+        try {
+            if ($type === 'database') {
+                $this->loadSelectedSchedule($backupUuid);
+                abort_unless($this->selectedDatabaseBackup, 404);
+                $this->authorize('manageBackups', $this->selectedDatabaseBackup->database);
+                DatabaseBackupJob::dispatch($this->selectedDatabaseBackup);
+            } else {
+                abort_unless($type === 'storage', 404);
+                $this->loadSelectedSchedule($backupUuid);
+                abort_unless($this->selectedVolumeBackup, 404);
+                $this->authorize('update', $this->selectedVolumeBackup->targetResource());
+                VolumeBackupJob::dispatch($this->selectedVolumeBackup);
+            }
+
+            $this->selectedDatabaseBackup = null;
+            $this->selectedVolumeBackup = null;
+            $this->dispatch('success', 'Backup queued.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function render(): View
@@ -68,4 +127,24 @@ class Index extends Component
             ->where('uuid', request()->route('service_uuid'))
             ->firstOrFail();
     }
+
+    private function loadSelectedSchedule(string $backupUuid): void
+    {
+        $this->selectedDatabaseBackup = ScheduledDatabaseBackup::query()
+            ->with('database')
+            ->whereUuid($backupUuid)
+            ->where('database_type', (new ServiceDatabase)->getMorphClass())
+            ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
+            ->first();
+
+        if ($this->selectedDatabaseBackup) {
+            return;
+        }
+
+        $this->selectedVolumeBackup = ScheduledVolumeBackup::query()
+            ->with('backupable.resource')
+            ->whereUuid($backupUuid)
+            ->forService($this->service)
+            ->firstOrFail();
+    }
 }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Show.php b/app/Livewire/Project/Service/VolumeBackup/Show.php
index eec60497f7..10abeb3bf4 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Show.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Show.php
@@ -20,7 +20,7 @@ class Show extends Component
 
     public string $section = 'general';
 
-    public function mount(): void
+    public function mount(): mixed
     {
         $project = currentTeam()->projects()->where('uuid', request()->route('project_uuid'))->firstOrFail();
         $environment = $project->environments()->where('uuid', request()->route('environment_uuid'))->firstOrFail();
@@ -43,6 +43,10 @@ class Show extends Component
             'project.service.volume-backups.danger' => 'danger',
             default => 'general',
         };
+
+        $routeParameters = collect($this->parameters)->except('backup_uuid')->all();
+
+        return redirect()->route('project.service.volume-backups.index', $routeParameters);
     }
 
     public function render(): View
diff --git a/app/Livewire/Project/Shared/Danger.php b/app/Livewire/Project/Shared/Danger.php
index 7f0d3b173e..d2420a029f 100644
--- a/app/Livewire/Project/Shared/Danger.php
+++ b/app/Livewire/Project/Shared/Danger.php
@@ -106,14 +106,13 @@ class Danger extends Component
 
         try {
             $this->authorize('delete', $this->resource);
-            $this->resource->delete();
             DeleteResourceJob::dispatch(
                 $this->resource,
                 $this->delete_volumes,
                 $this->delete_connected_networks,
                 $this->delete_configurations,
                 $this->docker_cleanup
-            );
+            )->afterResponse();
 
             return redirectRoute($this, 'project.resource.index', [
                 'project_uuid' => $this->projectUuid,
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 4b68c4d8f1..fea181395c 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -152,6 +152,8 @@ class Show extends Component
      */
     public function loadValues(): void
     {
+        $this->authorize('update', $this->env);
+
         if ($this->valuesLoaded) {
             return;
         }
@@ -185,7 +187,8 @@ class Show extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
+
     {
         if ($toModel) {
             $this->key = ValidationPatterns::normalizeEnvironmentVariableKey($this->key);
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index 67a040ef77..e1e5413719 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -17,12 +17,15 @@ use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Process;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class GetLogs extends Component
 {
+    use AuthorizesRequests;
+
     public const MAX_LOG_LINES = 50000;
 
     public const MAX_DISPLAY_SIZE_BYTES = 5 * 1024 * 1024;
@@ -82,6 +85,10 @@ class GetLogs extends Component
     public function instantSave()
     {
         if (! is_null($this->resource)) {
+            if (auth()->user()->cannot('update', $this->resource)) {
+                return;
+            }
+
             if ($this->resource->getMorphClass() === Application::class) {
                 $this->resource->settings->is_include_timestamps = $this->showTimeStamps;
                 $this->resource->settings->save();
diff --git a/app/Livewire/Project/Shared/HealthChecks.php b/app/Livewire/Project/Shared/HealthChecks.php
index 6a128a1426..70633fe030 100644
--- a/app/Livewire/Project/Shared/HealthChecks.php
+++ b/app/Livewire/Project/Shared/HealthChecks.php
@@ -86,7 +86,7 @@ class HealthChecks extends Component
         }
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index 61bc6b0fbc..f170a0a6f0 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -102,7 +102,7 @@ class Add extends Component
         }
     }
 
-    public function saveScheduledTask()
+    private function saveScheduledTask(): mixed
     {
         try {
             $task = new ScheduledTask;
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 14777724e5..c121f1b93b 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -87,7 +87,7 @@ class Show extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -169,9 +169,9 @@ class Show extends Component
             $this->task->delete();
 
             if ($this->type === 'application') {
-                return redirect()->route('project.application.scheduled-tasks.show', $this->parameters);
+                return redirectRoute($this, 'project.application.scheduled-tasks.show', $this->parameters);
             } else {
-                return redirect()->route('project.service.scheduled-tasks.show', $this->parameters);
+                return redirectRoute($this, 'project.service.scheduled-tasks.show', $this->parameters);
             }
         } catch (\Exception $e) {
             return handleError($e);
diff --git a/app/Livewire/Project/Shared/Storages/All.php b/app/Livewire/Project/Shared/Storages/All.php
index efe54a6a7d..3dadfb46f4 100644
--- a/app/Livewire/Project/Shared/Storages/All.php
+++ b/app/Livewire/Project/Shared/Storages/All.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared\Storages;
 
+use App\Livewire\Project\Service\Storage as StorageComponent;
 use App\Models\Application;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
@@ -44,7 +45,7 @@ class All extends Component
 
     public bool $deleteDockerVolume = false;
 
-    protected $listeners = ['refreshStorages' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
+    protected $listeners = ['refreshVolumeList' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
 
     public function mount(): void
     {
@@ -182,7 +183,7 @@ class All extends Component
 
         $storage->delete();
         $this->refreshList();
-        $this->dispatch('refreshStorages');
+        $this->dispatch('storageCountsChanged')->to(StorageComponent::class);
         $this->dispatch('configurationChanged');
 
         return true;
diff --git a/app/Livewire/Project/Shared/Storages/Show.php b/app/Livewire/Project/Shared/Storages/Show.php
deleted file mode 100644
index 7e1e2dec1d..0000000000
--- a/app/Livewire/Project/Shared/Storages/Show.php
+++ /dev/null
@@ -1,200 +0,0 @@
-<?php
-
-namespace App\Livewire\Project\Shared\Storages;
-
-use App\Models\Application;
-use App\Models\LocalPersistentVolume;
-use App\Models\ScheduledVolumeBackup;
-use App\Support\ValidationPatterns;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-class Show extends Component
-{
-    use AuthorizesRequests;
-
-    public LocalPersistentVolume $storage;
-
-    public $resource;
-
-    public bool $isReadOnly = false;
-
-    public bool $isFirst = true;
-
-    public bool $isService = false;
-
-    public ?string $startedAt = null;
-
-    public bool $supportsPreviewSuffix = false;
-
-    // Explicit properties
-    public string $name;
-
-    public string $mountPath;
-
-    public ?string $hostPath = null;
-
-    public bool $isPreviewSuffixEnabled = true;
-
-    public bool $hasEnabledBackup = false;
-
-    public ?string $backupUrl = null;
-
-    /**
-     * When true, parent already batched badge/url data — skip per-row queries on mount.
-     */
-    public bool $backupMetaHydrated = false;
-
-    /** When true, the Backup Configure Livewire modal is mounted (lazy). */
-    public bool $showBackupModal = false;
-
-    protected $validationAttributes = [
-        'name' => 'name',
-        'mountPath' => 'mount',
-        'hostPath' => 'host',
-    ];
-
-    protected function rules(): array
-    {
-        return [
-            'name' => ValidationPatterns::volumeNameRules(),
-            'mountPath' => ['required', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
-            'hostPath' => ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
-            'isPreviewSuffixEnabled' => 'required|boolean',
-        ];
-    }
-
-    protected function messages(): array
-    {
-        return array_merge(
-            ValidationPatterns::volumeNameMessages(),
-            [
-                'mountPath.regex' => 'Mount path must start with / and only contain safe path characters.',
-                'hostPath.regex' => 'Host path must start with / and only contain safe path characters.',
-            ]
-        );
-    }
-
-    /**
-     * Sync data between component properties and model
-     *
-     * @param  bool  $toModel  If true, sync FROM properties TO model. If false, sync FROM model TO properties.
-     */
-    private function syncData(bool $toModel = false): void
-    {
-        if ($toModel) {
-            // Sync TO model (before save)
-            $this->storage->name = $this->name;
-            $this->storage->mount_path = $this->mountPath;
-            $this->storage->host_path = $this->hostPath;
-            $this->storage->is_preview_suffix_enabled = $this->isPreviewSuffixEnabled;
-        } else {
-            // Sync FROM model (on load/refresh)
-            $this->name = $this->storage->name;
-            $this->mountPath = $this->storage->mount_path;
-            $this->hostPath = $this->storage->host_path;
-            $this->isPreviewSuffixEnabled = $this->storage->is_preview_suffix_enabled ?? true;
-        }
-    }
-
-    public function mount(): void
-    {
-        $this->syncData(false);
-        $this->isReadOnly = $this->storage->shouldBeReadOnlyInUI();
-        // PR deployment volume suffixes only apply to git-based applications.
-        $this->supportsPreviewSuffix = $this->resource instanceof Application
-            && $this->resource->git_based()
-            && filled($this->resource->git_repository)
-            && ! $this->isService;
-        // Parent All batches badge/url; isolated embeds still hydrate themselves.
-        if (! $this->backupMetaHydrated) {
-            $this->refreshBackupStatus();
-        }
-    }
-
-    #[On('refreshVolumeBackups')]
-    public function refreshBackupStatus(): void
-    {
-        $backup = $this->storage->scheduledBackups()->first();
-
-        $this->hasEnabledBackup = $backup?->enabled ?? false;
-        $this->backupUrl = null;
-
-        if (! $this->hasEnabledBackup || ! $this->resource instanceof Application) {
-            return;
-        }
-
-        $this->resource->loadMissing('environment.project');
-
-        $parameters = [
-            'project_uuid' => $this->resource->project()->uuid,
-            'environment_uuid' => $this->resource->environment->uuid,
-            'application_uuid' => $this->resource->uuid,
-        ];
-        $hasOtherBackups = ScheduledVolumeBackup::query()
-            ->forApplication($this->resource)
-            ->where('id', '!=', $backup->id)
-            ->exists();
-
-        $this->backupUrl = $hasOtherBackups
-            ? route('project.application.backup.index', [...$parameters, 'search' => $this->storage->name])
-            : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
-    }
-
-    public function openBackupModal(): void
-    {
-        $this->authorize('update', $this->resource);
-        $this->showBackupModal = true;
-    }
-
-    #[On('modalClosed')]
-    public function onModalClosed(): void
-    {
-        // Drop the nested Create component from the DOM after close to free snapshot weight.
-        if ($this->showBackupModal) {
-            $this->showBackupModal = false;
-        }
-    }
-
-    public function instantSave(): void
-    {
-        $this->authorize('update', $this->resource);
-        $this->validate();
-
-        $this->syncData(true);
-        $this->storage->save();
-        $this->dispatch('success', 'Storage updated successfully');
-    }
-
-    public function submit()
-    {
-        $this->authorize('update', $this->resource);
-
-        $this->validate();
-        $this->syncData(true);
-        $this->storage->save();
-        $this->dispatch('success', 'Storage updated successfully');
-    }
-
-    public function delete($password, $selectedActions = [])
-    {
-        $this->authorize('update', $this->resource);
-
-        if (! verifyPasswordConfirmation($password, $this)) {
-            return 'The provided password is incorrect.';
-        }
-
-        if ($this->storage->scheduledBackups()->exists()) {
-            $this->dispatch('error', 'Delete this volume backup schedule and its archives before deleting the volume.');
-
-            return false;
-        }
-
-        $this->storage->delete();
-        $this->dispatch('refreshStorages');
-        $this->dispatch('configurationChanged');
-
-        return true;
-    }
-}
diff --git a/app/Livewire/Security/CloudInitScripts.php b/app/Livewire/Security/CloudInitScripts.php
index b6d448e903..0d26d1d669 100644
--- a/app/Livewire/Security/CloudInitScripts.php
+++ b/app/Livewire/Security/CloudInitScripts.php
@@ -28,6 +28,8 @@ class CloudInitScripts extends Component
 
     public function loadScripts()
     {
+        $this->authorize('viewAny', CloudInitScript::class);
+
         CloudInitScript::ownedByCurrentTeam()
             ->whereNull('uuid')
             ->get()
diff --git a/app/Livewire/Security/CloudProviderTokenForm.php b/app/Livewire/Security/CloudProviderTokenForm.php
index ba2655b434..2c31d22035 100644
--- a/app/Livewire/Security/CloudProviderTokenForm.php
+++ b/app/Livewire/Security/CloudProviderTokenForm.php
@@ -94,6 +94,7 @@ class CloudProviderTokenForm extends Component
 
     public function addToken()
     {
+        $this->authorize('create', CloudProviderToken::class);
         $this->validate();
 
         try {
diff --git a/app/Livewire/Security/PrivateKey/Index.php b/app/Livewire/Security/PrivateKey/Index.php
index 8b170e6ae0..9a7ff4e979 100644
--- a/app/Livewire/Security/PrivateKey/Index.php
+++ b/app/Livewire/Security/PrivateKey/Index.php
@@ -10,13 +10,38 @@ class Index extends Component
 {
     use AuthorizesRequests;
 
+    public ?string $selectedPrivateKeyUuid = null;
+
     public function getListeners(): array
     {
         return [
             'securityResourceChanged' => '$refresh',
+            'privateKeyCreated' => 'refreshResources',
+            'privateKeyDeleted' => 'refreshResources',
+            'privateKeyUpdated' => 'refreshResources',
+            'modalClosed' => 'closeEditor',
         ];
     }
 
+    public function openEditor(string $privateKeyUuid): void
+    {
+        $privateKey = PrivateKey::ownedByCurrentTeam()->whereUuid($privateKeyUuid)->firstOrFail();
+        $this->authorize('view', $privateKey);
+
+        $this->selectedPrivateKeyUuid = $privateKey->uuid;
+    }
+
+    public function closeEditor(): void
+    {
+        $this->selectedPrivateKeyUuid = null;
+    }
+
+    public function refreshResources(): void
+    {
+        $this->closeEditor();
+        $this->dispatch('close-modal');
+    }
+
     public function generatePrivateKey(string $type)
     {
         try {
diff --git a/app/Livewire/Security/PrivateKey/Show.php b/app/Livewire/Security/PrivateKey/Show.php
index 7fa2300031..1b8f26ff28 100644
--- a/app/Livewire/Security/PrivateKey/Show.php
+++ b/app/Livewire/Security/PrivateKey/Show.php
@@ -76,7 +76,9 @@ class Show extends Component
             // Sync FROM model (on load/refresh)
             $this->name = $this->private_key->name;
             $this->description = $this->private_key->description;
-            $this->privateKeyValue = $this->private_key->private_key;
+            $this->privateKeyValue = auth()->user()->can('update', $this->private_key)
+                ? $this->private_key->private_key
+                : '';
             $this->isGitRelated = $this->private_key->is_git_related;
         }
     }
@@ -92,6 +94,7 @@ class Show extends Component
 
             $this->syncData(false);
             $this->isInUse = $this->private_key->isInUse();
+            $this->public_key = $this->private_key->getPublicKey();
         } catch (AuthorizationException $e) {
             abort(403, 'You do not have permission to view this private key.');
         } catch (\Throwable) {
@@ -99,14 +102,6 @@ class Show extends Component
         }
     }
 
-    public function loadPublicKey()
-    {
-        $this->public_key = $this->private_key->getPublicKey();
-        if ($this->public_key === 'Error loading private key') {
-            $this->dispatch('error', 'Failed to load public key. The private key may be invalid.');
-        }
-    }
-
     public function delete()
     {
         try {
@@ -123,8 +118,7 @@ class Show extends Component
             currentTeam()->privateKeys = PrivateKey::where('team_id', currentTeam()->id)->get();
 
             if ($this->modalMode) {
-                $this->dispatch('securityResourceChanged');
-                $this->dispatch('close-modal');
+                $this->dispatch('privateKeyDeleted');
 
                 return null;
             }
@@ -150,10 +144,12 @@ class Show extends Component
             ]);
             refresh_server_connection($this->private_key);
             $this->dispatch('success', 'Private key updated.');
-            $this->dispatch('securityResourceChanged');
             if ($this->modalMode) {
-                $this->dispatch('close-modal');
+                $this->dispatch('privateKeyUpdated');
+
+                return null;
             }
+            $this->dispatch('securityResourceChanged');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Server/Advanced.php b/app/Livewire/Server/Advanced.php
index a94881b12b..895ce34e79 100644
--- a/app/Livewire/Server/Advanced.php
+++ b/app/Livewire/Server/Advanced.php
@@ -42,10 +42,9 @@ class Advanced extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->concurrent_builds = $this->concurrentBuilds;
             $this->server->settings->dynamic_timeout = $this->dynamicTimeout;
@@ -67,6 +66,7 @@ class Advanced extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
@@ -81,6 +81,7 @@ class Advanced extends Component
                 $this->serverDiskUsageCheckFrequency = $this->server->settings->getOriginal('server_disk_usage_check_frequency');
                 throw new \Exception('Invalid Cron / Human expression for Disk Usage Check Frequency.');
             }
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/DockerCleanup.php b/app/Livewire/Server/DockerCleanup.php
index 24acdecad1..d0a8d8ca9d 100644
--- a/app/Livewire/Server/DockerCleanup.php
+++ b/app/Livewire/Server/DockerCleanup.php
@@ -97,10 +97,9 @@ class DockerCleanup extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->force_docker_cleanup = $this->forceDockerCleanup;
             $this->server->settings->docker_cleanup_frequency = $this->dockerCleanupFrequency;
@@ -122,6 +121,7 @@ class DockerCleanup extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
@@ -154,6 +154,7 @@ class DockerCleanup extends Component
                 $this->dockerCleanupFrequency = $this->server->settings->getOriginal('docker_cleanup_frequency');
                 throw new \Exception('Invalid Cron / Human expression for Docker Cleanup Frequency.');
             }
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/LogDrains.php b/app/Livewire/Server/LogDrains.php
index ae53488bd5..9319c856c0 100644
--- a/app/Livewire/Server/LogDrains.php
+++ b/app/Livewire/Server/LogDrains.php
@@ -52,7 +52,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncDataNewRelic(bool $toModel = false)
+    private function syncDataNewRelic(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_newrelic_enabled = $this->isLogDrainNewRelicEnabled;
@@ -65,7 +65,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncDataAxiom(bool $toModel = false)
+    private function syncDataAxiom(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_axiom_enabled = $this->isLogDrainAxiomEnabled;
@@ -78,7 +78,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncDataCustom(bool $toModel = false)
+    private function syncDataCustom(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_custom_enabled = $this->isLogDrainCustomEnabled;
@@ -91,7 +91,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncData(bool $toModel = false, ?string $type = null)
+    private function syncData(bool $toModel = false, ?string $type = null): void
     {
         if ($toModel) {
             $this->customValidation();
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 811a01eb19..68cb52a926 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -57,6 +57,7 @@ class Proxy extends Component
         $this->redirectUrl = data_get($this->server, 'proxy.redirect_url');
         $this->syncData(false);
         $this->loadProxyConfiguration();
+        $this->clearAppliedTraefikBranchWarning();
     }
 
     private function syncData(bool $toModel = false): void
@@ -276,6 +277,8 @@ class Proxy extends Component
                 return null;
             }
 
+            $configuredBranch = $this->getConfiguredTraefikBranch();
+
             // Check if we have outdated info stored for this server (faster than computing)
             $outdatedInfo = $this->server->traefik_outdated_info;
             $storedCurrentVersion = ltrim((string) data_get($outdatedInfo, 'current'), 'v');
@@ -283,9 +286,15 @@ class Proxy extends Component
             if ($storedCurrentVersion === $detectedCurrentVersion && data_get($outdatedInfo, 'type') === 'minor_upgrade') {
                 // Use the upgrade_target field if available (e.g., "v3.6")
                 if (isset($outdatedInfo['upgrade_target'])) {
-                    return str_starts_with($outdatedInfo['upgrade_target'], 'v')
+                    $upgradeTarget = str_starts_with($outdatedInfo['upgrade_target'], 'v')
                         ? $outdatedInfo['upgrade_target']
                         : "v{$outdatedInfo['upgrade_target']}";
+
+                    if ($configuredBranch && version_compare($configuredBranch, ltrim($upgradeTarget, 'v'), '>=')) {
+                        return null;
+                    }
+
+                    return $upgradeTarget;
                 }
             }
 
@@ -315,9 +324,53 @@ class Proxy extends Component
                 }
             }
 
-            return $newestBranch ? "v{$newestBranch}" : null;
+            if (! $newestBranch || ($configuredBranch && version_compare($configuredBranch, $newestBranch, '>='))) {
+                return null;
+            }
+
+            return "v{$newestBranch}";
         } catch (\Throwable $e) {
             return null;
         }
     }
+
+    private function getConfiguredTraefikBranch(): ?string
+    {
+        if ($this->server->proxy->get('status') !== 'running' || $this->server->hasPendingProxyConfiguration()) {
+            return null;
+        }
+
+        if (! is_string($this->proxySettings)) {
+            return null;
+        }
+
+        if (! preg_match('/^\s*image:\s*[\'\"]?traefik:v?(\d+\.\d+)(?:\.\d+)?[\'\"]?\s*$/mi', $this->proxySettings, $matches)) {
+            return null;
+        }
+
+        return $matches[1];
+    }
+
+    private function clearAppliedTraefikBranchWarning(): void
+    {
+        $outdatedInfo = $this->server->traefik_outdated_info;
+
+        if (data_get($outdatedInfo, 'type') !== 'minor_upgrade') {
+            return;
+        }
+
+        $configuredBranch = $this->getConfiguredTraefikBranch();
+        $upgradeTarget = ltrim((string) data_get($outdatedInfo, 'upgrade_target'), 'v');
+
+        if (! $configuredBranch || ! $upgradeTarget || version_compare($configuredBranch, $upgradeTarget, '<')) {
+            return;
+        }
+
+        Server::query()
+            ->whereKey($this->server->id)
+            ->where('traefik_outdated_info->type', data_get($outdatedInfo, 'type'))
+            ->where('traefik_outdated_info->current', data_get($outdatedInfo, 'current'))
+            ->where('traefik_outdated_info->upgrade_target', data_get($outdatedInfo, 'upgrade_target'))
+            ->update(['traefik_outdated_info' => null]);
+    }
 }
diff --git a/app/Livewire/Server/Security/TerminalAccess.php b/app/Livewire/Server/Security/TerminalAccess.php
index b4b99a3e7c..999482dcff 100644
--- a/app/Livewire/Server/Security/TerminalAccess.php
+++ b/app/Livewire/Server/Security/TerminalAccess.php
@@ -62,10 +62,9 @@ class TerminalAccess extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             // No other fields to sync for terminal access
         } else {
diff --git a/app/Livewire/Server/Sentinel.php b/app/Livewire/Server/Sentinel.php
index a69eb3f807..2d4742eb67 100644
--- a/app/Livewire/Server/Sentinel.php
+++ b/app/Livewire/Server/Sentinel.php
@@ -54,10 +54,9 @@ class Sentinel extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->is_metrics_enabled = $this->isMetricsEnabled;
             $this->server->settings->sentinel_token = $this->sentinelToken;
@@ -145,6 +144,7 @@ class Sentinel extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');
         } catch (\Throwable $e) {
@@ -155,6 +155,7 @@ class Sentinel extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->restartSentinel();
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index 017beb3719..38bbe24e7c 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -230,12 +230,10 @@ class Show extends Component
             ->toArray();
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-
-            $this->authorize('update', $this->server);
             $foundServer = Server::where('ip', $this->ip)
                 ->where('id', '!=', $this->server->id)
                 ->first();
@@ -363,6 +361,7 @@ class Show extends Component
     public function checkLocalhostConnection()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
             if ($uptime) {
@@ -479,6 +478,7 @@ class Show extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -694,6 +694,7 @@ class Show extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/Swarm.php b/app/Livewire/Server/Swarm.php
index e3e441ea0e..af785a8c20 100644
--- a/app/Livewire/Server/Swarm.php
+++ b/app/Livewire/Server/Swarm.php
@@ -29,10 +29,9 @@ class Swarm extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->server->settings->is_swarm_manager = $this->isSwarmManager;
             $this->server->settings->is_swarm_worker = $this->isSwarmWorker;
             $this->server->settings->save();
@@ -45,6 +44,7 @@ class Swarm extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/ValidateAndInstall.php b/app/Livewire/Server/ValidateAndInstall.php
index c39f868baf..db62bff2db 100644
--- a/app/Livewire/Server/ValidateAndInstall.php
+++ b/app/Livewire/Server/ValidateAndInstall.php
@@ -53,6 +53,8 @@ class ValidateAndInstall extends Component
 
     public function init(int $data = 0)
     {
+        $this->authorize('update', $this->server);
+
         if (! $this->server->canBeValidated()) {
             $this->error = 'This server was transferred to another Coolify instance and cannot be revalidated here.';
             $this->server->update([
@@ -160,6 +162,8 @@ class ValidateAndInstall extends Component
 
     public function validateOS()
     {
+        $this->authorize('update', $this->server);
+
         $this->supported_os_type = $this->server->validateOS();
         if (! $this->supported_os_type) {
             $this->error = 'Server OS type is not supported. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://docs.docker.com/engine/install/#server">documentation</a>.';
@@ -174,6 +178,8 @@ class ValidateAndInstall extends Component
 
     public function validatePrerequisites()
     {
+        $this->authorize('update', $this->server);
+
         $validationResult = $this->server->validatePrerequisites();
         $this->prerequisites_installed = $validationResult['success'];
         if (! $validationResult['success']) {
@@ -212,6 +218,8 @@ class ValidateAndInstall extends Component
 
     public function validateDockerEngine()
     {
+        $this->authorize('update', $this->server);
+
         $this->docker_installed = $this->server->validateDockerEngine();
         $this->docker_compose_installed = $this->server->validateDockerCompose();
         if (! $this->docker_installed || ! $this->docker_compose_installed) {
@@ -248,6 +256,8 @@ class ValidateAndInstall extends Component
 
     public function validateDockerVersion()
     {
+        $this->authorize('update', $this->server);
+
         if ($this->server->isSwarm()) {
             $swarmInstalled = $this->server->validateDockerSwarm();
             if ($swarmInstalled) {
diff --git a/app/Livewire/SettingsEmail.php b/app/Livewire/SettingsEmail.php
index 1426f61f02..975ce9a241 100644
--- a/app/Livewire/SettingsEmail.php
+++ b/app/Livewire/SettingsEmail.php
@@ -74,7 +74,7 @@ class SettingsEmail extends Component
         $this->testEmailAddress = auth()->user()->email;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 2570c3a1b5..2dadd73661 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -122,13 +122,6 @@ class Change extends Component
         }
     }
 
-    public function boot()
-    {
-        if ($this->github_app) {
-            $this->github_app->makeVisible(['client_secret', 'webhook_secret']);
-        }
-    }
-
     /**
      * Sync data between component properties and model
      *
@@ -170,8 +163,9 @@ class Change extends Component
             $this->appId = $this->github_app->app_id;
             $this->installationId = $this->github_app->installation_id;
             $this->clientId = $this->github_app->client_id;
-            $this->clientSecret = $this->github_app->client_secret;
-            $this->webhookSecret = $this->github_app->webhook_secret;
+            $canUpdate = auth()->user()->can('update', $this->github_app);
+            $this->clientSecret = $canUpdate ? $this->github_app->client_secret : null;
+            $this->webhookSecret = $canUpdate ? $this->github_app->webhook_secret : null;
             $this->isSystemWide = $this->github_app->is_system_wide;
             $this->privateKeyId = $this->github_app->private_key_id;
             $this->contents = $this->github_app->contents;
@@ -231,7 +225,7 @@ class Change extends Component
             syncGithubAppName($this->github_app);
 
             GithubAppPermissionJob::dispatchSync($this->github_app);
-            $this->github_app->refresh()->makeVisible('client_secret')->makeVisible('webhook_secret');
+            $this->github_app->refresh();
             $this->syncData(false);
             $this->isConnected = $this->github_app->isConnected();
             $this->name = str($this->github_app->name)->kebab();
@@ -305,7 +299,7 @@ class Change extends Component
         try {
             $github_app_uuid = request()->github_app_uuid;
             $this->github_app = GithubApp::ownedByCurrentTeam()->whereUuid($github_app_uuid)->firstOrFail();
-            $this->github_app->makeVisible(['client_secret', 'webhook_secret']);
+            $this->authorize('view', $this->github_app);
             $this->privateKeys = PrivateKey::ownedByCurrentTeamCached();
 
             $this->applications = $this->github_app->applications;
@@ -420,7 +414,6 @@ class Change extends Component
         try {
             $this->authorize('update', $this->github_app);
 
-            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
             $this->organization = normalizeGithubOrganization($this->organization);
             $this->apiUrl = filled($this->apiUrl)
                 ? $this->apiUrl
@@ -442,7 +435,6 @@ class Change extends Component
     {
         $this->authorize('update', $this->github_app);
 
-        $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
         $this->github_app->app_id = 1234567890;
         $this->github_app->installation_id = 1234567890;
         $this->github_app->save();
@@ -457,8 +449,6 @@ class Change extends Component
         try {
             $this->authorize('update', $this->github_app);
 
-            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
-
             $this->syncData(true);
             $this->github_app->save();
             $this->isConnected = $this->github_app->isConnected();
@@ -475,7 +465,6 @@ class Change extends Component
 
             if ($this->github_app->applications->isNotEmpty()) {
                 $this->dispatch('error', 'This source is being used by an application. Please delete all applications first.');
-                $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
 
                 return;
             }
@@ -484,7 +473,7 @@ class Change extends Component
             // @can and canGate checks against a deleted model (null team_id TypeError).
             $this->github_app = null;
 
-            return redirect()->route('source.all');
+            return redirectRoute($this, 'source.all');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Source/Gitlab/Change.php b/app/Livewire/Source/Gitlab/Change.php
index dd0284582b..29374105b2 100644
--- a/app/Livewire/Source/Gitlab/Change.php
+++ b/app/Livewire/Source/Gitlab/Change.php
@@ -338,7 +338,7 @@ class Change extends Component
             // @can and canGate checks against a deleted model (null team_id TypeError).
             $this->gitlab_app = null;
 
-            return redirect()->route('source.all');
+            return redirectRoute($this, 'source.all');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Storage/Show.php b/app/Livewire/Storage/Show.php
index 89782d686c..17abd19e51 100644
--- a/app/Livewire/Storage/Show.php
+++ b/app/Livewire/Storage/Show.php
@@ -43,7 +43,7 @@ class Show extends Component
 
             $this->storage->delete();
 
-            return redirect()->route('storage.index');
+            return redirectRoute($this, 'storage.index');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 2fa1cff990..e7c2c1d90e 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -7,7 +7,10 @@ use App\Services\ConfigurationGenerator;
 use App\Services\DeploymentConfiguration\ApplicationConfigurationSnapshot;
 use App\Services\DeploymentConfiguration\ConfigurationDiff;
 use App\Services\DeploymentConfiguration\ConfigurationDiffer;
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
 use App\Traits\Auditable;
+
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasConfiguration;
 use App\Traits\HasMetrics;
@@ -135,6 +138,7 @@ class Application extends BaseModel
         'description',
         'fqdn',
         'noindex_domains',
+        'domain_port_overrides',
         'git_repository',
         'git_branch',
         'git_commit_sha',
@@ -213,6 +217,8 @@ class Application extends BaseModel
         'last_online_at',
         'restart_count',
         'max_restart_count',
+        'restart_limit_reached',
+        'container_present',
         'last_restart_at',
         'last_restart_type',
         'uuid',
@@ -244,6 +250,7 @@ class Application extends BaseModel
         'docker_compose_raw',
         'custom_labels',
         'domain_dns_statuses',
+        'domain_port_overrides',
     ];
 
     protected function casts(): array
@@ -256,8 +263,11 @@ class Application extends BaseModel
             'manual_webhook_secret_gitea' => 'encrypted',
             'noindex_domains' => 'array',
             'domain_dns_statuses' => 'array',
+            'domain_port_overrides' => 'array',
             'restart_count' => 'integer',
             'max_restart_count' => 'integer',
+            'restart_limit_reached' => 'boolean',
+            'container_present' => 'boolean',
             'last_restart_at' => 'datetime',
         ];
     }
@@ -282,6 +292,9 @@ class Application extends BaseModel
                 if ($application->fqdn === '') {
                     $application->fqdn = null;
                 }
+                $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
+                $application->fqdn = $normalized['fqdn'];
+                $application->domain_port_overrides = $normalized['overrides'];
                 $payload['fqdn'] = $application->fqdn;
                 $application->syncNoindexDomains();
             }
@@ -606,10 +619,8 @@ class Application extends BaseModel
     public function stoppedAfterRestartLimit(): bool
     {
         return str($this->status)->startsWith('exited')
-            && ($this->restart_count ?? 0) > 0
-            && ($this->max_restart_count ?? 0) > 0
-            && $this->restart_count >= $this->max_restart_count
-            && $this->last_restart_type === 'crash';
+            && $this->container_present === true
+            && $this->restart_limit_reached === true;
     }
 
     public function taskLink($task_uuid)
@@ -740,24 +751,20 @@ class Application extends BaseModel
 
             return "{$this->source->html_url}/{$this->git_repository}/commit/{$link}";
         }
-        if (str($this->git_repository)->contains('bitbucket')) {
-            $git_repository = str_replace('.git', '', $this->git_repository);
-            $url = Url::fromString($git_repository);
-            $url = $url->withUserInfo('');
-            $url = $url->withPath($url->getPath().'/commits/'.$link);
 
-            return $url->__toString();
-        }
+        $git_repository = $this->git_repository;
         if (strpos($this->git_repository, 'git@') === 0) {
-            $git_repository = str_replace(['git@', ':', '.git'], ['', '/', ''], $this->git_repository);
-            if (data_get($this, 'source.html_url')) {
-                return "{$this->source->html_url}/{$git_repository}/commit/{$link}";
-            }
-
-            return "{$git_repository}/commit/{$link}";
+            $git_repository = preg_replace('/^git@([^:]+):/', 'https://$1/', $git_repository);
+        } elseif (str($this->git_repository)->startsWith('ssh://')) {
+            $git_repository = 'https://'.parse_url($git_repository, PHP_URL_HOST).parse_url($git_repository, PHP_URL_PATH);
         }
 
-        return $this->git_repository;
+        $url = Url::fromString(Str::replaceEnd('.git', '', $git_repository));
+        $url = $url->withUserInfo('');
+        $commitPath = str($git_repository)->contains('bitbucket') ? 'commits' : 'commit';
+        $url = $url->withPath(Str::finish($url->getPath(), '/').$commitPath.'/'.$link);
+
+        return $url->__toString();
     }
 
     public function dockerfileLocation(): Attribute
@@ -977,6 +984,46 @@ class Application extends BaseModel
         return $this->settings->is_static ? [80] : $this->ports_exposes_array;
     }
 
+    /**
+     * Ports the container is expected to listen on: Ports Exposes plus ports already used by application domains.
+     *
+     * @return list<int>
+     */
+    public function availableInternalPorts(): array
+    {
+        $ports = collect($this->settings?->is_static ? [80] : $this->ports_exposes_array)
+            ->filter(fn (mixed $port): bool => is_numeric($port) && (int) $port > 0)
+            ->map(fn (mixed $port): int => (int) $port);
+
+        foreach ($this->domain_port_overrides ?? [] as $port) {
+            if (is_numeric($port) && (int) $port > 0) {
+                $ports->push((int) $port);
+            }
+        }
+
+        foreach (explode(',', (string) $this->fqdn) as $url) {
+            $url = trim($url);
+            if ($url === '') {
+                continue;
+            }
+            $legacyPort = DomainUrlParts::split($url)['port'] ?? '';
+            if ($legacyPort !== '' && is_numeric($legacyPort) && (int) $legacyPort > 0) {
+                $ports->push((int) $legacyPort);
+            }
+        }
+
+        return $ports->unique()->sort()->values()->all();
+    }
+
+    public function portRequiresConfirmation(?int $port): bool
+    {
+        if ($port === null || $port <= 0) {
+            return false;
+        }
+
+        return ! in_array($port, $this->availableInternalPorts(), true);
+    }
+
     public function detectPortFromEnvironment(?bool $isPreview = false): ?int
     {
         $envVars = $isPreview
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index 0905242753..bffbdab621 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -2,14 +2,16 @@
 
 namespace App\Models;
 
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use RuntimeException;
 use Spatie\Url\Url;
 
 class ApplicationPreview extends BaseModel
 {
-    use SoftDeletes;
+    use HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'uuid',
@@ -23,10 +25,18 @@ class ApplicationPreview extends BaseModel
         'docker_compose_domains',
         'docker_registry_image_tag',
         'last_online_at',
+        'domain_dns_statuses',
+        'domain_port_overrides',
+    ];
+
+    protected $hidden = [
+        'domain_port_overrides',
     ];
 
     protected $casts = [
         'pull_request_id' => 'integer',
+        'domain_dns_statuses' => 'array',
+        'domain_port_overrides' => 'array',
     ];
 
     protected static function booted(): void
@@ -82,6 +92,14 @@ class ApplicationPreview extends BaseModel
             if ($preview->isDirty('status')) {
                 $preview->last_online_at = now();
             }
+            if ($preview->isDirty('fqdn')) {
+                if ($preview->fqdn === '') {
+                    $preview->fqdn = null;
+                }
+                $normalized = DomainPortOverrides::normalize($preview->fqdn, $preview->domain_port_overrides);
+                $preview->fqdn = $normalized['fqdn'];
+                $preview->domain_port_overrides = $normalized['overrides'];
+            }
         });
     }
 
@@ -100,39 +118,42 @@ class ApplicationPreview extends BaseModel
         return $this->belongsTo(Application::class);
     }
 
+    public function restartLimitMaximum(): int
+    {
+        return $this->application->max_restart_count ?? $this->max_restart_count ?? 0;
+    }
+
     public function persistentStorages()
     {
         return $this->morphMany(LocalPersistentVolume::class, 'resource');
     }
 
-    public function generate_preview_fqdn()
+    public function generate_preview_fqdn(bool $generateWithoutApplicationDomain = false)
     {
-        if ($this->application->fqdn) {
-            if (str($this->application->fqdn)->contains(',')) {
-                $url = Url::fromString(str($this->application->fqdn)->explode(',')[0]);
-            } else {
-                $url = Url::fromString($this->application->fqdn);
-            }
-            $template = $this->application->preview_url_template;
-            $host = $url->getHost();
-            $schema = $url->getScheme();
-            $portInt = $url->getPort();
-            $port = $portInt !== null ? ':'.$portInt : '';
-            $urlPath = $url->getPath();
-            $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-            $random = new_public_id();
-            $preview_fqdn = str_replace('{{random}}', $random, $template);
-            $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-            $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
-            $preview_fqdn = "$schema://$preview_fqdn{$port}{$path}";
-            $this->fqdn = $preview_fqdn;
+        $applicationFqdn = $this->application->fqdn;
+        if (! $applicationFqdn && $generateWithoutApplicationDomain) {
+            $applicationFqdn = generateUrl(
+                server: $this->application->destination->server,
+                random: $this->application->uuid,
+            );
+        }
+
+        if ($applicationFqdn) {
+            $sourceDomain = str($applicationFqdn)->contains(',')
+                ? str($applicationFqdn)->explode(',')[0]
+                : $applicationFqdn;
+            $generated = $this->generatedPreviewDomain((string) $sourceDomain);
+            $this->fqdn = $generated['url'];
+            $this->domain_port_overrides = filled($generated['port'])
+                ? [$generated['url'] => $generated['port']]
+                : null;
             $this->save();
         }
 
         return $this;
     }
 
-    public function generate_preview_fqdn_compose()
+    public function generate_preview_fqdn_compose(bool $generateWithoutApplicationDomain = false)
     {
         $applicationDomains = json_decode($this->application->docker_compose_domains ?: '[]', true) ?: [];
         $previewDomains = json_decode(data_get($this, 'docker_compose_domains') ?: '[]', true) ?: [];
@@ -171,11 +192,19 @@ class ApplicationPreview extends BaseModel
             ->all();
 
         $docker_compose_domains = [];
+        $previewPortOverrides = [];
         foreach ($serviceNames as $service_name) {
             $domain_string = getComposeServiceDomainString($applicationDomains, $service_name);
 
-            // If domain string is empty or null, don't auto-generate domain
-            // Only generate domains when main app already has domains set
+            if (empty($domain_string)) {
+                if ($generateWithoutApplicationDomain) {
+                    $domain_string = generateUrl(
+                        server: $this->application->destination->server,
+                        random: str($service_name)->slug().'-'.$this->application->uuid,
+                    );
+                }
+            }
+
             if (empty($domain_string)) {
                 $docker_compose_domains = putComposeServiceDomain(
                     $docker_compose_domains,
@@ -195,20 +224,11 @@ class ApplicationPreview extends BaseModel
                     continue;
                 }
 
-                $url = Url::fromString($domain);
-                $template = $this->application->preview_url_template;
-                $host = $url->getHost();
-                $schema = $url->getScheme();
-                $portInt = $url->getPort();
-                $port = $portInt !== null ? ':'.$portInt : '';
-                $urlPath = $url->getPath();
-                $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-                $random = new_public_id();
-                $preview_fqdn = str_replace('{{random}}', $random, $template);
-                $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
-                $preview_fqdn = "$schema://$preview_fqdn{$port}{$path}";
-                $preview_domains[] = $preview_fqdn;
+                $generated = $this->generatedPreviewDomain((string) $domain);
+                $preview_domains[] = $generated['url'];
+                if (filled($generated['port'])) {
+                    $previewPortOverrides[$generated['url']] = $generated['port'];
+                }
             }
 
             $docker_compose_domains = putComposeServiceDomain(
@@ -232,10 +252,36 @@ class ApplicationPreview extends BaseModel
             ->implode(',');
 
         $this->fqdn = ! empty($allDomains) ? $allDomains : null;
+        $this->domain_port_overrides = $previewPortOverrides ?: null;
 
         $this->save();
     }
 
+    /**
+     * @return array{url: string, port: ?int}
+     */
+    public function generatedPreviewDomain(string $sourceDomain): array
+    {
+        $url = Url::fromString($sourceDomain);
+        $template = $this->application->preview_url_template;
+        $host = $url->getHost();
+        $schema = $url->getScheme();
+        $urlPath = $url->getPath();
+        $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
+        $random = new_public_id();
+        $previewFqdn = str_replace('{{random}}', $random, $template);
+        $previewFqdn = str_replace('{{domain}}', $host, $previewFqdn);
+        $previewFqdn = str_replace('{{pr_id}}', (string) $this->pull_request_id, $previewFqdn);
+        $previewUrl = "{$schema}://{$previewFqdn}{$path}";
+        $sourceCanonical = DomainPortOverrides::withoutPort($sourceDomain);
+        $port = $url->getPort() ?? ($this->application->domain_port_overrides[$sourceCanonical] ?? null);
+
+        return [
+            'url' => $previewUrl,
+            'port' => $port !== null ? (int) $port : null,
+        ];
+    }
+
     /**
      * Original compose service names for this preview (PR suffix stripped), excluding database images.
      *
diff --git a/app/Models/DiscordNotificationSettings.php b/app/Models/DiscordNotificationSettings.php
index 135c921f61..48d5b5d293 100644
--- a/app/Models/DiscordNotificationSettings.php
+++ b/app/Models/DiscordNotificationSettings.php
@@ -20,6 +20,7 @@ class DiscordNotificationSettings extends Model
         'deployment_success_discord_notifications',
         'deployment_failure_discord_notifications',
         'status_change_discord_notifications',
+        'restart_limit_reached_discord_notifications',
         'backup_success_discord_notifications',
         'backup_failure_discord_notifications',
         'scheduled_task_success_discord_notifications',
@@ -45,6 +46,7 @@ class DiscordNotificationSettings extends Model
         'deployment_success_discord_notifications' => 'boolean',
         'deployment_failure_discord_notifications' => 'boolean',
         'status_change_discord_notifications' => 'boolean',
+        'restart_limit_reached_discord_notifications' => 'boolean',
         'backup_success_discord_notifications' => 'boolean',
         'backup_failure_discord_notifications' => 'boolean',
         'scheduled_task_success_discord_notifications' => 'boolean',
diff --git a/app/Models/EmailNotificationSettings.php b/app/Models/EmailNotificationSettings.php
index 814d053395..3b04b482af 100644
--- a/app/Models/EmailNotificationSettings.php
+++ b/app/Models/EmailNotificationSettings.php
@@ -31,6 +31,7 @@ class EmailNotificationSettings extends Model
         'deployment_success_email_notifications',
         'deployment_failure_email_notifications',
         'status_change_email_notifications',
+        'restart_limit_reached_email_notifications',
         'backup_success_email_notifications',
         'backup_failure_email_notifications',
         'scheduled_task_success_email_notifications',
@@ -73,6 +74,7 @@ class EmailNotificationSettings extends Model
         'deployment_success_email_notifications' => 'boolean',
         'deployment_failure_email_notifications' => 'boolean',
         'status_change_email_notifications' => 'boolean',
+        'restart_limit_reached_email_notifications' => 'boolean',
         'backup_success_email_notifications' => 'boolean',
         'backup_failure_email_notifications' => 'boolean',
         'scheduled_task_success_email_notifications' => 'boolean',
diff --git a/app/Models/PushoverNotificationSettings.php b/app/Models/PushoverNotificationSettings.php
index dd0d81cc0e..2ab6693142 100644
--- a/app/Models/PushoverNotificationSettings.php
+++ b/app/Models/PushoverNotificationSettings.php
@@ -21,6 +21,7 @@ class PushoverNotificationSettings extends Model
         'deployment_success_pushover_notifications',
         'deployment_failure_pushover_notifications',
         'status_change_pushover_notifications',
+        'restart_limit_reached_pushover_notifications',
         'backup_success_pushover_notifications',
         'backup_failure_pushover_notifications',
         'scheduled_task_success_pushover_notifications',
@@ -47,6 +48,7 @@ class PushoverNotificationSettings extends Model
         'deployment_success_pushover_notifications' => 'boolean',
         'deployment_failure_pushover_notifications' => 'boolean',
         'status_change_pushover_notifications' => 'boolean',
+        'restart_limit_reached_pushover_notifications' => 'boolean',
         'backup_success_pushover_notifications' => 'boolean',
         'backup_failure_pushover_notifications' => 'boolean',
         'scheduled_task_success_pushover_notifications' => 'boolean',
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 429422b90e..11756f3c7e 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -4,7 +4,9 @@ namespace App\Models;
 
 use App\Enums\ProcessStatus;
 use App\Services\ContainerStatusAggregator;
+use App\Support\DomainPortOverrides;
 use App\Traits\Auditable;
+
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
@@ -94,11 +96,18 @@ class Service extends BaseModel
 
     public function isConfigurationChanged(bool $save = false)
     {
-        $domains = $this->applications()->get()->pluck('fqdn')->sort()->toArray();
+        $applications = $this->applications()->get();
+        $domains = $applications->pluck('fqdn')->sort()->toArray();
         $domains = implode(',', $domains);
-        $noindexDomains = $this->applications()->get()->pluck('noindex_domains')->flatten()->filter()->sort()->implode(',');
+        $noindexDomains = $applications->pluck('noindex_domains')->flatten()->filter()->sort()->implode(',');
+        $domainPortOverrides = $applications
+            ->mapWithKeys(fn (ServiceApplication $application): array => [
+                $application->id => DomainPortOverrides::sorted($application->domain_port_overrides),
+            ])
+            ->sortKeys()
+            ->all();
 
-        $applicationImages = $this->applications()->get()->pluck('image')->sort();
+        $applicationImages = $applications->pluck('image')->sort();
         $databaseImages = $this->databases()->get()->pluck('image')->sort();
         $images = $applicationImages->merge($databaseImages);
         $images = implode(',', $images->toArray());
@@ -107,7 +116,7 @@ class Service extends BaseModel
         $databaseStorages = $this->databases()->get()->pluck('persistentStorages')->flatten()->sortBy('id');
         $storages = $applicationStorages->merge($databaseStorages)->implode('updated_at');
 
-        $newConfigHash = $images.$domains.$images.$storages.$noindexDomains;
+        $newConfigHash = $images.$domains.$images.$storages.$noindexDomains.json_encode($domainPortOverrides);
         $newConfigHash .= json_encode($this->environment_variables()->get('value')->makeVisible('value')->sort());
         $newConfigHash = md5($newConfigHash);
         $oldConfigHash = data_get($this, 'config_hash');
@@ -1498,7 +1507,7 @@ class Service extends BaseModel
     {
         try {
             $services = get_service_templates();
-            $serviceName = str($this->name)->beforeLast('-')->value();
+            $serviceName = $this->service_type ?: str($this->name)->beforeLast('-')->value();
             $service = data_get($services, $serviceName, []);
             $port = data_get($service, 'port');
 
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index 9763fa894b..cf0faef5bd 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -2,7 +2,10 @@
 
 namespace App\Models;
 
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
 use App\Traits\HasNoindexDomains;
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
@@ -10,7 +13,9 @@ use Symfony\Component\Yaml\Yaml;
 
 class ServiceApplication extends BaseModel
 {
-    use HasFactory, HasNoindexDomains, SoftDeletes;
+    use HasFactory, HasNoindexDomains, HasRestartLimit, SoftDeletes;
+
+    protected $appends = ['url'];
 
     protected $fillable = [
         'service_id',
@@ -21,6 +26,7 @@ class ServiceApplication extends BaseModel
         'noindex_domains',
         'redirect',
         'domain_dns_statuses',
+        'domain_port_overrides',
         'ports',
         'exposes',
         'status',
@@ -43,6 +49,7 @@ class ServiceApplication extends BaseModel
      */
     protected $hidden = [
         'domain_dns_statuses',
+        'domain_port_overrides',
     ];
 
     protected $attributes = [
@@ -53,6 +60,7 @@ class ServiceApplication extends BaseModel
     {
         return [
             'domain_dns_statuses' => 'array',
+            'domain_port_overrides' => 'array',
             'noindex_domains' => 'array',
             'is_force_https_enabled' => 'boolean',
         ];
@@ -70,6 +78,7 @@ class ServiceApplication extends BaseModel
                 $service->last_online_at = now();
             }
             if ($service->isDirty('fqdn')) {
+                $service->normalizeDomainPortOverrides();
                 $service->syncNoindexDomains();
             }
         });
@@ -191,6 +200,45 @@ class ServiceApplication extends BaseModel
         );
     }
 
+    /**
+     * Return the public URLs with their persisted internal port overrides.
+     */
+    protected function url(): Attribute
+    {
+        return Attribute::make(
+            get: function (): ?string {
+                if (blank($this->fqdn)) {
+                    return null;
+                }
+
+                $overrides = $this->domain_port_overrides ?? [];
+
+                return collect(explode(',', $this->fqdn))
+                    ->map(function (string $url) use ($overrides): string {
+                        $url = trim($url);
+                        $canonical = DomainPortOverrides::withoutPort($url);
+                        $port = $overrides[$canonical] ?? null;
+
+                        if ($port === null) {
+                            return $canonical;
+                        }
+
+                        $parts = DomainUrlParts::split($canonical);
+
+                        return DomainUrlParts::compose($parts['scheme'], $parts['host'], (string) $port, $parts['path']);
+                    })
+                    ->implode(',');
+            },
+        );
+    }
+
+    public function setEditableUrls(?string $urls): void
+    {
+        $normalized = DomainPortOverrides::normalize($urls, null);
+        $this->fqdn = $normalized['fqdn'];
+        $this->domain_port_overrides = $normalized['overrides'];
+    }
+
     /**
      * Extract port number from a given FQDN URL.
      * Returns null if no port is specified.
@@ -212,6 +260,58 @@ class ServiceApplication extends BaseModel
         }
     }
 
+    /**
+     * True when saving this URL should confirm that it does not use the required template port.
+     */
+    public function portRequiresConfirmation(string $fqdn, ?int $requiredPort, ?string $previousFqdn = null): bool
+    {
+        if ($requiredPort === null) {
+            return false;
+        }
+
+        $fqdn = trim($fqdn);
+        if ($fqdn === '') {
+            return false;
+        }
+
+        $canonical = DomainPortOverrides::withoutPort($fqdn);
+        $explicit = self::extractPortFromUrl($fqdn);
+
+        if ($explicit === $requiredPort) {
+            return false;
+        }
+
+        if ($explicit === null) {
+            $previous = collect(explode(',', (string) $previousFqdn))
+                ->filter();
+            $previousUrl = $previous->first(
+                fn (string $url): bool => DomainPortOverrides::withoutPort(trim($url)) === $canonical
+            );
+
+            if (is_string($previousUrl) && self::extractPortFromUrl($previousUrl) !== null) {
+                return true;
+            }
+
+            return $previousUrl === null;
+        }
+
+        $existingOverride = $this->domain_port_overrides[$canonical] ?? null;
+
+        return (int) $existingOverride !== $explicit;
+    }
+
+    public static function withoutPort(string $url): string
+    {
+        return DomainPortOverrides::withoutPort($url);
+    }
+
+    protected function normalizeDomainPortOverrides(): void
+    {
+        $normalized = DomainPortOverrides::normalize($this->fqdn, $this->domain_port_overrides);
+        $this->fqdn = $normalized['fqdn'];
+        $this->domain_port_overrides = $normalized['overrides'];
+    }
+
     /**
      * Check if all FQDNs have a port specified.
      */
@@ -276,6 +376,7 @@ class ServiceApplication extends BaseModel
             // Extract SERVICE_URL and SERVICE_FQDN variables DIRECTLY DECLARED in this service's environment
             // (not variables that are merely referenced with ${VAR} syntax)
             $portFound = null;
+            $declaresHttpUrl = false;
             foreach ($environment as $key => $value) {
                 if (is_int($key) && is_string($value)) {
                     // List-style: "- SERVICE_URL_APP_3000" or "- SERVICE_URL_APP_3000=value"
@@ -284,6 +385,7 @@ class ServiceApplication extends BaseModel
 
                     // Only process direct declarations
                     if ($envVarName->startsWith('SERVICE_FQDN_') || $envVarName->startsWith('SERVICE_URL_')) {
+                        $declaresHttpUrl = true;
                         // Parse to check if it has a port suffix
                         $parsed = parseServiceEnvironmentVariable($envVarName->value());
                         if ($parsed['has_port'] && $parsed['port']) {
@@ -298,6 +400,7 @@ class ServiceApplication extends BaseModel
 
                     // Only process direct declarations
                     if ($envVarName->startsWith('SERVICE_FQDN_') || $envVarName->startsWith('SERVICE_URL_')) {
+                        $declaresHttpUrl = true;
                         // Parse to check if it has a port suffix
                         $parsed = parseServiceEnvironmentVariable($envVarName->value());
                         if ($parsed['has_port'] && $parsed['port']) {
@@ -314,8 +417,12 @@ class ServiceApplication extends BaseModel
                 return $portFound;
             }
 
-            // No port-specific variables found for this service, return null
-            // (DO NOT fall back to service-level port, as that applies to all services)
+            // HTTP-facing compose services that only declare SERVICE_URL/FQDN (no _PORT
+            // suffix), such as WordPress, inherit the one-click template `# port:`.
+            if ($declaresHttpUrl) {
+                return $this->service->getRequiredPort();
+            }
+
             return null;
         } catch (\Throwable $e) {
             return null;
diff --git a/app/Models/ServiceDatabase.php b/app/Models/ServiceDatabase.php
index 603d11a7f3..c932791a78 100644
--- a/app/Models/ServiceDatabase.php
+++ b/app/Models/ServiceDatabase.php
@@ -2,12 +2,13 @@
 
 namespace App\Models;
 
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ServiceDatabase extends BaseModel
 {
-    use HasFactory, SoftDeletes;
+    use HasFactory, HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/SlackNotificationSettings.php b/app/Models/SlackNotificationSettings.php
index 62603685e9..648869bafe 100644
--- a/app/Models/SlackNotificationSettings.php
+++ b/app/Models/SlackNotificationSettings.php
@@ -20,6 +20,7 @@ class SlackNotificationSettings extends Model
         'deployment_success_slack_notifications',
         'deployment_failure_slack_notifications',
         'status_change_slack_notifications',
+        'restart_limit_reached_slack_notifications',
         'backup_success_slack_notifications',
         'backup_failure_slack_notifications',
         'scheduled_task_success_slack_notifications',
@@ -44,6 +45,7 @@ class SlackNotificationSettings extends Model
         'deployment_success_slack_notifications' => 'boolean',
         'deployment_failure_slack_notifications' => 'boolean',
         'status_change_slack_notifications' => 'boolean',
+        'restart_limit_reached_slack_notifications' => 'boolean',
         'backup_success_slack_notifications' => 'boolean',
         'backup_failure_slack_notifications' => 'boolean',
         'scheduled_task_success_slack_notifications' => 'boolean',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index 6265345ee9..a627d00aa6 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,10 +15,12 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneClickhouse extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected array $auditExclude = ['last_online_at'];
 
+
     protected $fillable = [
         'uuid',
         'name',
diff --git a/app/Models/StandaloneDocker.php b/app/Models/StandaloneDocker.php
index 604a245fc7..e7e0a8c108 100644
--- a/app/Models/StandaloneDocker.php
+++ b/app/Models/StandaloneDocker.php
@@ -43,14 +43,20 @@ class StandaloneDocker extends BaseModel
             }
 
             $server = $newStandaloneDocker->server;
-            $safeNetwork = escapeshellarg($newStandaloneDocker->network);
             instant_remote_process([
-                "docker network inspect {$safeNetwork} >/dev/null 2>&1 || docker network create --driver overlay --attachable {$safeNetwork} >/dev/null",
+                $newStandaloneDocker->networkCreateCommand(),
             ], $server, false);
             ConnectProxyToNetworksJob::dispatchSync($server);
         });
     }
 
+    public function networkCreateCommand(): string
+    {
+        $safeNetwork = escapeshellarg($this->network);
+
+        return "docker network inspect {$safeNetwork} >/dev/null 2>&1 || docker network create --attachable {$safeNetwork} >/dev/null";
+    }
+
     public function setNetworkAttribute(string $value): void
     {
         if (! ValidationPatterns::isValidDockerNetwork($value)) {
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index da4804dd2d..8371bd0493 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,7 +15,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneDragonfly extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index f4dbaec210..bbe55a4f5a 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,7 +15,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneKeydb extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index c923b489bd..d35509ce99 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,7 +16,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMariadb extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index 70b108087a..faf54e0e71 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,7 +15,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMongodb extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 6a08a4dc45..5a1ecb8425 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,7 +15,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMysql extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index f8dc5c0caa..e91539d55b 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,7 +15,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandalonePostgresql extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 3bfcc5434e..674f7867fd 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -6,6 +6,7 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -14,10 +15,12 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneRedis extends BaseModel
 {
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected array $auditExclude = ['last_online_at'];
 
+
     protected $fillable = [
         'uuid',
         'name',
diff --git a/app/Models/Team.php b/app/Models/Team.php
index 12998be165..6ec79f2046 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -279,13 +279,22 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
         return $this->hasMany(TeamInvitation::class);
     }
 
-    public function isEmpty()
+    /**
+     * @return array<string, int>
+     */
+    public function deletionBlockers(): array
     {
-        if ($this->projects()->count() === 0 && $this->servers()->count() === 0 && $this->privateKeys()->count() === 0 && $this->sources()->count() === 0) {
-            return true;
-        }
+        return array_filter([
+            'projects' => $this->projects()->count(),
+            'servers' => $this->servers()->count(),
+            'sources' => GithubApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count()
+                + GitlabApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count(),
+        ]);
+    }
 
-        return false;
+    public function isEmpty(): bool
+    {
+        return $this->deletionBlockers() === [];
     }
 
     public function projects()
diff --git a/app/Models/TelegramNotificationSettings.php b/app/Models/TelegramNotificationSettings.php
index 8c644f9bcf..3376e239d6 100644
--- a/app/Models/TelegramNotificationSettings.php
+++ b/app/Models/TelegramNotificationSettings.php
@@ -21,6 +21,7 @@ class TelegramNotificationSettings extends Model
         'deployment_success_telegram_notifications',
         'deployment_failure_telegram_notifications',
         'status_change_telegram_notifications',
+        'restart_limit_reached_telegram_notifications',
         'backup_success_telegram_notifications',
         'backup_failure_telegram_notifications',
         'scheduled_task_success_telegram_notifications',
@@ -36,6 +37,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id',
         'telegram_notifications_deployment_failure_thread_id',
         'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_restart_limit_reached_thread_id',
         'telegram_notifications_backup_success_thread_id',
         'telegram_notifications_backup_failure_thread_id',
         'telegram_notifications_scheduled_task_success_thread_id',
@@ -55,6 +57,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id',
         'telegram_notifications_deployment_failure_thread_id',
         'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_restart_limit_reached_thread_id',
         'telegram_notifications_backup_success_thread_id',
         'telegram_notifications_backup_failure_thread_id',
         'telegram_notifications_scheduled_task_success_thread_id',
@@ -76,6 +79,7 @@ class TelegramNotificationSettings extends Model
         'deployment_success_telegram_notifications' => 'boolean',
         'deployment_failure_telegram_notifications' => 'boolean',
         'status_change_telegram_notifications' => 'boolean',
+        'restart_limit_reached_telegram_notifications' => 'boolean',
         'backup_success_telegram_notifications' => 'boolean',
         'backup_failure_telegram_notifications' => 'boolean',
         'scheduled_task_success_telegram_notifications' => 'boolean',
@@ -90,6 +94,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id' => 'encrypted',
         'telegram_notifications_deployment_failure_thread_id' => 'encrypted',
         'telegram_notifications_status_change_thread_id' => 'encrypted',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'encrypted',
         'telegram_notifications_backup_success_thread_id' => 'encrypted',
         'telegram_notifications_backup_failure_thread_id' => 'encrypted',
         'telegram_notifications_scheduled_task_success_thread_id' => 'encrypted',
diff --git a/app/Models/WebhookNotificationSettings.php b/app/Models/WebhookNotificationSettings.php
index c6a81b50a8..7ffd20a8c3 100644
--- a/app/Models/WebhookNotificationSettings.php
+++ b/app/Models/WebhookNotificationSettings.php
@@ -20,6 +20,7 @@ class WebhookNotificationSettings extends Model
         'deployment_success_webhook_notifications',
         'deployment_failure_webhook_notifications',
         'status_change_webhook_notifications',
+        'restart_limit_reached_webhook_notifications',
         'backup_success_webhook_notifications',
         'backup_failure_webhook_notifications',
         'scheduled_task_success_webhook_notifications',
@@ -46,6 +47,7 @@ class WebhookNotificationSettings extends Model
             'deployment_success_webhook_notifications' => 'boolean',
             'deployment_failure_webhook_notifications' => 'boolean',
             'status_change_webhook_notifications' => 'boolean',
+            'restart_limit_reached_webhook_notifications' => 'boolean',
             'backup_success_webhook_notifications' => 'boolean',
             'backup_failure_webhook_notifications' => 'boolean',
             'scheduled_task_success_webhook_notifications' => 'boolean',
diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
index 635dfdbdce..687fd30867 100644
--- a/app/Notifications/Application/RestartLimitReached.php
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -2,7 +2,8 @@
 
 namespace App\Notifications\Application;
 
-use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\BaseModel;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
@@ -27,26 +28,40 @@ class RestartLimitReached extends CustomEmailNotification
 
     public int $max_restart_count;
 
-    public function __construct(public Application $resource)
+    public function __construct(public BaseModel $resource)
     {
         $this->onQueue('high');
         $this->afterCommit();
-        $this->resource_name = data_get($resource, 'name');
-        $this->project_uuid = data_get($resource, 'environment.project.uuid');
-        $this->environment_uuid = data_get($resource, 'environment.uuid');
-        $this->environment_name = data_get($resource, 'environment.name');
+        $environment = data_get($resource, 'environment')
+            ?? data_get($resource, 'application.environment')
+            ?? data_get($resource, 'service.environment');
+        $this->resource_name = $resource instanceof ApplicationPreview
+            ? data_get($resource, 'application.name').' PR #'.$resource->pull_request_id
+            : data_get($resource, 'name');
+        $this->project_uuid = data_get($environment, 'project.uuid');
+        $this->environment_uuid = data_get($environment, 'uuid');
+        $this->environment_name = data_get($environment, 'name');
         $this->fqdn = data_get($resource, 'fqdn', null);
         $this->restart_count = $resource->restart_count;
-        $this->max_restart_count = $resource->max_restart_count;
+        $this->max_restart_count = method_exists($resource, 'restartLimitMaximum')
+            ? $resource->restartLimitMaximum()
+            : $resource->max_restart_count;
         if (str($this->fqdn)->explode(',')->count() > 1) {
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
-        $this->resource_url = $this->resource->link() ?? base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/application/{$this->resource->uuid}";
+        $service = data_get($resource, 'service');
+        $this->resource_url = match (true) {
+            method_exists($this->resource, 'link') => $this->resource->link(),
+            $resource instanceof ApplicationPreview => $resource->application->link(),
+            is_object($service) && method_exists($service, 'link') => $service->link(),
+            default => null,
+        };
+        $this->resource_url ??= base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}";
     }
 
     public function via(object $notifiable): array
     {
-        return $notifiable->getEnabledChannels('status_change');
+        return $notifiable->getEnabledChannels('restart_limit_reached');
     }
 
     public function toMail(): MailMessage
@@ -68,7 +83,7 @@ class RestartLimitReached extends CustomEmailNotification
     {
         return new DiscordMessage(
             title: ':warning: Restart limit reached',
-            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Application in Coolify]({$this->resource_url})",
+            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Resource in Coolify]({$this->resource_url})",
             color: DiscordMessage::errorColor(),
             isCritical: true,
         );
@@ -82,7 +97,7 @@ class RestartLimitReached extends CustomEmailNotification
             'message' => $message,
             'buttons' => [
                 [
-                    'text' => 'Open Application in Coolify',
+                    'text' => 'Open Resource in Coolify',
                     'url' => $this->resource_url,
                 ],
             ],
@@ -99,7 +114,7 @@ class RestartLimitReached extends CustomEmailNotification
             message: $message,
             buttons: [
                 [
-                    'text' => 'Open Application in Coolify',
+                    'text' => 'Open Resource in Coolify',
                     'url' => $this->resource_url,
                 ],
             ],
@@ -110,10 +125,13 @@ class RestartLimitReached extends CustomEmailNotification
     {
         $title = 'Restart limit reached';
         $description = "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count})";
+        $environment = data_get($this->resource, 'environment')
+            ?? data_get($this->resource, 'application.environment')
+            ?? data_get($this->resource, 'service.environment');
 
-        $description .= "\n\n*Project:* ".data_get($this->resource, 'environment.project.name');
+        $description .= "\n\n*Project:* ".data_get($environment, 'project.name');
         $description .= "\n*Environment:* {$this->environment_name}";
-        $description .= "\n*Application URL:* {$this->resource_url}";
+        $description .= "\n*Resource URL:* {$this->resource_url}";
 
         return new SlackMessage(
             title: $title,
@@ -130,6 +148,8 @@ class RestartLimitReached extends CustomEmailNotification
             'event' => 'restart_limit_reached',
             'application_name' => $this->resource_name,
             'application_uuid' => $this->resource->uuid,
+            'resource_name' => $this->resource_name,
+            'resource_uuid' => $this->resource->uuid,
             'restart_count' => $this->restart_count,
             'max_restart_count' => $this->max_restart_count,
             'url' => $this->resource_url,
diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index c2fa3ff10d..4f311bf681 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -3,6 +3,21 @@
 namespace App\Notifications\Channels;
 
 use App\Jobs\SendMessageToTelegramJob;
+use App\Notifications\Application\DeploymentFailed;
+use App\Notifications\Application\DeploymentSuccess;
+use App\Notifications\Application\RestartLimitReached;
+use App\Notifications\Application\StatusChanged;
+use App\Notifications\Container\ContainerRestarted;
+use App\Notifications\Database\BackupFailed;
+use App\Notifications\Database\BackupSuccess;
+use App\Notifications\ScheduledTask\TaskFailed;
+use App\Notifications\ScheduledTask\TaskSuccess;
+use App\Notifications\Server\DockerCleanupFailed;
+use App\Notifications\Server\DockerCleanupSuccess;
+use App\Notifications\Server\HighDiskUsage;
+use App\Notifications\Server\Reachable;
+use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\Unreachable;
 
 class TelegramChannel
 {
@@ -17,24 +32,24 @@ class TelegramChannel
         $chatId = $settings->telegram_chat_id;
 
         $threadId = match (get_class($notification)) {
-            \App\Notifications\Application\DeploymentSuccess::class => $settings->telegram_notifications_deployment_success_thread_id,
-            \App\Notifications\Application\DeploymentFailed::class => $settings->telegram_notifications_deployment_failure_thread_id,
-            \App\Notifications\Application\StatusChanged::class,
-            \App\Notifications\Container\ContainerRestarted::class,
-            \App\Notifications\Container\ContainerStopped::class => $settings->telegram_notifications_status_change_thread_id,
+            DeploymentSuccess::class => $settings->telegram_notifications_deployment_success_thread_id,
+            DeploymentFailed::class => $settings->telegram_notifications_deployment_failure_thread_id,
+            StatusChanged::class,
+            ContainerRestarted::class => $settings->telegram_notifications_status_change_thread_id,
+            RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id,
 
-            \App\Notifications\Database\BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
-            \App\Notifications\Database\BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
+            BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
+            BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
 
-            \App\Notifications\ScheduledTask\TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
-            \App\Notifications\ScheduledTask\TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
+            TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
+            TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
 
-            \App\Notifications\Server\DockerCleanupSuccess::class => $settings->telegram_notifications_docker_cleanup_success_thread_id,
-            \App\Notifications\Server\DockerCleanupFailed::class => $settings->telegram_notifications_docker_cleanup_failure_thread_id,
-            \App\Notifications\Server\HighDiskUsage::class => $settings->telegram_notifications_server_disk_usage_thread_id,
-            \App\Notifications\Server\Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
-            \App\Notifications\Server\Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
-            \App\Notifications\Server\ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
+            DockerCleanupSuccess::class => $settings->telegram_notifications_docker_cleanup_success_thread_id,
+            DockerCleanupFailed::class => $settings->telegram_notifications_docker_cleanup_failure_thread_id,
+            HighDiskUsage::class => $settings->telegram_notifications_server_disk_usage_thread_id,
+            Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
+            Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
+            ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
 
             default => null,
         };
diff --git a/app/Notifications/Container/ContainerStopped.php b/app/Notifications/Container/ContainerStopped.php
deleted file mode 100644
index f518cd2fdd..0000000000
--- a/app/Notifications/Container/ContainerStopped.php
+++ /dev/null
@@ -1,123 +0,0 @@
-<?php
-
-namespace App\Notifications\Container;
-
-use App\Models\Server;
-use App\Notifications\CustomEmailNotification;
-use App\Notifications\Dto\DiscordMessage;
-use App\Notifications\Dto\PushoverMessage;
-use App\Notifications\Dto\SlackMessage;
-use Illuminate\Notifications\Messages\MailMessage;
-
-class ContainerStopped extends CustomEmailNotification
-{
-    public function __construct(public string $name, public Server $server, public ?string $url = null)
-    {
-        $this->onQueue('high');
-    }
-
-    public function via(object $notifiable): array
-    {
-        return $notifiable->getEnabledChannels('status_change');
-    }
-
-    public function toMail(): MailMessage
-    {
-        $mail = new MailMessage;
-        $mail->subject("Coolify: A resource  has been stopped unexpectedly on {$this->server->name}");
-        $mail->view('emails.container-stopped', [
-            'containerName' => $this->name,
-            'serverName' => $this->server->name,
-            'url' => $this->url,
-        ]);
-
-        return $mail;
-    }
-
-    public function toDiscord(): DiscordMessage
-    {
-        $message = new DiscordMessage(
-            title: ':cross_mark: Resource stopped',
-            description: "{$this->name} has been stopped unexpectedly on {$this->server->name}.",
-            color: DiscordMessage::errorColor(),
-        );
-
-        if ($this->url) {
-            $message->addField('Resource', '[Link]('.$this->url.')');
-        }
-
-        return $message;
-    }
-
-    public function toTelegram(): array
-    {
-        $message = "Coolify: A resource ($this->name) has been stopped unexpectedly on {$this->server->name}";
-        $payload = [
-            'message' => $message,
-        ];
-        if ($this->url) {
-            $payload['buttons'] = [
-                [
-                    [
-                        'text' => 'Open Application in Coolify',
-                        'url' => $this->url,
-                    ],
-                ],
-            ];
-        }
-
-        return $payload;
-    }
-
-    public function toPushover(): PushoverMessage
-    {
-        $buttons = [];
-        if ($this->url) {
-            $buttons[] = [
-                'text' => 'Open Application in Coolify',
-                'url' => $this->url,
-            ];
-        }
-
-        return new PushoverMessage(
-            title: 'Resource stopped',
-            level: 'error',
-            message: "A resource ({$this->name}) has been stopped unexpectedly on {$this->server->name}",
-            buttons: $buttons,
-        );
-    }
-
-    public function toSlack(): SlackMessage
-    {
-        $title = 'Resource stopped';
-        $description = "A resource ({$this->name}) has been stopped unexpectedly on {$this->server->name}";
-
-        if ($this->url) {
-            $description .= "\n*Resource URL:* {$this->url}";
-        }
-
-        return new SlackMessage(
-            title: $title,
-            description: $description,
-            color: SlackMessage::errorColor()
-        );
-    }
-
-    public function toWebhook(): array
-    {
-        $data = [
-            'success' => false,
-            'message' => 'Resource stopped unexpectedly',
-            'event' => 'container_stopped',
-            'container_name' => $this->name,
-            'server_name' => $this->server->name,
-            'server_uuid' => $this->server->uuid,
-        ];
-
-        if ($this->url) {
-            $data['url'] = $this->url;
-        }
-
-        return $data;
-    }
-}
diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
index dfa3bb3314..b5ca1922eb 100644
--- a/app/Providers/FortifyServiceProvider.php
+++ b/app/Providers/FortifyServiceProvider.php
@@ -9,10 +9,8 @@ use App\Actions\Fortify\UpdateUserProfileInformation;
 use App\Models\OauthSetting;
 use App\Models\TeamInvitation;
 use App\Models\User;
-use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 use Laravel\Fortify\Contracts\RegisterResponse;
 use Laravel\Fortify\Fortify;
@@ -122,45 +120,5 @@ class FortifyServiceProvider extends ServiceProvider
         Fortify::twoFactorChallengeView(function () {
             return view('auth.two-factor-challenge');
         });
-
-        RateLimiter::for('force-password-reset', function (Request $request) {
-            return Limit::perMinute(15)->by($request->user()->id);
-        });
-
-        RateLimiter::for('forgot-password', function (Request $request) {
-            // Use real client IP (not spoofable forwarded headers)
-            $realIp = $request->server('REMOTE_ADDR') ?? $request->ip();
-
-            $limits = [
-                Limit::perMinutes(10, 3)->by('forgot-password:ip:'.sha1($realIp)),
-            ];
-
-            $emailIdentity = normalize_email_identity($request->input('email'));
-            if ($emailIdentity !== null) {
-                $limits[] = Limit::perHour(3)->by('forgot-password:email-identity:'.sha1($emailIdentity));
-            }
-
-            return $limits;
-        });
-
-        RateLimiter::for('login', function (Request $request) {
-            $email = (string) $request->email;
-            // Use email + real client IP (not spoofable forwarded headers)
-            // server('REMOTE_ADDR') gives the actual connecting IP before proxy headers
-            $realIp = $request->server('REMOTE_ADDR') ?? $request->ip();
-
-            return Limit::perMinute(5)->by($email.'|'.$realIp);
-        });
-
-        RateLimiter::for('magic-link', function (Request $request) {
-            $realIp = $request->server('REMOTE_ADDR') ?? $request->ip();
-            $token = (string) $request->input('token');
-
-            return Limit::perMinute(5)->by(hash('sha256', $token.'|'.$realIp));
-        });
-
-        RateLimiter::for('two-factor', function (Request $request) {
-            return Limit::perMinute(5)->by($request->session()->get('login.id'));
-        });
     }
 }
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 4068572c81..79139c6b93 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -58,5 +58,34 @@ class RouteServiceProvider extends ServiceProvider
         RateLimiter::for('feedback', function (Request $request) {
             return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
         });
+
+        RateLimiter::for('login', function (Request $request) {
+            return Limit::perMinute(5)->by((string) $request->email.'|'.auth_rate_limit_ip($request));
+        });
+
+        RateLimiter::for('two-factor', function (Request $request) {
+            return Limit::perMinute(5)->by($request->session()->get('login.id'));
+        });
+
+        RateLimiter::for('forgot-password', function (Request $request) {
+            $limits = [
+                Limit::perMinutes(10, 3)->by('forgot-password:ip:'.sha1(auth_rate_limit_ip($request))),
+            ];
+
+            $emailIdentity = normalize_email_identity($request->input('email'));
+            if ($emailIdentity !== null) {
+                $limits[] = Limit::perHour(3)->by('forgot-password:email-identity:'.sha1($emailIdentity));
+            }
+
+            return $limits;
+        });
+
+        RateLimiter::for('magic-link', function (Request $request) {
+            return Limit::perMinute(5)->by(hash('sha256', (string) $request->input('token').'|'.auth_rate_limit_ip($request)));
+        });
+
+        RateLimiter::for('force-password-reset', function (Request $request) {
+            return Limit::perMinute(15)->by($request->user()->id);
+        });
     }
 }
diff --git a/app/Services/ContainerStatusAggregator.php b/app/Services/ContainerStatusAggregator.php
index 8859a99809..3a59ad58fa 100644
--- a/app/Services/ContainerStatusAggregator.php
+++ b/app/Services/ContainerStatusAggregator.php
@@ -18,14 +18,13 @@ use Illuminate\Support\Facades\Log;
  * State Priority (highest to lowest):
  * 1. Degraded (from sub-resources) → degraded:unhealthy
  * 2. Restarting → degraded:unhealthy (or restarting:unknown if preserveRestarting=true)
- * 3. Crash Loop (exited with restarts) → degraded:unhealthy
- * 4. Mixed (running + exited) → degraded:unhealthy
- * 5. Mixed (running + starting) → starting:unknown
- * 6. Running → running:healthy/unhealthy/unknown
- * 7. Dead/Removing → degraded:unhealthy
- * 8. Paused → paused:unknown
- * 9. Starting/Created → starting:unknown
- * 10. Exited → exited
+ * 3. Mixed (running + exited) → degraded:unhealthy
+ * 4. Mixed (running + starting) → starting:unknown
+ * 5. Running → running:healthy/unhealthy/unknown
+ * 6. Dead/Removing → degraded:unhealthy
+ * 7. Paused → paused:unknown
+ * 8. Starting/Created → starting:unknown
+ * 9. Exited → exited
  *
  * The $preserveRestarting parameter controls whether "restarting" containers should be
  * reported as "restarting:unknown" (true) or "degraded:unhealthy" (false, default).
@@ -228,23 +227,18 @@ class ContainerStatusAggregator
             return $preserveRestarting ? 'restarting:unknown' : 'degraded:unhealthy';
         }
 
-        // Priority 3: Crash loop detection (exited with restart count > 0)
-        if ($hasExited && $maxRestartCount > 0) {
-            return 'degraded:unhealthy';
-        }
-
-        // Priority 4: Mixed state (some running, some exited = degraded)
+        // Priority 3: Mixed state (some running, some exited = degraded)
         if ($hasRunning && $hasExited) {
             return 'degraded:unhealthy';
         }
 
-        // Priority 5: Mixed state (some running, some starting = still starting)
+        // Priority 4: Mixed state (some running, some starting = still starting)
         // If any component is still starting, the entire service stack is not fully ready
         if ($hasRunning && $hasStarting) {
             return 'starting:unknown';
         }
 
-        // Priority 6: Running containers (check health status)
+        // Priority 5: Running containers (check health status)
         if ($hasRunning) {
             if ($hasUnhealthy) {
                 return 'running:unhealthy';
@@ -255,22 +249,22 @@ class ContainerStatusAggregator
             }
         }
 
-        // Priority 7: Dead or removing containers
+        // Priority 6: Dead or removing containers
         if ($hasDead) {
             return 'degraded:unhealthy';
         }
 
-        // Priority 8: Paused containers
+        // Priority 7: Paused containers
         if ($hasPaused) {
             return 'paused:unknown';
         }
 
-        // Priority 9: Starting/created containers
+        // Priority 8: Starting/created containers
         if ($hasStarting) {
             return 'starting:unknown';
         }
 
-        // Priority 10: All containers exited (no restart count = truly stopped)
+        // Priority 9: All containers exited
         return 'exited';
     }
 }
diff --git a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
index 386bdd5bb9..e3ba77163d 100644
--- a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
+++ b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
@@ -7,6 +7,7 @@ use App\Models\EnvironmentVariable;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
 use App\Services\DeploymentConfiguration\Concerns\SummarizesDiffText;
+use App\Support\DomainPortOverrides;
 use Illuminate\Support\Arr;
 
 class ApplicationConfigurationSnapshot
@@ -194,6 +195,7 @@ class ApplicationConfigurationSnapshot
     {
         return [
             $this->item('fqdn', 'Domains', $this->application->fqdn, 'redeploy'),
+            $this->item('domain_port_overrides', 'Domain port overrides', DomainPortOverrides::sorted($this->application->domain_port_overrides), 'redeploy'),
             $this->item('noindex_domains', 'Search engine indexing', $this->application->noindexDomains()->all(), 'redeploy'),
             $this->item('docker_compose_domains', 'Service domains', $this->decodedComposeDomains(), 'redeploy', displayValue: $this->summarizeText($this->composeDomainsText()), displayFull: $this->composeDomainsText(), diffMode: 'lines'),
             $this->item('redirect', 'Redirect', $this->application->redirect, 'redeploy'),
diff --git a/app/Services/RestartCountTracker.php b/app/Services/RestartCountTracker.php
new file mode 100644
index 0000000000..e67deacb3c
--- /dev/null
+++ b/app/Services/RestartCountTracker.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Services;
+
+class RestartCountTracker
+{
+    /**
+     * @return array{restart_count: int, restart_count_changed: bool, restart_limit_reached: bool, new_generation: bool}
+     */
+    public function evaluate(
+        int $previousRestartCount,
+        int $observedRestartCount,
+        int $maxRestartCount,
+        bool $newGenerationConfirmed = false,
+    ): array {
+        $newGeneration = $newGenerationConfirmed
+            && $observedRestartCount < $previousRestartCount;
+        $restartCountIncreased = $observedRestartCount > $previousRestartCount;
+        $restartCountChanged = $newGeneration || $restartCountIncreased;
+
+        $restartLimitReached = $maxRestartCount > 0
+            && $observedRestartCount >= $maxRestartCount;
+
+        return [
+            'restart_count' => $restartCountChanged ? $observedRestartCount : $previousRestartCount,
+            'restart_count_changed' => $restartCountChanged,
+            'restart_limit_reached' => $restartLimitReached,
+            'new_generation' => $newGeneration,
+        ];
+    }
+}
diff --git a/app/Support/DomainPortOverrides.php b/app/Support/DomainPortOverrides.php
new file mode 100644
index 0000000000..320540ad68
--- /dev/null
+++ b/app/Support/DomainPortOverrides.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Support;
+
+class DomainPortOverrides
+{
+    /**
+     * @param  array<string, int|string>|null  $overrides
+     * @return array<string, int|string>
+     */
+    public static function sorted(?array $overrides): array
+    {
+        return collect($overrides ?? [])->sortKeys()->all();
+    }
+
+    public static function withoutPort(string $url): string
+    {
+        $parts = DomainUrlParts::split($url);
+
+        return DomainUrlParts::compose($parts['scheme'], $parts['host'], path: $parts['path']);
+    }
+
+    /**
+     * @param  array<string, int|string>|null  $existing
+     * @return array{fqdn: ?string, overrides: ?array<string, int>}
+     */
+    public static function normalize(?string $fqdn, ?array $existing): array
+    {
+        if (blank($fqdn)) {
+            return ['fqdn' => null, 'overrides' => null];
+        }
+
+        $existingOverrides = $existing ?? [];
+        $normalizedDomains = collect(explode(',', $fqdn))
+            ->map(fn (string $domain): string => trim($domain))
+            ->filter()
+            ->map(function (string $domain) use ($existingOverrides): array {
+                $portlessDomain = self::withoutPort($domain);
+                $parts = DomainUrlParts::split($domain);
+                $port = $parts['port'] !== ''
+                    ? (int) $parts['port']
+                    : ($existingOverrides[$portlessDomain] ?? null);
+
+                return ['domain' => $portlessDomain, 'port' => $port];
+            })
+            ->keyBy('domain')
+            ->values();
+
+        $effectiveOverrides = $normalizedDomains
+            ->filter(fn (array $domain): bool => filled($domain['port']))
+            ->mapWithKeys(fn (array $domain): array => [$domain['domain'] => (int) $domain['port']]);
+
+        $normalizedDomains = $normalizedDomains->map(function (array $domain) use ($effectiveOverrides): array {
+            if (filled($domain['port'])) {
+                return $domain;
+            }
+
+            $counterpart = self::wwwCounterpart($domain['domain']);
+            $domain['port'] = $counterpart === null ? null : $effectiveOverrides->get($counterpart);
+
+            return $domain;
+        });
+
+        $normalizedFqdn = $normalizedDomains->pluck('domain')->implode(',');
+        $overrides = $normalizedDomains
+            ->filter(fn (array $domain): bool => filled($domain['port']))
+            ->mapWithKeys(fn (array $domain): array => [$domain['domain'] => (int) $domain['port']])
+            ->all();
+
+        return [
+            'fqdn' => $normalizedFqdn === '' ? null : $normalizedFqdn,
+            'overrides' => $overrides ?: null,
+        ];
+    }
+
+    private static function wwwCounterpart(string $url): ?string
+    {
+        $parts = DomainUrlParts::split($url);
+        $host = $parts['host'];
+
+        if ($host === '') {
+            return null;
+        }
+
+        $counterpartHost = str_starts_with(strtolower($host), 'www.')
+            ? substr($host, 4)
+            : 'www.'.$host;
+
+        return DomainUrlParts::compose($parts['scheme'], $counterpartHost, path: $parts['path']);
+    }
+}
diff --git a/app/Support/ServiceComposeUrl.php b/app/Support/ServiceComposeUrl.php
index cdeb75e58d..5d3ded154a 100644
--- a/app/Support/ServiceComposeUrl.php
+++ b/app/Support/ServiceComposeUrl.php
@@ -25,15 +25,7 @@ class ServiceComposeUrl
             ->map(fn ($url) => trim((string) $url))
             ->filter();
 
-        foreach ($urls as $url) {
-            if (! filter_var($url, FILTER_VALIDATE_URL)) {
-                $errors[] = "Invalid URL: {$url}";
-            }
-            $scheme = parse_url($url, PHP_URL_SCHEME) ?? '';
-            if (! in_array(strtolower($scheme), ['http', 'https'], true)) {
-                $errors[] = "Invalid URL scheme: {$scheme} for URL: {$url}. Only http and https are supported.";
-            }
-        }
+        $errors = ValidationPatterns::validateApplicationDomains($urls->implode(','));
 
         $duplicates = $urls->duplicates()->unique()->values();
         if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 41b27f9ff9..4656406fc4 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -108,6 +108,11 @@ class ValidationPatterns
      */
     public const ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_.]*\z/u';
 
+    /**
+     * Pattern for environment variable keys written to shell-sourced files.
+     */
+    public const SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_]*\z/u';
+
     /**
      * Characters that are valid in some URL positions but unsafe for values
      * that are later reused in shell assignment contexts.
@@ -192,6 +197,43 @@ class ValidationPatterns
         return preg_match(self::ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) === 1;
     }
 
+    /**
+     * Make an environment variable key safe to show in deployment logs.
+     *
+     * Control characters are escaped and long values are truncated so an
+     * unexpected key cannot corrupt or overflow the deployment log output.
+     */
+    public static function displayShellEnvironmentVariableKey(string $value, int $maxLength = 80): string
+    {
+        $printable = str($value)
+            ->replace(["\0", "\r", "\n", "\t"], ['\\0', '\\r', '\\n', '\\t'])
+            ->value();
+
+        $printable = preg_replace_callback(
+            '/[\x00-\x1F\x7F]/',
+            fn (array $matches): string => sprintf('\\x%02X', ord($matches[0])),
+            $printable,
+        );
+
+        if ($printable === '') {
+            return '(empty)';
+        }
+
+        return str($printable)->limit($maxLength)->value();
+    }
+
+    /**
+     * Validate an environment variable key before writing it to a shell-sourced file.
+     */
+    public static function validatedShellEnvironmentVariableKey(string $value): string
+    {
+        if (preg_match(self::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) !== 1) {
+            throw new \InvalidArgumentException('Invalid environment variable name '.self::displayShellEnvironmentVariableKey($value).'. Names must start with a letter or underscore and contain only letters, numbers, and underscores.');
+        }
+
+        return $value;
+    }
+
     /**
      * Check if a string is a valid S3 bucket name.
      */
@@ -570,8 +612,23 @@ class ValidationPatterns
                 continue;
             }
 
-            if (blank(parse_url($url, PHP_URL_HOST))) {
+            $host = parse_url($url, PHP_URL_HOST);
+            if (blank($host)) {
                 $errors[] = "Invalid URL: {$url}";
+
+                continue;
+            }
+
+            $port = parse_url($url, PHP_URL_PORT);
+            if ($port !== null && ($port < 1 || $port > 65535)) {
+                $errors[] = "Invalid port for URL: {$url}. The port must be between 1 and 65535.";
+
+                continue;
+            }
+
+            $unwrappedHost = trim((string) $host, '[]');
+            if (! str_contains($unwrappedHost, '.') && filter_var($unwrappedHost, FILTER_VALIDATE_IP) === false) {
+                $errors[] = "Invalid URL: {$url}. The hostname must be a fully qualified domain name.";
             }
         }
 
diff --git a/app/Traits/HasNoindexDomains.php b/app/Traits/HasNoindexDomains.php
index c3ba8a7d86..7afe0d4f25 100644
--- a/app/Traits/HasNoindexDomains.php
+++ b/app/Traits/HasNoindexDomains.php
@@ -2,6 +2,7 @@
 
 namespace App\Traits;
 
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Support\Collection;
 
@@ -19,7 +20,7 @@ trait HasNoindexDomains
     {
         return collect($this->noindex_domains ?? [])
             ->filter(fn ($domain) => is_string($domain) && filled($domain))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain))
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain))
             ->unique()
             ->values();
     }
@@ -27,7 +28,7 @@ trait HasNoindexDomains
     public function isDomainNoindexed(string $domain): bool
     {
         return $this->noindexDomains()->contains(
-            ValidationPatterns::normalizeApplicationDomainUrl($domain)
+            $this->normalizeNoindexDomain($domain)
         );
     }
 
@@ -35,7 +36,7 @@ trait HasNoindexDomains
     {
         $this->noindex_domains = collect($domains)
             ->filter(fn ($domain) => is_string($domain) && filled($domain))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain))
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain))
             ->intersect($this->currentDomains())
             ->unique()
             ->values()
@@ -58,6 +59,13 @@ trait HasNoindexDomains
     private function currentDomains(): Collection
     {
         return collect(ValidationPatterns::applicationDomainList($this->fqdn))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain));
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain));
+    }
+
+    private function normalizeNoindexDomain(string $domain): string
+    {
+        return DomainPortOverrides::withoutPort(
+            ValidationPatterns::normalizeApplicationDomainUrl($domain)
+        );
     }
 }
diff --git a/app/Traits/HasRestartLimit.php b/app/Traits/HasRestartLimit.php
new file mode 100644
index 0000000000..edb461cdcd
--- /dev/null
+++ b/app/Traits/HasRestartLimit.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Traits;
+
+use App\Services\RestartCountTracker;
+
+trait HasRestartLimit
+{
+    public function initializeHasRestartLimit(): void
+    {
+        $this->mergeFillable(['restart_count', 'max_restart_count', 'restart_limit_reached', 'last_restart_at', 'last_restart_type']);
+        $this->mergeCasts([
+            'restart_count' => 'integer',
+            'max_restart_count' => 'integer',
+            'restart_limit_reached' => 'boolean',
+            'last_restart_at' => 'datetime',
+            'last_restart_type' => 'string',
+        ]);
+    }
+
+    public function stoppedAfterRestartLimit(): bool
+    {
+        return str($this->status)->startsWith('exited') && $this->restart_limit_reached === true;
+    }
+
+    public function trackRestartCount(int $observedRestartCount): bool
+    {
+        $state = (new RestartCountTracker)->evaluate(
+            previousRestartCount: $this->restart_count ?? 0,
+            observedRestartCount: $observedRestartCount,
+            maxRestartCount: $this->restartLimitMaximum(),
+        );
+
+        if ($state['restart_count_changed']) {
+            $hasCrashRestarts = $state['restart_count'] > 0;
+            $this->update([
+                'restart_count' => $state['restart_count'],
+                'last_restart_at' => $hasCrashRestarts ? now() : null,
+                'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
+            ]);
+        }
+
+        if (! $state['restart_limit_reached']) {
+            return false;
+        }
+
+        $claimed = $this->newQuery()
+            ->whereKey($this->getKey())
+            ->where('restart_limit_reached', false)
+            ->update(['restart_limit_reached' => true]) === 1;
+
+        if ($claimed) {
+            $this->restart_limit_reached = true;
+        }
+
+        return $claimed;
+    }
+
+    public function resetRestartLimit(): void
+    {
+        $this->update([
+            'restart_count' => 0,
+            'restart_limit_reached' => false,
+            'last_restart_at' => null,
+            'last_restart_type' => null,
+        ]);
+    }
+
+    public function restartLimitMaximum(): int
+    {
+        return $this->max_restart_count ?? 0;
+    }
+}
diff --git a/app/View/Components/Forms/Input.php b/app/View/Components/Forms/Input.php
index 7831c9f024..a1b01e2808 100644
--- a/app/View/Components/Forms/Input.php
+++ b/app/View/Components/Forms/Input.php
@@ -34,6 +34,8 @@ class Input extends Component
         public ?string $canGate = null,
         public mixed $canResource = null,
         public bool $autoDisable = true,
+        public bool $loading = false,
+        public string $loadingText = 'Loading...',
     ) {
         // Handle authorization-based disabling
         if ($this->canGate && $this->canResource && $this->autoDisable) {
diff --git a/bootstrap/helpers/auth.php b/bootstrap/helpers/auth.php
new file mode 100644
index 0000000000..7580fc1e06
--- /dev/null
+++ b/bootstrap/helpers/auth.php
@@ -0,0 +1,14 @@
+<?php
+
+use Illuminate\Http\Request;
+
+function auth_rate_limit_ip(Request $request): string
+{
+    $cloudflareIp = $request->header('CF-Connecting-IP');
+
+    if (isCloud() && is_string($cloudflareIp) && filter_var($cloudflareIp, FILTER_VALIDATE_IP) !== false) {
+        return $cloudflareIp;
+    }
+
+    return (string) $request->ip();
+}
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 00300d26a2..f80fccafb2 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -530,7 +530,7 @@ function isNoindexDomain(string $domain, ?Collection $noindex_domains): bool
         ->contains(ValidationPatterns::normalizeApplicationDomainUrl($domain));
 }
 
-function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null)
+function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, array $domainPortOverrides = [])
 {
     $labels = collect([]);
     if ($serviceLabels) {
@@ -554,7 +554,8 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if ($schema === 'https' && ! $is_force_https_enabled) {
             $siteAddress = "http://{$host}, https://{$host}";
         }
-        $port = $url->getPort();
+        $portlessDomain = ServiceApplication::withoutPort($domain);
+        $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
         $handle = 'handle_path';
         if (! $is_stripprefix_enabled) {
             $handle = 'handle';
@@ -600,7 +601,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
-function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true)
+function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
 {
     $labels = collect([]);
     $labels->push('traefik.enable=true');
@@ -655,7 +656,8 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
             $host = $url->getHost();
             $path = $url->getPath();
             $schema = $url->getScheme();
-            $port = $url->getPort();
+            $portlessDomain = ServiceApplication::withoutPort($domain);
+            $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
             if (is_null($port) && ! is_null($onlyPort)) {
                 $port = $onlyPort;
             }
@@ -898,6 +900,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            domainPortOverrides: $application->domain_port_overrides ?? [],
                         ));
                         break;
                     case ProxyTypes::CADDY->value:
@@ -914,6 +917,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            domainPortOverrides: $application->domain_port_overrides ?? [],
                         ));
                         break;
                 }
@@ -931,6 +935,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
                     escape_redirect_replacement_for_compose: false,
+                    domainPortOverrides: $application->domain_port_overrides ?? [],
                 ));
                 $labels = $labels->merge(fqdnLabelsForCaddy(
                     network: $application->destination->network,
@@ -945,6 +950,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_username: $application->http_basic_auth_username,
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
+                    domainPortOverrides: $application->domain_port_overrides ?? [],
                 ));
             }
         }
@@ -972,6 +978,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
                         escape_redirect_replacement_for_compose: false,
+                        domainPortOverrides: $preview->domain_port_overrides ?? [],
                     ));
                     break;
                 case ProxyTypes::CADDY->value:
@@ -987,6 +994,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_username: $application->http_basic_auth_username,
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
+                        domainPortOverrides: $preview->domain_port_overrides ?? [],
                     ));
                     break;
             }
@@ -1003,6 +1011,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
                 escape_redirect_replacement_for_compose: false,
+                domainPortOverrides: $preview->domain_port_overrides ?? [],
             ));
             $labels = $labels->merge(fqdnLabelsForCaddy(
                 network: $application->destination->network,
@@ -1016,6 +1025,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_username: $application->http_basic_auth_username,
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
+                domainPortOverrides: $preview->domain_port_overrides ?? [],
             ));
         }
     }
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index b47e570477..f65b626984 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1265,24 +1265,16 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         $fqdns = collect([]);
                     }
                 } else {
-                    $fqdns = $fqdns->map(function ($fqdn) use ($pullRequestId, $resource) {
-                        $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pullRequestId);
-                        $url = Url::fromString($fqdn);
-                        $template = $resource->preview_url_template;
-                        $host = $url->getHost();
-                        $schema = $url->getScheme();
-                        $portInt = $url->getPort();
-                        $port = $portInt !== null ? ':'.$portInt : '';
-                        $random = new_public_id();
-                        $preview_fqdn = str_replace('{{random}}', $random, $template);
-                        $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                        $preview_fqdn = str_replace('{{pr_id}}', $pullRequestId, $preview_fqdn);
-                        $preview_fqdn = "$schema://$preview_fqdn{$port}";
-                        $preview->fqdn = $preview_fqdn;
-                        $preview->save();
-
-                        return $preview_fqdn;
-                    });
+                    $generatedDomains = $fqdns->map(
+                        fn ($fqdn) => $preview->generatedPreviewDomain((string) $fqdn)
+                    );
+                    $fqdns = $generatedDomains->pluck('url');
+                    $preview->fqdn = $fqdns->implode(',');
+                    $preview->domain_port_overrides = $generatedDomains
+                        ->filter(fn (array $generated): bool => filled($generated['port']))
+                        ->mapWithKeys(fn (array $generated): array => [$generated['url'] => $generated['port']])
+                        ->all();
+                    $preview->save();
                 }
             }
         }
@@ -1359,6 +1351,14 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
+            $previewForPorts = $isPullRequest
+                ? ($resource->previews()->find($preview_id) ?? ApplicationPreview::where('application_id', $resource->id)->where('pull_request_id', $pullRequestId)->first())
+                : null;
+            $domainPortOverrides = $isPullRequest
+                ? ($previewForPorts?->domain_port_overrides ?? [])
+                : ($originalResource->domain_port_overrides ?? []);
+            $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
+            $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1374,8 +1374,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            domainPortOverrides: $domainPortOverrides,
                         ));
                         break;
                     case ProxyTypes::CADDY->value:
@@ -1389,9 +1391,11 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             predefinedPort: $predefinedPort,
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            domainPortOverrides: $domainPortOverrides,
                         ));
                         break;
                 }
@@ -1405,8 +1409,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    domainPortOverrides: $domainPortOverrides,
                 ));
                 $serviceLabels = $serviceLabels->merge(fqdnLabelsForCaddy(
                     network: $labelNetwork,
@@ -1418,9 +1424,11 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     predefinedPort: $predefinedPort,
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    domainPortOverrides: $domainPortOverrides,
                 ));
             }
         }
@@ -1849,11 +1857,7 @@ function serviceParser(Service $resource): Collection
                 // Only save fqdn to ServiceApplication, not ServiceDatabase
                 if ($isServiceApplication && is_null($savedService->fqdn)) {
                     // Save URL (with scheme) to database, not FQDN
-                    if ((int) $resource->compose_parsing_version >= 5 && version_compare(config('constants.coolify.version'), '4.0.0-beta.420.7', '>=')) {
-                        $savedService->fqdn = $urlWithPort;
-                    } else {
-                        $savedService->fqdn = $urlWithPort;
-                    }
+                    $savedService->fqdn = $url;
                     $savedService->save();
                 }
 
@@ -2636,6 +2640,9 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
+            $onlyPort = $originalResource instanceof ServiceApplication
+                ? ($originalResource->getRequiredPort() ?? $predefinedPort)
+                : $predefinedPort;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -2651,6 +2658,8 @@ function serviceParser(Service $resource): Collection
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
+                            domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
                         ));
@@ -2666,7 +2675,9 @@ function serviceParser(Service $resource): Collection
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             predefinedPort: $predefinedPort,
+                            domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
                         ));
@@ -2682,6 +2693,8 @@ function serviceParser(Service $resource): Collection
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
+                    domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
                 ));
@@ -2695,7 +2708,9 @@ function serviceParser(Service $resource): Collection
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     predefinedPort: $predefinedPort,
+                    domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
                 ));
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index 982dda5511..241368d388 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -346,7 +346,7 @@ function remove_iip($text)
     $text = preg_replace('/Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/i', 'Bearer '.REDACTED, $text);
 
     // GitHub tokens (ghp_ = personal, gho_ = OAuth, ghu_ = user-to-server, ghs_ = server-to-server, ghr_ = refresh)
-    $text = preg_replace('/\b(gh[pousr]_[A-Za-z0-9_]{36,})\b/', REDACTED, $text);
+    $text = preg_replace('/\bgh[pousr]_[A-Za-z0-9.\-_]{36,}(?![A-Za-z0-9.\-_])/', REDACTED, $text);
 
     // GitLab tokens (glpat- = personal access token, glcbt- = CI build token, glrt- = runner token)
     $text = preg_replace('/\b(gl(?:pat|cbt|rt)-[A-Za-z0-9\-_]{20,})\b/', REDACTED, $text);
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 07fdeb086f..96257a6323 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -1,5 +1,30 @@
 <?php
 
+function service_logo_urls(mixed $logo): array
+{
+    $defaultLogo = 'svgs/default.webp';
+
+    if (! is_string($logo) || $logo === '' || basename($logo) === basename($defaultLogo)) {
+        return [
+            'logo' => asset($defaultLogo),
+            'logo_cdn_url' => asset($defaultLogo),
+            'logo_default_url' => asset($defaultLogo),
+        ];
+    }
+
+    if (str_starts_with($logo, 'svg/')) {
+        $logo = 'svgs/'.str($logo)->after('svg/');
+    }
+
+    $logo = ltrim($logo, '/');
+
+    return [
+        'logo' => asset($logo),
+        'logo_cdn_url' => 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo,
+        'logo_default_url' => asset($defaultLogo),
+    ];
+}
+
 use App\Models\Application;
 use App\Models\Service;
 use App\Models\ServiceApplication;
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 8d0ab9b8c5..1112e9442b 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -12,6 +12,8 @@ use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -815,6 +817,54 @@ function firstDomainFromList(?string $fqdns): string
 {
     return trim((string) str($fqdns ?? '')->explode(',')->first());
 }
+function profile_avatar_url(User $user): string
+{
+    if ($user->avatar_storage_type === 's3') {
+        $url = s3_image_url($user->avatar_s3_storage_id, $user->avatar_path, $user->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('profile.avatar', ['v' => $user->updated_at->timestamp]);
+}
+
+function project_icon_url(Project $project): string
+{
+    if ($project->icon_storage_type === 's3') {
+        $url = s3_image_url($project->icon_s3_storage_id, $project->icon_path, $project->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('project.icon', [
+        'project_uuid' => $project->uuid,
+        'v' => $project->updated_at->timestamp,
+    ]);
+}
+
+function s3_image_url(?int $storageId, ?string $path, int $version): ?string
+{
+    if (! $storageId || blank($path)) {
+        return null;
+    }
+
+    $storage = S3Storage::query()
+        ->whereKey($storageId)
+        ->whereTeamId(0)
+        ->where('is_usable', true)
+        ->first();
+
+    if (! $storage) {
+        return null;
+    }
+
+    $baseUrl = config('constants.coolify.avatar_cdn_url') ?: $storage->awsUrl();
+
+    return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
+}
+
 /**
  * If fqdn is set, return it, otherwise return public ip.
  */
@@ -3053,6 +3103,12 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $redirectDirection = in_array(data_get($savedService, 'redirect'), ['www', 'non-www', 'both'], true)
                             ? data_get($savedService, 'redirect')
                             : 'both';
+                        $domainPortOverrides = $savedService instanceof ServiceApplication
+                            ? ($savedService->domain_port_overrides ?? [])
+                            : [];
+                        $onlyPort = $savedService instanceof ServiceApplication
+                            ? ($savedService->getRequiredPort() ?? $predefinedPort)
+                            : $predefinedPort;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($resource->server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
@@ -3065,8 +3121,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
+                                        onlyPort: $onlyPort,
                                         noindex_domains: $noindexDomains,
-                                        redirect_direction: $redirectDirection
+                                        redirect_direction: $redirectDirection,
+                                        domainPortOverrides: $domainPortOverrides,
                                     ));
                                     break;
                                 case ProxyTypes::CADDY->value:
@@ -3080,8 +3138,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
+                                        onlyPort: $onlyPort,
+                                        predefinedPort: $predefinedPort,
                                         noindex_domains: $noindexDomains,
-                                        redirect_direction: $redirectDirection
+                                        redirect_direction: $redirectDirection,
+                                        domainPortOverrides: $domainPortOverrides,
                                     ));
                                     break;
                             }
@@ -3095,8 +3156,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
+                                onlyPort: $onlyPort,
                                 noindex_domains: $noindexDomains,
-                                redirect_direction: $redirectDirection
+                                redirect_direction: $redirectDirection,
+                                domainPortOverrides: $domainPortOverrides,
                             ));
                             $serviceLabels = $serviceLabels->merge(fqdnLabelsForCaddy(
                                 network: $resource->destination->network,
@@ -3108,8 +3171,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
+                                onlyPort: $onlyPort,
+                                predefinedPort: $predefinedPort,
                                 noindex_domains: $noindexDomains,
-                                redirect_direction: $redirectDirection
+                                redirect_direction: $redirectDirection,
+                                domainPortOverrides: $domainPortOverrides,
                             ));
                         }
                     }
@@ -3808,6 +3874,13 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $fqdns = str($fqdns)->explode(',');
                         if ($pull_request_id !== 0) {
                             $preview = $resource->previews()->find($preview_id);
+                            if (! $preview) {
+                                try {
+                                    $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pull_request_id);
+                                } catch (ModelNotFoundException) {
+                                    throw new RuntimeException('Preview not found.');
+                                }
+                            }
                             $docker_compose_domains = json_decode(data_get($preview, 'docker_compose_domains') ?: '[]', true) ?: [];
                             if (count($docker_compose_domains) > 0) {
                                 $found_fqdn = getComposeServiceDomainString($docker_compose_domains, (string) $serviceName);
@@ -3817,22 +3890,20 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     $fqdns = collect([]);
                                 }
                             } else {
-                                $fqdns = $fqdns->map(function ($fqdn) use ($pull_request_id, $resource) {
-                                    $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pull_request_id);
-                                    $url = Url::fromString($fqdn);
-                                    $template = $resource->preview_url_template;
-                                    $host = $url->getHost();
-                                    $schema = $url->getScheme();
-                                    $random = new_public_id();
-                                    $preview_fqdn = str_replace('{{random}}', $random, $template);
-                                    $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                                    $preview_fqdn = str_replace('{{pr_id}}', $pull_request_id, $preview_fqdn);
-                                    $preview_fqdn = "$schema://$preview_fqdn";
-                                    $preview->fqdn = $preview_fqdn;
-                                    $preview->save();
-
-                                    return $preview_fqdn;
-                                });
+                                $generatedDomains = $fqdns->map(
+                                    fn ($fqdn) => $preview->generatedPreviewDomain((string) $fqdn)
+                                );
+                                $fqdns = $generatedDomains->pluck('url');
+                                $preview->fqdn = $fqdns->implode(',');
+                                $generatedOverrides = $generatedDomains
+                                    ->filter(fn (array $generated): bool => filled($generated['port']))
+                                    ->mapWithKeys(fn (array $generated): array => [$generated['url'] => $generated['port']])
+                                    ->all();
+                                $preview->domain_port_overrides = array_replace(
+                                    $preview->domain_port_overrides ?? [],
+                                    $generatedOverrides,
+                                );
+                                $preview->save();
                             }
                         }
                         $noindexDomains = $pull_request_id !== 0 ? $fqdns : $resource->noindexDomains();
@@ -3841,6 +3912,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                             ? $composeRedirect
                             : 'both';
+                        $domainPortOverrides = $pull_request_id === 0
+                            ? ($resource->domain_port_overrides ?? [])
+                            : ($preview?->domain_port_overrides ?? []);
+                        $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
+                        $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
@@ -3854,8 +3930,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                            onlyPort: $onlyPort,
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
+                                            domainPortOverrides: $domainPortOverrides,
                                         )
                                     );
                                     break;
@@ -3870,8 +3948,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                            onlyPort: $onlyPort,
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
+                                            domainPortOverrides: $domainPortOverrides,
                                         )
                                     );
                                     break;
@@ -3887,8 +3967,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                    onlyPort: $onlyPort,
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
+                                    domainPortOverrides: $domainPortOverrides,
                                 )
                             );
                             $serviceLabels = $serviceLabels->merge(
@@ -3901,8 +3983,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                    onlyPort: $onlyPort,
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
+                                    domainPortOverrides: $domainPortOverrides,
                                 )
                             );
                         }
diff --git a/composer.json b/composer.json
index c0ffc6f07f..4778cc91dd 100644
--- a/composer.json
+++ b/composer.json
@@ -22,7 +22,7 @@
         "laravel/mcp": "^0.6.7",
         "laravel/nightwatch": "^1.28.6",
         "laravel/pail": "^1.2.7",
-        "laravel/prompts": "^0.3.22|^0.3.22|^0.3.22",
+        "laravel/prompts": "^0.3.22",
         "laravel/sanctum": "^4.3.3",
         "laravel/socialite": "^5.29.0",
         "laravel/tinker": "^2.11.1",
diff --git a/composer.lock b/composer.lock
index b77aef46f5..55be2166b6 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3644,16 +3644,16 @@
         },
         {
             "name": "livewire/livewire",
-            "version": "v3.8.3",
+            "version": "v3.8.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/livewire/livewire.git",
-                "reference": "ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2"
+                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/livewire/livewire/zipball/ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2",
-                "reference": "ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2",
+                "url": "https://api.github.com/repos/livewire/livewire/zipball/ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
+                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
                 "shasum": ""
             },
             "require": {
@@ -3708,7 +3708,7 @@
             "description": "A front-end framework for Laravel.",
             "support": {
                 "issues": "https://github.com/livewire/livewire/issues",
-                "source": "https://github.com/livewire/livewire/tree/v3.8.3"
+                "source": "https://github.com/livewire/livewire/tree/v3.8.7"
             },
             "funding": [
                 {
@@ -3716,7 +3716,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-07-31T00:08:18+00:00"
+            "time": "2026-08-31T15:40:46+00:00"
         },
         {
             "name": "log1x/laravel-webfonts",
diff --git a/config/constants.php b/config/constants.php
index ca05db48f4..457a8a1ff8 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,9 +2,9 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.11',
-        'helper_version' => '1.0.15',
-        'realtime_version' => '1.0.17',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.15',
+        'helper_version' => '1.0.16',
+        'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
@@ -14,6 +14,7 @@ return [
         'realtime_image' => env('REALTIME_IMAGE', env('REGISTRY_URL', 'docker.io').'/coollabsio/coolify-realtime'),
         'is_windows_docker_desktop' => env('IS_WINDOWS_DOCKER_DESKTOP', false),
         'cdn_url' => env('CDN_URL', 'https://cdn.coollabs.io'),
+        'avatar_cdn_url' => env('AVATAR_CDN_URL'),
         'versions_url' => env('VERSIONS_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/versions.json'),
         'upgrade_script_url' => env('UPGRADE_SCRIPT_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/upgrade.sh'),
         'releases_url' => env('RELEASES_URL', 'https://cdn.coollabs.io/coolify/releases.json'),
diff --git a/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php b/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
new file mode 100644
index 0000000000..fd1865ed32
--- /dev/null
+++ b/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->json('domain_dns_statuses')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn('domain_dns_statuses');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php b/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
new file mode 100644
index 0000000000..fc59fb587b
--- /dev/null
+++ b/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->boolean('container_present')->nullable()->after('status');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('container_present');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php b/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
new file mode 100644
index 0000000000..80603ee978
--- /dev/null
+++ b/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached')->default(false)->after('max_restart_count');
+        });
+
+        DB::table('applications')
+            ->where('status', 'like', 'exited%')
+            ->where('restart_count', '>', 0)
+            ->where('max_restart_count', '>', 0)
+            ->whereColumn('restart_count', '>=', 'max_restart_count')
+            ->where('last_restart_type', 'crash')
+            ->update(['restart_limit_reached' => true]);
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php b/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
new file mode 100644
index 0000000000..adf119a6e0
--- /dev/null
+++ b/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php b/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
new file mode 100644
index 0000000000..0838ad4bd7
--- /dev/null
+++ b/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php b/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
new file mode 100644
index 0000000000..046b02960c
--- /dev/null
+++ b/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php b/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
new file mode 100644
index 0000000000..641da5b759
--- /dev/null
+++ b/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_postgresqls', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_postgresqls', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php b/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
new file mode 100644
index 0000000000..24329da9f3
--- /dev/null
+++ b/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_redis', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_redis', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php b/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
new file mode 100644
index 0000000000..08980a7cb8
--- /dev/null
+++ b/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mongodbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mongodbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php b/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
new file mode 100644
index 0000000000..729f852739
--- /dev/null
+++ b/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mysqls', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mysqls', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php b/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
new file mode 100644
index 0000000000..6bada23268
--- /dev/null
+++ b/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mariadbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mariadbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php b/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
new file mode 100644
index 0000000000..41a983924b
--- /dev/null
+++ b/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_keydbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_keydbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php b/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
new file mode 100644
index 0000000000..23d8ccf2c0
--- /dev/null
+++ b/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_dragonflies', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_dragonflies', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php b/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
new file mode 100644
index 0000000000..5ec8d4522c
--- /dev/null
+++ b/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_clickhouses', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_clickhouses', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php b/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
new file mode 100644
index 0000000000..e4db4b7e8c
--- /dev/null
+++ b/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('email_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_email_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('email_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_email_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php b/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
new file mode 100644
index 0000000000..b7803e6335
--- /dev/null
+++ b/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('discord_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_discord_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('discord_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_discord_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php b/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
new file mode 100644
index 0000000000..51880ceb81
--- /dev/null
+++ b/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('telegram_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_telegram_notifications')->default(true);
+            $table->text('telegram_notifications_restart_limit_reached_thread_id')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('telegram_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_telegram_notifications');
+            $table->dropColumn('telegram_notifications_restart_limit_reached_thread_id');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php b/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
new file mode 100644
index 0000000000..0b82b423f8
--- /dev/null
+++ b/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('slack_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_slack_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('slack_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_slack_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php b/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
new file mode 100644
index 0000000000..596af0b5cc
--- /dev/null
+++ b/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('pushover_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_pushover_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('pushover_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_pushover_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php b/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
new file mode 100644
index 0000000000..cc03cf0f52
--- /dev/null
+++ b/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('webhook_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_webhook_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('webhook_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_webhook_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php b/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
new file mode 100644
index 0000000000..c51551e792
--- /dev/null
+++ b/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php b/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
new file mode 100644
index 0000000000..f208c5865f
--- /dev/null
+++ b/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php b/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
new file mode 100644
index 0000000000..80fc8a0618
--- /dev/null
+++ b/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 0d7caceb95..ebf12379d5 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.17'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index 33709873f2..cc266e5562 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -97,7 +97,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.17'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/docker/coolify-realtime/terminal-server.js b/docker/coolify-realtime/terminal-server.js
index 0d7b6dcdd9..b72574c8d0 100755
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@@ -10,6 +10,8 @@ import {
     extractTimeout,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
+    sanitizeSshArgs,
+    validateSshArgs,
 } from './terminal-utils.js';
 
 async function postToCoolify(path, headers) {
@@ -384,6 +386,16 @@ async function handleCommand(ws, command, userId) {
         return;
     }
 
+    if (!validateSshArgs(sshArgs, userSession.authorizedIPs)) {
+        logTerminal('warn', 'Rejecting terminal command because its SSH arguments are not allowed.', {
+            userId,
+            targetHost,
+        });
+        ws.send('Invalid SSH command: Unsupported SSH arguments');
+        return;
+    }
+    const sanitizedSshArgs = sanitizeSshArgs(sshArgs);
+
     const options = {
         name: 'xterm-color',
         cols: 80,
@@ -401,7 +413,7 @@ async function handleCommand(ws, command, userId) {
         commandTimeout,
         terminalSessionTimeout,
     });
-    const ptyProcess = pty.spawn('ssh', sshArgs.concat([hereDocContent]), options);
+    const ptyProcess = pty.spawn('ssh', sanitizedSshArgs.concat([hereDocContent]), options);
 
     userSession.ptyProcess = ptyProcess;
     userSession.isActive = true;
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index 61f82f6265..c6865f1800 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -131,3 +131,133 @@ export function isAuthorizedTargetHost(targetHost, authorizedHosts = []) {
         .map(host => normalizeHostForAuthorization(host))
         .includes(normalizedTargetHost);
 }
+
+const REQUIRED_SSH_OPTIONS = new Set([
+    'StrictHostKeyChecking',
+    'UserKnownHostsFile',
+    'PasswordAuthentication',
+    'ConnectTimeout',
+    'ServerAliveInterval',
+    'RequestTTY',
+    'LogLevel',
+]);
+
+function isAllowedSshOption(name, value) {
+    const fixedOptions = {
+        StrictHostKeyChecking: 'no',
+        UserKnownHostsFile: '/dev/null',
+        PasswordAuthentication: 'no',
+        LogLevel: 'ERROR',
+        ControlMaster: 'auto',
+        ProxyCommand: 'cloudflared access ssh --hostname %h',
+    };
+
+    if (Object.hasOwn(fixedOptions, name)) {
+        return value === fixedOptions[name];
+    }
+
+    if (name === 'RequestTTY') {
+        return value === 'yes' || value === 'no';
+    }
+
+    if (name === 'ConnectTimeout' || name === 'ServerAliveInterval' || name === 'ControlPersist') {
+        return /^\d+$/.test(value) && Number(value) > 0;
+    }
+
+    if (name === 'ControlPath') {
+        return /^\/var\/www\/html\/storage\/app\/ssh\/mux\/mux_[a-zA-Z0-9_-]+$/.test(value);
+    }
+
+    return false;
+}
+
+export function validateSshArgs(sshArgs, authorizedHosts = []) {
+    if (!Array.isArray(sshArgs) || sshArgs.length === 0) {
+        return false;
+    }
+
+    const seenOptions = new Set();
+    let hasIdentityFile = false;
+    let hasPort = false;
+    let targetHost = null;
+
+    for (let index = 0; index < sshArgs.length; index++) {
+        const argument = sshArgs[index];
+
+        if (typeof argument !== 'string' || /[\0\r\n]/.test(argument)) {
+            return false;
+        }
+
+        if (argument === '-i') {
+            const identityFile = sshArgs[++index];
+            if (hasIdentityFile || !/^\/var\/www\/html\/storage\/app\/ssh\/keys\/ssh_key@[a-zA-Z0-9_-]+$/.test(identityFile ?? '')) {
+                return false;
+            }
+            hasIdentityFile = true;
+            continue;
+        }
+
+        if (argument === '-p') {
+            const port = sshArgs[++index];
+            if (hasPort || !/^\d+$/.test(port ?? '') || Number(port) < 1 || Number(port) > 65535) {
+                return false;
+            }
+            hasPort = true;
+            continue;
+        }
+
+        if (argument === '-o') {
+            const option = sshArgs[++index];
+            const separator = option?.indexOf('=') ?? -1;
+            if (separator < 1) {
+                return false;
+            }
+
+            const name = option.slice(0, separator);
+            const value = option.slice(separator + 1);
+            if (seenOptions.has(name) || !isAllowedSshOption(name, value)) {
+                return false;
+            }
+            seenOptions.add(name);
+            continue;
+        }
+
+        if (/^[a-zA-Z0-9_][a-zA-Z0-9._-]*@[^@]+$/.test(argument) && targetHost === null) {
+            targetHost = extractTargetHost([argument]);
+            continue;
+        }
+
+        return false;
+    }
+
+    const hasRequiredOptions = [...REQUIRED_SSH_OPTIONS].every(option => seenOptions.has(option));
+    const hasCompleteMultiplexingOptions =
+        !['ControlMaster', 'ControlPath', 'ControlPersist'].some(option => seenOptions.has(option))
+        || ['ControlMaster', 'ControlPath', 'ControlPersist'].every(option => seenOptions.has(option));
+
+    return hasIdentityFile
+        && hasPort
+        && targetHost !== null
+        && hasRequiredOptions
+        && hasCompleteMultiplexingOptions
+        && isAuthorizedTargetHost(targetHost, authorizedHosts);
+}
+
+export function sanitizeSshArgs(sshArgs) {
+    const multiplexingOptions = new Set(['ControlMaster', 'ControlPath', 'ControlPersist']);
+    const sanitizedArgs = [];
+
+    for (let index = 0; index < sshArgs.length; index++) {
+        if (sshArgs[index] === '-o') {
+            const optionName = sshArgs[index + 1]?.split('=', 1)[0];
+            if (multiplexingOptions.has(optionName)) {
+                index++;
+                continue;
+            }
+        }
+
+        sanitizedArgs.push(sshArgs[index]);
+    }
+
+    return sanitizedArgs;
+}
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index d3b639ba5f..7af98be898 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -7,6 +7,8 @@ import {
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
+    sanitizeSshArgs,
+    validateSshArgs,
 } from './terminal-utils.js';
 
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
@@ -56,6 +58,79 @@ test('isAuthorizedTargetHost rejects hosts that are not in the allowlist', () =>
     assert.equal(isAuthorizedTargetHost("'10.0.0.9'", ['10.0.0.5']), false);
 });
 
+test('validateSshArgs accepts the SSH arguments generated by Coolify', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p '22' 'root'@'10.0.0.5' 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), true);
+});
+
+test('validateSshArgs rejects an injected ProxyCommand', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 300 ssh -o 'ProxyCommand=/bin/busybox id >/tmp/marker' root@10.0.0.5 'bash -se' << \\ENDSSH\nENDSSH"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), false);
+});
+
+test('validateSshArgs accepts only the fixed Cloudflare ProxyCommand', () => {
+    const validArgs = extractSshArgs(
+        "timeout 3600 ssh -o ProxyCommand='cloudflared access ssh --hostname %h' -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@example.com 'bash -se' << \\$abc\necho hi\nabc"
+    );
+    const maliciousArgs = [...validArgs];
+    maliciousArgs[1] = 'ProxyCommand=cloudflared access ssh --hostname %h; id';
+
+    assert.equal(validateSshArgs(validArgs, ['example.com']), true);
+    assert.equal(validateSshArgs(maliciousArgs, ['example.com']), false);
+});
+
+test('validateSshArgs rejects unknown SSH options and key paths', () => {
+    const baseArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(['-F', '/tmp/config', ...baseArgs], ['10.0.0.5']), false);
+    assert.equal(validateSshArgs(['-i', '/tmp/attacker-key', ...baseArgs.slice(2)], ['10.0.0.5']), false);
+});
+
+test('validateSshArgs rejects a destination that begins with an option prefix', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 -evil@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), false);
+});
+
+test('sanitizeSshArgs removes SSH multiplexing options before spawning SSH', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/mux_cm123 -o ControlPersist=3600 -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), true);
+    assert.deepEqual(sanitizeSshArgs(sshArgs), [
+        '-i',
+        '/var/www/html/storage/app/ssh/keys/ssh_key@cm123',
+        '-o',
+        'StrictHostKeyChecking=no',
+        '-o',
+        'UserKnownHostsFile=/dev/null',
+        '-o',
+        'PasswordAuthentication=no',
+        '-o',
+        'ConnectTimeout=10',
+        '-o',
+        'ServerAliveInterval=20',
+        '-o',
+        'RequestTTY=yes',
+        '-o',
+        'LogLevel=ERROR',
+        '-p',
+        '22',
+        'root@10.0.0.5',
+    ]);
+});
+
 
 test('getTerminalSessionTimeout always enforces the maximum terminal session lifetime', () => {
     assert.equal(getTerminalSessionTimeout(null), MAX_TERMINAL_SESSION_TIMEOUT_SECONDS);
diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml
index 0d7caceb95..ebf12379d5 100644
--- a/other/nightly/docker-compose.prod.yml
+++ b/other/nightly/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.17'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/other/nightly/docker-compose.windows.yml b/other/nightly/docker-compose.windows.yml
index 43f6f0d0e9..32524c4f43 100644
--- a/other/nightly/docker-compose.windows.yml
+++ b/other/nightly/docker-compose.windows.yml
@@ -96,7 +96,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.17'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index d4e5b5c8c9..455918fdc0 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,16 +1,16 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.11"
+            "version": "4.3.15"
         },
         "nightly": {
             "version": "4.4-rc.1"
         },
         "helper": {
-            "version": "1.0.15"
+            "version": "1.0.16"
         },
         "realtime": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
             "version": "0.0.22"
diff --git a/public/svgs/executor.png b/public/svgs/executor.png
new file mode 100644
index 0000000000..a7cc57de9f
Binary files /dev/null and b/public/svgs/executor.png differ
diff --git a/resources/css/app.css b/resources/css/app.css
index 06fb672538..9b12a7a7c5 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -2207,6 +2207,14 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 /* Data table (layer-card body, full-bleed) */
+.data-table {
+    min-width: 0;
+    max-width: 100%;
+    overflow-x: auto;
+    overscroll-behavior-x: contain;
+    -webkit-overflow-scrolling: touch;
+}
+
 .data-table-header {
     display: grid;
     align-items: center;
@@ -2637,8 +2645,25 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .service-backup-table-grid {
-    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr);
-    min-width: 45rem;
+    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 7.5rem;
+    width: 100%;
+}
+
+.data-table-row.service-backup-table-grid {
+    background: var(--coollabs-base);
+    border-bottom: 1px solid var(--coollabs-fill);
+}
+
+.data-table-row.service-backup-table-grid:last-child {
+    border-bottom: 0;
+}
+
+.data-table-row.service-backup-table-grid:hover {
+    background: color-mix(in srgb, var(--coollabs-base) 98%, black);
+}
+
+.dark .data-table-row.service-backup-table-grid:hover {
+    background: color-mix(in srgb, var(--coollabs-base) 98%, white);
 }
 
 /* Persistent storage volumes: Name | Source | Destination | [PR suffix] | Backup | [Actions] */
diff --git a/resources/views/components/application/configuration-sidebar.blade.php b/resources/views/components/application/configuration-sidebar.blade.php
index 36578a043b..ee600c66d0 100644
--- a/resources/views/components/application/configuration-sidebar.blade.php
+++ b/resources/views/components/application/configuration-sidebar.blade.php
@@ -268,7 +268,8 @@
                                 <span class="menu-item-label">{{ $menuItem['label'] }}</span>
                                 @if ($menuItem['badge'] ?? false)
                                     <span class="shrink-0">
-                                        <livewire:project.application.server-status-badge :application="$application" />
+                                        <livewire:project.application.server-status-badge :application="$application"
+                                            :key="'application-server-status-'.$application->uuid" />
                                     </span>
                                 @endif
                             </a>
diff --git a/resources/views/components/application/restart-limit-warning.blade.php b/resources/views/components/application/restart-limit-warning.blade.php
new file mode 100644
index 0000000000..3d08c803d5
--- /dev/null
+++ b/resources/views/components/application/restart-limit-warning.blade.php
@@ -0,0 +1,10 @@
+@props(['application'])
+
+@if ($application->stoppedAfterRestartLimit())
+    @php($restartLimit = method_exists($application, 'restartLimitMaximum') ? $application->restartLimitMaximum() : ($application->max_restart_count ?? 0))
+    @php($displayRestartCount = max($application->restart_count ?? 0, $restartLimit))
+    <x-status-badge
+        status="Restart limit reached"
+        type="warning"
+        title="Container has crashed and Coolify stopped it after {{ $displayRestartCount }} restart attempts." />
+@endif
diff --git a/resources/views/components/backup-sidebar.blade.php b/resources/views/components/backup-sidebar.blade.php
index 90c86ddb55..a2177b690d 100644
--- a/resources/views/components/backup-sidebar.blade.php
+++ b/resources/views/components/backup-sidebar.blade.php
@@ -15,7 +15,7 @@
             'danger' => 'project.application.backup.danger',
         ],
         'service' => [
-            'back' => 'project.service.database.backups',
+            'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.database.backup.show',
             's3' => 'project.service.database.backup.s3',
             'retention' => 'project.service.database.backup.retention',
@@ -48,9 +48,11 @@
         ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'shield-alert'],
     ];
     $backLabel = $context === 'database' ? 'Back to database' : 'Back to backups';
-    $backParameters = $context === 'database'
-        ? collect($parameters)->except('backup_uuid')->all()
-        : $parameters;
+    $backParameters = match ($context) {
+        'database' => collect($parameters)->except('backup_uuid')->all(),
+        'service' => collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all(),
+        default => $parameters,
+    };
 @endphp
 
 <aside class="application-settings-navigation min-w-0 xl:self-start">
diff --git a/resources/views/components/backup-tabs.blade.php b/resources/views/components/backup-tabs.blade.php
new file mode 100644
index 0000000000..4898a29ed5
--- /dev/null
+++ b/resources/views/components/backup-tabs.blade.php
@@ -0,0 +1,62 @@
+@props([
+    'context',
+    'parameters',
+    'section',
+])
+
+@php
+    $routes = match ($context) {
+        'service-schedule' => [
+            'general' => true,
+            's3' => true,
+            'retention' => true,
+            'danger' => true,
+        ],
+        'service' => [
+            'general' => 'project.service.database.backup.show',
+            's3' => 'project.service.database.backup.s3',
+            'retention' => 'project.service.database.backup.retention',
+            'executions' => 'project.service.database.backup.executions',
+            'danger' => 'project.service.database.backup.danger',
+        ],
+        'service-volume' => [
+            'general' => 'project.service.volume-backups.show',
+            's3' => 'project.service.volume-backups.s3',
+            'retention' => 'project.service.volume-backups.retention',
+            'executions' => 'project.service.volume-backups.executions',
+            'danger' => 'project.service.volume-backups.danger',
+        ],
+    };
+
+    $items = collect([
+        ['key' => 'general', 'label' => 'General'],
+        ['key' => 's3', 'label' => 'S3 storage'],
+        ['key' => 'retention', 'label' => 'Retention'],
+        ['key' => 'executions', 'label' => 'Executions'],
+        ['key' => 'danger', 'label' => 'Danger Zone'],
+    ])->filter(fn (array $item): bool => isset($routes[$item['key']]));
+@endphp
+
+<nav aria-label="Backup sections"
+    class="flex min-w-0 flex-wrap gap-1 border-b border-neutral-200 pb-2 dark:border-white/[0.08]">
+    @foreach ($items as $item)
+        @if ($context === 'service-schedule')
+            <button type="button" @click="activeSection = '{{ $item['key'] }}'"
+                :class="activeSection === '{{ $item['key'] }}'
+                    ? 'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25'
+                    : 'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg'"
+                class="inline-flex h-8 shrink-0 cursor-pointer items-center rounded-md px-3 text-[13px] font-medium transition-colors">
+                {{ $item['label'] }}
+            </button>
+        @else
+            <a @class([
+                'inline-flex h-8 shrink-0 items-center rounded-md px-3 text-[13px] font-medium transition-colors',
+                'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25' => $section === $item['key'],
+                'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg' => $section !== $item['key'],
+            ])
+                {{ wireNavigate() }} href="{{ route($routes[$item['key']], $parameters) }}">
+                {{ $item['label'] }}
+            </a>
+        @endif
+    @endforeach
+</nav>
diff --git a/resources/views/components/forms/input.blade.php b/resources/views/components/forms/input.blade.php
index 2f96331643..4a94d3e02e 100644
--- a/resources/views/components/forms/input.blade.php
+++ b/resources/views/components/forms/input.blade.php
@@ -22,7 +22,11 @@
             @endif
         </div>
     @endif
-    @if ($type === 'password')
+    @if ($loading)
+        <div class="{{ $defaultClass }} flex w-full items-center text-neutral-500 dark:text-fg-dim" aria-busy="true">
+            <x-loading :text="$loadingText" />
+        </div>
+    @elseif ($type === 'password')
         <div class="relative" x-data="{ type: 'password' }" @success.window="type = 'password'">
             <input autocomplete="{{ $autocomplete }}" value="{{ $value }}"
                 x-bind:type="type"
@@ -33,7 +37,7 @@
                 @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
                 name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
                 aria-placeholder="{{ $attributes->get('placeholder') }}"
-                @if ($autofocus) x-ref="autofocusInput" @endif>
+                @if ($autofocus) x-ref="autofocusInput" autofocus @endif>
             @if ($allowToPeak)
                 <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
                     class="password-toggle flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer text-neutral-500 hover:text-black dark:text-neutral-400 dark:hover:text-white"
@@ -56,7 +60,7 @@
             maxlength="{{ $attributes->get('maxlength') }}"
             @if ($htmlId !== 'null') id={{ $htmlId }} @endif name="{{ $name }}"
             placeholder="{{ $attributes->get('placeholder') }}"
-            @if ($autofocus) x-ref="autofocusInput" @endif>
+            @if ($autofocus) x-ref="autofocusInput" autofocus @endif>
     @endif
     @if (!$label && $helper)
         <x-helper :helper="$helper" />
diff --git a/resources/views/components/forms/monaco-editor.blade.php b/resources/views/components/forms/monaco-editor.blade.php
index b0d4adb14e..69466f7daa 100644
--- a/resources/views/components/forms/monaco-editor.blade.php
+++ b/resources/views/components/forms/monaco-editor.blade.php
@@ -3,8 +3,6 @@
         monacoVersion: '0.52.2',
         monacoContent: @entangle($id),
         monacoLanguage: '',
-        monacoPlaceholder: true,
-        monacoPlaceholderText: 'Start typing here',
         monacoLoader: true,
         monacoFontSize: '15px',
         monacoId: $id('monaco-editor'),
@@ -14,20 +12,7 @@
         monacoEditor(editor) {
             editor.onDidChangeModelContent((e) => {
                 this.monacoContent = editor.getValue();
-                this.updatePlaceholder(editor.getValue());
             });
-            editor.onDidBlurEditorWidget(() => {
-                this.updatePlaceholder(editor.getValue());
-            });
-            editor.onDidFocusEditorWidget(() => {
-                this.updatePlaceholder(editor.getValue());
-            });
-        },
-        updatePlaceholder(value) {
-            this.monacoPlaceholder = value === '';
-        },
-        monacoEditorFocus() {
-            document.getElementById(this.monacoId).dispatchEvent(new CustomEvent('monaco-editor-focused', { detail: { monacoId: this.monacoId } }));
         },
         monacoEditorAddLoaderScriptToHead() {
             // Use a global flag to prevent duplicate script loading
@@ -111,6 +96,7 @@
                         lineNumbersMinChars: 3,
                         automaticLayout: true,
                         language: '{{ $language }}',
+                        placeholder: 'Start typing here',
                         domReadOnly: '{{ $readonly ?? false }}',
                         contextmenu: '!{{ $readonly ?? false }}',
                         renderLineHighlight: 'none',
@@ -143,13 +129,8 @@
                     });
         
                     monacoEditor(editor);
-        
-                    document.getElementById(monacoId).editor = editor;
-                    document.getElementById(monacoId).addEventListener('monaco-editor-focused', (event) => {
-                        editor.focus();
-                    });
 
-                    updatePlaceholder(editor.getValue());
+                    document.getElementById(monacoId).editor = editor;
 
                     @if ($autofocus)
                     // Auto-focus the editor
@@ -172,10 +153,6 @@
         </div>
         <div class="relative z-10 w-full h-full">
             <div x-ref="monacoEditorElement" class="w-full text-md {{ $readonly ? 'opacity-65' : '' }}" style="height: var(--editor-height, calc(100vh - 20rem)); min-height: 150px;"></div>
-            <div x-ref="monacoPlaceholderElement" x-show="monacoPlaceholder" @click="monacoEditorFocus()"
-                :style="'font-size: ' + monacoFontSize"
-                class="w-full text-sm font-mono absolute z-50 text-gray-500 ml-14 -translate-x-0.5 mt-0.5 left-0 top-0"
-                x-text="monacoPlaceholderText"></div>
         </div>
     </div>
 </div>
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index b80e3d649b..588032e039 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -47,7 +47,7 @@
                 x-transition:enter-end="opacity-100" x-transition:leave="ease-in duration-100"
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
-            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-4 sm:items-center">
+            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-2 sm:items-center sm:p-4">
                 <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
                     x-transition:enter="ease-out duration-100"
                     x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
@@ -61,19 +61,22 @@
                         'lg:w-auto lg:min-w-2xl lg:max-w-4xl' => ! $isLarge,
                     ])
                     style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
-                    <header class="flex-nowrap!">
+                    <header class="flex-wrap! sm:flex-nowrap!">
                         <h3 class="min-w-0 flex-1 truncate">{{ $title }}</h3>
                         @isset($headerActions)
-                            <div class="flex shrink-0 items-center gap-2">
+                            <div class="order-3 w-full sm:order-none sm:w-auto flex shrink-0 items-center gap-2">
                                 {{ $headerActions }}
                             </div>
                         @endisset
                         <button type="button" @click="modalOpen=false"
-                            class="flex size-7 shrink-0 cursor-pointer items-center justify-center rounded-md text-neutral-500 outline-0 transition-colors hover:bg-neutral-100 hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                            class="order-2 sm:order-none flex size-7 shrink-0 cursor-pointer items-center justify-center rounded-md text-neutral-500 outline-0 transition-colors hover:bg-neutral-100 hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                             <x-reicon name="x" class="size-4" />
                         </button>
                     </header>
-                    <div class="application-settings-section-body min-h-0 flex-1 overflow-y-auto"
+                    <div @class([
+                        'application-settings-section-body min-h-0 flex-1 overflow-y-auto',
+                        'mt-2 sm:mt-0' => isset($headerActions),
+                    ])
                         style="-webkit-overflow-scrolling: touch;">
                         {{ $slot }}
                     </div>
diff --git a/resources/views/components/notification/event-grid.blade.php b/resources/views/components/notification/event-grid.blade.php
index 2ce6a4a7f7..55b452cf5e 100644
--- a/resources/views/components/notification/event-grid.blade.php
+++ b/resources/views/components/notification/event-grid.blade.php
@@ -9,10 +9,17 @@
         'Deployments' => [
             ['key' => 'deploymentSuccess', 'label' => 'Deployment success'],
             ['key' => 'deploymentFailure', 'label' => 'Deployment failure'],
+        ],
+        'Resources' => [
             [
                 'key' => 'statusChange',
-                'label' => 'Container status changes',
-                'helper' => 'Notify when a container stops or restarts.',
+                'label' => 'Resource status changes',
+                'helper' => 'Notify when a resource stops or Coolify automatically restarts it.',
+            ],
+            [
+                'key' => 'restartLimitReached',
+                'label' => 'Restart limit reached',
+                'helper' => 'Notify when a resource is stopped after reaching its restart limit.',
             ],
         ],
         'Backups' => [
diff --git a/resources/views/components/service-database/sidebar.blade.php b/resources/views/components/service-database/sidebar.blade.php
index 610cbd9493..756cc6068a 100644
--- a/resources/views/components/service-database/sidebar.blade.php
+++ b/resources/views/components/service-database/sidebar.blade.php
@@ -1,11 +1,9 @@
 @props([
     'parameters',
     'serviceDatabase',
-    'isImportSupported' => false,
 ])
 
 @php
-    $serviceParameters = \Illuminate\Support\Arr::except($parameters, ['stack_service_uuid']);
     $items = [
         [
             'label' => 'General',
@@ -19,22 +17,6 @@
             'icon' => 'grid',
             'active' => request()->routeIs('project.service.index.advanced'),
         ],
-        [
-            'label' => 'Backups',
-            'route' => 'project.service.volume-backups.index',
-            'parameters' => $serviceParameters,
-            'icon' => 'storages',
-            'active' => request()->routeIs('project.service.database.backup*'),
-            'visible' => $serviceDatabase?->isBackupSolutionAvailable() || $serviceDatabase?->is_migrated,
-        ],
-        [
-            'label' => 'Import Backup',
-            'route' => 'project.service.database.import',
-            'icon' => 'upload',
-            'active' => request()->routeIs('project.service.database.import'),
-            'visible' => $isImportSupported,
-            'navigate' => false,
-        ],
     ];
 
     $items = array_values(array_filter($items, fn (array $item): bool => $item['visible'] ?? true));
diff --git a/resources/views/components/service/configuration-sidebar.blade.php b/resources/views/components/service/configuration-sidebar.blade.php
index 5d2388ec62..e56b6a9934 100644
--- a/resources/views/components/service/configuration-sidebar.blade.php
+++ b/resources/views/components/service/configuration-sidebar.blade.php
@@ -13,6 +13,7 @@
         ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
         ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
         ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
+        ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
         ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
         ['label' => 'Files', 'route' => 'project.service.files', 'icon' => 'folder', 'visible' => auth()->user()?->can('canAccessTerminal')],
@@ -28,13 +29,15 @@
                 || ($item['route'] === 'project.service.scheduled-tasks.show'
                     && str($currentRoute)->startsWith('project.service.scheduled-tasks'))
                 || ($item['route'] === 'project.service.volume-backups.index'
-                    && str($currentRoute)->startsWith('project.service.volume-backups')),
+                    && str($currentRoute)->startsWith('project.service.volume-backups'))
+                || ($item['route'] === 'project.service.import-backup'
+                    && str($currentRoute)->startsWith('project.service.import-backup')),
         ]);
 
     $menuGroups = [
         'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
         'Observe & troubleshoot' => ['Runtime Logs', 'Terminal', 'Files'],
-        'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
+        'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
         'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
     ];
 
diff --git a/resources/views/components/status-summary.blade.php b/resources/views/components/status-summary.blade.php
index aee198a52b..88102f57ef 100644
--- a/resources/views/components/status-summary.blade.php
+++ b/resources/views/components/status-summary.blade.php
@@ -23,7 +23,7 @@
 
     $containerType = match (true) {
         str($containerStatus)->startsWith('running') => 'success',
-        str($containerStatus)->startsWith(['starting', 'restarting']) => 'warning',
+        str($containerStatus)->startsWith(['starting', 'restarting', 'degraded']) => 'warning',
         default => 'error',
     };
 
@@ -36,6 +36,7 @@
 
     [$summaryLabel, $summaryType] = match (true) {
         $containerType === 'error' => [$containerLabel, 'error'],
+        str($containerStatus)->startsWith('degraded') => ['Degraded', 'warning'],
         $healthType === 'error' => ['Degraded', 'error'],
         $containerType === 'warning' => [$containerLabel, 'warning'],
         $monitoringExcluded => ["{$containerLabel} (monitoring disabled)", 'warning'],
diff --git a/resources/views/components/status/index.blade.php b/resources/views/components/status/index.blade.php
index d774fa94ce..aafa106a7c 100644
--- a/resources/views/components/status/index.blade.php
+++ b/resources/views/components/status/index.blade.php
@@ -22,9 +22,7 @@
             title="Container has restarted {{ $resource->restart_count }} time{{ $resource->restart_count > 1 ? 's' : '' }}. Last restart: {{ $resource->last_restart_at?->diffForHumans() }}" />
     @endif
     @if ($stoppedAfterRestartLimit)
-        <x-status-badge status="Stopped after reaching restart limit ({{ $resource->restart_count }}/{{ $resource->max_restart_count }})."
-            type="warning"
-            title="Container has crashed and Coolify stopped it after {{ $resource->restart_count }} restart attempts." />
+        <x-application.restart-limit-warning :application="$resource" />
     @endif
     @if (!str($resource->status)->contains('exited') && $showRefreshButton)
         <x-status-badge as="button" wire:target="manualCheckStatus" wire:loading.attr="disabled"
diff --git a/resources/views/components/top-user-menu.blade.php b/resources/views/components/top-user-menu.blade.php
index b176f4f219..7fdc312cbc 100644
--- a/resources/views/components/top-user-menu.blade.php
+++ b/resources/views/components/top-user-menu.blade.php
@@ -15,7 +15,7 @@
     pageWidth: localStorage.getItem('pageWidth') || 'full',
     themeColor: localStorage.getItem('themeColor') || '#6b16ed',
     themeColorFrame: null,
-    avatarUrl: @js($user?->avatar_path ? route('profile.avatar', ['v' => $user->updated_at->timestamp]) : null),
+    avatarUrl: @js($user?->avatar_path ? profile_avatar_url($user) : null),
     openPanel() {
         this.appearanceOpen = false;
         this.open = true;
diff --git a/resources/views/emails/container-stopped.blade.php b/resources/views/emails/container-stopped.blade.php
deleted file mode 100644
index cc1cec1da9..0000000000
--- a/resources/views/emails/container-stopped.blade.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<x-emails.layout>
-A resource ({{ $containerName }}) has been stopped unexpectedly on {{ $serverName }}.
-
-@if ($url)
-Please check what is going on [here]({{ $url }}).
-@endif
-</x-emails.layout>
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index a8f4d0369d..ebee5d2a34 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -66,7 +66,7 @@
                                 <div
                                     class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                                     @if ($project->icon_path)
-                                        <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                        <img src="{{ project_icon_url($project) }}"
                                             alt="{{ $project->name }} icon"
                                             class="h-full w-full rounded-lg object-cover">
                                     @else
diff --git a/resources/views/livewire/global-search.blade.php b/resources/views/livewire/global-search.blade.php
index 43d6e6b55a..9e714b59f9 100644
--- a/resources/views/livewire/global-search.blade.php
+++ b/resources/views/livewire/global-search.blade.php
@@ -655,7 +655,9 @@
                                             class="search-result-item command-palette-item">
                                             <template x-if="item.logo">
                                                 <div class="command-palette-item-icon">
-                                                    <img :src="'/' + item.logo" :alt="item.name">
+                                                    <img :src="item.logo.startsWith('http') ? item.logo : '/' + item.logo"
+                                                        :alt="item.name"
+                                                        x-on:error="if (item.logo_cdn_url && !$el.dataset.cdnTried) { $el.dataset.cdnTried = 'true'; $el.src = item.logo_cdn_url; } else if (item.logo_default_url && !$el.dataset.defaultTried) { $el.dataset.defaultTried = 'true'; $el.src = item.logo_default_url; }">
                                                 </div>
                                             </template>
                                             <template x-if="!item.logo">
diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 2e5f6a02db..693c332d95 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -11,7 +11,7 @@
     reminderCollapseAfter: 10000,
     isDevelopment: {{ isDev() ? 'true' : 'false' }},
     init() {
-        this.popups.sponsorship = this.shouldShowMonthlyPopup('popupSponsorship');
+        this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup('popupSponsorship');
         this.popups.notification = this.shouldShowMonthlyPopup('popupNotification');
         this.popups.realtime = localStorage.getItem('popupRealtime');
 
@@ -86,7 +86,7 @@
         return isDifferentMonth;
         {{-- } --}}
     }
-}">
+}" x-on:show-sponsorship-reminder.window="popups.sponsorship = true; reminders.sponsorship.compact = false">
     @auth
         <span x-show="popups.realtime === true">
             @if (!isCloud())
@@ -140,11 +140,12 @@
             @endif
         </span>
     @endauth
-    @if (instanceSettings()->is_sponsorship_popup_enabled && !isCloud())
+    @if ((isDev() || instanceSettings()->is_sponsorship_popup_enabled) && ! isCloud())
         <span x-show="popups.sponsorship">
             <x-popup>
                 <x-slot:customActions>
                     <div class="relative mx-auto flex w-full flex-col overflow-hidden rounded-2xl border border-neutral-200 bg-white shadow-modal transition-all duration-300 dark:border-white/[0.1] dark:bg-surface"
+                        x-on:show-sponsorship-reminder.window="bannerVisible = true"
                         :class="reminders.sponsorship.compact ? 'max-w-sm gap-3 p-4' : 'max-w-2xl gap-5 p-5 sm:p-6'">
                         <button type="button" aria-label="Dismiss sponsorship reminder"
                             class="absolute top-3 right-3 flex size-7 items-center justify-center rounded-full text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg"
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index a41e72cb7a..fdc2ac672a 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -149,7 +149,11 @@
                         :events="[
                             ['property' => 'deploymentSuccessEmailNotifications', 'label' => 'Deployment success', 'enabled' => $deploymentSuccessEmailNotifications],
                             ['property' => 'deploymentFailureEmailNotifications', 'label' => 'Deployment failure', 'enabled' => $deploymentFailureEmailNotifications],
-                            ['property' => 'statusChangeEmailNotifications', 'label' => 'Container status changes', 'enabled' => $statusChangeEmailNotifications],
+                        ]" />
+                    <x-notification.event-multiselect :settings="$settings" id="resource-email-events" label="Resources"
+                        :events="[
+                            ['property' => 'statusChangeEmailNotifications', 'label' => 'Resource status changes', 'enabled' => $statusChangeEmailNotifications],
+                            ['property' => 'restartLimitReachedEmailNotifications', 'label' => 'Restart limit reached', 'enabled' => $restartLimitReachedEmailNotifications],
                         ]" />
                     <x-notification.event-multiselect :settings="$settings" id="backup-email-events" label="Backups"
                         :events="[
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index da5329a475..cc8c094b1e 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -91,7 +91,7 @@
                     <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
                         class="h-full w-full object-cover">
                     @if (auth()->user()->avatar_path)
-                        <img src="{{ route('profile.avatar', ['v' => auth()->user()->updated_at->timestamp]) }}"
+                        <img src="{{ profile_avatar_url(auth()->user()) }}"
                             x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
                     @else
                         <span x-show="!preview">
@@ -249,9 +249,10 @@
                                 </p>
                             </div>
                             <form action="/user/confirmed-two-factor-authentication" method="POST"
-                                class="flex items-end gap-2">
+                                class="flex items-end gap-2"
+                                x-init="$nextTick(() => $el.querySelector('input[name=code]')?.focus())">
                                 @csrf
-                                <x-forms.input type="text" inputmode="numeric" pattern="[0-9]*" id="code"
+                                <x-forms.input name="code" type="text" inputmode="numeric" pattern="[0-9]*" id="code"
                                     label="One-time code" required />
                                 <x-forms.button type="submit">Validate 2FA</x-forms.button>
                             </form>
diff --git a/resources/views/livewire/project/application/deployment/index.blade.php b/resources/views/livewire/project/application/deployment/index.blade.php
index 88301d71c6..b2c2be9081 100644
--- a/resources/views/livewire/project/application/deployment/index.blade.php
+++ b/resources/views/livewire/project/application/deployment/index.blade.php
@@ -213,39 +213,43 @@
                             $commitMessage = $deployment->commitMessage()
                                 ? Str::before($deployment->commitMessage(), "\n")
                                 : null;
+                            $deploymentUrl = $current_url . '/' . data_get($deployment, 'deployment_uuid');
+                            $commitUrl = data_get($deployment, 'commit')
+                                ? $application->gitCommitLink(data_get($deployment, 'commit'))
+                                : null;
                         @endphp
-                        <a wire:key="deployment-{{ data_get($deployment, 'deployment_uuid') }}"
-                            href="{{ $current_url . '/' . data_get($deployment, 'deployment_uuid') }}"
-                            {{ wireNavigate() }}
+                        <div wire:key="deployment-{{ data_get($deployment, 'deployment_uuid') }}"
                             @class([
                                 'data-table-row deployment-table-grid border-b border-neutral-200 text-[13px] text-neutral-600 dark:border-white/[0.08] dark:text-fg-dim',
                                 'data-table-row-active' => $selectedDeploymentUuid === data_get($deployment, 'deployment_uuid'),
                             ])>
-                            <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
-                            <span>{{ $sourceLabel }}</span>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }}><x-status-badge :status="$statusLabel" :type="$statusType" /></a>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }}>{{ $sourceLabel }}</a>
                             <span class="min-w-0">
                                 @if (data_get($deployment, 'commit'))
                                     <span class="flex min-w-0 items-center gap-2">
-                                        <span class="shrink-0 font-mono text-xs text-neutral-950 dark:text-fg">
+                                        <a href="{{ $commitUrl }}" target="_blank" rel="noopener noreferrer"
+                                            class="shrink-0 font-mono text-xs text-neutral-950 underline decoration-neutral-400 underline-offset-2 dark:text-fg dark:decoration-neutral-600">
                                             {{ substr(data_get($deployment, 'commit'), 0, 7) }}
-                                        </span>
+                                        </a>
                                         @if ($commitMessage)
-                                            <span class="truncate text-neutral-500 dark:text-fg-faint"
-                                                title="{{ $commitMessage }}">{{ $commitMessage }}</span>
+                                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }}
+                                                class="truncate text-neutral-500 dark:text-fg-faint"
+                                                title="{{ $commitMessage }}">{{ $commitMessage }}</a>
                                         @endif
                                     </span>
                                 @else
                                     <span class="text-neutral-400 dark:text-fg-faint">-</span>
                                 @endif
                             </span>
-                            <span title="{{ formatDateInServerTimezone(data_get($deployment, 'created_at'), data_get($application, 'destination.server')) }}">
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }} title="{{ formatDateInServerTimezone(data_get($deployment, 'created_at'), data_get($application, 'destination.server')) }}">
                                 {{ \Carbon\Carbon::parse(data_get($deployment, 'created_at'))->diffForHumans() }}
-                            </span>
-                            <span class="tabular-nums">{{ $duration }}</span>
-                            <span class="truncate">
+                            </a>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }} class="tabular-nums">{{ $duration }}</a>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }} class="truncate">
                                 {{ data_get($deployment, 'server_name') ?: data_get($application, 'destination.server.name', '-') }}
-                            </span>
-                        </a>
+                            </a>
+                        </div>
                         @endforeach
                     </div>
 
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index 128f2f2627..b80085b9d5 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -366,4 +366,48 @@
 
     <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
         confirmAction="confirmDomainUsage" />
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+            class="relative z-40">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Unrecognized internal port" class="mb-4">
+                                Port <strong>{{ $unrecognizedPort }}</strong> is not listed in Ports Exposes
+                                and is not used by any application domain. The proxy will still route to it,
+                                but the container may not be listening there.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button" canGate="update" :canResource="$application"
+                                    @click="modalOpen = false; $wire.call('cancelUseUnknownPort')">
+                                    Cancel
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmUseUnknownPort" canGate="update"
+                                    :canResource="$application"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index 7384067f98..6c455c197b 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -119,8 +119,7 @@
                 @else
                     <div class="flex flex-col gap-5">
                         @if ($buildPack === 'dockercompose')
-                            <div class="flex flex-col gap-2"
-                                @can('update', $application) x-init="$wire.dispatch('loadCompose', true)" @endcan>
+                            <div class="flex flex-col gap-2">
                                 <div x-data="{
                                     baseDir: @entangle('baseDirectory'),
                                     composeLocation: @entangle('dockerComposeLocation'),
@@ -399,7 +398,15 @@
             @endif
 
             @if ($buildPack !== 'dockercompose')
-                <x-application.settings-section id="networking-section" title="Networking" helper="Ports the container exposes, host port mappings and internal network aliases.">
+                @php
+                    $applicationDomainsUrl = route('project.application.domains', [
+                        'project_uuid' => $application->environment->project->uuid,
+                        'environment_uuid' => $application->environment->uuid,
+                        'application_uuid' => $application->uuid,
+                    ]);
+                    $portsExposesDomainHint = "You can also set a different internal port for each domain on the <a class='underline dark:text-white' href='{$applicationDomainsUrl}'>Domains</a> page.";
+                @endphp
+                <x-application.settings-section id="networking-section" title="Networking" helper="Ports the container exposes, host port mappings and internal network aliases. You can also set an internal port per domain.">
                 @if ($this->detectedPortInfo)
                     @if ($this->detectedPortInfo['isEmpty'])
                         <div
@@ -461,20 +468,30 @@
                     </x-callout>
                 @endif
                 <div class="grid gap-4 lg:grid-cols-[14rem_16rem_minmax(0,1fr)]">
+                    <div class="min-w-0">
                     @if ($isStatic || $buildPack === 'static')
                         <x-forms.input id="portsExposes" label="Ports exposes" readonly
+                            :helper="$portsExposesDomainHint"
+                            canGate="update" :canResource="$application"
                             x-bind:disabled="!canUpdate" />
                     @else
                         @if ($application->settings->is_container_label_readonly_enabled === false)
                             <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports exposes" readonly
-                                helper="Readonly labels are disabled. You can set the ports manually in the labels section."
+                                :helper="'Readonly labels are disabled. You can set the ports manually in the labels section.<br><br>'.$portsExposesDomainHint"
+                                canGate="update" :canResource="$application"
                                 x-bind:disabled="!canUpdate" />
                         @else
                             <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports exposes"
-                                helper="A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly."
+                                :helper="'A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly.<br><br>'.$portsExposesDomainHint"
+                                canGate="update" :canResource="$application"
                                 x-bind:disabled="!canUpdate" />
                         @endif
                     @endif
+                    <p class="mt-1.5 text-xs text-neutral-500 dark:text-fg-dim">
+                        You can also set an internal port per domain on
+                        <a class="underline dark:text-white" href="{{ $applicationDomainsUrl }}" {{ wireNavigate() }}>Domains</a>.
+                    </p>
+                    </div>
                     @if (!$application->destination->server->isSwarm())
                         <x-forms.input placeholder="3000:3000" id="portsMappings" label="Port mappings"
                             helper="A comma separated list of ports you would like to map to the host system. Useful when you do not want to use domains.<br><br><span class='inline-block font-bold dark:text-warning'>Format:</span> host:container<br><br><span class='inline-block font-bold dark:text-warning'>Example:</span> 3000:3000,3002:3002<br><br>Rolling update is not supported if you have a port mapped to the host."
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index df7522eacf..06d07d9ffe 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -44,13 +44,20 @@
                         @if (str($application->status)->startsWith('exited'))
                             <x-slot:main wire:click="deploy">
                                 <x-reicon name="play-circle" class="size-3.5" />
-                                Deploy
+                                {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
                             </x-slot:main>
                             @if (!$application->destination->server->isSwarm())
                                 <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="deploy(true)"
                                     @click="open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Deploy (without cache)
+                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
+                                </button>
+                            @endif
+                            @if ($application->container_present !== false)
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()" role="menuitem">
+                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                    Remove container
                                 </button>
                             @endif
                         @else
@@ -99,10 +106,13 @@
                 @endcan
             @endif
             <div class="hidden" aria-hidden="true">
-                <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
+                <x-modal-confirmation
+                    canGate="deploy" :canResource="$application"
+                    title="{{ str($application->status)->startsWith('exited') ? 'Confirm Container Removal?' : 'Confirm Application Stopping?' }}"
+                    buttonTitle="{{ str($application->status)->startsWith('exited') ? 'Remove container' : 'Stop' }}"
                     submitAction="stop" :checkboxes="$checkboxes" :actions="[
-                        'This application will be stopped.',
-                        'All non-persistent data of this application will be deleted.',
+                        str($application->status)->startsWith('exited') ? 'The exited application container will be removed.' : 'This application will be stopped.',
+                        str($application->status)->startsWith('exited') ? 'Anonymous volumes may become eligible for Docker cleanup.' : 'All non-persistent data of this application will be deleted.',
                     ]" :confirmWithText="false" :confirmWithPassword="false"
                     step1ButtonText="Continue" step2ButtonText="Confirm">
                     <x-slot:trigger>
@@ -138,13 +148,20 @@
                                 @if (str($application->status)->startsWith('exited'))
                                     <x-slot:main wire:click="deploy">
                                         <x-reicon name="play-circle" class="size-3.5" />
-                                        Deploy
+                                        {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
                                     </x-slot:main>
                                     @if (!$application->destination->server->isSwarm())
                                         <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="deploy(true)"
                                             @click="open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Deploy (without cache)
+                                            {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
+                                        </button>
+                                    @endif
+                                    @if ($application->container_present !== false)
+                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                            @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()" role="menuitem">
+                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                            Remove container
                                         </button>
                                     @endif
                                 @else
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index 6c20d0a46d..cf8970d814 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -37,9 +37,10 @@
         ->keys()
         ->first();
     $showDirection = ($showDirectionControl ?? true) && ! $isSuggested && $firstPairRowIndex === $index;
+    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
 @endphp
 
-<div wire:key="domain-row-{{ $index }}-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
+<div wire:key="domain-row-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
     class="env-table-item">
     <div @class([
         'data-table-row',
@@ -73,6 +74,17 @@
                         title="{{ $row['url'] }}">
                         {{ $row['url'] }}
                     </a>
+                    @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                        <span class="table-badge shrink-0"
+                            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
+                            Internal port {{ $row['internal_port'] }}
+                        </span>
+                    @else
+                        <span class="table-badge table-badge-danger shrink-0"
+                            title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
+                            No internal port
+                        </span>
+                    @endif
                 @endif
                 @if ($isSuggested && ! empty($row['suggestion_label']))
                     <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -185,7 +197,7 @@
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                         <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?" buttonTitle="Remove"
-                            isErrorButton submitAction="removeDomain({{ $index }})" :actions="[
+                            isErrorButton submitAction="removeDomainByKey({{ $domainKey }})" :actions="[
                                 'This domain will be removed from the application.',
                                 'Redeploy or restart may be required for proxy changes.',
                             ]" :confirmWithPassword="false" :confirmWithText="false" step2ButtonText="Remove domain">
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
new file mode 100644
index 0000000000..2a131e43cd
--- /dev/null
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -0,0 +1,207 @@
+<div class="flex flex-col gap-3" x-data="{ editOpen: false }"
+    @open-preview-domain-edit.window="editOpen = true"
+    @close-preview-domain-edit.window="editOpen = false">
+    @if (collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking'))
+        <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
+    @endif
+    <div class="flex flex-wrap items-center gap-2">
+        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+            {{ count($domainRows) }} domain{{ count($domainRows) === 1 ? '' : 's' }}
+        </p>
+        @can('update', $preview->application)
+            @if (count($domainRows) > 0)
+                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
+                    <x-reicon name="refresh" class="size-3.5" />
+                    Recheck DNS
+                </x-forms.button>
+            @endif
+            <x-modal-input title="Add domain" :closeOutside="false" :wireIgnore="false"
+                canGate="update" :canResource="$preview->application">
+                <x-slot:content>
+                    <button type="button" class="button button-highlighted">
+                        <x-reicon name="plus" class="size-3.5" />
+                        Add
+                    </button>
+                </x-slot:content>
+                <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
+                    @if ($isCompose && count($composeServices) > 0)
+                        <x-forms.listbox id="newDomainService" label="Service" required
+                            :options="collect($composeServices)->map(fn ($service) => ['value' => $service, 'label' => $service])->all()" />
+                    @endif
+                    <x-forms.domain-input id="newDomainParts" />
+
+                    <div class="flex flex-wrap items-center justify-between gap-2 pt-2">
+                        <x-forms.button type="button" wire:click="generateDomain">Generate domain</x-forms.button>
+                        <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                    </div>
+                </form>
+            </x-modal-input>
+        @endcan
+    </div>
+
+    @if (count($domainRows) === 0)
+        <div class="application-settings-section-body">
+            <x-empty size="sm" title="No domains configured"
+                description="Add a domain or generate one with the server wildcard domain." icon-name="globe" />
+        </div>
+    @else
+        <div class="application-settings-section-body is-flush overflow-visible">
+            <div class="data-table-header domains-table-grid-service">
+                <span>Domain</span>
+                <span>DNS check</span>
+                <span></span>
+                <span></span>
+            </div>
+            @foreach ($domainRows as $index => $row)
+                @php
+                    $dnsType = match ($row['dns_status']) {
+                        'ok' => 'success',
+                        'failed' => 'error',
+                        'skipped' => 'warning',
+                        default => 'neutral',
+                    };
+                    $dnsLabel = match ($row['dns_status']) {
+                        'ok' => 'DNS OK',
+                        'failed' => 'DNS mismatch',
+                        'skipped' => 'DNS skipped',
+                        default => 'DNS pending',
+                    };
+                    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+                @endphp
+                <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" class="env-table-item">
+                    <div class="data-table-row domains-table-grid-service">
+                        <div class="flex min-w-0 flex-col gap-1">
+                            <div class="flex min-w-0 flex-wrap items-center gap-2">
+                                <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
+                                <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
+                                    class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                    title="{{ $row['url'] }}">{{ $row['url'] }}</a>
+                                @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                                    <span class="table-badge shrink-0"
+                                        title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
+                                        Internal port {{ $row['internal_port'] }}
+                                    </span>
+                                @else
+                                    <span class="table-badge table-badge-danger shrink-0"
+                                        title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
+                                        No internal port
+                                    </span>
+                                @endif
+                                @if (filled($row['service']))
+                                    <span class="table-badge shrink-0">{{ $row['service'] }}</span>
+                                @endif
+                            </div>
+                        </div>
+                        <div class="flex min-w-0 items-center">
+                            <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
+                        </div>
+                        <div class="hidden"></div>
+                        <div class="flex items-center justify-end gap-1">
+                            @can('update', $preview->application)
+                                <button type="button" wire:click="checkDomainDns({{ $index }})"
+                                    wire:loading.attr="disabled"
+                                    wire:target="checkDomainDns({{ $index }}),checkAllDns"
+                                    class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
+                                    <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                    <x-loading-on-button wire:loading.delay
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                </button>
+                                <button type="button" wire:click="startEdit({{ $index }})"
+                                    class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
+                                    <x-reicon name="settings" class="size-3.5" />
+                                </button>
+                                <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
+                                    buttonTitle="Remove" isErrorButton
+                                    submitAction="removeDomainByKey({{ $domainKey }})"
+                                    :actions="[
+                                        'This domain will be removed from the preview deployment.',
+                                        'Redeploy the preview to apply proxy changes.',
+                                    ]"
+                                    :confirmWithPassword="false" :confirmWithText="false"
+                                    step2ButtonText="Remove domain">
+                                    <x-slot:trigger>
+                                        <button type="button"
+                                            class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
+                                            title="Remove domain" aria-label="Remove domain">
+                                            <x-reicon name="trash" class="size-3.5" />
+                                        </button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
+                            @endcan
+                        </div>
+                    </div>
+                </div>
+            @endforeach
+        </div>
+    @endif
+
+    <template x-teleport="body">
+        <div x-show="editOpen" x-cloak class="fixed inset-0 z-99 overflow-y-auto">
+            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="editOpen = false"></div>
+            <div class="relative flex min-h-full items-center justify-center p-4">
+                <div x-show="editOpen" x-trap.inert.noscroll="editOpen"
+                    class="application-settings-form application-settings-section relative w-full max-w-3xl">
+                    <header>
+                        <h3>Edit domain</h3>
+                        <button type="button" @click="editOpen = false" class="icon-button" aria-label="Close">
+                            <x-reicon name="x" class="size-4" />
+                        </button>
+                    </header>
+                    <div class="application-settings-section-body">
+                        <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                            <x-forms.domain-input id="editingDomainParts" />
+                            <div class="flex justify-end">
+                                <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                            </div>
+                        </form>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </template>
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+            class="relative z-40">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Unrecognized internal port" class="mb-4">
+                                Port <strong>{{ $unrecognizedPort }}</strong> is not listed in Ports Exposes
+                                and is not used by any application domain. The proxy will still route to it,
+                                but the container may not be listening there.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button" canGate="update" :canResource="$preview->application"
+                                    @click="modalOpen = false; $wire.call('cancelUseUnknownPort')">
+                                    Cancel
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmUseUnknownPort" canGate="update"
+                                    :canResource="$preview->application"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/project/application/previews-compose.blade.php b/resources/views/livewire/project/application/previews-compose.blade.php
deleted file mode 100644
index 85159682d8..0000000000
--- a/resources/views/livewire/project/application/previews-compose.blade.php
+++ /dev/null
@@ -1,6 +0,0 @@
-<form wire:submit="save"
-    class="grid gap-3 rounded-lg bg-neutral-50 p-3 ring-1 ring-neutral-200 md:grid-cols-[minmax(0,1fr)_auto] md:items-end dark:bg-white/[0.025] dark:ring-white/[0.07]">
-    <x-forms.input helper="One domain per preview." label="{{ Str::headline($serviceName) }} domain"
-        id="domain" wire:change="save" canGate="update" :canResource="$preview->application" />
-    <x-forms.button wire:click="generate">Generate domain</x-forms.button>
-</form>
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index ef42760b97..ac616b84a3 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -103,6 +103,7 @@
                                     Preview #{{ data_get($preview, 'pull_request_id') }}
                                 </h4>
                                 <x-status-summary :status="data_get($preview, 'status')" title="Preview status" />
+                                <x-application.restart-limit-warning :application="$preview" />
                             </div>
                         </div>
                     </div>
@@ -251,49 +252,19 @@
                 </div>
 
                 <div class="mt-4 border-t border-neutral-200 pt-4 dark:border-white/[0.07]">
-                    @if ($application->build_pack === 'dockercompose')
-                        @if (collect(json_decode($preview->docker_compose_domains))->count() === 0)
-                            <form wire:submit="save_preview('{{ $preview->id }}')"
-                                class="grid gap-3 md:grid-cols-[minmax(0,1fr)_auto] md:items-end">
-                                <x-forms.input label="Domain" helper="One domain per preview."
-                                    id="previewFqdns.{{ $previewName }}" canGate="update"
-                                    :canResource="$application"
-                                    wire:change="save_preview('{{ $preview->id }}')" />
-                                @can('update', $application)
-                                    <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">
-                                        Generate domain
-                                    </x-forms.button>
-                                @endcan
-                            </form>
-                        @else
-                            <div class="flex flex-col gap-3">
-                                @foreach (collect(json_decode($preview->docker_compose_domains)) as $serviceName => $service)
-                                    <livewire:project.application.previews-compose
-                                        wire:key="preview-{{ $preview->pull_request_id }}-{{ $serviceName }}"
-                                        :service="$service" :serviceName="$serviceName" :preview="$preview" />
-                                @endforeach
-                            </div>
-                        @endif
-                    @else
+                    <livewire:project.application.preview-domains
+                        wire:key="preview-domains-{{ $preview->id }}"
+                        :preview="$preview" />
+
+                    @if ($application->build_pack === 'dockerimage')
                         <form wire:submit="save_preview('{{ $preview->id }}')"
-                            class="grid gap-3 {{ $application->build_pack === 'dockerimage'
-                                ? 'md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto]'
-                                : 'md:grid-cols-[minmax(0,1fr)_auto]' }} md:items-end">
-                            <x-forms.input label="Domain" helper="One domain per preview."
-                                id="previewFqdns.{{ $previewName }}" canGate="update"
-                                :canResource="$application"
-                                wire:change="save_preview('{{ $preview->id }}')" />
-                            @if ($application->build_pack === 'dockerimage')
-                                <x-forms.input label="Docker tag" helper="Image tag used by this preview."
-                                    id="previewDockerTags.{{ $previewName }}" canGate="update"
+                            class="application-settings-section-body is-flush mt-3 overflow-visible">
+                            <div class="data-table-header grid-cols-1"><span>Docker tag</span></div>
+                            <div class="p-3">
+                                <x-forms.input id="previewDockerTags.{{ $previewName }}" canGate="update"
                                     :canResource="$application"
                                     wire:change="save_preview('{{ $preview->id }}')" />
-                            @endif
-                            @can('update', $application)
-                                <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">
-                                    Generate domain
-                                </x-forms.button>
-                            @endcan
+                            </div>
                         </form>
                     @endif
                 </div>
@@ -305,15 +276,4 @@
         @endforelse
     </x-application.settings-section>
 
-    <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
-        confirmAction="confirmDomainUsage">
-        The preview deployment domain is already used by another resource and may cause routing conflicts.
-        <x-slot:consequences>
-            <ul class="mt-2 ml-4 list-disc">
-                <li>The preview deployment may not be accessible.</li>
-                <li>SSL certificates may not work correctly.</li>
-                <li>Requests may be routed unpredictably.</li>
-            </ul>
-        </x-slot:consequences>
-    </x-domain-conflict-modal>
 </div>
diff --git a/resources/views/livewire/project/application/status.blade.php b/resources/views/livewire/project/application/status.blade.php
index 2aa68fd779..6d692d36b9 100644
--- a/resources/views/livewire/project/application/status.blade.php
+++ b/resources/views/livewire/project/application/status.blade.php
@@ -1,3 +1,4 @@
 <div wire:poll.10000ms="refreshStatus">
     <x-status-summary :status="$application->status" />
+    <x-application.restart-limit-warning :application="$application" />
 </div>
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index 6519b419d1..2d28510165 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -63,7 +63,12 @@
                 <h1 class="min-w-0 max-w-full truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $database->name }}
                 </h1>
-                <x-status-summary :status="$database->status" title="Database status" />
+                <div class="relative flex w-full min-w-0 items-center gap-2">
+                    <x-status-summary :status="$database->status" title="Database status" />
+                </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    <x-application.restart-limit-warning :application="$database" />
+                </div>
             </div>
         </div>
 
diff --git a/resources/views/livewire/project/database/import-form.blade.php b/resources/views/livewire/project/database/import-form.blade.php
index a8087bd8ed..dd57b121c2 100644
--- a/resources/views/livewire/project/database/import-form.blade.php
+++ b/resources/views/livewire/project/database/import-form.blade.php
@@ -57,6 +57,10 @@
                 <div class="space-y-4">
             @if ($resourceDbType === 'standalone-postgresql')
                 @if ($dumpAll)
+                            <x-callout type="warning" title="Full restore overwrites administrator passwords">
+                                The backup replaces PostgreSQL administrator role passwords, including the destination administrator password.
+                                <span class="mt-1 block">If the administrator password changes, update it in Coolify's database configuration after the restore.</span>
+                            </x-callout>
                             <x-forms.textarea rows="6" readonly label="Import command"
                                 wire:model="restoreCommandText" canGate="update"
                                 :canResource="$this->resource" />
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 738c46fea9..130669b01d 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -138,7 +138,7 @@
         <div class="divide-y divide-neutral-200 dark:divide-border-subtle">
             @forelse($initScripts ?? [] as $script)
                 <livewire:project.database.init-script :database="$database" :script="$script"
-                    :wire:key="$script['index']" />
+                    :wire:key="'init-script-'.md5($script['filename'])" />
             @empty
                 <x-empty title="No initialization scripts"
                     description="Add a SQL file to run during the first PostgreSQL initialization." />
diff --git a/resources/views/livewire/project/database/status.blade.php b/resources/views/livewire/project/database/status.blade.php
index 8f8a720676..cf2d32c7a4 100644
--- a/resources/views/livewire/project/database/status.blade.php
+++ b/resources/views/livewire/project/database/status.blade.php
@@ -1,3 +1,4 @@
 <div wire:poll.10000ms="refreshStatus">
     <x-status-summary :status="$database->status" title="Database status" />
+    <x-application.restart-limit-warning :application="$database" />
 </div>
diff --git a/resources/views/livewire/project/edit.blade.php b/resources/views/livewire/project/edit.blade.php
index 564da27647..f3d27997a0 100644
--- a/resources/views/livewire/project/edit.blade.php
+++ b/resources/views/livewire/project/edit.blade.php
@@ -65,7 +65,7 @@
                 <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                     <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
                     @if ($project->icon_path)
-                        <img x-show="!preview" src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                        <img x-show="!preview" src="{{ project_icon_url($project) }}"
                             alt="{{ $project->name }} icon" class="h-full w-full object-cover">
                     @else
                         <x-reicon x-show="!preview" name="projects" class="size-6" />
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index d8e0920ef1..aed3b96978 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -287,15 +287,8 @@
                                     <div class="flex min-w-0 items-start gap-3">
                                         <div
                                             class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
-                                            <template x-if="service.has_logo">
-                                                <img class="h-full w-full object-contain p-2" :src="service.logo"
-                                                    onerror="this.onerror=null; this.src=this.getAttribute('data-fallback');"
-                                                    :data-fallback="service.logo_github_url" />
-                                            </template>
-                                            <template x-if="!service.has_logo">
-                                                <x-reicon name="layers"
-                                                    class="size-6 text-neutral-400 dark:text-fg-faint" />
-                                            </template>
+                                            <img class="h-full w-full object-contain p-2" :src="service.logo"
+                                                x-on:error="if (!$el.dataset.cdnTried) { $el.dataset.cdnTried = 'true'; $el.src = service.logo_cdn_url; } else if (!$el.dataset.defaultTried) { $el.dataset.defaultTried = 'true'; $el.src = service.logo_default_url; }" />
                                         </div>
                                         <div class="min-w-0 flex-1">
                                             <h3 class="truncate text-[13px] font-semibold text-black dark:text-fg"
diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index 3ab0ac6330..09be827990 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -220,7 +220,7 @@
                             x-text="item.typeLabel"></div>
 
                         <div>
-                            <x-status-badge dynamic>
+                            <x-status-badge dynamic x-bind:title="statusTitle(item)">
                                 <span class="size-1.5 shrink-0 rounded-full"
                                     x-bind:class="statusDotClass(item)"></span>
                                 <span class="truncate" x-text="statusLabel(item)"></span>
@@ -299,7 +299,7 @@
                                     <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint"
                                         x-text="item.typeLabel"></p>
                                 </div>
-                                <x-status-badge dynamic>
+                                <x-status-badge dynamic x-bind:title="statusTitle(item)">
                                     <span class="size-1.5 shrink-0 rounded-full"
                                         x-bind:class="statusDotClass(item)"></span>
                                     <span class="truncate" x-text="statusLabel(item)"></span>
@@ -314,8 +314,6 @@
                                         class="relative z-10 max-w-full self-start truncate text-[11px] text-neutral-500 hover:underline dark:text-fg-dim"
                                         :title="displayDomain(item.fqdn)" x-text="displayDomain(item.fqdn)"></a>
                                 </template>
-                                <span x-show="!item.fqdn"
-                                    class="text-[11px] text-neutral-400 dark:text-fg-faint">-</span>
                             </div>
                         </article>
                     </template>
@@ -518,13 +516,32 @@
                 localStorage.setItem('environment-resource-view', mode);
             },
             statusState(item) {
+                if (item.restartLimitReached) {
+                    return 'restart-limit';
+                }
+
                 return String(item.status || 'unknown').split(':')[0].toLowerCase();
             },
             statusLabel(item) {
+                if (item.restartLimitReached) {
+                    return 'Restart limit reached';
+                }
+
                 const state = this.statusState(item);
                 return state.charAt(0).toUpperCase() + state.slice(1);
             },
+            statusTitle(item) {
+                if (item.restartLimitReached) {
+                    return `${item.restartCount}/${item.maxRestartCount} restarts. Container preserved.`;
+                }
+
+                return this.statusLabel(item);
+            },
             statusTone(item) {
+                if (item.restartLimitReached) {
+                    return 'warning';
+                }
+
                 const state = this.statusState(item);
                 if (state === 'running') {
                     return 'success';
@@ -539,6 +556,10 @@
                 return 'neutral';
             },
             statusDotClass(item) {
+                if (item.restartLimitReached) {
+                    return 'bg-warning';
+                }
+
                 return {
                     success: 'bg-emerald-500',
                     warning: 'bg-warning',
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
new file mode 100644
index 0000000000..b5c2057cfd
--- /dev/null
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -0,0 +1,64 @@
+<div>
+    @if ($selectedExecution)
+        <x-modal-input title="Backup execution" wireOpen="executionModalOpen" :wireIgnore="false" isLarge>
+            <x-slot:content><span></span></x-slot:content>
+            <div class="flex flex-col gap-5">
+                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Target</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['target'] }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Status</p><p class="mt-1 text-sm font-medium">{{ str($selectedExecution['status'])->headline() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Started</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['started_at']->diffForHumans() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Size</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['size'] ? formatBytes($selectedExecution['size']) : '-' }}</p></div>
+                </div>
+                @if ($selectedExecution['filename'])
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Backup path</p><code class="mt-1 block overflow-x-auto rounded-md bg-neutral-100 p-3 text-xs dark:bg-black/20">{{ $selectedExecution['filename'] }}</code></div>
+                @endif
+                @if ($selectedExecution['message'])
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Output</p><pre class="mt-1 max-h-80 overflow-auto rounded-md bg-neutral-100 p-3 font-mono text-xs whitespace-pre-wrap dark:bg-black/20">{{ $selectedExecution['message'] }}</pre></div>
+                @endif
+            </div>
+        </x-modal-input>
+    @endif
+
+    <x-application.settings-section title="Executions"
+        helper="Review backup runs across every database and storage target in this service." flush>
+        @if ($executions->isEmpty())
+            <x-empty size="sm" title="No backup executions"
+                description="Execution history appears here after a backup schedule runs." icon-name="browser-terminal" />
+        @else
+            <div class="data-table w-full overflow-x-auto">
+                <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
+                    <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
+                </div>
+                @foreach ($executions as $execution)
+                    @php
+                        $statusType = match ($execution['status']) {
+                            'success' => 'success',
+                            'failed' => 'error',
+                            'running' => 'warning',
+                            default => 'neutral',
+                        };
+                    @endphp
+                    <div wire:key="service-backup-execution-{{ $execution['id'] }}"
+                        wire:click="openExecution('{{ $execution['uuid'] }}')"
+                        wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
+                        class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
+                        <span class="truncate font-medium text-neutral-950 dark:text-fg" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                        <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
+                        <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
+                        <span>{{ $execution['started_at']->diffForHumans() }}</span>
+                        <span>{{ $execution['size'] ? formatBytes($execution['size']) : '-' }}</span>
+                        <span class="flex justify-end">
+                            @if ($execution['download_url'])
+                                <a href="{{ $execution['download_url'] }}" target="_blank" rel="noopener"
+                                    @click.stop class="icon-button shrink-0" title="Download backup"
+                                    aria-label="Download backup">
+                                    <x-reicon name="upload" class="size-3.5 rotate-180" />
+                                </a>
+                            @endif
+                        </span>
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </x-application.settings-section>
+</div>
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index 02855fec27..e3d0e5e24d 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -18,6 +18,7 @@
             ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
             ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
             ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
+            ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
             ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
             ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
             ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
@@ -35,7 +36,7 @@
         $menuGroups = [
             'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
             'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
-            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
+            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
             'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
         ];
 
@@ -143,12 +144,12 @@
 
                         <div :class="viewMode === 'grid'
                             ? 'grid grid-cols-1 gap-3 sm:grid-cols-2'
-                            : 'overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
+                            : 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
                             @if ($applications->isNotEmpty() || $databases->isNotEmpty())
                                 <div x-cloak x-show="viewMode === 'table'"
-                                    class="grid grid-cols-[minmax(0,1fr)_auto] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_8rem_5rem] dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                    class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
                                     <div>Resource</div>
-                                    <div class="hidden sm:block">Image</div>
+                                    <div>Image</div>
                                     <div class="justify-self-start">Status</div>
                                     <div></div>
                                 </div>
diff --git a/resources/views/livewire/project/service/database-backups.blade.php b/resources/views/livewire/project/service/database-backups.blade.php
index 9740b215a4..7db3174af6 100644
--- a/resources/views/livewire/project/service/database-backups.blade.php
+++ b/resources/views/livewire/project/service/database-backups.blade.php
@@ -8,24 +8,41 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            @if ($backup)
-                <x-backup-sidebar context="service" :parameters="$backupParameters" :section="$section" />
-            @else
-                <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase"
-                    :isImportSupported="$isImportSupported" />
-            @endif
+            <x-service.configuration-sidebar :service="$service"
+                current-route="project.service.volume-backups.index" />
 
             <div class="min-w-0">
                 @if ($backup)
-                    @if ($section === 'executions')
-                        <livewire:project.database.backup-executions :backup="$backup"
-                            :database="$serviceDatabase" />
-                    @else
-                        <livewire:project.database.backup-edit :backup="$backup"
-                            :available-s3-storages="$s3s" :status="data_get($serviceDatabase, 'status')"
-                            :section="$section"
-                            wire:key="service-database-backup-{{ $backup->uuid }}-{{ $section }}" />
-                    @endif
+                    <div class="flex min-w-0 flex-col gap-6">
+                        <div class="flex min-w-0 flex-col gap-4">
+                            <div>
+                                <a class="inline-flex items-center gap-1.5 text-xs text-neutral-500 hover:text-neutral-900 dark:text-fg-dim dark:hover:text-fg"
+                                    {{ wireNavigate() }}
+                                    href="{{ route('project.service.volume-backups.index', collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all()) }}">
+                                    <x-reicon name="arrow-right" class="size-3.5 rotate-180" />
+                                    Back to backups
+                                </a>
+                                <h1 class="mt-2 text-xl font-semibold text-neutral-950 dark:text-fg">
+                                    {{ $serviceDatabase->human_name ?: $serviceDatabase->name }} backup
+                                </h1>
+                                <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                                    {{ $backup->frequency }} schedule
+                                </p>
+                            </div>
+
+                            <x-backup-tabs context="service" :parameters="$backupParameters" :section="$section" />
+                        </div>
+
+                        @if ($section === 'executions')
+                            <livewire:project.database.backup-executions :backup="$backup"
+                                :database="$serviceDatabase" />
+                        @else
+                            <livewire:project.database.backup-edit :backup="$backup"
+                                :available-s3-storages="$s3s" :status="data_get($serviceDatabase, 'status')"
+                                :section="$section"
+                                wire:key="service-database-backup-{{ $backup->uuid }}-{{ $section }}" />
+                        @endif
+                    </div>
                 @else
                     <section class="application-settings-section">
                         <div class="application-settings-section-header">
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index c228f39e59..a02d5ae758 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -283,4 +283,46 @@
 
     <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
         confirmAction="confirmDomainUsage" />
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelRemovePort')"
+            :class="{ 'z-40': modalOpen }" class="relative">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelRemovePort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Port requirement" class="mb-4">
+                                This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
+                                One or more of your domains use a different port, or none.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button"
+                                    @click="modalOpen = false; $wire.call('cancelRemovePort')">
+                                    Keep required port
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmRemovePort"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/livewire/project/service/edit-compose.blade.php b/resources/views/livewire/project/service/edit-compose.blade.php
index 78400cb76e..47b3e732f2 100644
--- a/resources/views/livewire/project/service/edit-compose.blade.php
+++ b/resources/views/livewire/project/service/edit-compose.blade.php
@@ -25,7 +25,7 @@
     </div>
 
     <div
-        class="flex flex-wrap items-center gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 dark:border-white/[0.08] dark:bg-white/[0.025]">
+        class="flex flex-col items-stretch gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 sm:flex-row sm:flex-wrap sm:items-center dark:border-white/[0.08] dark:bg-white/[0.025]">
         <x-forms.checkbox label="Escape special characters in labels"
             helper="By default, $ (and other characters) is escaped. A $ in a label is saved as $$. Turn this off to use environment variables inside labels."
             id="isContainerLabelEscapeEnabled" instantSave />
diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index 52474c8d98..91518194cd 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -44,7 +44,7 @@
                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header>
-                            <h3>Remove required port?</h3>
+                            <h3>Use a different port?</h3>
                             <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                 class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                                 <x-reicon name="x" class="size-4" />
@@ -53,7 +53,7 @@
                         <div class="application-settings-section-body">
                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                One or more of your domains are missing a port number.
+                                One or more of your domains use a different port, or none.
                             </x-callout>
 
                             <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
@@ -68,11 +68,11 @@
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                     class="w-auto">
-                                    Keep port
+                                    Keep required port
                                 </x-forms.button>
                                 <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
                                     isError>
-                                    Remove port anyway
+                                    Use this port anyway
                                 </x-forms.button>
                             </div>
                         </div>
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index d08572dd7c..7604d7d0cc 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -75,7 +75,12 @@
             @if ($service->isDeployable)
                 @can('deploy', $service)
                     <x-split-action id="service-mobile-actions" class="mb-3 flex w-full">
-                        @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                        @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <x-slot:main @click="document.getElementById('selected-resource-remove-trigger')?.click()">
+                                <x-reicon name="trash" class="size-3.5" />
+                                Remove container
+                            </x-slot:main>
+                        @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
                             <x-slot:main x-bind:disabled="deploying"
                                 @click="document.getElementById('service-restart-trigger')?.click()">
                                 <x-reicon name="restart" class="size-3.5" />
@@ -141,7 +146,12 @@
                         </div>
                         @can('deploy', $service)
                             <x-split-action id="service-desktop-actions">
-                                @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                                @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <x-slot:main @click="document.getElementById('selected-resource-remove-trigger')?.click()">
+                                <x-reicon name="trash" class="size-3.5" />
+                                Remove container
+                            </x-slot:main>
+                        @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
                                     <x-slot:main x-bind:disabled="deploying"
                                         @click="document.getElementById('service-restart-trigger')?.click()">
                                         <x-reicon name="restart" class="size-3.5" />
@@ -217,6 +227,17 @@
                     <button id="service-stop-trigger" type="button">Stop</button>
                 </x-slot:trigger>
             </x-modal-confirmation>
+            @if ($selectedResource)
+                <x-modal-confirmation title="Confirm Container Removal?" buttonTitle="Remove container"
+                    canGate="deploy" :canResource="$service" submitAction="removeSelectedResourceContainer"
+                    :actions="['The exited service resource container will be removed.', __('resource.non_persistent')]"
+                    :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue"
+                    step2ButtonText="Confirm">
+                    <x-slot:trigger>
+                        <button id="selected-resource-remove-trigger" type="button">Remove container</button>
+                    </x-slot:trigger>
+                </x-modal-confirmation>
+            @endif
         </div>
     @endif
 
diff --git a/resources/views/livewire/project/service/import-backup.blade.php b/resources/views/livewire/project/service/import-backup.blade.php
new file mode 100644
index 0000000000..802ca7d10a
--- /dev/null
+++ b/resources/views/livewire/project/service/import-backup.blade.php
@@ -0,0 +1,39 @@
+<div>
+    <x-slot:title>
+        {{ data_get_str($service, 'name')->limit(10) }} > Import Backup | Coolify
+    </x-slot>
+
+    <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="request()->query()"
+        wire:key="service-heading-import-backup" />
+
+    <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
+        <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            <x-service.configuration-sidebar :service="$service" current-route="project.service.import-backup" />
+
+            <div class="application-settings-form min-w-0 flex flex-col gap-6">
+                @if ($databases->isEmpty())
+                    <x-application.settings-section title="Import Backup"
+                        helper="Restore a backup into a database in this service.">
+                        <x-empty title="No compatible databases"
+                            description="This service does not contain a database that supports backup imports."
+                            icon-name="database" size="sm" />
+                    </x-application.settings-section>
+                @else
+                    <x-application.settings-section title="Import Backup"
+                        helper="Choose the database that should receive the backup.">
+                        <x-forms.listbox id="selectedDatabaseUuid" label="Database" live required canGate="update"
+                            :canResource="$service"
+                            :options="$databases->map(fn ($database) => [
+                                'value' => $database->uuid,
+                                'label' => $database->human_name ?: $database->name,
+                            ])->all()" />
+                    </x-application.settings-section>
+
+                    @if ($selectedDatabase)
+                        <livewire:project.database.import :key="'service-import-' . $selectedDatabase->uuid" />
+                    @endif
+                @endif
+            </div>
+        </div>
+    </section>
+</div>
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 8faf4cfdac..acd3f57f73 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -3,7 +3,7 @@
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
         @if ($resourceType === 'database')
-            <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" :isImportSupported="$isImportSupported" />
+            <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" />
         @else
             <aside class="application-settings-navigation min-w-0 xl:self-start">
                 <nav aria-label="Compose resource settings"
@@ -175,7 +175,7 @@
                                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                                         <header>
-                                            <h3>Remove required port?</h3>
+                                            <h3>Use a different port?</h3>
                                             <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                                 class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                                                 <x-reicon name="x" class="size-4" />
@@ -184,7 +184,7 @@
                                         <div class="application-settings-section-body">
                                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                                One or more of your domains are missing a port number.
+                                                One or more of your domains use a different port, or none.
                                             </x-callout>
 
                                             <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
@@ -199,11 +199,11 @@
                                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                                 <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                                     class="w-auto">
-                                                    Keep port
+                                                    Keep required port
                                                 </x-forms.button>
                                                 <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
                                                     isError>
-                                                    Remove port anyway
+                                                    Use this port anyway
                                                 </x-forms.button>
                                             </div>
                                         </div>
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index f856285adb..444d1bfd28 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -61,9 +61,10 @@
                 ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
                 ->first(fn ($item) => $redirectPairKey($item['url']) === $pairKey)['url'] ?? null;
             $showDirection = ! $isSuggested && $firstPairRowUrl === $row['url'];
+            $domainKey = hash('sha256', $row['url'].'|'.($row['service_application_id'] ?? ''));
         @endphp
 
-        <div wire:key="svc-domain-{{ $row['service_application_id'] ?? 'x' }}-{{ $index }}-{{ md5(($isSuggested ? 's:' : '') . $row['url']) }}"
+        <div wire:key="svc-domain-{{ $row['service_application_id'] ?? 'x' }}-{{ md5(($isSuggested ? 's:' : '') . $row['url']) }}"
             class="env-table-item">
             <div @class([
                 'data-table-row',
@@ -97,6 +98,12 @@
                                 title="{{ $row['url'] }}">
                                 {{ $row['url'] }}
                             </a>
+                            @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                                <span class="table-badge shrink-0"
+                                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
+                                    Internal port {{ $row['internal_port'] }}
+                                </span>
+                            @endif
                         @endif
                         @if ($isSuggested && ! empty($row['suggestion_label']))
                             <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -208,7 +215,7 @@
                             </button>
                             <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
                                 buttonTitle="Remove" isErrorButton
-                                submitAction="removeDomain({{ $index }})" :actions="[
+                                submitAction="removeDomainByKey({{ $domainKey }})" :actions="[
                                     'This domain will be removed from the service application.',
                                     'Redeploy or restart may be required for proxy changes.',
                                 ]" :confirmWithPassword="false" :confirmWithText="false"
diff --git a/resources/views/livewire/project/service/resource-card.blade.php b/resources/views/livewire/project/service/resource-card.blade.php
index fe976180da..c9106b0fc1 100644
--- a/resources/views/livewire/project/service/resource-card.blade.php
+++ b/resources/views/livewire/project/service/resource-card.blade.php
@@ -1,4 +1,12 @@
-<div>
+<div x-data="{
+    settingsUrl: @js(route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid])),
+    openSettings(event) {
+        if (event.target.closest('a, button')) {
+            return;
+        }
+        Livewire.navigate(this.settingsUrl);
+    }
+}">
     @php
         [$statusType, $statusLabel] = match (true) {
             str($resource->status)->contains('running') => ['success', formatContainerStatus($resource->status)],
@@ -26,6 +34,7 @@
                     </div>
                 </div>
                 <x-status-badge :status="$statusLabel" :type="$statusType" />
+                <x-application.restart-limit-warning :application="$resource" />
             </div>
 
             @if ($resource->configuration_required)
@@ -76,7 +85,9 @@
     </div>
 
     <div x-cloak x-show="viewMode === 'table'"
-        class="grid min-h-14 grid-cols-[minmax(0,1fr)_auto] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_8rem_5rem] dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
+        x-on:click="openSettings($event)" x-on:keydown.enter="openSettings($event)"
+        role="link" tabindex="0" aria-label="Open {{ $resourceName }} settings"
+        class="grid min-h-14 min-w-[48rem] cursor-pointer grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-primary dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
         <div class="flex min-w-0 items-center gap-3">
             <div
                 class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-neutral-500 dark:bg-white/[0.06] dark:text-fg-dim">
@@ -86,14 +97,14 @@
                 <div class="truncate text-[13px] font-semibold text-black dark:text-fg">{{ $resourceName }}</div>
             </div>
         </div>
-        <div class="hidden truncate font-mono text-xs text-neutral-500 sm:block dark:text-fg-faint">
+        <div class="truncate font-mono text-xs text-neutral-500 dark:text-fg-faint">
             {{ $resource->image }}
         </div>
-        <div class="flex flex-wrap items-center justify-end gap-1 sm:contents">
-            <div class="justify-self-start">
-                <x-status-badge :status="$statusLabel" :type="$statusType" />
-            </div>
-            <div class="flex items-center justify-end gap-1">
+        <div class="flex flex-wrap items-center gap-1">
+            <x-status-badge :status="$statusLabel" :type="$statusType" />
+            <x-application.restart-limit-warning :application="$resource" />
+        </div>
+        <div class="flex items-center justify-end gap-1">
                 @if ($isDatabase && ($resource->isBackupSolutionAvailable() || $resource->is_migrated))
                     <a class="icon-button" title="Service backups" aria-label="Service backups" {{ wireNavigate() }}
                         href="{{ route('project.service.volume-backups.index', $parameters) }}">
@@ -109,10 +120,9 @@
                     @endcan
                 @endif
                 <a class="icon-button" title="Resource settings" aria-label="Resource settings" {{ wireNavigate() }}
-                    href="{{ route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid]) }}">
+            href="{{ route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid]) }}">
                     <x-reicon name="settings" class="size-4" />
                 </a>
-            </div>
         </div>
     </div>
 </div>
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 423ea0aaf8..d42c2a575d 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -14,7 +14,7 @@
                         <x-slot:headerActions>
                             <div x-data="{ preview: false, validating: false, saving: false }"
                                 @compose-validate-finished.window="validating = false"
-                                @compose-save-finished.window="saving = false" class="flex items-center gap-2">
+                                @compose-save-finished.window="saving = false" class="flex w-full items-center gap-2 overflow-x-auto sm:w-auto">
                                 <x-forms.button
                                     @click="preview = !preview; $dispatch('compose-preview-toggle')">
                                     <x-reicon name="eye" class="size-3.5" />
diff --git a/resources/views/livewire/project/service/status.blade.php b/resources/views/livewire/project/service/status.blade.php
index dd7a0bd8c9..2bdf531b0f 100644
--- a/resources/views/livewire/project/service/status.blade.php
+++ b/resources/views/livewire/project/service/status.blade.php
@@ -1,3 +1,8 @@
 <div wire:poll.10000ms="refreshStatus">
-    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+    @php($displayStatus = $selectedResource?->status ?? $service->status)
+    <x-status-summary :status="$displayStatus" :title="$selectedResource ? 'Resource status' : 'Service status'"
+        :container-name="$selectedResource ? 'Container' : 'Containers'" />
+    @if ($selectedResource)
+        <x-application.restart-limit-warning :application="$selectedResource" />
+    @endif
 </div>
diff --git a/resources/views/livewire/project/service/storage.blade.php b/resources/views/livewire/project/service/storage.blade.php
index 42ade3da6e..43608188d1 100644
--- a/resources/views/livewire/project/service/storage.blade.php
+++ b/resources/views/livewire/project/service/storage.blade.php
@@ -366,7 +366,7 @@
                 icon-name="storages" />
         @elseif ($activeTab === 'volumes')
             @if ($hasVolumes)
-                <livewire:project.shared.storages.all wire:key="volumes-{{ $resource->id }}-{{ $this->volumeCount }}"
+                <livewire:project.shared.storages.all wire:key="volumes-{{ $resource->id }}"
                     :resource="$resource" />
             @else
                 <x-empty size="sm" title="No volumes configured"
@@ -433,7 +433,7 @@
             @elseif ($activeTab === 'volumes')
                 @if ($hasVolumes)
                     <livewire:project.shared.storages.all
-                        wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"
+                        wire:key="svc-volumes-{{ $resource->id }}"
                         :resource="$resource" />
                 @else
                     <x-empty size="sm" title="No volumes configured"
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index 9fa11f1f8a..f69d3f0db2 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -56,6 +56,44 @@
     <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="request()->query()"
         wire:key="service-heading-volume-backup-index" />
 
+    @if ($selectedDatabaseBackup || $selectedVolumeBackup)
+        @php
+            $selectedSchedule = $selectedDatabaseBackup ?: $selectedVolumeBackup;
+        @endphp
+        <x-modal-input :title="'Edit backup schedule'" wireOpen="scheduleModalOpen" :wireIgnore="false" isLarge
+            canGate="update" :canResource="$service">
+            <x-slot:content><span></span></x-slot:content>
+
+            <div x-data="{ activeSection: 'general' }" class="flex min-w-0 flex-col gap-6">
+                <div>
+                    <h2 class="text-base font-semibold text-neutral-950 dark:text-fg">
+                        {{ $selectedDatabaseBackup
+                            ? ($selectedDatabaseBackup->database->human_name ?: $selectedDatabaseBackup->database->name)
+                            : $selectedVolumeBackup->targetName() }}
+                    </h2>
+                    <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">{{ $selectedSchedule->frequency }} schedule</p>
+                </div>
+
+                <x-backup-tabs context="service-schedule" :parameters="$parameters" section="general" />
+
+                @foreach (['general', 's3', 'retention', 'danger'] as $modalSection)
+                    <div x-show="activeSection === '{{ $modalSection }}'" x-cloak>
+                        @if ($selectedDatabaseBackup)
+                            <livewire:project.database.backup-edit :backup="$selectedDatabaseBackup"
+                                :available-s3-storages="$s3s" :status="data_get($selectedDatabaseBackup->database, 'status')"
+                                :section="$modalSection"
+                                wire:key="service-database-backup-modal-{{ $selectedDatabaseBackup->uuid }}-{{ $modalSection }}" />
+                        @else
+                            <livewire:project.shared.storages.volume-backups :storage="$selectedVolumeBackup->backupable"
+                                :resource="$service" :section="$modalSection"
+                                wire:key="service-volume-backup-modal-{{ $selectedVolumeBackup->uuid }}-{{ $modalSection }}" />
+                        @endif
+                    </div>
+                @endforeach
+            </div>
+        </x-modal-input>
+    @endif
+
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
             <x-service.configuration-sidebar :service="$service"
@@ -190,9 +228,11 @@
         </div>
 
         <div @class([
-            'application-settings-section-body w-full',
+            'application-settings-section-body relative w-full',
             'is-flush' => $backups->isNotEmpty() || $databaseBackups->isNotEmpty(),
         ])>
+            <x-table.loading target="openSchedule" text="Loading schedule..." />
+
             <div x-cloak x-show="backups.length > 0 && filteredBackups.length === 0">
                 <x-empty size="sm" title="No backups found"
                     description="No scheduled backups match your search." />
@@ -200,6 +240,7 @@
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
+                    <div class="min-w-[59rem]">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
@@ -207,6 +248,7 @@
                         <span>Status</span>
                         <span>S3</span>
                         <span>Last run</span>
+                        <span class="text-right">Actions</span>
                     </div>
 
                     @foreach ($databaseBackups as $databaseBackup)
@@ -227,16 +269,12 @@
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
                         @endphp
-                        <a wire:key="database-backup-{{ $databaseBackup->uuid }}"
+                        <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
                             x-bind:style="{ order: backupOrder(@js($databaseBackupId)) }"
-                            href="{{ route('project.service.database.backup.show', [
-                                ...$parameters,
-                                'stack_service_uuid' => $databaseBackup->database->uuid,
-                                'backup_uuid' => $databaseBackup->uuid,
-                            ]) }}"
-                            {{ wireNavigate() }}
-                            class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
+                            wire:click="openSchedule('{{ $databaseBackup->uuid }}')"
+                            wire:keydown.enter="openSchedule('{{ $databaseBackup->uuid }}')" role="button" tabindex="0"
+                            class="data-table-row backup-table-grid cursor-pointer text-left text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
                             <span class="min-w-0 truncate font-medium text-neutral-950 dark:text-fg">
                                 {{ $databaseBackup->database->human_name ?: $databaseBackup->database->name }}
                             </span>
@@ -248,7 +286,12 @@
                                     :type="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'success' : 'error') : 'neutral'" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
-                        </a>
+                            <span class="flex justify-end">
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="backupNow('database', '{{ $databaseBackup->uuid }}')"
+                                    wire:target="backupNow('database', '{{ $databaseBackup->uuid }}')">Back up now</x-forms.button>
+                            </span>
+                        </div>
                     @endforeach
 
                     @foreach ($backups as $backup)
@@ -268,12 +311,12 @@
                                 default => 'neutral',
                             };
                         @endphp
-                        <a wire:key="volume-backup-{{ $backup->uuid }}"
+                        <div wire:key="volume-backup-{{ $backup->uuid }}"
                             x-show="isVisible(@js('storage:'.$backup->id))"
                             x-bind:style="{ order: backupOrder(@js('storage:'.$backup->id)) }"
-                            href="{{ route('project.service.volume-backups.show', [...$parameters, 'backup_uuid' => $backup->uuid]) }}"
-                            {{ wireNavigate() }}
-                            class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
+                            wire:click="openSchedule('{{ $backup->uuid }}')"
+                            wire:keydown.enter="openSchedule('{{ $backup->uuid }}')" role="button" tabindex="0"
+                            class="data-table-row backup-table-grid cursor-pointer text-left text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
                             <span class="min-w-0 truncate font-medium text-neutral-950 dark:text-fg"
                                 title="{{ $backup->targetName() }}">
                                 {{ $backup->targetName() }}
@@ -288,8 +331,14 @@
                             <span>
                                 {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
                             </span>
-                        </a>
+                            <span class="flex justify-end">
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="backupNow('storage', '{{ $backup->uuid }}')"
+                                    wire:target="backupNow('storage', '{{ $backup->uuid }}')">Back up now</x-forms.button>
+                            </span>
+                        </div>
                     @endforeach
+                    </div>
                 </div>
             @else
                 <x-empty size="sm" title="No scheduled backups"
@@ -297,6 +346,8 @@
                     icon-name="storages" />
             @endif
         </div>
+        <livewire:project.service.backup-executions :service="$service"
+            wire:key="service-backup-executions-{{ $service->id }}" />
             </div>
         </div>
     </section>
diff --git a/resources/views/livewire/project/service/volume-backup/show.blade.php b/resources/views/livewire/project/service/volume-backup/show.blade.php
index e23a8a94cf..393822467f 100644
--- a/resources/views/livewire/project/service/volume-backup/show.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/show.blade.php
@@ -8,9 +8,29 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            <x-backup-sidebar context="service-volume" :parameters="$parameters" :section="$section" />
+            <x-service.configuration-sidebar :service="$service"
+                current-route="project.service.volume-backups.index" />
+
+            <div class="flex min-w-0 flex-col gap-6">
+                <div class="flex min-w-0 flex-col gap-4">
+                    <div>
+                        <a class="inline-flex items-center gap-1.5 text-xs text-neutral-500 hover:text-neutral-900 dark:text-fg-dim dark:hover:text-fg"
+                            {{ wireNavigate() }}
+                            href="{{ route('project.service.volume-backups.index', collect($parameters)->except('backup_uuid')->all()) }}">
+                            <x-reicon name="arrow-right" class="size-3.5 rotate-180" />
+                            Back to backups
+                        </a>
+                        <h1 class="mt-2 text-xl font-semibold text-neutral-950 dark:text-fg">
+                            {{ $backup->targetName() }} backup
+                        </h1>
+                        <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                            {{ $backup->frequency }} schedule
+                        </p>
+                    </div>
+
+                    <x-backup-tabs context="service-volume" :parameters="$parameters" :section="$section" />
+                </div>
 
-            <div class="min-w-0">
                 <livewire:project.shared.storages.volume-backups :storage="$backup->backupable"
                     :resource="$service" :section="$section"
                     wire:key="service-volume-backup-{{ $backup->uuid }}-{{ $section }}" />
diff --git a/resources/views/livewire/project/shared/destination.blade.php b/resources/views/livewire/project/shared/destination.blade.php
index a1f7923d3a..5aba6c9ece 100644
--- a/resources/views/livewire/project/shared/destination.blade.php
+++ b/resources/views/livewire/project/shared/destination.blade.php
@@ -35,6 +35,7 @@
                     <div class="flex flex-wrap items-center gap-2 sm:justify-end">
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
+                        <x-application.restart-limit-warning :application="$resource" />
                         <x-status-summary :status="$resource->status" />
                         @if ($hasAdditionalDestinations)
                             <x-forms.button canGate="deploy" :canResource="$resource"
@@ -217,6 +218,9 @@
                     <div class="flex flex-wrap items-center gap-2 sm:justify-end">
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
+                        @if (method_exists($resource, 'stoppedAfterRestartLimit'))
+                            <x-application.restart-limit-warning :application="$resource" />
+                        @endif
                         @if ($primaryStatus->startsWith('running'))
                             <x-status.running :status="$primaryStatus->value()" />
                         @elseif ($primaryStatus->startsWith(['starting', 'restarting']))
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index 972cbdf3e7..30ef3f6598 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -152,10 +152,8 @@
                                 </label>
                                 <div class="relative">
                                     @if (!$valuesLoaded)
-                                        <div class="input input-with-password-toggle flex w-full items-center text-neutral-500 dark:text-fg-dim"
-                                            aria-busy="true">
-                                            <x-loading text="Loading value..." />
-                                        </div>
+                                        <x-forms.input loading loadingText="Loading value..."
+                                            defaultClass="input input-with-password-toggle" />
                                     @else
                                         <x-forms.env-var-input id="value" type="password"
                                             canGate="manageEnvironment" :canResource="$this->resource"
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index 57391233d4..dc64666e2f 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -513,19 +513,23 @@
                     @if ($outputs)
                         @php
                             $displayLines = collect(explode("\n", $outputs))->filter(fn($line) => trim($line) !== '');
+                            $lineOccurrences = [];
                         @endphp
                         <div id="logs" class="font-logs max-w-full cursor-default text-[11px] leading-relaxed sm:text-xs">
                             <div x-show="searchQuery.trim() && matchCount === 0"
                                 class="py-2 text-gray-500 dark:text-gray-400">
                                 No matches found.
                             </div>
-                            @foreach ($displayLines as $index => $line)
+                            @foreach ($displayLines as $line)
                                 @php
+                                    $lineFingerprint = md5($line);
+                                    $lineOccurrence = $lineOccurrences[$lineFingerprint] ?? 0;
+                                    $lineOccurrences[$lineFingerprint] = $lineOccurrence + 1;
+
                                     // Parse timestamp from log line (ISO 8601 format: 2025-12-04T11:48:39.136764033Z)
                                     $timestamp = '';
                                     $logContent = $line;
                                     if (preg_match('/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z?\s(.*)$/', $line, $matches)) {
-                                        $microseconds = isset($matches[2]) ? substr($matches[2], 0, 6) : '000000';
                                         $logContent = $matches[3];
 
                                         // Convert UTC Docker timestamp to server timezone for display
@@ -537,11 +541,9 @@
                                             // keep UTC
                                         }
                                         $timestamp = $carbonTs->format('Y-M-d H:i:s');
-                                        // Include microseconds in key for uniqueness
-                                        $lineKey = "{$timestamp}.{$microseconds}";
                                     }
                                 @endphp
-                                <div wire:key="{{ $lineKey ?? 'line-' . $index }}" data-log-line data-log-content="{{ $line }}" class="log-line logs-viewer-line">
+                                <div wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}" data-log-line data-log-content="{{ $line }}" class="log-line logs-viewer-line">
                                     @if ($timestamp && $showTimeStamps)
                                         <span class="logs-viewer-timestamp text-gray-500">{{ $timestamp }}</span>
                                     @endif
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index dbe21fd7b8..cfbc58972b 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -183,7 +183,7 @@
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
                                     <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" :options="[
+                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" portal :options="[
                                         ['value' => true, 'label' => 'Add suffix'],
                                         ['value' => false, 'label' => 'Share volume'],
                                     ]" />
diff --git a/resources/views/livewire/project/shared/storages/show.blade.php b/resources/views/livewire/project/shared/storages/show.blade.php
deleted file mode 100644
index 3662568087..0000000000
--- a/resources/views/livewire/project/shared/storages/show.blade.php
+++ /dev/null
@@ -1,156 +0,0 @@
-@php
-    $showActionsColumn = $resource instanceof \App\Models\Application;
-    $gridClass = match (true) {
-        $supportsPreviewSuffix => 'volumes-table-grid-with-pr',
-        $showActionsColumn => 'volumes-table-grid',
-        default => 'volumes-table-grid-readonly',
-    };
-    $canUpdate = auth()->user()?->can('update', $resource) ?? false;
-    $inputsReadonly = $isReadOnly || ! $canUpdate;
-    $displayHostPath = filled($hostPath) ? $hostPath : '—';
-@endphp
-
-@if ($inputsReadonly)
-    {{-- Read-only: plain data-table row (service / compose / no permission) --}}
-    <div class="env-table-item" wire:key="storage-row-{{ $storage->id }}">
-        <div class="data-table-row {{ $gridClass }} text-[13px] text-neutral-700 dark:text-fg-dim">
-            <div class="volumes-cell-name min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Volume Name</span>
-                <div class="flex min-w-0 items-center gap-2">
-                    <span class="min-w-0 truncate text-[13px] font-medium text-neutral-950 dark:text-fg"
-                        title="{{ $name }}">{{ $name }}</span>
-                    @if ($hasEnabledBackup)
-                        @if ($backupUrl)
-                            <a href="{{ $backupUrl }}"
-                                class="table-badge table-badge-success shrink-0 underline-offset-2 hover:underline"
-                                title="Volume backup is enabled">
-                                Backup
-                            </a>
-                        @else
-                            <span class="table-badge table-badge-success shrink-0" title="Volume backup is enabled">
-                                Backup
-                            </span>
-                        @endif
-                    @endif
-                </div>
-            </div>
-
-            <div class="volumes-col-source min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                <span class="block min-w-0 truncate text-[13px]" title="{{ $hostPath }}">
-                    {{ $displayHostPath }}
-                </span>
-            </div>
-
-            <div class="volumes-cell-dest min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Destination Path</span>
-                <span class="block min-w-0 truncate text-[13px] text-neutral-950 dark:text-fg"
-                    title="{{ $mountPath }}">{{ $mountPath }}</span>
-            </div>
-
-            @if ($supportsPreviewSuffix)
-                <div class="volumes-col-pr min-w-0">
-                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                    <span>{{ $isPreviewSuffixEnabled ? 'Add suffix' : 'Share volume' }}</span>
-                </div>
-            @endif
-
-            @if ($showActionsColumn)
-                <div class="volumes-col-actions volumes-cell-actions flex flex-wrap items-center justify-end gap-1.5">
-                    @if ($canUpdate)
-                        @if ($showBackupModal)
-                            <x-modal-input buttonTitle="Backup" title="Configure Volume Backup" :wireIgnore="false"
-                                wireOpen="showBackupModal">
-                                <livewire:project.application.backup.create :application="$resource"
-                                    :selected-target-key="'volume:' . $storage->id"
-                                    wire:key="configure-readonly-volume-backup-{{ $storage->id }}" />
-                            </x-modal-input>
-                        @else
-                            <x-forms.button type="button" wire:click="openBackupModal" class="!px-2.5 !text-xs">
-                                Backup
-                            </x-forms.button>
-                        @endif
-                    @else
-                        <span class="text-neutral-400 dark:text-fg-faint">—</span>
-                    @endif
-                </div>
-            @endif
-        </div>
-    </div>
-@else
-    {{-- Editable volume row --}}
-    <form wire:submit="submit" class="env-table-item" wire:key="storage-row-{{ $storage->id }}">
-        <div class="data-table-row {{ $gridClass }}">
-            <div class="volumes-cell-name min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Volume Name</span>
-                <div class="flex min-w-0 items-center gap-2">
-                    <div class="min-w-0 flex-1">
-                        <x-forms.input id="name" required />
-                    </div>
-                    @if ($hasEnabledBackup)
-                        @if ($backupUrl)
-                            <a href="{{ $backupUrl }}"
-                                class="table-badge table-badge-success shrink-0 underline-offset-2 hover:underline"
-                                title="Volume backup is enabled">
-                                Backup
-                            </a>
-                        @else
-                            <span class="table-badge table-badge-success shrink-0" title="Volume backup is enabled">
-                                Backup
-                            </span>
-                        @endif
-                    @endif
-                </div>
-            </div>
-
-            <div class="volumes-col-source min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                <x-forms.input id="hostPath" placeholder="Host path (optional)" />
-            </div>
-
-            <div class="volumes-cell-dest min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Destination Path</span>
-                <x-forms.input id="mountPath" required placeholder="/path/in/container" />
-            </div>
-
-            @if ($supportsPreviewSuffix)
-                <div class="volumes-col-pr min-w-0">
-                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                    <x-forms.listbox id="isPreviewSuffixEnabled" onChange="instantSave" :options="[
-                        ['value' => true, 'label' => 'Add suffix'],
-                        ['value' => false, 'label' => 'Share volume'],
-                    ]" />
-                </div>
-            @endif
-
-            <div class="volumes-col-actions volumes-cell-actions flex flex-wrap items-center justify-end gap-1.5">
-                <x-forms.button type="submit" class="!px-2.5 !text-xs">
-                    Update
-                </x-forms.button>
-
-                @if ($resource instanceof \App\Models\Application)
-                    @if ($showBackupModal)
-                        <x-modal-input buttonTitle="Backup" title="Configure Volume Backup" :wireIgnore="false"
-                            wireOpen="showBackupModal">
-                            <livewire:project.application.backup.create :application="$resource"
-                                :selected-target-key="'volume:' . $storage->id"
-                                wire:key="configure-volume-backup-{{ $storage->id }}" />
-                        </x-modal-input>
-                    @else
-                        <x-forms.button type="button" wire:click="openBackupModal" class="!px-2.5 !text-xs">
-                            Backup
-                        </x-forms.button>
-                    @endif
-                @endif
-
-                <x-modal-confirmation title="Confirm persistent storage deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete" :actions="[
-                        'The selected persistent storage/volume will be permanently deleted.',
-                        'If the persistent storage/volume is actvily used by a resource data will be lost.',
-                    ]" confirmationText="{{ $storage->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
-                    shortConfirmationLabel="Storage Name" />
-            </div>
-        </div>
-    </form>
-@endif
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 80647458df..ddffd51094 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -107,13 +107,17 @@
             @endcan
 
             @if (session()->has('token'))
-                <x-application.settings-section title="Copy your token"
-                    description="This value will not be shown again after you leave this page.">
-                    <div class="relative">
-                        <input type="text" value="{{ session('token') }}" readonly
-                            class="input w-full pr-12! font-mono text-[12px] text-black dark:text-fg">
-                        <x-copy-button :value="session('token')" label="Copy token"
-                            class="absolute top-1/2 right-2 -translate-y-1/2" />
+                <x-application.settings-section title="Copy your token">
+                    <div class="flex flex-col gap-3">
+                        <p class="text-sm text-neutral-500 dark:text-fg-dim">
+                            This value will not be shown again after you leave this page.
+                        </p>
+                        <div class="relative">
+                            <input type="text" value="{{ session('token') }}" readonly
+                                class="input w-full pr-12! font-mono text-[12px] text-black dark:text-fg">
+                            <x-copy-button :value="session('token')" label="Copy token"
+                                class="absolute top-1/2 right-2 -translate-y-1/2" />
+                        </div>
                     </div>
                 </x-application.settings-section>
             @endif
diff --git a/resources/views/livewire/security/private-key/index.blade.php b/resources/views/livewire/security/private-key/index.blade.php
index 32f6ad655a..a5dda7ad9a 100644
--- a/resources/views/livewire/security/private-key/index.blade.php
+++ b/resources/views/livewire/security/private-key/index.blade.php
@@ -76,9 +76,8 @@
             </div>
             @foreach ($privateKeys as $key)
                 @can('view', $key)
-                    <x-modal-input title="Edit Private Key" isFullWidth :wireIgnore="false" :contentClicks="false"
+                    <div wire:key="private-key-{{ $key->id }}"
                         class="border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
-                        <x-slot:content>
                     <div
                         class="grid min-h-14 w-full grid-cols-[minmax(0,1fr)_7rem_1.75rem] items-center gap-3 px-4 py-2.5 text-left transition-colors hover:bg-neutral-50 sm:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)_7rem_1.75rem] dark:hover:bg-white/[0.025]"
                     >
@@ -104,14 +103,13 @@
                             @endif
                         </div>
                         <button type="button" class="icon-button" title="Edit private key"
-                            aria-label="Edit {{ $key->name }}" @click="modalOpen=true">
+                            aria-label="Edit {{ $key->name }}"
+                            @click="$dispatch('open-private-key-editor', { name: @js($key->name), description: @js($key->description ?? '') })"
+                            wire:click="openEditor('{{ $key->uuid }}')">
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                     </div>
-                        </x-slot:content>
-                        <livewire:security.private-key.show :private_key_uuid="$key->uuid" :modalMode="true"
-                            :key="'private-key-editor-'.$key->uuid" />
-                    </x-modal-input>
+                    </div>
                 @else
                     <div class="grid min-h-14 cursor-not-allowed grid-cols-[minmax(0,1fr)_7rem_1.75rem] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 opacity-65 last:border-b-0 sm:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)_7rem_1.75rem] dark:border-white/[0.07]"
                         title="You do not have permission to view this private key">
@@ -139,6 +137,39 @@
             @endforeach
         </div>
     @endif
+
+    <x-modal-input title="Edit Private Key" :wireIgnore="false" :contentClicks="false"
+        @open-private-key-editor.window="modalOpen=true; $nextTick(() => { $refs.loadingPrivateKeyName.value = $event.detail.name; $refs.loadingPrivateKeyDescription.value = $event.detail.description })">
+        <x-slot:content><span class="hidden" aria-hidden="true"></span></x-slot:content>
+        <div wire:loading.flex wire:target="openEditor" aria-label="Loading private key editor"
+            class="w-full flex-col gap-4">
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input label="Name" required x-ref="loadingPrivateKeyName" />
+                <x-forms.input label="Description" x-ref="loadingPrivateKeyDescription" />
+                <div class="lg:col-span-2">
+                    <x-forms.input label="Public key" loading
+                        helper="Copy this value to ~/.ssh/authorized_keys on the target server." />
+                </div>
+                <div class="lg:col-span-2">
+                    <div class="mb-1.5 flex items-center justify-between gap-3">
+                        <label class="text-[13px] font-medium">Private key <span class="text-helper">*</span></label>
+                        <span class="text-[11px] font-medium text-neutral-400 dark:text-fg-faint">Edit key</span>
+                    </div>
+                    <x-forms.input loading :allowToPeak="false" />
+                </div>
+            </div>
+            <div class="flex items-center justify-between gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                <x-forms.button disabled isError>Delete</x-forms.button>
+                <x-forms.button disabled isHighlighted>Save changes</x-forms.button>
+            </div>
+        </div>
+        @if ($selectedPrivateKeyUuid)
+            <div wire:loading.remove wire:target="openEditor">
+                <livewire:security.private-key.show :private_key_uuid="$selectedPrivateKeyUuid" :modalMode="true"
+                    :key="'private-key-editor-'.$selectedPrivateKeyUuid" />
+            </div>
+        @endif
+    </x-modal-input>
         </x-application.settings-section>
 
     </x-security.settings-layout>
diff --git a/resources/views/livewire/security/private-key/show.blade.php b/resources/views/livewire/security/private-key/show.blade.php
index 59cffc70fa..da9373f0f1 100644
--- a/resources/views/livewire/security/private-key/show.blade.php
+++ b/resources/views/livewire/security/private-key/show.blade.php
@@ -1,6 +1,8 @@
-<div x-init="$wire.loadPublicKey()">
+<div>
     @if ($modalMode)
-        <form wire:submit="changePrivateKey" class="flex flex-col gap-4" x-data="{ showPrivateKey: false }">
+        <div class="relative">
+        <form wire:submit="changePrivateKey" class="flex flex-col gap-4" x-data="{ showPrivateKey: false }"
+            wire:loading.class="pointer-events-none opacity-50" wire:target="delete">
             <div class="grid gap-4 lg:grid-cols-2">
                 <x-forms.input canGate="update" :canResource="$private_key" id="name" label="Name" required />
                 <x-forms.input canGate="update" :canResource="$private_key" id="description" label="Description" />
@@ -34,6 +36,11 @@
                 <x-forms.button type="submit" isHighlighted>Save changes</x-forms.button>
             </div>
         </form>
+        <div wire:loading.flex wire:target="delete"
+            class="absolute inset-0 z-10 items-center justify-center rounded-lg bg-white/50 dark:bg-black/40">
+            <x-loading text="Deleting private key..." />
+        </div>
+        </div>
     @else
     <x-slot:title>
         {{ $private_key->name }} | Private Keys | Coolify
diff --git a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
index 6e2016370d..2ffc8ae779 100644
--- a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
+++ b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
@@ -60,7 +60,7 @@
                                         <livewire:server.proxy.dynamic-configuration-navbar
                                             :server_id="$server->id" :server="$server" :fileName="$fileName"
                                             :value="$value ?? ''" :newFile="false"
-                                            wire:key="{{ $fileName }}-{{ $loop->index }}" />
+                                            wire:key="proxy-navbar-{{ $fileName }}" />
                                     @endif
                                 </x-slot:actions>
                                 <x-forms.textarea disabled wire:model="contents.{{ $fileName }}"
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 491535dd62..9fb2ca2fcc 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -61,10 +61,14 @@
                                     {{ str($resource->type())->headline() }}
                                 </div>
                                 <div>
-                                    <x-status-badge :status="str($resourceStatus)->headline()"
-                                        :type="str($resourceStatus)->contains('running')
-                                            ? 'success'
-                                            : (str($resourceStatus)->contains(['failed', 'exited']) ? 'error' : 'neutral')" />
+                                    @if (method_exists($resource, 'stoppedAfterRestartLimit') && $resource->stoppedAfterRestartLimit())
+                                        <x-application.restart-limit-warning :application="$resource" />
+                                    @else
+                                        <x-status-badge :status="str($resourceStatus)->headline()"
+                                            :type="str($resourceStatus)->contains('running')
+                                                ? 'success'
+                                                : (str($resourceStatus)->contains(['failed', 'exited']) ? 'error' : 'neutral')" />
+                                    @endif
                                 </div>
                             </div>
                         @endforeach
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index d05ac5ac98..6840529dc8 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -134,11 +134,18 @@
                             ['value' => false, 'label' => 'Enabled'],
                             ['value' => true, 'label' => 'Disabled'],
                         ]" />
-                    <x-forms.listbox id="is_sponsorship_popup_enabled" label="Sponsorship reminders"
-                        helper="Show the monthly project sponsorship reminder." onChange="instantSave" :options="[
-                            ['value' => true, 'label' => 'Enabled'],
-                            ['value' => false, 'label' => 'Disabled'],
-                        ]" />
+                    <div class="flex flex-col gap-2">
+                        <x-forms.listbox id="is_sponsorship_popup_enabled" label="Sponsorship reminders"
+                            helper="Show the monthly project sponsorship reminder." onChange="instantSave" :options="[
+                                ['value' => true, 'label' => 'Enabled'],
+                                ['value' => false, 'label' => 'Disabled'],
+                            ]" />
+                        @if (isDev())
+                            <x-forms.button type="button" @click="$dispatch('show-sponsorship-reminder')">
+                                Show sponsorship reminder
+                            </x-forms.button>
+                        @endif
+                    </div>
                 </div>
             </x-application.settings-section>
 
diff --git a/resources/views/livewire/settings/scheduled-jobs.blade.php b/resources/views/livewire/settings/scheduled-jobs.blade.php
index 11d0e5fdd2..4cbd4a8cd0 100644
--- a/resources/views/livewire/settings/scheduled-jobs.blade.php
+++ b/resources/views/livewire/settings/scheduled-jobs.blade.php
@@ -216,7 +216,7 @@
                                 <span>Skipped</span>
                             </div>
                             @foreach ($managerRuns as $run)
-                                <div wire:key="run-{{ $loop->index }}"
+                                <div wire:key="run-{{ md5(serialize($run)) }}"
                                     x-show="{{ $loop->index }} >= (page - 1) * perPage && {{ $loop->index }} < page * perPage"
                                     class="data-table-row scheduler-runs-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
                                     <div class="font-mono text-[11px] text-neutral-500 dark:text-fg-dim">
@@ -272,7 +272,7 @@
                                     default => ucfirst(str_replace('_', ' ', $skip['reason'])),
                                 };
                             @endphp
-                            <div wire:key="skip-{{ $loop->index }}"
+                            <div wire:key="skip-{{ md5(serialize($skip)) }}"
                                 class="data-table-row skipped-jobs-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
                                 <div class="font-mono text-[11px] text-neutral-500 dark:text-fg-dim">
                                     {{ $skip['timestamp'] }}
diff --git a/resources/views/livewire/shared-variables/project/index.blade.php b/resources/views/livewire/shared-variables/project/index.blade.php
index eb394ae83e..63e4f45731 100644
--- a/resources/views/livewire/shared-variables/project/index.blade.php
+++ b/resources/views/livewire/shared-variables/project/index.blade.php
@@ -24,7 +24,7 @@
                             <div class="flex items-start gap-3">
                                 <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                                     @if ($project->icon_path)
-                                        <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                        <img src="{{ project_icon_url($project) }}"
                                             alt="{{ $project->name }} icon"
                                             class="h-full w-full rounded-lg object-cover">
                                     @else
@@ -49,7 +49,7 @@
                             href="{{ route('shared-variables.project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
                             class="flex min-h-14 items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                             @if ($project->icon_path)
-                                <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                <img src="{{ project_icon_url($project) }}"
                                     alt="{{ $project->name }} icon" class="size-4 shrink-0 rounded object-cover">
                             @else
                                 <x-reicon name="projects" class="size-4 shrink-0 text-neutral-500 dark:text-fg-dim" />
diff --git a/resources/views/livewire/team/danger-zone.blade.php b/resources/views/livewire/team/danger-zone.blade.php
index 8d0c022b12..b31ef2c5ab 100644
--- a/resources/views/livewire/team/danger-zone.blade.php
+++ b/resources/views/livewire/team/danger-zone.blade.php
@@ -1,4 +1,12 @@
 <div>
+    @php
+        $deletionBlockers = currentTeam()->deletionBlockers();
+        $blockerDetails = [
+            'projects' => ['label' => 'project', 'route' => 'project.index'],
+            'servers' => ['label' => 'server', 'route' => 'server.index'],
+            'sources' => ['label' => 'Git source', 'route' => 'source.all'],
+        ];
+    @endphp
     <x-slot:title>
         Team Danger Zone | Coolify
     </x-slot>
@@ -34,7 +42,7 @@
                                         {{ wireNavigate() }} href="{{ route('subscription.show') }}">subscription</a>
                                     before deleting this team.
                                 </p>
-                            @elseif(currentTeam()->isEmpty())
+                            @elseif($deletionBlockers === [])
                                 <p class="mt-2 max-w-2xl text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
                                     Permanently delete <strong class="font-semibold text-black dark:text-fg">{{ currentTeam()->name }}</strong>
                                     from Coolify. This action cannot be undone.
@@ -45,7 +53,20 @@
                                 </ul>
                             @else
                                 <p class="mt-2 text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
-                                    Remove or move every resource owned by this team before deleting it.
+                                    This team still owns:
+                                </p>
+                                <ul class="mt-2 space-y-1 text-[13px] text-neutral-600 dark:text-fg-dim">
+                                    @foreach ($deletionBlockers as $type => $count)
+                                        <li>
+                                            <a class="font-medium text-coollabs hover:underline dark:text-warning"
+                                                {{ wireNavigate() }} href="{{ route($blockerDetails[$type]['route']) }}">
+                                                {{ $count }} {{ str($blockerDetails[$type]['label'])->plural($count) }}
+                                            </a>
+                                        </li>
+                                    @endforeach
+                                </ul>
+                                <p class="mt-2 text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
+                                    Remove or move these resources before deleting the team.
                                 </p>
                             @endif
                         </div>
@@ -57,14 +78,15 @@
                                     auth()->user()->teams()->count() > 1 &&
                                     !auth()->user()->currentTeam()->personal_team &&
                                     !currentTeam()->subscription &&
-                                    currentTeam()->isEmpty())
+                                    $deletionBlockers === [])
                                 <x-modal-confirmation title="Confirm Team Deletion?" buttonTitle="Delete team"
                                     isErrorButton submitAction="delete"
                                     :actions="['The current team will be permanently deleted from Coolify and the database.']"
                                     confirmationText="{{ currentTeam()->name }}"
                                     confirmationLabel="Enter the team name to confirm permanent deletion"
                                     shortConfirmationLabel="Team name" :confirmWithPassword="false"
-                                    step2ButtonText="Permanently Delete" />
+                                    step2ButtonText="Permanently Delete" canGate="delete"
+                                    :canResource="$team" />
                             @else
                                 <x-forms.button disabled tooltip="Resolve the requirements shown before deleting this team.">
                                     Delete team
diff --git a/routes/api.php b/routes/api.php
index 5c89a4f8e5..177c82f3ce 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -283,6 +283,7 @@ Route::group([
     Route::post('/applications/{uuid}/restart', [ApplicationsController::class, 'action_restart'])->middleware(['api.ability:deploy']);
     Route::post('/applications/{uuid}/stop', [ApplicationsController::class, 'action_stop'])->middleware(['api.ability:deploy']);
 
+    Route::patch('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'update_preview_by_pull_request_id'])->middleware(['api.ability:write']);
     Route::delete('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'delete_preview_by_pull_request_id'])->middleware(['api.ability:write']);
 
     Route::get('/github-apps', [GithubController::class, 'list_github_apps'])->middleware(['api.ability:read']);
diff --git a/routes/web.php b/routes/web.php
index 435dcc9ed6..f78166057d 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -37,6 +37,7 @@ use App\Livewire\Project\Resource\Create as ResourceCreate;
 use App\Livewire\Project\Resource\Index as ResourceIndex;
 use App\Livewire\Project\Service\Configuration as ServiceConfiguration;
 use App\Livewire\Project\Service\DatabaseBackups as ServiceDatabaseBackups;
+use App\Livewire\Project\Service\ImportBackup as ServiceImportBackup;
 use App\Livewire\Project\Service\Index as ServiceIndex;
 use App\Livewire\Project\Service\VolumeBackup\Index;
 use App\Livewire\Project\Service\VolumeBackup\Show;
@@ -331,6 +332,8 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/logs', Logs::class)->name('project.service.logs');
         Route::get('/environment-variables', ServiceConfiguration::class)->name('project.service.environment-variables');
         Route::get('/storages', ServiceConfiguration::class)->name('project.service.storages');
+        Route::get('/import-backup', ServiceImportBackup::class)->name('project.service.import-backup')->middleware('can.update.resource');
+        Route::get('/import-backup/{stack_service_uuid}', ServiceImportBackup::class)->name('project.service.import-backup.database')->middleware('can.update.resource');
         Route::get('/storage-backups', Index::class)->name('project.service.volume-backups.index');
         Route::get('/storage-backups/{backup_uuid}', Show::class)->name('project.service.volume-backups.show');
         Route::get('/storage-backups/{backup_uuid}/s3', Show::class)->name('project.service.volume-backups.s3');
@@ -350,7 +353,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/retention', ServiceDatabaseBackups::class)->name('project.service.database.backup.retention');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/executions', ServiceDatabaseBackups::class)->name('project.service.database.backup.executions');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/danger', ServiceDatabaseBackups::class)->name('project.service.database.backup.danger');
-        Route::get('/{stack_service_uuid}/import', ServiceIndex::class)->name('project.service.database.import')->middleware('can.update.resource');
+        Route::get('/{stack_service_uuid}/import', ServiceImportBackup::class)->name('project.service.database.import')->middleware('can.update.resource');
         Route::get('/{stack_service_uuid}/advanced', ServiceIndex::class)->name('project.service.index.advanced');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
         Route::get('/tasks/{task_uuid}', ServiceConfiguration::class)->name('project.service.scheduled-tasks');
diff --git a/templates/compose/appsmith.yaml b/templates/compose/appsmith.yaml
index d4a05accc2..70f85fb085 100644
--- a/templates/compose/appsmith.yaml
+++ b/templates/compose/appsmith.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: lowcode, nocode, no, low, platform
 # logo: svgs/appsmith.svg
+# port: 80
 
 services:
   appsmith:
diff --git a/templates/compose/appwrite.yaml b/templates/compose/appwrite.yaml
index 2a8e90d18c..4f60baa11e 100644
--- a/templates/compose/appwrite.yaml
+++ b/templates/compose/appwrite.yaml
@@ -3,6 +3,7 @@
 # category: backend
 # tags: backend, backend-as-a-service, platform
 # logo: svgs/appwrite.svg
+# port: 3003
 
 services:
   appwrite:
diff --git a/templates/compose/babybuddy.yaml b/templates/compose/babybuddy.yaml
index a3b52ff989..af07b2282e 100644
--- a/templates/compose/babybuddy.yaml
+++ b/templates/compose/babybuddy.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: baby, parents, health, growth, activities
 # logo: svgs/babybuddy.png
+# port: 8000
 
 services:
   babybuddy:
diff --git a/templates/compose/budge.yaml b/templates/compose/budge.yaml
index 3d98408fc5..d4b7828540 100644
--- a/templates/compose/budge.yaml
+++ b/templates/compose/budge.yaml
@@ -3,6 +3,7 @@
 # category: finance
 # tags: personal finance, budgeting, expense tracking
 # logo: svgs/budge.png
+# port: 80
 
 services:
   budge:
diff --git a/templates/compose/classicpress-with-mariadb.yaml b/templates/compose/classicpress-with-mariadb.yaml
index 20cc9518a5..19ee86e424 100644
--- a/templates/compose/classicpress-with-mariadb.yaml
+++ b/templates/compose/classicpress-with-mariadb.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
   classicpress:
diff --git a/templates/compose/classicpress-with-mysql.yaml b/templates/compose/classicpress-with-mysql.yaml
index ed880538cd..2d90e046c9 100644
--- a/templates/compose/classicpress-with-mysql.yaml
+++ b/templates/compose/classicpress-with-mysql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
   classicpress:
diff --git a/templates/compose/classicpress-without-database.yaml b/templates/compose/classicpress-without-database.yaml
index b2d6d51755..c52fc38605 100644
--- a/templates/compose/classicpress-without-database.yaml
+++ b/templates/compose/classicpress-without-database.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
    classicpress:
diff --git a/templates/compose/dokuwiki.yaml b/templates/compose/dokuwiki.yaml
index d428877ee0..32ce13b293 100644
--- a/templates/compose/dokuwiki.yaml
+++ b/templates/compose/dokuwiki.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: wiki, documentation, knowledge, base
 # logo: svgs/dokuwiki.png
+# port: 80
 
 services:
   dokuwiki:
diff --git a/templates/compose/drupal-with-postgresql.yaml b/templates/compose/drupal-with-postgresql.yaml
index 8329970682..419f0e3002 100644
--- a/templates/compose/drupal-with-postgresql.yaml
+++ b/templates/compose/drupal-with-postgresql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, postgresql
 # logo: svgs/drupal.svg
+# port: 80
 
 services:
   drupal:
diff --git a/templates/compose/executor.yaml b/templates/compose/executor.yaml
new file mode 100644
index 0000000000..e6913ae5d7
--- /dev/null
+++ b/templates/compose/executor.yaml
@@ -0,0 +1,35 @@
+# documentation: https://executor.sh/docs/hosted/docker
+# slogan: Self-hosted AI agent integrations and code execution server.
+# category: development
+# tags: executor,ai,agents,mcp,automation,development
+# logo: svgs/executor.png
+# port: 4788
+
+services:
+  executor:
+    image: 'ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}'
+    environment:
+      - SERVICE_URL_EXECUTOR_4788
+      - EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}
+      - EXECUTOR_HOST=${EXECUTOR_HOST:-0.0.0.0}
+      - PORT=${PORT:-4788}
+      - EXECUTOR_DATA_DIR=/data
+      - EXECUTOR_DB_PATH=${EXECUTOR_DB_PATH:-/data/data.db}
+      - EXECUTOR_ORG_NAME=${EXECUTOR_ORG_NAME:-Default}
+      - EXECUTOR_ORG_SLUG=${EXECUTOR_ORG_SLUG:-default}
+      - EXECUTOR_ALLOW_LOCAL_NETWORK=${EXECUTOR_ALLOW_LOCAL_NETWORK:-false}
+    volumes:
+      - executor-data:/data
+    healthcheck:
+      test:
+        - CMD
+        - bun
+        - -e
+        - "fetch(`http://127.0.0.1:${process.env.PORT||4788}/api/health`).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+volumes:
+  executor-data:
diff --git a/templates/compose/grocy.yaml b/templates/compose/grocy.yaml
index a78373fdf1..fc96d272df 100644
--- a/templates/compose/grocy.yaml
+++ b/templates/compose/grocy.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: groceries, household, management, grocery, shopping
 # logo: svgs/grocy.svg
+# port: 80
 
 services:
   grocy:
diff --git a/templates/compose/heimdall.yaml b/templates/compose/heimdall.yaml
index 5fbdf763cb..56e193f1cf 100644
--- a/templates/compose/heimdall.yaml
+++ b/templates/compose/heimdall.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: dashboard, server, applications, interface
 # logo: svgs/heimdall.svg
+# port: 80
 
 services:
   heimdall:
diff --git a/templates/compose/logto.yaml b/templates/compose/logto.yaml
index ce83a2ec31..7aa840f6d6 100644
--- a/templates/compose/logto.yaml
+++ b/templates/compose/logto.yaml
@@ -3,6 +3,7 @@
 # category: auth
 # tags: logto,identity,login,authentication,oauth,oidc,openid
 # logo: svgs/logto_dark.svg
+# port: 3001
 
 services:
   logto:
diff --git a/templates/compose/phpmyadmin.yaml b/templates/compose/phpmyadmin.yaml
index 5732cdae02..6c95948e07 100644
--- a/templates/compose/phpmyadmin.yaml
+++ b/templates/compose/phpmyadmin.yaml
@@ -3,6 +3,7 @@
 # category: database
 # tags: database management
 # logo: svgs/phpmyadmin.svg
+# port: 80
 
 services:
   phpmyadmin:
diff --git a/templates/compose/snapdrop.yaml b/templates/compose/snapdrop.yaml
index 74d53b007d..6fba2adbb6 100644
--- a/templates/compose/snapdrop.yaml
+++ b/templates/compose/snapdrop.yaml
@@ -2,6 +2,7 @@
 # slogan: A self-hosted file-sharing service for secure and convenient file transfers, whether on a local network or the internet.
 # category: productivity
 # tags: file, sharing, transfer, local, network, internet
+# port: 80
 
 services:
   snapdrop:
diff --git a/templates/compose/wordpress-with-mariadb.yaml b/templates/compose/wordpress-with-mariadb.yaml
index 952aa0498d..7822a05539 100644
--- a/templates/compose/wordpress-with-mariadb.yaml
+++ b/templates/compose/wordpress-with-mariadb.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, mariadb
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/compose/wordpress-with-mysql.yaml b/templates/compose/wordpress-with-mysql.yaml
index 34ad36d65b..269208e514 100644
--- a/templates/compose/wordpress-with-mysql.yaml
+++ b/templates/compose/wordpress-with-mysql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, mysql
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/compose/wordpress-without-database.yaml b/templates/compose/wordpress-without-database.yaml
index f451080364..cb9a459b58 100644
--- a/templates/compose/wordpress-without-database.yaml
+++ b/templates/compose/wordpress-without-database.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index 439aa15d75..c6fc73c60d 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -138,7 +138,8 @@
         "category": "productivity",
         "logo": "svgs/appsmith.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
@@ -152,7 +153,8 @@
         "category": "backend",
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T19:52:21+05:30"
+        "template_last_updated_at": "2025-10-23T19:52:21+05:30",
+        "port": "3003"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -219,7 +221,7 @@
     },
     "autobase": {
         "documentation": "https://autobase.tech/docs/?utm_source=coolify.io",
-        "slogan": "Autobase for PostgreSQL\u00ae is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
+        "slogan": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
         "compose": "c2VydmljZXM6CiAgYXV0b2Jhc2U6CiAgICBpbWFnZTogJ2F1dG9iYXNlL2NvbnNvbGVfdWk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BVVRPQkFTRV84MAogICAgICAtICdQR19DT05TT0xFX0FVVEhPUklaQVRJT05fVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX1VJfScKICAgICAgLSBQR19DT05TT0xFX0FQSV9IT1NUPWF1dG9iYXNlLWFwaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBhdXRvYmFzZS1hcGk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhdXRvYmFzZS1kYjoKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9kYjoyLjUuMicKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdhdXRvYmFzZS1kYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgcG9zdGdyZXMnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogIGF1dG9iYXNlLWFwaToKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9hcGk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFBHX0NPTlNPTEVfREJfSE9TVD1hdXRvYmFzZS1kYgogICAgICAtICdQR19DT05TT0xFX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BHX0NPTlNPTEVfQVVUSE9SSVpBVElPTl9UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdQR19DT05TT0xFX0VOQ1JZUFRJT05LRVk9JHtTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnUEdfQ09OU09MRV9MT0dHRVJfTEVWRUw9JHtQR19DT05TT0xFX0xPR0dFUl9MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3RtcC9hbnNpYmxlOi90bXAvYW5zaWJsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWZzUycKICAgICAgICAtICctSCcKICAgICAgICAtICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24nCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2FwaS92MS92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgIGRlcGVuZHNfb246CiAgICAgIGF1dG9iYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "database",
@@ -248,7 +250,8 @@
         "category": "productivity",
         "logo": "svgs/babybuddy.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "8000"
     },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
@@ -377,7 +380,8 @@
         "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00"
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "port": "80"
     },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
@@ -679,7 +683,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-with-mysql": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -694,7 +699,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-without-database": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -709,7 +715,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
@@ -1070,7 +1077,8 @@
         "category": "cms",
         "logo": "svgs/dokuwiki.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "dolibarr": {
         "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
@@ -1149,7 +1157,8 @@
         "category": "cms",
         "logo": "svgs/drupal.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
@@ -1400,6 +1409,24 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
+    "executor": {
+        "documentation": "https://executor.sh/docs/hosted/docker?utm_source=coolify.io",
+        "slogan": "Self-hosted AI agent integrations and code execution server.",
+        "compose": "c2VydmljZXM6CiAgZXhlY3V0b3I6CiAgICBpbWFnZTogJ2doY3IuaW8vcmh5c3N1bGxpdmFuL2V4ZWN1dG9yLXNlbGZob3N0OiR7RVhFQ1VUT1JfVkVSU0lPTjotbGF0ZXN0fScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0VYRUNVVE9SXzQ3ODgKICAgICAgLSAnRVhFQ1VUT1JfV0VCX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfRVhFQ1VUT1JfNDc4OH0nCiAgICAgIC0gJ0VYRUNVVE9SX0hPU1Q9JHtFWEVDVVRPUl9IT1NUOi0wLjAuMC4wfScKICAgICAgLSAnUE9SVD0ke1BPUlQ6LTQ3ODh9JwogICAgICAtIEVYRUNVVE9SX0RBVEFfRElSPS9kYXRhCiAgICAgIC0gJ0VYRUNVVE9SX0RCX1BBVEg9JHtFWEVDVVRPUl9EQl9QQVRIOi0vZGF0YS9kYXRhLmRifScKICAgICAgLSAnRVhFQ1VUT1JfT1JHX05BTUU9JHtFWEVDVVRPUl9PUkdfTkFNRTotRGVmYXVsdH0nCiAgICAgIC0gJ0VYRUNVVE9SX09SR19TTFVHPSR7RVhFQ1VUT1JfT1JHX1NMVUc6LWRlZmF1bHR9JwogICAgICAtICdFWEVDVVRPUl9BTExPV19MT0NBTF9ORVRXT1JLPSR7RVhFQ1VUT1JfQUxMT1dfTE9DQUxfTkVUV09SSzotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnZXhlY3V0b3ItZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBidW4KICAgICAgICAtICctZScKICAgICAgICAtICdmZXRjaChgaHR0cDovLzEyNy4wLjAuMToke3Byb2Nlc3MuZW52LlBPUlR8fDQ3ODh9L2FwaS9oZWFsdGhgKS50aGVuKHI9PnByb2Nlc3MuZXhpdChyLm9rPzA6MSksKCk9PnByb2Nlc3MuZXhpdCgxKSknCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDIwcwp2b2x1bWVzOgogIGV4ZWN1dG9yLWRhdGE6IG51bGwK",
+        "tags": [
+            "executor",
+            "ai",
+            "agents",
+            "mcp",
+            "automation",
+            "development"
+        ],
+        "category": "development",
+        "logo": "svgs/executor.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "4788"
+    },
     "faraday": {
         "documentation": "https://faradaysec.com/?utm_source=coolify.io",
         "slogan": "Faraday is a powerful, open-source, web-based vulnerability management tool.",
@@ -1776,7 +1803,7 @@
     },
     "getoutline": {
         "documentation": "https://docs.getoutline.com/s/hosting/doc/hosting-outline-nipGaCRBDu?utm_source=coolify.io",
-        "slogan": "Your team\u2019s knowledge base",
+        "slogan": "Your team’s knowledge base",
         "compose": "c2VydmljZXM6CiAgb3V0bGluZToKICAgIGltYWdlOiAnZG9ja2VyLmdldG91dGxpbmUuY29tL291dGxpbmV3aWtpL291dGxpbmU6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZS1kYXRhOi92YXIvbGliL291dGxpbmUvZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PVVRMSU5FXzMwMDAKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gJ1NFQ1JFVF9LRVk9JHtTRVJWSUNFX0hFWF82NF9PVVRMSU5FfScKICAgICAgLSAnVVRJTFNfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9PVVRMSU5FfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF82NF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RBVEFCQVNFOi1vdXRsaW5lfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnVVJMPSR7U0VSVklDRV9VUkxfT1VUTElORX0nCiAgICAgIC0gJ1BPUlQ9JHtPVVRMSU5FX1BPUlQ6LTMwMDB9JwogICAgICAtICdGSUxFX1NUT1JBR0U9JHtGSUxFX1NUT1JBR0U6LWxvY2FsfScKICAgICAgLSAnRklMRV9TVE9SQUdFX0xPQ0FMX1JPT1RfRElSPSR7RklMRV9TVE9SQUdFX0xPQ0FMX1JPT1RfRElSOi0vdmFyL2xpYi9vdXRsaW5lL2RhdGF9JwogICAgICAtICdGSUxFX1NUT1JBR0VfVVBMT0FEX01BWF9TSVpFPSR7RklMRV9TVE9SQUdFX1VQTE9BRF9NQVhfU0laRTotMjAwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9JTVBPUlRfTUFYX1NJWkU9JHtGSUxFX1NUT1JBR0VfSU1QT1JUX01BWF9TSVpFOi0xMDB9JwogICAgICAtICdGSUxFX1NUT1JBR0VfV09SS1NQQUNFX0lNUE9SVF9NQVhfU0laRT0ke0ZJTEVfU1RPUkFHRV9XT1JLU1BBQ0VfSU1QT1JUX01BWF9TSVpFfScKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtBV1NfQUNDRVNTX0tFWV9JRH0nCiAgICAgIC0gJ0FXU19TRUNSRVRfQUNDRVNTX0tFWT0ke0FXU19TRUNSRVRfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ0FXU19SRUdJT049JHtBV1NfUkVHSU9OfScKICAgICAgLSAnQVdTX1MzX0FDQ0VMRVJBVEVfVVJMPSR7QVdTX1MzX0FDQ0VMRVJBVEVfVVJMfScKICAgICAgLSAnQVdTX1MzX1VQTE9BRF9CVUNLRVRfVVJMPSR7QVdTX1MzX1VQTE9BRF9CVUNLRVRfVVJMfScKICAgICAgLSAnQVdTX1MzX1VQTE9BRF9CVUNLRVRfTkFNRT0ke0FXU19TM19VUExPQURfQlVDS0VUX05BTUV9JwogICAgICAtICdBV1NfUzNfRk9SQ0VfUEFUSF9TVFlMRT0ke0FXU19TM19GT1JDRV9QQVRIX1NUWUxFOi10cnVlfScKICAgICAgLSAnQVdTX1MzX0FDTD0ke0FXU19TM19BQ0w6LXByaXZhdGV9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfSUQ9JHtHT09HTEVfQ0xJRU5UX0lEfScKICAgICAgLSAnR09PR0xFX0NMSUVOVF9TRUNSRVQ9JHtHT09HTEVfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0FaVVJFX0NMSUVOVF9JRD0ke0FaVVJFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0FaVVJFX0NMSUVOVF9TRUNSRVQ9JHtBWlVSRV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVfUkVTT1VSQ0VfQVBQX0lEPSR7QVpVUkVfUkVTT1VSQ0VfQVBQX0lEfScKICAgICAgLSAnT0lEQ19DTElFTlRfSUQ9JHtPSURDX0NMSUVOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX1NFQ1JFVD0ke09JRENfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ09JRENfQVVUSF9VUkk9JHtPSURDX0FVVEhfVVJJfScKICAgICAgLSAnT0lEQ19UT0tFTl9VUkk9JHtPSURDX1RPS0VOX1VSSX0nCiAgICAgIC0gJ09JRENfVVNFUklORk9fVVJJPSR7T0lEQ19VU0VSSU5GT19VUkl9JwogICAgICAtICdPSURDX0xPR09VVF9VUkk9JHtPSURDX0xPR09VVF9VUkl9JwogICAgICAtICdPSURDX1VTRVJOQU1FX0NMQUlNPSR7T0lEQ19VU0VSTkFNRV9DTEFJTX0nCiAgICAgIC0gJ09JRENfRElTUExBWV9OQU1FPSR7T0lEQ19ESVNQTEFZX05BTUV9JwogICAgICAtICdPSURDX1NDT1BFUz0ke09JRENfU0NPUEVTfScKICAgICAgLSAnR0lUSFVCX0NMSUVOVF9JRD0ke0dJVEhVQl9DTElFTlRfSUR9JwogICAgICAtICdHSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke0dJVEhVQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR0lUSFVCX0FQUF9OQU1FPSR7R0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnR0lUSFVCX0FQUF9JRD0ke0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdHSVRIVUJfQVBQX1BSSVZBVEVfS0VZPSR7R0lUSFVCX0FQUF9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ0RJU0NPUkRfQ0xJRU5UX0lEPSR7RElTQ09SRF9DTElFTlRfSUR9JwogICAgICAtICdESVNDT1JEX0NMSUVOVF9TRUNSRVQ9JHtESVNDT1JEX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdESVNDT1JEX1NFUlZFUl9JRD0ke0RJU0NPUkRfU0VSVkVSX0lEfScKICAgICAgLSAnRElTQ09SRF9TRVJWRVJfUk9MRVM9JHtESVNDT1JEX1NFUlZFUl9ST0xFU30nCiAgICAgIC0gJ1BHU1NMTU9ERT0ke1BHU1NMTU9ERTotZGlzYWJsZX0nCiAgICAgIC0gJ0ZPUkNFX0hUVFBTPSR7Rk9SQ0VfSFRUUFM6LXRydWV9JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlR9JwogICAgICAtICdTTVRQX1VTRVJOQU1FPSR7U01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEfScKICAgICAgLSAnU01UUF9GUk9NX0VNQUlMPSR7U01UUF9GUk9NX0VNQUlMfScKICAgICAgLSAnU01UUF9SRVBMWV9FTUFJTD0ke1NNVFBfUkVQTFlfRU1BSUx9JwogICAgICAtICdTTVRQX1RMU19DSVBIRVJTPSR7U01UUF9UTFNfQ0lQSEVSU30nCiAgICAgIC0gJ1NNVFBfU0VDVVJFPSR7U01UUF9TRUNVUkV9JwogICAgICAtICdTTVRQX05BTUU9JHtTTVRQX05BTUV9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIGRpc2FibGU6IHRydWUKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6YWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JFRElTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLXJlcXVpcmVwYXNzJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTItYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnZGF0YWJhc2UtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREFUQUJBU0U6LW91dGxpbmV9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBnX2lzcmVhZHkKICAgICAgICAtICctVScKICAgICAgICAtICcke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgICAgLSAnLWQnCiAgICAgICAgLSAnJHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMK",
         "tags": [
             "knowledge base",
@@ -2153,7 +2180,8 @@
         "category": "productivity",
         "logo": "svgs/grocy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-12T09:10:44+02:00"
+        "template_last_updated_at": "2026-05-12T09:10:44+02:00",
+        "port": "80"
     },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
@@ -2203,11 +2231,12 @@
         "category": "productivity",
         "logo": "svgs/heimdall.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
-        "slogan": "Hermes Agent \u2014 autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
+        "slogan": "Hermes Agent — autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
         "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50QHNoYTI1NjoyZjFmMmYxNzI1ZTVkYzlhNjFjZjZhMmRlYTVhY2E1MmE3NzZlYzRkMDIyY2IyOTY3OWU2YWEzZmYzMDNlNzdhJwogICAgY29tbWFuZDogJ2dhdGV3YXkgcnVuJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEVSTUVTX0hPTUU9L2hvbWUvaGVybWVzLy5oZXJtZXMKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lcy8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjkyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBoZXJtZXMtYWdlbnQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0hFUk1FU1dFQlVJXzg3ODcKICAgICAgLSBIRVJNRVNfV0VCVUlfSE9TVD0wLjAuMC4wCiAgICAgIC0gSEVSTUVTX1dFQlVJX1BPUlQ9ODc4NwogICAgICAtIEhFUk1FU19XRUJVSV9TVEFURV9ESVI9L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy93ZWJ1aQogICAgICAtIFdBTlRFRF9VSUQ9MTAwMAogICAgICAtIFdBTlRFRF9HSUQ9MTAwMAogICAgICAtICdIRVJNRVNfV0VCVUlfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0hFUk1FU1dFQlVJfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1hZ2VudC1zcmM6L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy9oZXJtZXMtYWdlbnQ6cm8nCiAgICAgIC0gJ2hlcm1lcy13b3Jrc3BhY2U6L3dvcmtzcGFjZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4Nzg3L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "ai",
@@ -2506,7 +2535,7 @@
     },
     "jitsi": {
         "documentation": "https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/?utm_source=coolify.io",
-        "slogan": "Self-hosted Jitsi Meet \u2014 open-source video conferencing platform",
+        "slogan": "Self-hosted Jitsi Meet — open-source video conferencing platform",
         "compose": "c2VydmljZXM6CiAgaml0c2ktd2ViOgogICAgaW1hZ2U6ICdqaXRzaS93ZWI6c3RhYmxlLTEwODg4JwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9VUkxfSklUU0kKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gRU5BQkxFX0dVRVNUUz0xCiAgICAgIC0gRU5BQkxFX0xFVFNFTkNSWVBUPTAKICAgICAgLSBFTkFCTEVfSFRUUF9SRURJUkVDVD0wCiAgICAgIC0gRElTQUJMRV9IVFRQUz0xCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9HVUVTVF9ET01BSU49Z3Vlc3QubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0lOVEVSTkFMX01VQ19ET01BSU49aW50ZXJuYWwuYXV0aC5tZWV0LmppdHNpCiAgICAgIC0gJ1hNUFBfQk9TSF9VUkxfQkFTRT1odHRwOi8vcHJvc29keTo1MjgwJwogICAgICAtIEpWQl9CUkVXRVJZX01VQz1qdmJicmV3ZXJ5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgICAgLSBqaWNvZm8KICAgICAgLSBqdmIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLXdlYjovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6CiAgICAgICAgYWxpYXNlczoKICAgICAgICAgIC0gbWVldC5qaXRzaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgcHJvc29keToKICAgIGltYWdlOiAnaml0c2kvcHJvc29keTpzdGFibGUtMTA4ODgnCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQVVUSF9UWVBFPWludGVybmFsCiAgICAgIC0gRU5BQkxFX0FVVEg9MAogICAgICAtIEVOQUJMRV9HVUVTVFM9MQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfR1VFU1RfRE9NQUlOPWd1ZXN0Lm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtICdKSUNPRk9fQ09NUE9ORU5UX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSklDT0ZPX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pJQ09GT30nCiAgICAgIC0gJ0pWQl9BVVRIX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KVkJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0xPR19MRVZFTD0ke0xPR19MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1wcm9zb2R5Oi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSB4bXBwLm1lZXQuaml0c2kKICAgICAgICAgIC0gYXV0aC5tZWV0LmppdHNpCiAgICAgICAgICAtIGd1ZXN0Lm1lZXQuaml0c2kKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1MjgwL2h0dHAtYmluZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGppY29mbzoKICAgIGltYWdlOiAnaml0c2kvamljb2ZvOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX1NFUlZFUj1wcm9zb2R5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSBKVkJfQlJFV0VSWV9NVUM9anZiYnJld2VyeQogICAgICAtIEpJQ09GT19FTkFCTEVfSEVBTFRIX0NIRUNLUz0xCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWppY29mbzovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4ODg4L2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGp2YjoKICAgIGltYWdlOiAnaml0c2kvanZiOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMTAwMDA6MTAwMDAvdWRwJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gWE1QUF9TRVJWRVI9cHJvc29keQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gSlZCX0FVVEhfVVNFUj1qdmIKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSBKVkJfUE9SVD0xMDAwMAogICAgICAtICdKVkJfQURWRVJUSVNFX0lQUz0ke0pWQl9BRFZFUlRJU0VfSVBTOi19JwogICAgICAtICdKVkJfU1RVTl9TRVJWRVJTPSR7SlZCX1NUVU5fU0VSVkVSUzotc3R1bi5sLmdvb2dsZS5jb206MTkzMDJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWp2YjovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQpuZXR3b3JrczoKICBtZWV0LmppdHNpOiBudWxsCg==",
         "tags": [
             "jitsi",
@@ -2957,7 +2986,8 @@
         "category": "auth",
         "logo": "svgs/logto_dark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-01T13:19:47Z"
+        "template_last_updated_at": "2026-04-01T13:19:47Z",
+        "port": "3001"
     },
     "lowcoder": {
         "documentation": "https://docs.lowcoder.cloud/?utm_source=coolify.io",
@@ -3265,7 +3295,7 @@
     },
     "moodle": {
         "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
+        "slogan": "Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.",
         "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX01PT0RMRV84MDgwCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX0hPU1Q9bWFyaWFkYgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9QT1JUX05VTUJFUj0zMzA2CiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX05BTUU9Yml0bmFtaV9tb29kbGUKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIEFMTE9XX0VNUFRZX1BBU1NXT1JEPW5vCiAgICAgIC0gJ01PT0RMRV9VU0VSTkFNRT0ke01PT0RMRV9VU0VSTkFNRTotdXNlcn0nCiAgICAgIC0gTU9PRExFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01PT0RMRQogICAgICAtIE1PT0RMRV9FTUFJTD11c2VyQGV4YW1wbGUuY29tCiAgICAgIC0gJ01PT0RMRV9TSVRFX05BTUU9JHtNT09ETEVfU0lURV9OQU1FOi1OZXcgU2l0ZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdtb29kbGUtZGF0YTovYml0bmFtaS9tb29kbGUnCiAgICAgIC0gJ21vb2RsZWRhdGEtZGF0YTovYml0bmFtaS9tb29kbGVkYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBocAogICAgICAgIC0gJy1yJwogICAgICAgIC0gImV4aXQoZmlsZV9leGlzdHMoJy9vcHQvYml0bmFtaS9tb29kbGUvY29uZmlnLnBocCcpID8gMCA6IDEpOyIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "moodle",
@@ -3392,7 +3422,7 @@
     },
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
-        "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
+        "slogan": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.",
         "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
@@ -3829,7 +3859,7 @@
     },
     "openobserve": {
         "documentation": "https://openobserve.ai/docs/?utm_source=coolify.io",
-        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays \u2014 a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
+        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays — a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
         "compose": "c2VydmljZXM6CiAgb3Blbm9ic2VydmU6CiAgICBpbWFnZTogJ3B1YmxpYy5lY3IuYXdzL3ppbmNsYWJzL29wZW5vYnNlcnZlOnYwLjkwLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PUEVOT0JTRVJWRV81MDgwCiAgICAgIC0gWk9fREFUQV9ESVI9L2RhdGEKICAgICAgLSAnWk9fUk9PVF9VU0VSX0VNQUlMPSR7Wk9fUk9PVF9VU0VSX0VNQUlMOi1yb290QGV4YW1wbGUuY29tfScKICAgICAgLSAnWk9fUk9PVF9VU0VSX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9PUEVOT0JTRVJWRX0nCiAgICAgIC0gJ1pPX1RFTEVNRVRSWT0ke1pPX1RFTEVNRVRSWTotZmFsc2V9JwogICAgICAtICdaT19DT09LSUVfU0VDVVJFX09OTFk9JHtaT19DT09LSUVfU0VDVVJFX09OTFk6LXRydWV9JwogICAgdm9sdW1lczoKICAgICAgLSAnb3Blbm9ic2VydmUtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSAvb3Blbm9ic2VydmUKICAgICAgICAtIG5vZGUKICAgICAgICAtIHN0YXR1cwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMK",
         "tags": [
             "logs",
@@ -4112,7 +4142,8 @@
         "category": "database",
         "logo": "svgs/phpmyadmin.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
@@ -4311,7 +4342,7 @@
     },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
-        "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
+        "slogan": "Prowlarr⁠ is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
         "compose": "c2VydmljZXM6CiAgcHJvd2xhcnI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvcHJvd2xhcnI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUFJPV0xBUlJfOTY5NgogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9QUk9XTEFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAncHJvd2xhcnItY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6OTY5Ni9waW5nJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
         "tags": [
             "media",
@@ -4346,7 +4377,7 @@
     },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
-        "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
+        "slogan": "The qBittorrent project aims to provide an open-source software alternative to μTorrent.",
         "compose": "c2VydmljZXM6CiAgcWJpdDoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9xYml0dG9ycmVudDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnV0VCVUlfUE9SVD0ke1dFQlVJX1BPUlQ6LTgwODB9JwogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgdm9sdW1lczoKICAgICAgLSAncWJpdHRvcnJlbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3FiaXR0b3JyZW50LWRvd25sb2FkczovZG93bmxvYWRzJwogICAgICAtICdxYml0dG9ycmVudC10b3JyZW50czovdG9ycmVudHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2dWV0b3JyZW50LWJhY2tlbmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vdnVldG9ycmVudC92dWV0b3JyZW50LWJhY2tlbmQ6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUUJJVE9SUkVOVF84MDgwCiAgICAgIC0gJ1BPUlQ9JHtXRUJVSV9QT1JUOi04MDgwfScKICAgICAgLSAnUUJJVF9CQVNFPSR7U0VSVklDRV9VUkxfUUJJVE9SUkVOVH0nCiAgICAgIC0gJ1JFTEVBU0VfVFlQRT0ke1JFTEVBU0VfVFlQRTotc3RhYmxlfScKICAgICAgLSAnVVBEQVRFX1ZUX0NST049JHtVUERBVEVfVlRfQ1JPTjotIjAgKiAqICogKiJ9JwogICAgdm9sdW1lczoKICAgICAgLSAndnVldG9ycmVudC1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLXEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwLycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "torrent",
@@ -4400,7 +4431,7 @@
     },
     "radarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io",
-        "slogan": "Radarr\u2060 - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
+        "slogan": "Radarr⁠ - A fork of Sonarr to work with movies à la Couchpotato.",
         "compose": "c2VydmljZXM6CiAgcmFkYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3JhZGFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9SQURBUlJfNzg3OAogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9SQURBUlIKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotQW1lcmljYS9Ub3JvbnRvfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JhZGFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo3ODc4L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -4803,7 +4834,8 @@
         "category": "productivity",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
@@ -4856,7 +4888,7 @@
     },
     "sonarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/sonarr?utm_source=coolify.io",
-        "slogan": "Sonarr\u2060 (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
+        "slogan": "Sonarr⁠ (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
         "compose": "c2VydmljZXM6CiAgc29uYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3NvbmFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TT05BUlJfODk4OQogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9TT05BUlIKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotQW1lcmljYS9Ub3JvbnRvfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NvbmFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4OTg5L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -5768,7 +5800,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-with-mysql": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5784,7 +5817,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-without-database": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5799,7 +5833,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
@@ -5882,7 +5917,7 @@
     },
     "marimo": {
         "documentation": "https://marimo.io/?utm_source=coolify.io",
-        "slogan": "An open-source reactive notebook for Python \u2014 reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
+        "slogan": "An open-source reactive notebook for Python — reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
         "compose": "c2VydmljZXM6CiAgbWFyaW1vOgogICAgaW1hZ2U6ICdnaGNyLmlvL21hcmltby10ZWFtL21hcmltbzpsYXRlc3Qtc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTUFSSU1PXzgwODAKICAgICAgLSBUT0tFTl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NQVJJTU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21hcmltbzovYXBwJwogICAgY29tbWFuZDoKICAgICAgLSBtYXJpbW8KICAgICAgLSBlZGl0CiAgICAgIC0gJy0tdG9rZW4tcGFzc3dvcmQnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF9NQVJJTU99JwogICAgICAtICctLXBvcnQnCiAgICAgIC0gJzgwODAnCiAgICAgIC0gJy0taG9zdCcKICAgICAgLSAwLjAuMC4wCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gdXZ4CiAgICAgICAgLSAnLS13aXRoJwogICAgICAgIC0gJ2h0dHB4W2NsaV0nCiAgICAgICAgLSBodHRweAogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "notebook",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index 5f03d77f6b..c13c02896d 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -138,7 +138,8 @@
         "category": "productivity",
         "logo": "svgs/appsmith.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
@@ -152,7 +153,8 @@
         "category": "backend",
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T19:52:21+05:30"
+        "template_last_updated_at": "2025-10-23T19:52:21+05:30",
+        "port": "3003"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -219,7 +221,7 @@
     },
     "autobase": {
         "documentation": "https://autobase.tech/docs/?utm_source=coolify.io",
-        "slogan": "Autobase for PostgreSQL\u00ae is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
+        "slogan": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
         "compose": "c2VydmljZXM6CiAgYXV0b2Jhc2U6CiAgICBpbWFnZTogJ2F1dG9iYXNlL2NvbnNvbGVfdWk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BVVRPQkFTRV84MAogICAgICAtICdQR19DT05TT0xFX0FVVEhPUklaQVRJT05fVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX1VJfScKICAgICAgLSBQR19DT05TT0xFX0FQSV9IT1NUPWF1dG9iYXNlLWFwaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBhdXRvYmFzZS1hcGk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhdXRvYmFzZS1kYjoKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9kYjoyLjUuMicKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdhdXRvYmFzZS1kYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgcG9zdGdyZXMnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogIGF1dG9iYXNlLWFwaToKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9hcGk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFBHX0NPTlNPTEVfREJfSE9TVD1hdXRvYmFzZS1kYgogICAgICAtICdQR19DT05TT0xFX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BHX0NPTlNPTEVfQVVUSE9SSVpBVElPTl9UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdQR19DT05TT0xFX0VOQ1JZUFRJT05LRVk9JHtTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnUEdfQ09OU09MRV9MT0dHRVJfTEVWRUw9JHtQR19DT05TT0xFX0xPR0dFUl9MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3RtcC9hbnNpYmxlOi90bXAvYW5zaWJsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWZzUycKICAgICAgICAtICctSCcKICAgICAgICAtICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24nCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2FwaS92MS92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgIGRlcGVuZHNfb246CiAgICAgIGF1dG9iYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "database",
@@ -248,7 +250,8 @@
         "category": "productivity",
         "logo": "svgs/babybuddy.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "8000"
     },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
@@ -377,7 +380,8 @@
         "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00"
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "port": "80"
     },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
@@ -679,7 +683,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-with-mysql": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -694,7 +699,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-without-database": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -709,7 +715,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
@@ -1070,7 +1077,8 @@
         "category": "cms",
         "logo": "svgs/dokuwiki.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "dolibarr": {
         "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
@@ -1149,7 +1157,8 @@
         "category": "cms",
         "logo": "svgs/drupal.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
@@ -1400,6 +1409,24 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
+    "executor": {
+        "documentation": "https://executor.sh/docs/hosted/docker?utm_source=coolify.io",
+        "slogan": "Self-hosted AI agent integrations and code execution server.",
+        "compose": "c2VydmljZXM6CiAgZXhlY3V0b3I6CiAgICBpbWFnZTogJ2doY3IuaW8vcmh5c3N1bGxpdmFuL2V4ZWN1dG9yLXNlbGZob3N0OiR7RVhFQ1VUT1JfVkVSU0lPTjotbGF0ZXN0fScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9FWEVDVVRPUl80Nzg4CiAgICAgIC0gJ0VYRUNVVE9SX1dFQl9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9FWEVDVVRPUl80Nzg4fScKICAgICAgLSAnRVhFQ1VUT1JfSE9TVD0ke0VYRUNVVE9SX0hPU1Q6LTAuMC4wLjB9JwogICAgICAtICdQT1JUPSR7UE9SVDotNDc4OH0nCiAgICAgIC0gRVhFQ1VUT1JfREFUQV9ESVI9L2RhdGEKICAgICAgLSAnRVhFQ1VUT1JfREJfUEFUSD0ke0VYRUNVVE9SX0RCX1BBVEg6LS9kYXRhL2RhdGEuZGJ9JwogICAgICAtICdFWEVDVVRPUl9PUkdfTkFNRT0ke0VYRUNVVE9SX09SR19OQU1FOi1EZWZhdWx0fScKICAgICAgLSAnRVhFQ1VUT1JfT1JHX1NMVUc9JHtFWEVDVVRPUl9PUkdfU0xVRzotZGVmYXVsdH0nCiAgICAgIC0gJ0VYRUNVVE9SX0FMTE9XX0xPQ0FMX05FVFdPUks9JHtFWEVDVVRPUl9BTExPV19MT0NBTF9ORVRXT1JLOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdleGVjdXRvci1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGJ1bgogICAgICAgIC0gJy1lJwogICAgICAgIC0gJ2ZldGNoKGBodHRwOi8vMTI3LjAuMC4xOiR7cHJvY2Vzcy5lbnYuUE9SVHx8NDc4OH0vYXBpL2hlYWx0aGApLnRoZW4ocj0+cHJvY2Vzcy5leGl0KHIub2s/MDoxKSwoKT0+cHJvY2Vzcy5leGl0KDEpKScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMjBzCnZvbHVtZXM6CiAgZXhlY3V0b3ItZGF0YTogbnVsbAo=",
+        "tags": [
+            "executor",
+            "ai",
+            "agents",
+            "mcp",
+            "automation",
+            "development"
+        ],
+        "category": "development",
+        "logo": "svgs/executor.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "4788"
+    },
     "faraday": {
         "documentation": "https://faradaysec.com/?utm_source=coolify.io",
         "slogan": "Faraday is a powerful, open-source, web-based vulnerability management tool.",
@@ -1776,7 +1803,7 @@
     },
     "getoutline": {
         "documentation": "https://docs.getoutline.com/s/hosting/doc/hosting-outline-nipGaCRBDu?utm_source=coolify.io",
-        "slogan": "Your team\u2019s knowledge base",
+        "slogan": "Your team’s knowledge base",
         "compose": "c2VydmljZXM6CiAgb3V0bGluZToKICAgIGltYWdlOiAnZG9ja2VyLmdldG91dGxpbmUuY29tL291dGxpbmV3aWtpL291dGxpbmU6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZS1kYXRhOi92YXIvbGliL291dGxpbmUvZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1VUTElORV8zMDAwCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtICdTRUNSRVRfS0VZPSR7U0VSVklDRV9IRVhfNjRfT1VUTElORX0nCiAgICAgIC0gJ1VUSUxTX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfT1VUTElORX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovLzoke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9QHJlZGlzOjYzNzknCiAgICAgIC0gJ1VSTD0ke1NFUlZJQ0VfRlFETl9PVVRMSU5FfScKICAgICAgLSAnUE9SVD0ke09VVExJTkVfUE9SVDotMzAwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRT0ke0ZJTEVfU1RPUkFHRTotbG9jYWx9JwogICAgICAtICdGSUxFX1NUT1JBR0VfTE9DQUxfUk9PVF9ESVI9JHtGSUxFX1NUT1JBR0VfTE9DQUxfUk9PVF9ESVI6LS92YXIvbGliL291dGxpbmUvZGF0YX0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9VUExPQURfTUFYX1NJWkU9JHtGSUxFX1NUT1JBR0VfVVBMT0FEX01BWF9TSVpFOi0yMDAwfScKICAgICAgLSAnRklMRV9TVE9SQUdFX0lNUE9SVF9NQVhfU0laRT0ke0ZJTEVfU1RPUkFHRV9JTVBPUlRfTUFYX1NJWkU6LTEwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9XT1JLU1BBQ0VfSU1QT1JUX01BWF9TSVpFPSR7RklMRV9TVE9SQUdFX1dPUktTUEFDRV9JTVBPUlRfTUFYX1NJWkV9JwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke0FXU19BQ0NFU1NfS0VZX0lEfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgLSAnQVdTX1JFR0lPTj0ke0FXU19SRUdJT059JwogICAgICAtICdBV1NfUzNfQUNDRUxFUkFURV9VUkw9JHtBV1NfUzNfQUNDRUxFUkFURV9VUkx9JwogICAgICAtICdBV1NfUzNfVVBMT0FEX0JVQ0tFVF9VUkw9JHtBV1NfUzNfVVBMT0FEX0JVQ0tFVF9VUkx9JwogICAgICAtICdBV1NfUzNfVVBMT0FEX0JVQ0tFVF9OQU1FPSR7QVdTX1MzX1VQTE9BRF9CVUNLRVRfTkFNRX0nCiAgICAgIC0gJ0FXU19TM19GT1JDRV9QQVRIX1NUWUxFPSR7QVdTX1MzX0ZPUkNFX1BBVEhfU1RZTEU6LXRydWV9JwogICAgICAtICdBV1NfUzNfQUNMPSR7QVdTX1MzX0FDTDotcHJpdmF0ZX0nCiAgICAgIC0gJ1NMQUNLX0NMSUVOVF9JRD0ke1NMQUNLX0NMSUVOVF9JRH0nCiAgICAgIC0gJ1NMQUNLX0NMSUVOVF9TRUNSRVQ9JHtTTEFDS19DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX0NMSUVOVF9JRD0ke0dPT0dMRV9DTElFTlRfSUR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVfQ0xJRU5UX0lEPSR7QVpVUkVfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVfQ0xJRU5UX1NFQ1JFVD0ke0FaVVJFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRV9SRVNPVVJDRV9BUFBfSUQ9JHtBWlVSRV9SRVNPVVJDRV9BUFBfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9JRD0ke09JRENfQ0xJRU5UX0lEfScKICAgICAgLSAnT0lEQ19DTElFTlRfU0VDUkVUPSR7T0lEQ19DTElFTlRfU0VDUkVUfScKICAgICAgLSAnT0lEQ19BVVRIX1VSST0ke09JRENfQVVUSF9VUkl9JwogICAgICAtICdPSURDX1RPS0VOX1VSST0ke09JRENfVE9LRU5fVVJJfScKICAgICAgLSAnT0lEQ19VU0VSSU5GT19VUkk9JHtPSURDX1VTRVJJTkZPX1VSSX0nCiAgICAgIC0gJ09JRENfTE9HT1VUX1VSST0ke09JRENfTE9HT1VUX1VSSX0nCiAgICAgIC0gJ09JRENfVVNFUk5BTUVfQ0xBSU09JHtPSURDX1VTRVJOQU1FX0NMQUlNfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0NPUEVTPSR7T0lEQ19TQ09QRVN9JwogICAgICAtICdHSVRIVUJfQ0xJRU5UX0lEPSR7R0lUSFVCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7R0lUSFVCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdHSVRIVUJfQVBQX05BTUU9JHtHSVRIVUJfQVBQX05BTUV9JwogICAgICAtICdHSVRIVUJfQVBQX0lEPSR7R0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9BUFBfUFJJVkFURV9LRVk9JHtHSVRIVUJfQVBQX1BSSVZBVEVfS0VZfScKICAgICAgLSAnRElTQ09SRF9DTElFTlRfSUQ9JHtESVNDT1JEX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0RJU0NPUkRfQ0xJRU5UX1NFQ1JFVD0ke0RJU0NPUkRfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0RJU0NPUkRfU0VSVkVSX0lEPSR7RElTQ09SRF9TRVJWRVJfSUR9JwogICAgICAtICdESVNDT1JEX1NFUlZFUl9ST0xFUz0ke0RJU0NPUkRfU0VSVkVSX1JPTEVTfScKICAgICAgLSAnUEdTU0xNT0RFPSR7UEdTU0xNT0RFOi1kaXNhYmxlfScKICAgICAgLSAnRk9SQ0VfSFRUUFM9JHtGT1JDRV9IVFRQUzotdHJ1ZX0nCiAgICAgIC0gJ1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ1NNVFBfUE9SVD0ke1NNVFBfUE9SVH0nCiAgICAgIC0gJ1NNVFBfVVNFUk5BTUU9JHtTTVRQX1VTRVJOQU1FfScKICAgICAgLSAnU01UUF9QQVNTV09SRD0ke1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdTTVRQX0ZST01fRU1BSUw9JHtTTVRQX0ZST01fRU1BSUx9JwogICAgICAtICdTTVRQX1JFUExZX0VNQUlMPSR7U01UUF9SRVBMWV9FTUFJTH0nCiAgICAgIC0gJ1NNVFBfVExTX0NJUEhFUlM9JHtTTVRQX1RMU19DSVBIRVJTfScKICAgICAgLSAnU01UUF9TRUNVUkU9JHtTTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ1NNVFBfTkFNRT0ke1NNVFBfTkFNRX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgZGlzYWJsZTogdHJ1ZQogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczphbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcmVkaXMtc2VydmVyCiAgICAgIC0gJy0tcmVxdWlyZXBhc3MnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxMi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhYmFzZS1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdfaXNyZWFkeQogICAgICAgIC0gJy1VJwogICAgICAgIC0gJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgICAtICctZCcKICAgICAgICAtICcke1BPU1RHUkVTX0RBVEFCQVNFOi1vdXRsaW5lfScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "knowledge base",
@@ -2153,7 +2180,8 @@
         "category": "productivity",
         "logo": "svgs/grocy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-12T09:10:44+02:00"
+        "template_last_updated_at": "2026-05-12T09:10:44+02:00",
+        "port": "80"
     },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
@@ -2203,11 +2231,12 @@
         "category": "productivity",
         "logo": "svgs/heimdall.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
-        "slogan": "Hermes Agent \u2014 autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
+        "slogan": "Hermes Agent — autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
         "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50QHNoYTI1NjoyZjFmMmYxNzI1ZTVkYzlhNjFjZjZhMmRlYTVhY2E1MmE3NzZlYzRkMDIyY2IyOTY3OWU2YWEzZmYzMDNlNzdhJwogICAgY29tbWFuZDogJ2dhdGV3YXkgcnVuJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEVSTUVTX0hPTUU9L2hvbWUvaGVybWVzLy5oZXJtZXMKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lcy8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjkyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBoZXJtZXMtYWdlbnQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9IRVJNRVNXRUJVSV84Nzg3CiAgICAgIC0gSEVSTUVTX1dFQlVJX0hPU1Q9MC4wLjAuMAogICAgICAtIEhFUk1FU19XRUJVSV9QT1JUPTg3ODcKICAgICAgLSBIRVJNRVNfV0VCVUlfU1RBVEVfRElSPS9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvd2VidWkKICAgICAgLSBXQU5URURfVUlEPTEwMDAKICAgICAgLSBXQU5URURfR0lEPTEwMDAKICAgICAgLSAnSEVSTUVTX1dFQlVJX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9IRVJNRVNXRUJVSX0nCiAgICB2b2x1bWVzOgogICAgICAtICdoZXJtZXMtaG9tZTovaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvaGVybWVzLWFnZW50OnJvJwogICAgICAtICdoZXJtZXMtd29ya3NwYWNlOi93b3Jrc3BhY2UnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODc4Ny9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "ai",
@@ -2506,7 +2535,7 @@
     },
     "jitsi": {
         "documentation": "https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/?utm_source=coolify.io",
-        "slogan": "Self-hosted Jitsi Meet \u2014 open-source video conferencing platform",
+        "slogan": "Self-hosted Jitsi Meet — open-source video conferencing platform",
         "compose": "c2VydmljZXM6CiAgaml0c2ktd2ViOgogICAgaW1hZ2U6ICdqaXRzaS93ZWI6c3RhYmxlLTEwODg4JwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtIEVOQUJMRV9BVVRIPTAKICAgICAgLSBFTkFCTEVfR1VFU1RTPTEKICAgICAgLSBFTkFCTEVfTEVUU0VOQ1JZUFQ9MAogICAgICAtIEVOQUJMRV9IVFRQX1JFRElSRUNUPTAKICAgICAgLSBESVNBQkxFX0hUVFBTPTEKICAgICAgLSBYTVBQX0RPTUFJTj1tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9BVVRIX0RPTUFJTj1hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0dVRVNUX0RPTUFJTj1ndWVzdC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9NVUNfRE9NQUlOPWNvbmZlcmVuY2UubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSAnWE1QUF9CT1NIX1VSTF9CQVNFPWh0dHA6Ly9wcm9zb2R5OjUyODAnCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSAnSklDT0ZPX0NPTVBPTkVOVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pJQ09GT30nCiAgICAgIC0gJ0pJQ09GT19BVVRIX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKVkJfQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSlZCfScKICAgICAgLSAnVFo9JHtUWjotVVRDfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gcHJvc29keQogICAgICAtIGppY29mbwogICAgICAtIGp2YgogICAgdm9sdW1lczoKICAgICAgLSAnaml0c2ktd2ViOi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSBtZWV0LmppdHNpCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwcm9zb2R5OgogICAgaW1hZ2U6ICdqaXRzaS9wcm9zb2R5OnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gRU5BQkxFX0dVRVNUUz0xCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9HVUVTVF9ET01BSU49Z3Vlc3QubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0lOVEVSTkFMX01VQ19ET01BSU49aW50ZXJuYWwuYXV0aC5tZWV0LmppdHNpCiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9GUUROX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0xPR19MRVZFTD0ke0xPR19MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1wcm9zb2R5Oi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSB4bXBwLm1lZXQuaml0c2kKICAgICAgICAgIC0gYXV0aC5tZWV0LmppdHNpCiAgICAgICAgICAtIGd1ZXN0Lm1lZXQuaml0c2kKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1MjgwL2h0dHAtYmluZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGppY29mbzoKICAgIGltYWdlOiAnaml0c2kvamljb2ZvOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX1NFUlZFUj1wcm9zb2R5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSBKVkJfQlJFV0VSWV9NVUM9anZiYnJld2VyeQogICAgICAtIEpJQ09GT19FTkFCTEVfSEVBTFRIX0NIRUNLUz0xCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWppY29mbzovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4ODg4L2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGp2YjoKICAgIGltYWdlOiAnaml0c2kvanZiOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMTAwMDA6MTAwMDAvdWRwJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gWE1QUF9TRVJWRVI9cHJvc29keQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gSlZCX0FVVEhfVVNFUj1qdmIKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSBKVkJfUE9SVD0xMDAwMAogICAgICAtICdKVkJfQURWRVJUSVNFX0lQUz0ke0pWQl9BRFZFUlRJU0VfSVBTOi19JwogICAgICAtICdKVkJfU1RVTl9TRVJWRVJTPSR7SlZCX1NUVU5fU0VSVkVSUzotc3R1bi5sLmdvb2dsZS5jb206MTkzMDJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtICdUWj0ke1RaOi1VVEN9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwcm9zb2R5CiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1qdmI6L2NvbmZpZycKICAgIG5ldHdvcmtzOgogICAgICBtZWV0LmppdHNpOiBudWxsCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9hYm91dC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKbmV0d29ya3M6CiAgbWVldC5qaXRzaTogbnVsbAo=",
         "tags": [
             "jitsi",
@@ -2957,7 +2986,8 @@
         "category": "auth",
         "logo": "svgs/logto_dark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-01T13:19:47Z"
+        "template_last_updated_at": "2026-04-01T13:19:47Z",
+        "port": "3001"
     },
     "lowcoder": {
         "documentation": "https://docs.lowcoder.cloud/?utm_source=coolify.io",
@@ -3265,7 +3295,7 @@
     },
     "moodle": {
         "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
+        "slogan": "Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.",
         "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9NT09ETEVfODA4MAogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9IT1NUPW1hcmlhZGIKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUE9SVF9OVU1CRVI9MzMwNgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9VU0VSPSRTRVJWSUNFX1VTRVJfTUFSSUFEQgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9OQU1FPWJpdG5hbWlfbW9vZGxlCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01BUklBREIKICAgICAgLSBBTExPV19FTVBUWV9QQVNTV09SRD1ubwogICAgICAtICdNT09ETEVfVVNFUk5BTUU9JHtNT09ETEVfVVNFUk5BTUU6LXVzZXJ9JwogICAgICAtIE1PT0RMRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NT09ETEUKICAgICAgLSBNT09ETEVfRU1BSUw9dXNlckBleGFtcGxlLmNvbQogICAgICAtICdNT09ETEVfU0lURV9OQU1FPSR7TU9PRExFX1NJVEVfTkFNRTotTmV3IFNpdGV9JwogICAgdm9sdW1lczoKICAgICAgLSAnbW9vZGxlLWRhdGE6L2JpdG5hbWkvbW9vZGxlJwogICAgICAtICdtb29kbGVkYXRhLWRhdGE6L2JpdG5hbWkvbW9vZGxlZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwaHAKICAgICAgICAtICctcicKICAgICAgICAtICJleGl0KGZpbGVfZXhpc3RzKCcvb3B0L2JpdG5hbWkvbW9vZGxlL2NvbmZpZy5waHAnKSA/IDAgOiAxKTsiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUK",
         "tags": [
             "moodle",
@@ -3392,7 +3422,7 @@
     },
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
-        "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
+        "slogan": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.",
         "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
@@ -3829,7 +3859,7 @@
     },
     "openobserve": {
         "documentation": "https://openobserve.ai/docs/?utm_source=coolify.io",
-        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays \u2014 a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
+        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays — a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
         "compose": "c2VydmljZXM6CiAgb3Blbm9ic2VydmU6CiAgICBpbWFnZTogJ3B1YmxpYy5lY3IuYXdzL3ppbmNsYWJzL29wZW5vYnNlcnZlOnYwLjkwLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1BFTk9CU0VSVkVfNTA4MAogICAgICAtIFpPX0RBVEFfRElSPS9kYXRhCiAgICAgIC0gJ1pPX1JPT1RfVVNFUl9FTUFJTD0ke1pPX1JPT1RfVVNFUl9FTUFJTDotcm9vdEBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1pPX1JPT1RfVVNFUl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfT1BFTk9CU0VSVkV9JwogICAgICAtICdaT19URUxFTUVUUlk9JHtaT19URUxFTUVUUlk6LWZhbHNlfScKICAgICAgLSAnWk9fQ09PS0lFX1NFQ1VSRV9PTkxZPSR7Wk9fQ09PS0lFX1NFQ1VSRV9PTkxZOi10cnVlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29wZW5vYnNlcnZlLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL29wZW5vYnNlcnZlCiAgICAgICAgLSBub2RlCiAgICAgICAgLSBzdGF0dXMKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCg==",
         "tags": [
             "logs",
@@ -4112,7 +4142,8 @@
         "category": "database",
         "logo": "svgs/phpmyadmin.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
@@ -4311,7 +4342,7 @@
     },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
-        "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
+        "slogan": "Prowlarr⁠ is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
         "compose": "c2VydmljZXM6CiAgcHJvd2xhcnI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvcHJvd2xhcnI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1BST1dMQVJSXzk2OTYKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1BST1dMQVJSCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUFtZXJpY2EvVG9yb250b30nCiAgICB2b2x1bWVzOgogICAgICAtICdwcm93bGFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo5Njk2L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -4346,7 +4377,7 @@
     },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
-        "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
+        "slogan": "The qBittorrent project aims to provide an open-source software alternative to μTorrent.",
         "compose": "c2VydmljZXM6CiAgcWJpdDoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9xYml0dG9ycmVudDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnV0VCVUlfUE9SVD0ke1dFQlVJX1BPUlQ6LTgwODB9JwogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgdm9sdW1lczoKICAgICAgLSAncWJpdHRvcnJlbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3FiaXR0b3JyZW50LWRvd25sb2FkczovZG93bmxvYWRzJwogICAgICAtICdxYml0dG9ycmVudC10b3JyZW50czovdG9ycmVudHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2dWV0b3JyZW50LWJhY2tlbmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vdnVldG9ycmVudC92dWV0b3JyZW50LWJhY2tlbmQ6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1FCSVRPUlJFTlRfODA4MAogICAgICAtICdQT1JUPSR7V0VCVUlfUE9SVDotODA4MH0nCiAgICAgIC0gJ1FCSVRfQkFTRT0ke1NFUlZJQ0VfRlFETl9RQklUT1JSRU5UfScKICAgICAgLSAnUkVMRUFTRV9UWVBFPSR7UkVMRUFTRV9UWVBFOi1zdGFibGV9JwogICAgICAtICdVUERBVEVfVlRfQ1JPTj0ke1VQREFURV9WVF9DUk9OOi0iMCAqICogKiAqIn0nCiAgICB2b2x1bWVzOgogICAgICAtICd2dWV0b3JyZW50LWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctcScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODAvJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "torrent",
@@ -4400,7 +4431,7 @@
     },
     "radarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io",
-        "slogan": "Radarr\u2060 - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
+        "slogan": "Radarr⁠ - A fork of Sonarr to work with movies à la Couchpotato.",
         "compose": "c2VydmljZXM6CiAgcmFkYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3JhZGFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fUkFEQVJSXzc4NzgKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1JBREFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAncmFkYXJyLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0Ojc4NzgvcGluZycKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "media",
@@ -4803,7 +4834,8 @@
         "category": "productivity",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
@@ -4856,7 +4888,7 @@
     },
     "sonarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/sonarr?utm_source=coolify.io",
-        "slogan": "Sonarr\u2060 (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
+        "slogan": "Sonarr⁠ (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
         "compose": "c2VydmljZXM6CiAgc29uYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3NvbmFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU09OQVJSXzg5ODkKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1NPTkFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAnc29uYXJyLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0Ojg5ODkvcGluZycKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "media",
@@ -5768,7 +5800,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-with-mysql": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5784,7 +5817,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-without-database": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5799,7 +5833,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
@@ -5882,7 +5917,7 @@
     },
     "marimo": {
         "documentation": "https://marimo.io/?utm_source=coolify.io",
-        "slogan": "An open-source reactive notebook for Python \u2014 reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
+        "slogan": "An open-source reactive notebook for Python — reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
         "compose": "c2VydmljZXM6CiAgbWFyaW1vOgogICAgaW1hZ2U6ICdnaGNyLmlvL21hcmltby10ZWFtL21hcmltbzpsYXRlc3Qtc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX01BUklNT184MDgwCiAgICAgIC0gVE9LRU5fUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSU1PCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpbW86L2FwcCcKICAgIGNvbW1hbmQ6CiAgICAgIC0gbWFyaW1vCiAgICAgIC0gZWRpdAogICAgICAtICctLXRva2VuLXBhc3N3b3JkJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSU1PfScKICAgICAgLSAnLS1wb3J0JwogICAgICAtICc4MDgwJwogICAgICAtICctLWhvc3QnCiAgICAgIC0gMC4wLjAuMAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHV2eAogICAgICAgIC0gJy0td2l0aCcKICAgICAgICAtICdodHRweFtjbGldJwogICAgICAgIC0gaHR0cHgKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwODAvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "notebook",
diff --git a/tests/Feature/AllResourceRestartLimitsTest.php b/tests/Feature/AllResourceRestartLimitsTest.php
new file mode 100644
index 0000000000..8418b552cd
--- /dev/null
+++ b/tests/Feature/AllResourceRestartLimitsTest.php
@@ -0,0 +1,223 @@
+<?php
+
+use App\Models\ApplicationPreview;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Traits\HasRestartLimit;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+it('gives every independently runnable non-application resource restart limit state', function (string $modelClass) {
+    expect(class_uses_recursive($modelClass))->toContain(HasRestartLimit::class);
+
+    $resource = new $modelClass;
+
+    expect($resource->getFillable())->toContain(
+        'restart_count',
+        'max_restart_count',
+        'restart_limit_reached',
+        'last_restart_at',
+        'last_restart_type',
+    )->and($resource->getCasts())->toMatchArray([
+        'restart_count' => 'integer',
+        'max_restart_count' => 'integer',
+        'restart_limit_reached' => 'boolean',
+        'last_restart_at' => 'datetime',
+    ]);
+})->with([
+    ApplicationPreview::class,
+    ServiceApplication::class,
+    ServiceDatabase::class,
+    StandaloneClickhouse::class,
+    StandaloneDragonfly::class,
+    StandaloneKeydb::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneMysql::class,
+    StandalonePostgresql::class,
+    StandaloneRedis::class,
+]);
+
+it('collects restart counts for preview and service containers from both status sources', function () {
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($dockerStatus)
+        ->toContain('previewContainerRestartCounts')
+        ->toContain('serviceContainerRestartCounts')
+        ->and($sentinelStatus)
+        ->toContain('previewContainerRestartCounts')
+        ->toContain('serviceContainerRestartCounts');
+});
+
+it('ignores docker compose one-off job containers in both status sources', function () {
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($dockerStatus)
+        ->toContain("filter_var(data_get(\$labels, 'com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)")
+        ->and($sentinelStatus)
+        ->toContain("filter_var(\$labels->get('com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)");
+});
+
+it('shows restart limit warnings for every resource family', function () {
+    $previews = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
+    $serviceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+    $applicationStatus = file_get_contents(resource_path('views/livewire/project/application/status.blade.php'));
+    $databaseStatus = file_get_contents(resource_path('views/livewire/project/database/status.blade.php'));
+
+    expect($previews)->toContain('<x-application.restart-limit-warning :application="$preview" />')
+        ->and($serviceCard)->toContain('<x-application.restart-limit-warning :application="$resource" />')
+        ->and($applicationStatus)->toContain('<x-application.restart-limit-warning :application="$application" />')
+        ->and($databaseStatus)->toContain('<x-application.restart-limit-warning :application="$database" />');
+
+    $serviceStatus = file_get_contents(resource_path('views/livewire/project/service/status.blade.php'));
+    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    expect($serviceStatus)->toContain('<x-application.restart-limit-warning :application="$selectedResource" />')
+        ->and($serviceStatus)->toContain('$selectedResource?->status ?? $service->status')
+        ->and($serviceHeading)->toContain('<x-application.restart-limit-warning :application="$selectedResource" />')
+        ->and($serviceHeading)->toContain('$selectedResource?->status ?? $service->status');
+});
+
+it('matches application restart badge layout on mobile resource headings', function () {
+    $applicationHeading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
+    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+
+    foreach ([$applicationHeading, $databaseHeading, $serviceHeading] as $heading) {
+        expect($heading)
+            ->toContain('class="relative flex w-full min-w-0 items-center gap-2"')
+            ->toContain('class="flex w-full flex-wrap gap-1"');
+    }
+});
+
+it('shows database restart limits in shared resource listings', function () {
+    $resourceIndex = file_get_contents(app_path('Livewire/Project/Resource/Index.php'));
+    $serverResources = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+    $destination = file_get_contents(resource_path('views/livewire/project/shared/destination.blade.php'));
+
+    expect($resourceIndex)
+        ->toContain("method_exists(\$item, 'stoppedAfterRestartLimit')")
+        ->not->toContain("\$type === 'application' && \$item->stoppedAfterRestartLimit()")
+        ->and($serverResources)
+        ->toContain('<x-application.restart-limit-warning :application="$resource" />')
+        ->and($destination)
+        ->toContain('<x-application.restart-limit-warning :application="$resource" />');
+});
+
+it('keeps the service resource table readable with horizontal scrolling on mobile', function () {
+    $configuration = file_get_contents(resource_path('views/livewire/project/service/configuration.blade.php'));
+    $resourceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+
+    expect($configuration)
+        ->toContain("'overflow-x-auto rounded-xl")
+        ->toContain('min-w-[48rem]')
+        ->and($resourceCard)
+        ->toContain('min-w-[48rem]')
+        ->not->toContain('<div class="hidden truncate font-mono');
+});
+
+it('opens service resource settings when a table row is clicked', function () {
+    $resourceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+
+    expect($resourceCard)
+        ->toContain('x-on:click="openSettings($event)"')
+        ->toContain('x-on:keydown.enter="openSettings($event)"')
+        ->toContain("closest('a, button')")
+        ->toContain('role="link"')
+        ->toContain('tabindex="0"');
+});
+
+it('uses selected service resource actions instead of parent complex status actions', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    $headingClass = file_get_contents(app_path('Livewire/Project/Service/Heading.php'));
+
+    expect(substr_count($heading, "\$selectedResource && \$selectedResource->container_present !== false && \$selectedResourceStatus->startsWith('exited')"))->toBe(2)
+        ->and($heading)
+        ->toContain('Remove container')
+        ->toContain('removeSelectedResourceContainer')
+        ->and($headingClass)
+        ->toContain('public function removeSelectedResourceContainer(): void');
+});
+
+it('imports the application model used when claiming a restart limit', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+
+    expect($statusAction)
+        ->toContain('use App\\Models\\Application;')
+        ->toContain('Application::query()');
+});
+
+it('adds restart limit columns to previews services and standalone databases', function () {
+    $migrations = collect(glob(database_path('migrations/*.php')))
+        ->map(fn (string $path): string => file_get_contents($path))
+        ->implode("\n");
+
+    expect($migrations)
+        ->toContain("'application_previews'")
+        ->toContain("'service_applications'")
+        ->toContain("'service_databases'")
+        ->toContain("'max_restart_count'")
+        ->toContain("'restart_limit_reached'");
+
+    $restartLimitMigrations = collect(glob(database_path('migrations/*_add_restart_limit_to_*.php')));
+
+    expect($restartLimitMigrations)->toHaveCount(11);
+    expect($restartLimitMigrations->map(
+        fn (string $path): string => substr(basename($path), 0, 17)
+    )->unique())->toHaveCount(11);
+    $restartLimitMigrations->each(function (string $path): void {
+        expect(file_get_contents($path))->not->toContain('foreach (');
+    });
+});
+
+it('atomically claims a resource restart limit once and can reset it', function () {
+    Schema::create('restart_limit_test_resources', function (Blueprint $table): void {
+        $table->id();
+        $table->string('status')->default('running');
+        $table->integer('restart_count')->default(0);
+        $table->integer('max_restart_count')->default(2);
+        $table->boolean('restart_limit_reached')->default(false);
+        $table->timestamp('last_restart_at')->nullable();
+        $table->string('last_restart_type')->nullable();
+        $table->timestamps();
+    });
+
+    $resource = new class extends Model
+    {
+        use HasRestartLimit;
+
+        protected $table = 'restart_limit_test_resources';
+    };
+    $resource->save();
+    $resource->refresh();
+
+    expect($resource->trackRestartCount(2))->toBeTrue()
+        ->and($resource->fresh()->restart_limit_reached)->toBeTrue()
+        ->and($resource->trackRestartCount(2))->toBeFalse();
+
+    $resource->resetRestartLimit();
+
+    expect($resource->fresh()->restart_count)->toBe(0)
+        ->and($resource->restart_limit_reached)->toBeFalse();
+
+    $resourceWithExistingRestarts = $resource->newInstance();
+    $resourceWithExistingRestarts->max_restart_count = 0;
+    $resourceWithExistingRestarts->save();
+    expect($resourceWithExistingRestarts->trackRestartCount(17))->toBeFalse();
+
+    $resourceWithExistingRestarts->update(['max_restart_count' => 10]);
+    expect($resourceWithExistingRestarts->trackRestartCount(17))->toBeTrue()
+        ->and($resourceWithExistingRestarts->fresh()->restart_limit_reached)->toBeTrue();
+
+    Schema::drop('restart_limit_test_resources');
+});
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index c1d08bf388..55d25927a3 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -138,6 +138,33 @@ test('proxy settings regenerate managed labels', function () {
     expect(base64_decode($this->application->fresh()->custom_labels))->not->toContain('sentinel-label=true');
 });
 
+test('changing a domain port regenerates managed labels with the requested port', function () {
+    $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'ports_exposes' => '80',
+        'domain_port_overrides' => [
+            'https://app.example.com' => 3000,
+        ],
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://app.example.com:8080',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+    $labels = $application->parseContainerLabels();
+
+    expect($application->fqdn)->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 8080,
+        ])
+        ->and($labels)->toContain('loadbalancer.server.port=8080')
+        ->and($labels)->not->toContain('loadbalancer.server.port=3000');
+});
+
 test('http basic auth updates regenerate managed labels', function () {
     $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
     $this->application->update([
@@ -279,6 +306,34 @@ test('PATCH /api/v1/applications/{uuid} updates preview_url_template and max_res
         ->and($application->max_restart_count)->toBe(5);
 });
 
+test('PATCH /api/v1/applications/{uuid} clears ports_exposes with null or an empty string', function (mixed $portsExposes) {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'ports_exposes' => $portsExposes,
+        ])
+        ->assertOk();
+
+    expect($this->application->fresh()->ports_exposes)->toBeNull();
+})->with([
+    'null' => null,
+    'empty string' => '',
+]);
+
+test('PATCH /api/v1/applications/{uuid} rejects invalid exposed ports', function (string $portsExposes) {
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'ports_exposes' => $portsExposes,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors('ports_exposes');
+})->with([
+    'not numeric' => '80,abc',
+    'zero' => '0',
+    'above TCP range' => '65536',
+]);
+
 test('GET /api/v1/applications/{uuid} includes advanced settings', function () {
     $this->application->settings->update(advancedApplicationSettingsPayload());
     $this->application->update([
diff --git a/tests/Feature/Api/LifecycleApisTest.php b/tests/Feature/Api/LifecycleApisTest.php
index 913eac59a5..4973453e93 100644
--- a/tests/Feature/Api/LifecycleApisTest.php
+++ b/tests/Feature/Api/LifecycleApisTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\DeleteResourceJob;
 use App\Jobs\ScheduledTaskJob;
 use App\Models\Application;
 use App\Models\CloudInitScript;
@@ -276,6 +277,60 @@ describe('POST /api/v1/services/{uuid}/clone', function () {
     });
 });
 
+describe('DELETE resource endpoints', function () {
+    test('soft deletes an application before queuing cleanup', function () {
+        Queue::fake();
+
+        $this->withHeaders($this->headers)
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}")
+            ->assertOk();
+
+        expect(Application::find($this->application->id))->toBeNull()
+            ->and(Application::withTrashed()->find($this->application->id)?->trashed())->toBeTrue();
+        Queue::assertPushed(DeleteResourceJob::class);
+    });
+
+    test('soft deletes a service before queuing cleanup', function () {
+        Queue::fake();
+        $service = Service::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'server_id' => $this->server->id,
+        ]);
+
+        $this->withHeaders($this->headers)
+            ->deleteJson("/api/v1/services/{$service->uuid}")
+            ->assertOk();
+
+        expect(Service::find($service->id))->toBeNull()
+            ->and(Service::withTrashed()->find($service->id)?->trashed())->toBeTrue();
+        Queue::assertPushed(DeleteResourceJob::class);
+    });
+
+    test('soft deletes a database before queuing cleanup', function () {
+        Queue::fake();
+        $database = StandalonePostgresql::create([
+            'name' => 'database-to-delete',
+            'image' => 'postgres:17-alpine',
+            'postgres_user' => 'postgres',
+            'postgres_password' => 'password',
+            'postgres_db' => 'postgres',
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $this->withHeaders($this->headers)
+            ->deleteJson("/api/v1/databases/{$database->uuid}")
+            ->assertOk();
+
+        expect(StandalonePostgresql::find($database->id))->toBeNull()
+            ->and(StandalonePostgresql::withTrashed()->find($database->id)?->trashed())->toBeTrue();
+        Queue::assertPushed(DeleteResourceJob::class);
+    });
+});
+
 describe('POST /api/v1/applications/{uuid}/scheduled-tasks/{task_uuid}/execute', function () {
     test('dispatches ScheduledTaskJob for an application task', function () {
         Queue::fake();
diff --git a/tests/Feature/ApplicationConfigurationChangedTest.php b/tests/Feature/ApplicationConfigurationChangedTest.php
index d9d365b966..4650e2b12c 100644
--- a/tests/Feature/ApplicationConfigurationChangedTest.php
+++ b/tests/Feature/ApplicationConfigurationChangedTest.php
@@ -77,6 +77,47 @@ it('reports noindex domain changes as requiring a redeploy', function () {
         ->and($change['impact'])->toBe('redeploy');
 });
 
+it('reports domain port-only changes as requiring a redeploy', function () {
+    $application = configurationChangedTestApplication([
+        'fqdn' => 'https://app.example.com',
+        'domain_port_overrides' => ['https://app.example.com' => 3000],
+    ]);
+    $deployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    $application->update([
+        'domain_port_overrides' => ['https://app.example.com' => 8080],
+    ]);
+
+    $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+    $change = collect($diff->changes())->firstWhere('key', 'domains.domain_port_overrides');
+
+    expect($diff->isChanged())->toBeTrue()
+        ->and($change)->not->toBeNull()
+        ->and($change['impact'])->toBe('redeploy');
+});
+
+it('keeps application deployment snapshots stable when port overrides are reordered', function () {
+    $application = configurationChangedTestApplication([
+        'fqdn' => 'https://one.example.com,https://two.example.com',
+        'domain_port_overrides' => [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    ]);
+    $deployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    $application->update([
+        'domain_port_overrides' => [
+            'https://two.example.com' => 8080,
+            'https://one.example.com' => 3000,
+        ],
+    ]);
+
+    expect($application->refresh()->pendingDeploymentConfigurationDiff()->isChanged())->toBeFalse();
+});
+
 it('does not flag applications whose older snapshot omitted noindex domains', function () {
     $application = configurationChangedTestApplication([
         'fqdn' => 'https://app.example.com',
diff --git a/tests/Feature/ApplicationContainerPresenceTest.php b/tests/Feature/ApplicationContainerPresenceTest.php
new file mode 100644
index 0000000000..4a80631dd8
--- /dev/null
+++ b/tests/Feature/ApplicationContainerPresenceTest.php
@@ -0,0 +1,56 @@
+<?php
+
+use App\Models\Application;
+
+it('stores nullable application container presence as a boolean', function () {
+    $application = new Application;
+    $application->forceFill(['container_present' => 1]);
+    $migration = file_get_contents(base_path('database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php'));
+
+    expect($application->container_present)->toBeTrue()
+        ->and($migration)->toContain("boolean('container_present')->nullable()");
+});
+
+it('updates container presence at application lifecycle boundaries', function () {
+    $stopAction = file_get_contents(app_path('Actions/Application/StopApplication.php'));
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($stopAction)->toContain('$containerPresent = ! $removeContainers;')
+        ->and($stopAction)->toMatch('/if \(\$server->isSwarm\(\)\).*?\$containerPresent = false;.*?docker stack rm/s')
+        ->and($stopAction)->toContain("'container_present' => \$containerPresent")
+        ->and($dockerStatus)->toContain("'container_present' => true")
+        ->and($dockerStatus)->toContain("'container_present' => false")
+        ->and($sentinelStatus)->toContain("'container_present' => true")
+        ->and($sentinelStatus)->toContain("'container_present' => false");
+});
+
+it('shows accurate destructive actions and the restart warning on mobile', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $mobileActions = str($heading)
+        ->after('id="application-mobile-actions"')
+        ->before('<div class="hidden" aria-hidden="true">')
+        ->toString();
+
+    expect($heading)->toContain('<x-application.restart-limit-warning :application="$application" />')
+        ->and(substr_count($heading, '$application->container_present !== false'))->toBe(2)
+        ->and($heading)->toContain("\$application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy'")
+        ->and($heading)->toContain("\$application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)'")
+        ->and($heading)->toContain('Remove container')
+        ->and($mobileActions)->toContain('Deploy (without cache)')
+        ->and($mobileActions)->toContain('Remove container')
+        ->and(strrpos($mobileActions, 'Remove container'))->toBeGreaterThan(strrpos($mobileActions, 'Deploy (without cache)'));
+});
+
+it('shows restart limit reached as a yellow state in environment resource lists', function () {
+    $indexClass = file_get_contents(app_path('Livewire/Project/Resource/Index.php'));
+    $indexView = file_get_contents(resource_path('views/livewire/project/resource/index.blade.php'));
+
+    expect($indexClass)->toContain("'restartLimitReached' => \$type === 'application' && \$item->stoppedAfterRestartLimit()")
+        ->and($indexClass)->toContain('? max($item->restart_count ?? 0, $item->max_restart_count ?? 0)')
+        ->and($indexClass)->toContain("'maxRestartCount' => \$item->max_restart_count ?? 0")
+        ->and($indexView)->toContain("if (item.restartLimitReached) {\n                    return 'restart-limit';")
+        ->and($indexView)->toContain("return 'Restart limit reached';")
+        ->and($indexView)->toContain("if (item.restartLimitReached) {\n                    return 'bg-warning';")
+        ->and($indexView)->toContain('x-bind:title="statusTitle(item)"');
+});
diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
index 98377fcbd3..afec2fe9fb 100644
--- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Exceptions\DeploymentException;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
@@ -11,6 +12,7 @@ use App\Models\Server;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Collection;
+use Symfony\Component\Process\Process;
 
 uses(RefreshDatabase::class);
 
@@ -80,6 +82,10 @@ class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
 {
     public array $recordedCommands = [];
 
+    public array $recordedLogEntries = [];
+
+    public array $writtenArtifacts = [];
+
     public ?string $writtenDockerfile = null;
 
     public function __construct() {}
@@ -98,6 +104,10 @@ class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
             if (preg_match('/echo .*?([A-Za-z0-9+\\/=]{16,}).*?\\| base64 -d \\| tee \\/artifacts\\/test-app\\/Dockerfile > \\/dev\\/null/', $commandString, $matches) === 1) {
                 $this->writtenDockerfile = base64_decode($matches[1]) ?: null;
             }
+
+            if (preg_match('~echo .*?([A-Za-z0-9+/=]{8,}).*?\\| base64 -d \\| tee (/artifacts/[^ ]+) > /dev/null~', $commandString, $matches) === 1) {
+                $this->writtenArtifacts[$matches[2]] = base64_decode($matches[1]);
+            }
         }
     }
 }
@@ -154,7 +164,11 @@ function makeControlVarFilteringJob(Application $application, Server $server, ar
     $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
 
     $queue = Mockery::mock(ApplicationDeploymentQueue::class);
-    $queue->shouldReceive('addLogEntry')->andReturnNull();
+    $queue->shouldReceive('addLogEntry')->andReturnUsing(function (string $message, string $type = 'stdout', bool $hidden = false) use ($job) {
+        $job->recordedLogEntries[] = $message;
+
+        return null;
+    });
 
     $properties = [
         'application' => $application->fresh(),
@@ -267,6 +281,345 @@ it('filters buildpack control vars from preview build-time env files', function
     expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith('RAILPACK_NODE_VERSION=')))->toBeFalse();
 });
 
+it('rejects unsafe Nixpacks plan variable keys before writing the build-time env file', function (string $key) {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'value',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+})->with([
+    'command substitution' => 'X$(id)',
+    'backticks' => 'X`id`',
+    'newline' => "X\nid",
+    'shell assignment' => 'X=value',
+    'semicolon' => 'X;id',
+    'pipe' => 'X|id',
+    'ampersand' => 'X&id',
+    'leading dollar' => '$(id)',
+    'command substitution with arguments' => 'X$(docker run --rm -v /:/mnt alpine true)',
+]);
+
+it('keeps persisted dotted user build-time variable keys', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'X.VALUE',
+        'value' => 'unsafe',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs)->toContain('X.VALUE="unsafe"');
+});
+
+it('loads shell variables and passes dotted variables through the build-time environment launcher', function () {
+    $temporaryDirectory = sys_get_temp_dir().'/coolify-build-env-'.str()->random(8);
+    expect(mkdir($temporaryDirectory))->toBeTrue();
+    $shellEnvironmentPath = $temporaryDirectory.'/build-time-shell.env';
+    $launcherPath = $temporaryDirectory.'/run-with-build-time-env';
+    $injectionMarkerPath = $temporaryDirectory.'/injection-marker';
+
+    try {
+        [$application, $server] = makeDeploymentControlVarFixture();
+
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'BASE_VALUE',
+            'value' => 'expanded',
+        ]);
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'X.VALUE',
+            'value' => '$BASE_VALUE',
+        ]);
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'DOTTED.VALUE',
+            'value' => "$(touch {$injectionMarkerPath})",
+        ]);
+
+        [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+        invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_PATH])
+            ->toContain('BASE_VALUE="expanded"')
+            ->toContain('X.VALUE="$BASE_VALUE"');
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH])
+            ->toContain('BASE_VALUE="expanded"')
+            ->not->toContain('X.VALUE');
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH])
+            ->toContain('source '.ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH)
+            ->toContain('X.VALUE="$BASE_VALUE"')
+            ->toContain('exec env');
+
+        $wrappedCommand = invokeDeploymentJobMethod($job, $reflection, 'wrap_build_command_with_env_export', 'printenv X.VALUE');
+
+        expect($wrappedCommand)
+            ->toContain(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH)
+            ->toContain("/bin/bash -c 'printenv X.VALUE'")
+            ->not->toContain('source '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH);
+
+        file_put_contents($shellEnvironmentPath, $job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH]);
+        file_put_contents(
+            $launcherPath,
+            str_replace(
+                'source '.ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH,
+                'source '.$shellEnvironmentPath,
+                $job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH],
+            ),
+        );
+        chmod($launcherPath, 0700);
+
+        $process = new Process(['/bin/bash', $launcherPath, '/bin/bash', '-c', 'printenv X.VALUE; printenv DOTTED.VALUE']);
+        $process->mustRun();
+
+        expect($process->getOutput())
+            ->toContain("expanded\n")
+            ->toContain("$(touch {$injectionMarkerPath})");
+        expect(file_exists($injectionMarkerPath))->toBeFalse();
+    } finally {
+        @unlink($launcherPath);
+        @unlink($shellEnvironmentPath);
+        @unlink($injectionMarkerPath);
+        @rmdir($temporaryDirectory);
+    }
+});
+
+it('keeps the original sourced environment path when build-time keys are shell safe', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_VALUE',
+        'value' => 'safe',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+    expect($job->writtenArtifacts)
+        ->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_ENV_PATH)
+        ->not->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH)
+        ->not->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH);
+
+    $wrappedCommand = invokeDeploymentJobMethod($job, $reflection, 'wrap_build_command_with_env_export', 'docker build .');
+
+    expect($wrappedCommand)
+        ->toContain('set -a && source '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH.' && set +a && docker build .')
+        ->not->toContain(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH);
+});
+
+it('uses BuildKit secrets for dotted Nixpacks variables instead of invalid Dockerfile expansion', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'dockerBuildkitSupported' => true,
+        'dockerSecretsAvailable' => true,
+        'env_args' => collect(['X.VALUE' => 'dotted-buildtime-ok']),
+        'nixpacks_plan_json' => collect([
+            'variables' => ['X.VALUE' => 'dotted-buildtime-ok'],
+        ]),
+        'saved_outputs' => collect([
+            'dockerfile_content' => "FROM alpine\nARG SAFE X.VALUE\nENV SAFE=\$SAFE X.VALUE=\$X.VALUE\nRUN printenv X.VALUE",
+        ]),
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'generate_build_env_variables');
+
+    expect(readDeploymentJobProperty($job, $reflection, 'dockerSecretsSupported'))->toBeTrue();
+    expect(readDeploymentJobProperty($job, $reflection, 'build_secrets'))->toContain('--secret id=X.VALUE,env=X.VALUE');
+
+    invokeDeploymentJobMethod($job, $reflection, 'modify_dockerfile_for_secrets', '/artifacts/test-app/.nixpacks/Dockerfile');
+
+    $dockerfile = $job->writtenArtifacts['/artifacts/test-app/.nixpacks/Dockerfile'];
+
+    expect($dockerfile)
+        ->not->toContain('ARG X.VALUE')
+        ->not->toContain('X.VALUE=$X.VALUE')
+        ->toContain('ARG SAFE')
+        ->toContain('ENV SAFE=$SAFE')
+        ->toContain('RUN --mount=type=secret,id=X.VALUE,env=X.VALUE')
+        ->toContain('printenv X.VALUE');
+});
+
+it('rejects dotted Nixpacks variables when Docker build secrets are unavailable', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'dockerBuildkitSupported' => true,
+        'dockerSecretsAvailable' => false,
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'X.VALUE' => 'dotted-buildtime-ok',
+                'ANOTHER.DOTTED.VALUE' => 'also-dotted',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_build_env_variables'))
+        ->toThrow(
+            DeploymentException::class,
+            'Dotted Nixpacks build-time environment variable names require Docker BuildKit secret support: X.VALUE, ANOTHER.DOTTED.VALUE. Rename these keys to use underscores instead of dots, or upgrade Docker on the build server.'
+        );
+});
+
+it('writes dotted Nixpacks ARG and ENV removal when the Dockerfile has no run command', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'env_args' => collect(['X.VALUE' => 'dotted-buildtime-ok']),
+        'nixpacks_plan_json' => collect([
+            'variables' => ['X.VALUE' => 'dotted-buildtime-ok'],
+        ]),
+        'build_secrets' => '--secret id=X.VALUE,env=X.VALUE',
+        'saved_outputs' => collect([
+            'dockerfile_content' => "FROM alpine\nARG X.VALUE=default\nENV X.VALUE=\$X.VALUE",
+        ]),
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'modify_dockerfile_for_secrets', '/artifacts/test-app/.nixpacks/Dockerfile');
+
+    expect($job->writtenArtifacts['/artifacts/test-app/.nixpacks/Dockerfile'])
+        ->not->toContain('X.VALUE');
+});
+
+it('skips unsafe reserved Nixpacks plan variable keys before validation', function (string $key) {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'value',
+            ],
+        ]),
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith($key.'=')))->toBeFalse();
+})->with([
+    'Coolify key' => 'COOLIFY_$(id)',
+    'service key' => 'SERVICE_$(id)',
+]);
+
+it('explains invalid Nixpacks plan variable keys in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'XPACK;SECURITY;ENABLED' => 'true',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class, 'Invalid environment variable name from the Nixpacks plan: XPACK;SECURITY;ENABLED');
+
+    $logs = implode("\n", $job->recordedLogEntries);
+
+    expect($logs)
+        ->toContain('Invalid environment variable name from the Nixpacks plan: XPACK;SECURITY;ENABLED')
+        ->toContain('must start with a letter or underscore')
+        ->toContain('How to fix')
+        ->toContain('nixpacks.toml')
+        ->toContain('https://nixpacks.com/docs/configuration/file');
+});
+
+it('truncates long Nixpacks plan variable keys in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $key = 'X$(docker run --rm alpine sh -c "'.str_repeat('a', 200).'TAIL_SHOULD_BE_TRUNCATED")';
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'x',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+
+    $logs = implode("\n", $job->recordedLogEntries);
+
+    expect($logs)
+        ->toContain('Invalid environment variable name from the Nixpacks plan: X$(docker run --rm')
+        ->toContain('...')
+        ->not->toContain('TAIL_SHOULD_BE_TRUNCATED')
+        ->toContain('nixpacks.toml');
+});
+
+it('bounds every deployment log entry for long invalid Nixpacks variable keys', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $key = 'X'.str_repeat('$', 10_000);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'x',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+
+    $longestLogEntryLength = max(array_map(strlen(...), $job->recordedLogEntries));
+
+    expect($longestLogEntryLength)->toBeLessThanOrEqual(200);
+});
+
+it('keeps shell-safe Nixpacks plan variables in the build-time env file', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'APP_NAME' => 'coolify',
+                '_PRIVATE_VALUE' => 'secret',
+                'X.VALUE' => 'dotted',
+            ],
+        ]),
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs)->toContain("APP_NAME='coolify'")
+        ->toContain("_PRIVATE_VALUE='secret'")
+        ->toContain("X.VALUE='dotted'");
+});
+
 it('does not let preview docker compose service names override generated build-time service names', function () {
     $compose = <<<'YAML'
 services:
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index cac3b29a39..9d0739d1ce 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2,7 +2,10 @@
 
 use App\Jobs\CheckDomainDnsJob;
 use App\Livewire\Project\Application\Domains;
+use App\Livewire\Project\Application\PreviewDomains;
+use App\Livewire\Project\Application\Previews;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -21,6 +24,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
 
     InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
         ['id' => 0],
@@ -98,6 +102,478 @@ it('uses safe domain validation rules on the domains form', function () {
         ->and($validator->errors()->has('newDomain'))->toBeTrue();
 });
 
+it('does not add a single-label hostname as an application domain', function () {
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'aaa')
+        ->call('addDomain')
+        ->assertDispatched('error');
+
+    expect($this->application->fresh()->fqdn)->toBeNull();
+});
+
+it('generates a preview domain when the application has no domain', function () {
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 41,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/41',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)
+        ->not->toBeNull()
+        ->toContain('41.');
+});
+
+it('generates compose preview domains when the application has no domains', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/42',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)
+        ->not->toBeNull()
+        ->toContain('42.');
+});
+
+it('derives preview domain services from compose and defaults the selected service', function () {
+    Queue::fake();
+
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker-pr-49:\n    image: nginx:alpine\n  database:\n    image: postgres:17\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 49,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/49',
+        'docker_compose_domains' => json_encode([
+            'removed-service' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertViewHas('composeServices', ['web', 'worker-pr-49'])
+        ->assertSet('newDomainService', 'web')
+        ->set('newDomainService', 'worker-pr-49')
+        ->set('newDomainParts.host', 'worker-preview.example.com')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertSet('newDomainService', 'web');
+
+    $preview->generate_preview_fqdn_compose();
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))
+        ->toHaveKey('worker-pr-49')
+        ->not->toHaveKey('worker');
+});
+
+it('handles compose parsing failures without exposing stale preview services', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services: [\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 52,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/52',
+        'docker_compose_domains' => json_encode([
+            'stale-service' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertViewHas('composeServices', [])
+        ->assertSet('newDomainService', null);
+});
+
+it('does not erase preview domains when compose parsing fails during persistence', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+    ]);
+
+    $storedDomains = [
+        'web' => ['domain' => 'https://web-preview.example.com'],
+        'worker' => ['domain' => 'https://worker-preview.example.com'],
+    ];
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 53,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/53',
+        'docker_compose_domains' => json_encode($storedDomains),
+        'fqdn' => 'https://web-preview.example.com,https://worker-preview.example.com',
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+
+    $application = Mockery::mock($component->instance()->preview->application)->makePartial();
+    $application->shouldReceive('parse')->once()->andThrow(new RuntimeException('Temporary parse failure'));
+    $component->instance()->preview->setRelation('application', $application);
+
+    $component->instance()->removeDomain(0);
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe($storedDomains)
+        ->and($preview->fresh()->fqdn)->toBe('https://web-preview.example.com,https://worker-preview.example.com')
+        ->and($component->get('domainRows'))->toHaveCount(2);
+});
+
+it('preserves empty compose service slots after removing the last preview domain', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 50,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/50',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web-preview.example.com'],
+        ]),
+        'fqdn' => 'https://web-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomain', 0)
+        ->assertViewHas('composeServices', ['web', 'worker']);
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => ''],
+        'worker' => ['domain' => ''],
+    ]);
+});
+
+it('rejects missing and unknown services when adding compose preview domains', function (?string $service) {
+    Queue::fake();
+
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 51,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/51',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainService', $service)
+        ->call('addDomain')
+        ->assertHasErrors('newDomainService')
+        ->assertCount('domainRows', 0);
+
+    expect($preview->fresh()->docker_compose_domains)->toBeNull()
+        ->and($preview->fresh()->fqdn)->toBeNull();
+    Queue::assertNothingPushed();
+})->with([null, 'unknown']);
+
+it('generates a compose preview domain only for the selected service', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com'],
+            'api' => ['domain' => 'https://api.example.com'],
+        ]),
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://custom-web.example.net'],
+            'api' => ['domain' => 'https://custom-api.example.net'],
+        ]),
+        'fqdn' => 'https://custom-web.example.net,https://custom-api.example.net',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainService', 'api')
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    $domains = json_decode($preview->fresh()->docker_compose_domains, true);
+
+    expect($domains['web']['domain'])->toBe('https://custom-web.example.net')
+        ->and($domains['api']['domain'])->toStartWith('https://custom-api.example.net,')
+        ->and($domains['api']['domain'])->toContain('48.api.example.com');
+});
+
+it('keeps compose services without application domains private when configuring a preview', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com'],
+            'worker' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $this->application->uuid,
+        ])
+        ->call('add', 43, 'https://github.com/coollabsio/coolify/pull/43');
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $this->application->id)
+        ->where('pull_request_id', 43)
+        ->firstOrFail();
+    $composeDomains = json_decode($preview->docker_compose_domains, true);
+
+    expect($composeDomains['web']['domain'])
+        ->toContain('web.example.com')
+        ->and($composeDomains['worker']['domain'])->toBe('')
+        ->and($preview->fqdn)->toContain('web.example.com')
+        ->not->toContain('worker');
+});
+
+it('generates a domain when configuring a preview', function () {
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $this->application->uuid,
+        ])
+        ->call('add', 43, 'https://github.com/coollabsio/coolify/pull/43')
+        ->assertDispatched('success');
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $this->application->id)
+        ->where('pull_request_id', 43)
+        ->firstOrFail();
+
+    expect($preview->fqdn)
+        ->not->toBeNull()
+        ->toContain('43.');
+});
+
+it('manages preview domains and their dns status', function () {
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 44,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/44',
+        'fqdn' => 'https://44.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.url', 'https://44.example.com')
+        ->call('checkDomainDns', 0)
+        ->assertSet('domainRows.0.dns_status', 'skipped')
+        ->set('newDomainParts.host', 'second.example.com')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertCount('domainRows', 2)
+        ->call('removeDomain', 0)
+        ->assertCount('domainRows', 1);
+
+    expect($preview->fresh()->fqdn)->toBe('https://second.example.com')
+        ->and($preview->fresh()->domain_dns_statuses)->not->toBeNull();
+});
+
+it('removes the intended preview domains by stable identities after reindexing', function () {
+    $domains = [
+        'https://first.example.com',
+        'https://second.example.com',
+        'https://third.example.com',
+    ];
+    $domainKeys = array_map(fn (string $domain): string => hash('sha256', $domain.'|'), $domains);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 47,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/47',
+        'fqdn' => implode(',', $domains),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomainByKey', $domainKeys[0])
+        ->assertSet('domainRows.0.url', $domains[1])
+        ->call('removeDomainByKey', $domainKeys[1])
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.url', $domains[2]);
+
+    expect($preview->fresh()->fqdn)->toBe($domains[2]);
+});
+
+it('renders preview domain delete confirmations with stable keys', function () {
+    $domains = [
+        'https://first.example.com',
+        'https://second.example.com',
+    ];
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'fqdn' => implode(',', $domains),
+    ]);
+
+    $renderedHtml = html_entity_decode(
+        Livewire::test(PreviewDomains::class, ['preview' => $preview])->html(),
+        ENT_QUOTES,
+    );
+
+    foreach ($domains as $domain) {
+        $domainKey = hash('sha256', $domain.'|');
+
+        expect($renderedHtml)->toMatch("/submitAction:\\s*[\"']removeDomainByKey\\({$domainKey}\\)[\"']/");
+    }
+
+    expect($renderedHtml)->not->toMatch('/submitAction:\\s*[\"\']removeDomain\\(\\d+\\)[\"\']/');
+});
+
+it('removes only the matching compose preview domain when services share a URL', function () {
+    $url = 'https://shared.example.com';
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+    ]);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 49,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/49',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => $url],
+            'worker' => ['domain' => $url],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomainByKey', hash('sha256', $url.'|worker'))
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.url', $url)
+        ->assertSet('domainRows.0.service', 'web');
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => $url],
+        'worker' => ['domain' => ''],
+    ]);
+});
+
+it('adds a preview domain and starts its dns check asynchronously', function () {
+    Queue::fake();
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 45,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/45',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->call('addDomain')
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.dns_status', 'checking')
+        ->assertDispatched('success', 'Domain added. DNS check started.');
+
+    Queue::assertPushed(CheckDomainDnsJob::class, fn (CheckDomainDnsJob $job): bool => $job->resource->is($preview)
+        && $job->url === 'https://preview.example.com');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and(collect($preview->fresh()->domain_dns_statuses)->first()['status'])->toBe('checking');
+});
+
+it('notifies when an asynchronous preview dns check finds a mismatch', function () {
+    $url = 'https://preview.example.com';
+    $statusKey = hash('sha256', $url.'|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 46,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/46',
+        'fqdn' => $url,
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'preview-check',
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.dns_status', 'checking');
+
+    $preview->update([
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'failed',
+                'message' => 'Required DNS record type A pointing to 203.0.113.10',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ],
+    ]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('domainRows.0.dns_status', 'failed')
+        ->assertDispatched('error', 'DNS is not configured for preview.example.com. Review the required DNS record.');
+});
+
+it('does not overwrite a completed preview dns result with stale checking state', function () {
+    $url = 'https://preview.example.com';
+    $statusKey = hash('sha256', $url.'|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'fqdn' => $url,
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'stale-check',
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+
+    $preview->update([
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'ok',
+                'message' => 'DNS looks correct.',
+                'check_id' => 'completed-check',
+            ],
+        ],
+    ]);
+
+    $method = new ReflectionMethod($component->instance(), 'persistDnsStatuses');
+    $method->invoke($component->instance());
+
+    expect($preview->fresh()->domain_dns_statuses[$statusKey])
+        ->toMatchArray([
+            'status' => 'ok',
+            'message' => 'DNS looks correct.',
+            'check_id' => 'completed-check',
+        ]);
+});
+
 it('lists existing domains as individual rows', function () {
     $this->application->update([
         'fqdn' => 'https://example.com,https://www.example.com,https://another.example.com,https://www.another.example.com',
@@ -269,9 +745,14 @@ it('composes the complete port on the server without duplicating an existing www
         ->assertHasNoErrors()
         ->assertDispatched('success');
 
-    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
-        'https://www.example.com:3000',
-        'https://example.com:3000',
+    $application = $this->application->fresh();
+
+    expect(explode(',', (string) $application->fqdn))->toBe([
+        'https://www.example.com',
+        'https://example.com',
+    ])->and($application->domain_port_overrides)->toBe([
+        'https://www.example.com' => 3000,
+        'https://example.com' => 3000,
     ]);
 });
 
@@ -346,12 +827,14 @@ it('updates a domain in place via modal', function () {
         ->assertSet('editingDomain', 'https://old.example.com')
         ->assertSee('Direction')
         ->assertSee('Search engine indexing')
-        ->set('editingDomain', 'https://new.example.com')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'new.example.com')
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertSet('showEditDomainModal', false)
         ->assertDispatched('edit-domain-saved')
-        ->assertDispatched('success');
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
 
     $this->application->refresh();
 
@@ -369,7 +852,8 @@ it('blocks editing a domain with bad dns until the user continues', function ()
 
     $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->call('startEdit', 0)
-        ->set('editingDomain', 'https://this-domain-should-not-resolve-for-coolify-tests.invalid')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'this-domain-should-not-resolve-for-coolify-tests.invalid')
         ->call('updateDomain')
         ->assertSet('editDomainDnsFailed', true)
         ->assertSet('showEditDomainModal', true)
@@ -402,6 +886,21 @@ it('removes a domain', function () {
     expect($this->application->fqdn)->toBe('https://www.example.com');
 });
 
+it('removes consecutive domains by stable row identity after indexes change', function () {
+    $this->application->update([
+        'fqdn' => 'https://first.example.com,https://second.example.com,https://third.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    $component
+        ->call('removeDomainByKey', hash('sha256', 'https://first.example.com|'))
+        ->call('removeDomainByKey', hash('sha256', 'https://second.example.com|'))
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->fqdn)->toBe('https://third.example.com');
+});
+
 it('does not revalidate dns on remaining domains when removing one', function () {
     $settings = InstanceSettings::get();
     $settings->is_dns_validation_enabled = true;
@@ -1202,7 +1701,10 @@ it('saves after confirming a domain conflict on add', function () {
         ->assertSet('pendingAction', null)
         ->assertDispatched('success');
 
-    expect($this->application->fresh()->fqdn)->toBe('https://shared.example.com');
+    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
+        'https://shared.example.com',
+        'https://www.shared.example.com',
+    ]);
 });
 
 it('saves after confirming a domain conflict on edit', function () {
@@ -1220,7 +1722,8 @@ it('saves after confirming a domain conflict on edit', function () {
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->call('startEdit', 0)
-        ->set('editingDomain', 'https://taken.example.com')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'taken.example.com')
         ->call('updateDomain')
         ->assertSet('showDomainConflictModal', true)
         ->assertSet('pendingAction', 'update')
@@ -1475,6 +1978,72 @@ it('auto-adds missing www pair for a single compose service redirect', function
         ->and($webDomains)->toContain('https://www.web.example.com');
 });
 
+it('saves domain port overrides separately from the public FQDN', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)
+        ->toBe('https://one.example.com,https://two.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+});
+
+it('retains an existing domain port override when saving a portless domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000',
+    ]);
+
+    $this->application->update([
+        'fqdn' => 'https://one.example.com',
+    ]);
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://one.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://one.example.com' => 3000]);
+});
+
+it('prunes a domain port override when that domain is removed', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $this->application->update([
+        'fqdn' => 'https://two.example.com',
+    ]);
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://two.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 8080]);
+});
+
+it('keeps a legacy port-bearing application domain after refresh and reparse', function () {
+    $this->application->update([
+        'fqdn' => 'https://legacy.example.com',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+    ]);
+
+    $application = Application::find($this->application->id);
+    $application->refresh();
+
+    expect($application->fqdn)->toBe('https://legacy.example.com:9090');
+
+    applicationParser($application);
+    $application->update(['description' => 'unrelated reparse']);
+
+    expect($application->fresh()->fqdn)->toBe('https://legacy.example.com:9090');
+});
+
 it('updates search engine indexing from the domains view', function () {
     $this->application->update(['fqdn' => 'https://app.example.com,https://staging.example.com']);
 
@@ -1496,3 +2065,498 @@ it('updates search engine indexing from the domains view', function () {
     expect($this->application->refresh()->noindexDomains()->all())
         ->toBe(['https://staging.example.com']);
 });
+
+it('keeps noindex domains when normalizing a custom domain port', function () {
+    $this->application->update([
+        'fqdn' => 'https://staging.example.com:8080',
+        'noindex_domains' => ['https://staging.example.com:8080'],
+    ]);
+
+    expect($this->application->refresh())
+        ->fqdn->toBe('https://staging.example.com')
+        ->noindex_domains->toBe(['https://staging.example.com'])
+        ->and($this->application->domain_port_overrides)
+        ->toBe(['https://staging.example.com' => 8080]);
+});
+
+it('saves a port override from the segmented add-domain form', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('https://example.com:8080');
+
+    $this->application->refresh();
+
+    expect(explode(',', (string) $this->application->fqdn))
+        ->toContain('https://example.com')
+        ->not->toContain('https://example.com:8080')
+        ->and($this->application->domain_port_overrides['https://example.com'] ?? null)
+        ->toBe(8080);
+});
+
+it('rejects adding a domain whose portless URL is already configured', function () {
+    $this->application->update([
+        'fqdn' => 'https://example.com:3000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasErrors('newDomain');
+
+    expect($this->application->fresh()->fqdn)->toBe('https://example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://example.com' => 3000]);
+});
+
+it('rejects renaming a domain to a port variant of another configured domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://first.example.com:3000,https://second.example.com:4000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->set('editingDomainParts.host', 'first.example.com')
+        ->set('editingDomainParts.port', '8080')
+        ->call('updateDomain')
+        ->assertHasErrors('editingDomain');
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://first.example.com,https://second.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe([
+            'https://first.example.com' => 3000,
+            'https://second.example.com' => 4000,
+        ]);
+});
+
+it('composes segmented add-domain fields into a port override when the changed flag is false', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->set('newDomainPartsChanged', false)
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->fqdn)
+        ->toContain('https://example.com')
+        ->not->toContain(':8080')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toHaveKey('https://example.com', 8080);
+});
+
+it('retains different port overrides for two application domains', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'one.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainParts.host', 'two.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $this->application->refresh();
+
+    expect($this->application->domain_port_overrides['https://one.example.com'] ?? null)->toBe(3000)
+        ->and($this->application->domain_port_overrides['https://two.example.com'] ?? null)->toBe(8080)
+        ->and(explode(',', (string) $this->application->fqdn))
+        ->toContain('https://one.example.com')
+        ->toContain('https://two.example.com')
+        ->not->toContain('https://one.example.com:3000')
+        ->not->toContain('https://two.example.com:8080');
+});
+
+it('reopens edit with the saved domain port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com:8080',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.url', 'https://example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'example.com');
+});
+
+it('does not prefill the default internal port when editing a domain without a port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '');
+});
+
+it('clears a domain port override and shows the default internal port', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:8080,https://two.example.com:9090',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertSee('Internal port 9090')
+        ->assertDontSee('Internal port 8080');
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)
+        ->toContain('https://one.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->not->toHaveKey('https://one.example.com')
+        ->toHaveKey('https://two.example.com', 9090);
+});
+
+it('prunes a domain port override when removing the domain from the ui', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:8080,https://two.example.com:3000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)->toBe('https://two.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 3000]);
+});
+
+it('renders a portless domain link with an internal port badge for overrides', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com:8080',
+    ]);
+
+    $html = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->assertSee('https://example.com')
+        ->assertDontSee('https://example.com:8080')
+        ->html();
+
+    expect($html)
+        ->toContain('href="'.getFqdnWithoutPort('https://example.com').'"')
+        ->not->toContain('href="https://example.com:8080"')
+        ->toContain('Custom internal port for this domain')
+        ->not->toContain('Inherited from Ports Exposes');
+});
+
+it('shows an error badge when a domain has no internal port and ports exposes is empty', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertSee('No internal port')
+        ->assertDontSee('Internal port ')
+        ->assertSee('table-badge-danger', false);
+});
+
+it('keeps the internal port badge when a domain override exists without ports exposes', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => [
+            'https://example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('No internal port');
+});
+
+it('distinguishes an inherited internal port from a domain port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 3000')
+        ->assertSee('Inherited from Ports Exposes', false)
+        ->assertDontSee('Custom internal port for this domain', false);
+});
+
+it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://legacy.example.com',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.url', 'https://legacy.example.com:9090')
+        ->assertSet('domainRows.0.internal_port', 9090)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->assertSee('Internal port 9090')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '9090');
+});
+
+it('stores compose domain port overrides without wiping other services', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
+        ]),
+        'domain_port_overrides' => [
+            'https://api.example.com' => 4000,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainService', 'web')
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->set('newDomainPartsChanged', false)
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 8080');
+
+    $this->application->refresh();
+    $domains = json_decode($this->application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'web.domain'))
+        ->toContain('https://web.example.com')
+        ->not->toContain(':8080')
+        ->and($this->application->fqdn)->toBeNull()
+        ->and($this->application->domain_port_overrides)
+        ->toHaveKey('https://web.example.com', 8080)
+        ->toHaveKey('https://api.example.com', 4000);
+});
+
+it('prunes a compose domain port override when that domain is removed', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com', 'redirect' => 'both'],
+            'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
+        ]),
+        'domain_port_overrides' => [
+            'https://web.example.com' => 8080,
+            'https://api.example.com' => 4000,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $this->application->refresh();
+
+    expect($this->application->domain_port_overrides)
+        ->not->toHaveKey('https://web.example.com')
+        ->toHaveKey('https://api.example.com', 4000)
+        ->and($this->application->fqdn)->toBeNull();
+});
+
+function applicationDomainPortOverrideApiToken(User $user, Team $team): string
+{
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'application-domain-port-override-api',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $team->id,
+    ]);
+    auth()->logout();
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+it('application domain port override API update containing a port persists a portless FQDN and override', function () {
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://example.com:8080',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe(['https://example.com' => 8080]);
+});
+
+it('application domain port override API update omitting ports preserves overrides for unchanged domains', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://one.example.com,https://two.example.com',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://one.example.com,https://two.example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+});
+
+it('application domain port override API domain removal prunes the override', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://two.example.com',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://two.example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 8080]);
+});
+
+it('application domain port override API update of an unrelated field does not rewrite a legacy FQDN', function () {
+    $this->application->update([
+        'fqdn' => 'https://legacy.example.com',
+        'description' => 'before',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertOk();
+
+    expect($this->application->fresh()->fqdn)->toBe('https://legacy.example.com:9090');
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'description' => 'unrelated',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://legacy.example.com:9090')
+        ->and($application->description)->toBe('unrelated')
+        ->and($application->domain_port_overrides)->toBeNull();
+});
+
+it('treats ports exposes and existing domain ports as available internal ports', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:9090',
+    ]);
+
+    $application = $this->application->fresh();
+
+    expect($application->availableInternalPorts())->toBe([3000, 8080, 9090])
+        ->and($application->portRequiresConfirmation(3000))->toBeFalse()
+        ->and($application->portRequiresConfirmation(8080))->toBeFalse()
+        ->and($application->portRequiresConfirmation(9090))->toBeFalse()
+        ->and($application->portRequiresConfirmation(5555))->toBeTrue()
+        ->and($application->portRequiresConfirmation(null))->toBeFalse();
+});
+
+it('shows a port warning when an application domain uses a port that is not exposed or already used', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '5555')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 5555)
+        ->assertSee('Use a different port?');
+
+    expect($this->application->fresh()->fqdn)->toBeNull();
+});
+
+it('saves an unrecognized application domain port after confirming the warning', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '5555')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    $application = $this->application->fresh();
+
+    expect(explode(',', (string) $application->fqdn))
+        ->toContain('https://example.com')
+        ->and($application->domain_port_overrides['https://example.com'] ?? null)->toBe(5555);
+});
+
+it('does not warn when editing an application domain to a port already used by another domain', function () {
+    $this->application->update([
+        'ports_exposes' => '3000',
+        'fqdn' => 'https://one.example.com:9090,https://two.example.com',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->set('editingDomainParts.port', '9090')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
diff --git a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
index 08f769eb6a..54183b9300 100644
--- a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
+++ b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
@@ -15,6 +15,19 @@ use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
+class GeneralWithoutBuildpackSubmitSideEffects extends General
+{
+    public function render(): mixed
+    {
+        return view('livewire.project.application.general');
+    }
+
+    public function submit($showToaster = true): void
+    {
+        $this->application->save();
+    }
+}
+
 beforeEach(function () {
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -85,3 +98,54 @@ test('existing application shows railpack without beta label in build pack selec
         ->assertDontSee('Railpack (Beta)')
         ->assertDontSee('Railpack (beta)');
 });
+
+test('switching from railpack to compose preserves the existing application domains', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'railpack',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'fqdn' => 'https://example.com,https://www.example.com',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(GeneralWithoutBuildpackSubmitSideEffects::class, ['application' => $application])
+        ->assertSuccessful()
+        ->set('buildPack', 'dockercompose')
+        ->assertSet('dockerComposeLocation', '/docker-compose.yaml');
+
+    expect($application->refresh()->fqdn)
+        ->toBe('https://example.com,https://www.example.com');
+});
+
+test('networking section hints that internal ports can be set per domain', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'ports_exposes' => '3000,3001',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    $domainsUrl = route('project.application.domains', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->assertSeeInOrder([
+            'Ports exposes',
+            'You can also set an internal port per domain on',
+            'Port mappings',
+        ])
+        ->assertSee($domainsUrl, false);
+});
diff --git a/tests/Feature/ApplicationGeneralLayoutTest.php b/tests/Feature/ApplicationGeneralLayoutTest.php
index f2daac9a96..41f62022af 100644
--- a/tests/Feature/ApplicationGeneralLayoutTest.php
+++ b/tests/Feature/ApplicationGeneralLayoutTest.php
@@ -13,6 +13,14 @@ test('compose actions are grouped with the application details header', function
         ->toContain('Reload compose');
 });
 
+test('compose file loading waits for the user to confirm the file location', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
+
+    expect($view)
+        ->toContain('x-on:click="$wire.dispatch(\'loadCompose\', false)"')
+        ->not->toContain('x-init="$wire.dispatch(\'loadCompose\', true)"');
+});
+
 test('docker compose heading separates its title and action', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
 
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index ebcb51fe19..0c40d4a86c 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -10,10 +10,20 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use phpseclib3\Crypt\EC;
 
 uses(RefreshDatabase::class);
 
+function disableExactProxyLabels(Application $application): Application
+{
+    $settings = $application->destination->server->settings;
+    $settings->generate_exact_labels = false;
+    $settings->save();
+
+    return $application;
+}
+
 beforeEach(function () {
     $this->user = User::factory()->create();
     $this->team = Team::factory()->create();
@@ -454,3 +464,138 @@ YAML,
         ->toContain('traefik.docker.network=custom-network')
         ->not->toContain("traefik.docker.network={$application->uuid}");
 });
+
+test('generateLabelsApplication routes portless domains to saved internal port overrides for Traefik and Caddy', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '80',
+        'fqdn' => 'https://one.example.com,https://two.example.com',
+        'domain_port_overrides' => [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    $labels = collect(generateLabelsApplication($application));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$application->uuid.'.rule=Host(`one.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-'.$application->uuid.'.rule=Host(`two.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-'.$application->uuid.'.loadbalancer.server.port=8080')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('Host(`one.example.com:3000`)')
+        ->not->toContain('Host(`two.example.com:8080`)');
+});
+
+test('generateLabelsApplication uses the first ports_exposes value when a portless domain has no override', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '4000,5000',
+        'fqdn' => 'https://plain.example.com',
+        'domain_port_overrides' => null,
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    $labels = collect(generateLabelsApplication($application));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=4000')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}');
+});
+
+test('generateLabelsApplication keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '80',
+        'fqdn' => 'https://legacy.example.com',
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    DB::table('applications')->where('id', $application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($application->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$application->uuid.'.rule=Host(`legacy.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=9090')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
+
+test('applicationParser compose labels receive the application domain port override map', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $application->update([
+        'domain_port_overrides' => [
+            'https://frontend.example.com' => 8080,
+        ],
+    ]);
+
+    $parsedCompose = applicationParser($application->fresh());
+    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8080')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8080}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
+        ->toBeTrue();
+});
+
+test('applicationParser compose labels use the first ports_exposes value when a portless domain has no override', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $parsedCompose = applicationParser($application->fresh());
+    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=3000')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 3000}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
+        ->toBeTrue();
+});
diff --git a/tests/Feature/ApplicationPreviewApiTest.php b/tests/Feature/ApplicationPreviewApiTest.php
index bc405d48ba..a994833990 100644
--- a/tests/Feature/ApplicationPreviewApiTest.php
+++ b/tests/Feature/ApplicationPreviewApiTest.php
@@ -12,6 +12,7 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Visus\Cuid2\Cuid2;
 
@@ -19,6 +20,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     Bus::fake();
+    config()->set('app.maintenance.store', 'array');
     InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
 
     $this->team = Team::factory()->create();
@@ -130,3 +132,273 @@ describe('DELETE /api/v1/applications/{uuid}/previews/{pull_request_id}', functi
         $response->assertForbidden();
     });
 });
+
+describe('PATCH /api/v1/applications/{uuid}/previews/{pull_request_id}', function () {
+    test('stores preview domain ports separately from portless public domains', function () {
+        $preview = createPreview($this->application, 42);
+
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/42", [
+                'domains' => 'https://one.example.com:3000,https://two.example.com:8080',
+            ])
+            ->assertOk()
+            ->assertJsonPath('domains', 'https://one.example.com,https://two.example.com');
+
+        expect($response->json('domain_port_overrides'))->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+
+        expect($preview->fresh()->fqdn)->toBe('https://one.example.com,https://two.example.com')
+            ->and($preview->fresh()->domain_port_overrides)->toBe([
+                'https://one.example.com' => 3000,
+                'https://two.example.com' => 8080,
+            ]);
+    });
+
+    test('clears an existing preview domain override when the submitted domain is portless', function () {
+        $preview = createPreview($this->application, 43);
+        $preview->update(['fqdn' => 'https://preview.example.com:8080']);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/43", [
+                'domains' => 'https://preview.example.com',
+            ])
+            ->assertOk()
+            ->assertJsonPath('domain_port_overrides', null);
+
+        expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+            ->and($preview->fresh()->domain_port_overrides)->toBeNull();
+    });
+
+    test('rejects invalid preview domains', function () {
+        createPreview($this->application, 44);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/44", [
+                'domains' => 'not-a-domain',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    });
+
+    test('rejects preview domain ports outside the valid TCP range', function (string $domain) {
+        createPreview($this->application, 59);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/59", [
+                'domains' => $domain,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    })->with([
+        'zero' => 'https://preview.example.com:0',
+        'above maximum' => 'https://preview.example.com:65536',
+    ]);
+
+    test('returns 403 when token lacks write ability', function () {
+        $readOnlyToken = createTeamApiToken($this->user, $this->team, ['read']);
+        createPreview($this->application, 45);
+
+        $this->withHeaders(previewAuthHeaders($readOnlyToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/45", [
+                'domains' => 'https://preview.example.com:3000',
+            ])
+            ->assertForbidden();
+    });
+
+    test('rejects a non-integer pull request id', function () {
+        createPreview($this->application, 1);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/1.9", [
+                'domains' => 'https://preview.example.com:3000',
+            ])
+            ->assertUnprocessable()
+            ->assertJson(['message' => 'Invalid pull_request_id.']);
+    });
+
+    test('detects conflicts after removing the submitted internal port', function () {
+        $otherApplication = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'fqdn' => 'https://taken.example.com',
+        ]);
+        createPreview($this->application, 46);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/46", [
+                'domains' => 'https://taken.example.com:3000',
+            ])
+            ->assertConflict()
+            ->assertJsonPath('conflicts.0.resource_uuid', $otherApplication->uuid);
+    });
+
+    test('detects conflicts with another preview domain', function () {
+        createPreview($this->application, 47)->update(['fqdn' => 'https://taken-preview.example.com:3000']);
+        createPreview($this->application, 48);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/48", [
+                'domains' => 'https://taken-preview.example.com:8080',
+            ])
+            ->assertConflict();
+    });
+
+    test('filters preview conflict candidates in the database', function () {
+        createPreview($this->application, 56)->update(['fqdn' => 'https://taken-preview.example.com']);
+        createPreview($this->application, 57)->update(['fqdn' => 'https://current-preview.example.com']);
+        createPreview($this->application, 58)->update(['fqdn' => 'https://unrelated.example.com']);
+
+        $queries = collect();
+        DB::listen(function ($query) use ($queries): void {
+            if (str_contains($query->sql, 'from "application_previews"')) {
+                $queries->push($query->sql);
+            }
+        });
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/57", [
+                'domains' => 'https://taken-preview.example.com',
+            ])
+            ->assertConflict();
+
+        expect($queries->first(fn (string $sql): bool => str_contains($sql, '"application_id" in (select')
+            && str_contains($sql, '"fqdn" is not null')
+            && str_contains($sql, '"fqdn" like ?')))->not->toBeNull();
+    });
+
+    test('updates Docker Compose preview domains with per-domain ports', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+        $preview = createPreview($this->application, 49);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/49", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://web-preview.example.com:8080'],
+                    ['name' => 'api', 'domain' => 'https://api-preview.example.com:3000'],
+                ],
+            ])
+            ->assertOk()
+            ->assertJsonPath('docker_compose_domains.0.name', 'web')
+            ->assertJsonPath('docker_compose_domains.0.domain', 'https://web-preview.example.com')
+            ->assertJsonPath('docker_compose_domains.1.name', 'api')
+            ->assertJsonPath('docker_compose_domains.1.domain', 'https://api-preview.example.com');
+
+        $preview->refresh();
+
+        expect(json_decode($preview->docker_compose_domains, true))->toBe([
+            'web' => ['domain' => 'https://web-preview.example.com'],
+            'api' => ['domain' => 'https://api-preview.example.com'],
+        ])->and($preview->fqdn)->toBe('https://web-preview.example.com,https://api-preview.example.com')
+            ->and($preview->domain_port_overrides)->toBe([
+                'https://web-preview.example.com' => 8080,
+                'https://api-preview.example.com' => 3000,
+            ]);
+    });
+
+    test('clears Docker Compose preview port overrides with portless domains', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        $preview = createPreview($this->application, 50);
+        $preview->update([
+            'fqdn' => 'https://web-preview.example.com:8080',
+            'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://web-preview.example.com']]),
+        ]);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/50", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://web-preview.example.com'],
+                ],
+            ])
+            ->assertOk()
+            ->assertJsonPath('domain_port_overrides', null);
+
+        expect($preview->fresh()->domain_port_overrides)->toBeNull();
+    });
+
+    test('rejects unknown Docker Compose preview services', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 51);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/51", [
+                'docker_compose_domains' => [
+                    ['name' => 'unknown', 'domain' => 'https://unknown.example.com:8080'],
+                ],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+
+    test('rejects the same Docker Compose preview domain on different internal ports', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 52);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/52", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://duplicate.example.com:8080'],
+                    ['name' => 'api', 'domain' => 'https://duplicate.example.com:3000'],
+                ],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+
+    test('rejects missing Compose services without changing the preview', function () {
+        $this->application->update(['build_pack' => 'dockercompose', 'docker_compose_raw' => '']);
+        $preview = createPreview($this->application, 53);
+        $originalFqdn = $preview->fresh()->fqdn;
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/53", [
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+
+        expect($preview->fresh()->fqdn)->toBe($originalFqdn);
+    });
+
+    test('rejects the domain field for Compose previews', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 54);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/54", [
+                'domains' => 'https://ignored.example.com',
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    });
+
+    test('rejects Docker Compose domains for non-Compose previews', function () {
+        createPreview($this->application, 55);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/55", [
+                'domains' => 'https://preview.example.com',
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+});
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 6b82d55689..3e6e04629d 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -1,16 +1,24 @@
 <?php
 
 use App\Actions\Application\StopApplication;
+use App\Actions\Docker\GetContainersStatus;
+use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\BaseModel;
+use App\Models\Server;
 use App\Notifications\Application\RestartLimitReached;
+use Mockery\MockInterface;
 
 function applicationWithRestartState(array $attributes = []): Application
 {
     $application = new Application;
     $application->forceFill(array_merge([
         'status' => 'exited:unhealthy',
+        'container_present' => true,
         'restart_count' => 2,
         'max_restart_count' => 2,
+        'restart_limit_reached' => true,
         'last_restart_type' => 'crash',
         'last_restart_at' => now(),
     ], $attributes));
@@ -21,9 +29,51 @@ function applicationWithRestartState(array $attributes = []): Application
 it('detects applications stopped after reaching the crash restart limit', function () {
     expect(applicationWithRestartState()->stoppedAfterRestartLimit())->toBeTrue()
         ->and(applicationWithRestartState(['status' => 'running:unhealthy'])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['restart_count' => 1])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['max_restart_count' => 0])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['last_restart_type' => null])->stoppedAfterRestartLimit())->toBeFalse();
+        ->and(applicationWithRestartState(['restart_limit_reached' => false])->stoppedAfterRestartLimit())->toBeFalse();
+});
+
+it('keeps the restart limit state after Docker resets its counter', function () {
+    expect(applicationWithRestartState([
+        'restart_count' => 0,
+        'last_restart_type' => null,
+        'last_restart_at' => null,
+    ])->stoppedAfterRestartLimit())->toBeTrue();
+});
+
+it('preserves exited application state when the container snapshot is empty', function () {
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->setRelation('additional_servers', collect());
+    $application->forceFill([
+        'id' => 1,
+        'status' => 'exited:unhealthy',
+        'container_present' => true,
+        'restart_limit_reached' => true,
+    ]);
+    $application->shouldNotReceive('update');
+
+    $services = Mockery::mock();
+    $services->shouldReceive('get')->once()->andReturn(collect());
+
+    $server = Mockery::mock(Server::class, function (MockInterface $mock) use ($application, $services) {
+        $mock->shouldReceive('isFunctional')->once()->andReturnTrue();
+        $mock->shouldReceive('applications')->once()->andReturn(collect([$application]));
+        $mock->shouldReceive('databases')->once()->andReturn(collect());
+        $mock->shouldReceive('services')->once()->andReturn($services);
+        $mock->shouldReceive('previews')->once()->andReturn(collect());
+    })->makePartial();
+    $server->setRelation('team', (object) ['id' => 1]);
+
+    GetContainersStatus::run($server, collect(), collect());
+
+    expect($application->container_present)->toBeTrue()
+        ->and($application->restart_limit_reached)->toBeTrue();
+});
+
+it('does not infer the restart limit from an exited existing container', function () {
+    expect(applicationWithRestartState([
+        'container_present' => true,
+        'restart_limit_reached' => false,
+    ])->stoppedAfterRestartLimit())->toBeFalse();
 });
 
 it('shows a stopped after restart limit warning in the status badge', function () {
@@ -32,7 +82,8 @@ it('shows a stopped after restart limit warning in the status badge', function (
         'showRefreshButton' => false,
     ])->render();
 
-    expect($html)->toContain('Stopped after reaching restart limit (2/2).')
+    expect($html)->toContain('Restart limit reached')
+        ->not->toContain('Stopped after reaching restart limit (2/2).')
         ->and($html)->toContain('Container has crashed and Coolify stopped it after 2 restart attempts.');
 });
 
@@ -41,11 +92,12 @@ it('does not show the restart limit warning for a normal manual stop', function
         'resource' => applicationWithRestartState([
             'restart_count' => 0,
             'last_restart_type' => null,
+            'restart_limit_reached' => false,
         ]),
         'showRefreshButton' => false,
     ])->render();
 
-    expect($html)->not->toContain('Stopped after reaching restart limit');
+    expect($html)->not->toContain('Restart limit reached');
 });
 
 it('keeps restart tracking configurable when stopping an application', function () {
@@ -56,6 +108,59 @@ it('keeps restart tracking configurable when stopping an application', function
         ->and($resetRestartCount->getDefaultValue())->toBeTrue();
 });
 
+it('can stop an application without removing its containers', function () {
+    $method = new ReflectionMethod(StopApplication::class, 'handle');
+    $removeContainers = collect($method->getParameters())->firstWhere('name', 'removeContainers');
+    $action = file_get_contents(app_path('Actions/Application/StopApplication.php'));
+
+    expect($removeContainers)->not->toBeNull()
+        ->and($removeContainers->getDefaultValue())->toBeTrue()
+        ->and($action)->toContain('docker update --restart=no')
+        ->and($action)->toContain('if ($removeContainers)');
+});
+
+it('preserves containers and skips cleanup when the restart limit is reached', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($statusAction)->toContain('dockerCleanup: false')
+        ->and($statusAction)->toContain('resetRestartCount: false')
+        ->and($statusAction)->toContain('removeContainers: false')
+        ->and($statusAction)->toContain("['restart_limit_reached' => true]")
+        ->and($sentinelJob)->toContain("['restart_limit_reached' => true]");
+});
+
+it('atomically claims the restart limit transition before stopping and notifying', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    foreach ([$statusAction, $sentinelJob] as $detector) {
+        expect($detector)
+            ->toContain("->where('restart_limit_reached', false)")
+            ->toContain("->update(['restart_limit_reached' => true]) === 1");
+    }
+});
+
+it('clears the explicit restart limit state only after a successful main deployment', function () {
+    $method = new ReflectionMethod(ApplicationDeploymentJob::class, 'handleSuccessfulDeployment');
+    $source = file($method->getFileName());
+    $deploymentJob = implode(array_slice($source, $method->getStartLine() - 1, $method->getEndLine() - $method->getStartLine() + 1));
+
+    expect(substr_count($deploymentJob, "'restart_limit_reached'] = false"))->toBe(1)
+        ->and($deploymentJob)->toContain("if (\$this->pull_request_id === 0) {\n            \$restartState['restart_limit_reached'] = false;\n        }")
+        ->and($deploymentJob)->toContain('$this->application->update($restartState);')
+        ->and(substr_count($deploymentJob, '$this->application->update('))->toBe(1);
+});
+
+it('preserves restart-limit applications only while their exited container exists', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($statusAction)->toContain("'container_present' => false")
+        ->and($statusAction)->toContain("'restart_limit_reached' => false")
+        ->and($sentinelJob)->toContain('if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(');
+});
+
 it('uses the application link for restart limit notifications', function () {
     $application = new class extends Application
     {
@@ -80,3 +185,55 @@ it('uses the application link for restart limit notifications', function () {
 
     expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
 });
+
+it('uses the resolved environment project name in Slack restart limit notifications', function () {
+    $environment = (object) [
+        'uuid' => 'environment-uuid',
+        'name' => 'production',
+        'project' => (object) [
+            'uuid' => 'project-uuid',
+            'name' => 'Coolify',
+        ],
+    ];
+
+    $application = new class extends Application
+    {
+        public function link(): string
+        {
+            return 'https://coolify.test/application';
+        }
+    };
+    $application->forceFill(['name' => 'app']);
+    $application->setRelation('environment', $environment);
+
+    $preview = new ApplicationPreview;
+    $preview->forceFill([
+        'uuid' => 'preview-uuid',
+        'pull_request_id' => 42,
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $preview->setRelation('application', $application);
+
+    $serviceResource = new class extends BaseModel {};
+    $serviceResource->forceFill([
+        'name' => 'database',
+        'uuid' => 'service-resource-uuid',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $serviceResource->setRelation('service', new class($environment)
+    {
+        public function __construct(public object $environment) {}
+
+        public function link(): string
+        {
+            return 'https://coolify.test/service';
+        }
+    });
+
+    expect((new RestartLimitReached($preview))->toSlack()->description)
+        ->toContain('*Project:* Coolify')
+        ->and((new RestartLimitReached($serviceResource))->toSlack()->description)
+        ->toContain('*Project:* Coolify');
+});
diff --git a/tests/Feature/Auth/LoginRateLimitIPTest.php b/tests/Feature/Auth/LoginRateLimitIPTest.php
index e1b85ae5c0..9c2214c58a 100644
--- a/tests/Feature/Auth/LoginRateLimitIPTest.php
+++ b/tests/Feature/Auth/LoginRateLimitIPTest.php
@@ -8,7 +8,9 @@ use Illuminate\Support\Facades\RateLimiter;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    config()->set('app.maintenance.store', 'array');
+
+    InstanceSettings::forceCreate(['id' => 0]);
     RateLimiter::clear('login');
 
     $this->user = User::factory()->create([
@@ -66,3 +68,27 @@ test('successful login is still possible within rate limit', function () {
     $response->assertRedirect();
     expect($response->status())->not->toBe(429);
 });
+
+test('cloud login rate limits use the Cloudflare client ip', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    foreach (range(1, 5) as $attempt) {
+        $this->withHeader('CF-Connecting-IP', '2001:db8::10')
+            ->withHeader('X-Forwarded-For', '2001:db8::10, 108.162.221.29')
+            ->withServerVariables(['REMOTE_ADDR' => '10.0.0.5'])
+            ->post('/login', [
+                'email' => 'test@example.com',
+                'password' => 'wrong-password',
+            ])
+            ->assertRedirect();
+    }
+
+    $this->withHeader('CF-Connecting-IP', '2001:db8::20')
+        ->withHeader('X-Forwarded-For', '2001:db8::20, 108.162.221.29')
+        ->withServerVariables(['REMOTE_ADDR' => '10.0.0.5'])
+        ->post('/login', [
+            'email' => 'test@example.com',
+            'password' => 'wrong-password',
+        ])
+        ->assertRedirect();
+});
diff --git a/tests/Feature/AuthRateLimitClientIpTest.php b/tests/Feature/AuthRateLimitClientIpTest.php
new file mode 100644
index 0000000000..ff32dab6a9
--- /dev/null
+++ b/tests/Feature/AuthRateLimitClientIpTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Http\Request;
+
+it('uses the Cloudflare client ip on cloud', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    $request = Request::create('/', server: [
+        'REMOTE_ADDR' => '10.0.0.5',
+        'HTTP_CF_CONNECTING_IP' => '2001:db8::10',
+    ]);
+
+    expect(auth_rate_limit_ip($request))->toBe('2001:db8::10');
+});
+
+it('falls back to the resolved request ip when the Cloudflare header is invalid', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    $request = Request::create('/', server: [
+        'REMOTE_ADDR' => '203.0.113.10',
+        'HTTP_CF_CONNECTING_IP' => 'invalid',
+    ]);
+
+    expect(auth_rate_limit_ip($request))->toBe('203.0.113.10');
+});
+
+it('ignores the Cloudflare header on self-hosted instances', function () {
+    config()->set('constants.coolify.self_hosted', true);
+
+    $request = Request::create('/', server: [
+        'REMOTE_ADDR' => '203.0.113.20',
+        'HTTP_CF_CONNECTING_IP' => '2001:db8::20',
+    ]);
+
+    expect(auth_rate_limit_ip($request))->toBe('203.0.113.20');
+});
diff --git a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
index 31c30c1245..eb331a775f 100644
--- a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
@@ -1,8 +1,11 @@
 <?php
 
 use App\Livewire\Project\Application\Advanced as ApplicationAdvanced;
+use App\Livewire\Project\Application\General as ApplicationGeneral;
 use App\Livewire\Project\Application\Heading as ApplicationHeading;
 use App\Livewire\Project\Application\Rollback as ApplicationRollback;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show as EnvironmentVariableShow;
+use App\Livewire\Project\Shared\GetLogs;
 use App\Models\Application;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -10,9 +13,11 @@ use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -168,6 +173,60 @@ test('member cannot update application general settings', function () {
     expect($this->member->can('update', $this->application))->toBeFalse();
 });
 
+test('member cannot reset application labels', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $originalLabels = $this->application->custom_labels;
+
+    $component = app(ApplicationGeneral::class);
+    $component->application = $this->application;
+    $component->isContainerLabelReadonlyEnabled = true;
+
+    expect(fn () => $component->resetDefaultLabels(true))
+        ->toThrow(AuthorizationException::class);
+
+    expect($this->application->fresh()->custom_labels)->toBe($originalLabels);
+});
+
+test('member cannot load application environment variable values', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $environmentVariable = $this->application->environment_variables()->create([
+        'key' => 'SECRET_KEY',
+        'value' => 'super-secret-value',
+        'is_preview' => false,
+    ]);
+
+    Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $environmentVariable,
+        'type' => 'application',
+    ])
+        ->call('loadValues')
+        ->assertForbidden()
+        ->assertSet('valuesLoaded', false)
+        ->assertSet('value', null);
+});
+
+test('member cannot save application log timestamp settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $originalValue = $this->application->settings->is_include_timestamps;
+
+    Livewire::test(GetLogs::class, [
+        'resource' => $this->application,
+        'server' => $this->server,
+        'container' => $this->application->uuid,
+    ])
+        ->set('showTimeStamps', ! $originalValue)
+        ->call('instantSave')
+        ->assertSuccessful();
+
+    expect($this->application->settings->fresh()->is_include_timestamps)->toBe($originalValue);
+});
+
 // --- Application Advanced Livewire actions ---
 
 test('member cannot save application advanced settings', function () {
@@ -188,6 +247,21 @@ test('member cannot submit application advanced settings', function () {
         ->assertDispatched('error');
 });
 
+test('the private application advanced syncData helper is not remotely callable', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $original = (bool) $this->application->settings->is_force_https_enabled;
+
+    $component = Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->set('isForceHttpsEnabled', ! $original);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect((bool) $this->application->settings->fresh()->is_force_https_enabled)->toBe($original);
+});
+
 // --- Application Rollback Livewire actions ---
 
 test('member cannot save rollback settings', function () {
diff --git a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
index 89c3d5e2f4..7807f00a27 100644
--- a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Livewire\Project\Database\Heading;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -10,11 +11,12 @@ use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
 
     $this->team = Team::factory()->create();
 
@@ -89,6 +91,18 @@ test('member cannot update database', function () {
     expect($this->member->can('update', $this->database))->toBeFalse();
 });
 
+test('member cannot persist database activity status', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Heading::class, ['database' => $this->database])
+        ->call('activityFinished')
+        ->assertSuccessful()
+        ->assertDispatched('refresh');
+
+    expect($this->database->fresh()->started_at)->toBeNull();
+});
+
 // --- Database Policy: delete ---
 
 test('admin can delete database', function () {
diff --git a/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php b/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php
new file mode 100644
index 0000000000..68bb0ac8b2
--- /dev/null
+++ b/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php
@@ -0,0 +1,117 @@
+<?php
+
+use App\Livewire\Security\PrivateKey\Show as PrivateKeyShow;
+use App\Livewire\Source\Github\Change as GithubAppChange;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Storage::fake('ssh-keys');
+
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->member = User::factory()->create();
+    $this->team->members()->attach($this->owner, ['role' => 'owner']);
+    $this->team->members()->attach($this->member, ['role' => 'member']);
+});
+
+it('does not serialize a private key for a member who cannot update it', function () {
+    $privateKeyValue = PrivateKey::generateNewKeyPair('ed25519')['private_key'];
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key' => $privateKeyValue,
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyShow::class, ['private_key_uuid' => $privateKey->uuid])
+        ->assertSuccessful()
+        ->assertSet('privateKeyValue', '')
+        ->assertDontSee($privateKeyValue);
+});
+
+it('keeps a private key available to an owner who can update it', function () {
+    $privateKeyValue = PrivateKey::generateNewKeyPair('ed25519')['private_key'];
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key' => $privateKeyValue,
+    ]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyShow::class, ['private_key_uuid' => $privateKey->uuid])
+        ->assertSuccessful()
+        ->assertSet('privateKeyValue', $privateKeyValue);
+});
+
+it('does not serialize GitHub App secrets for a member who cannot update it', function () {
+    $githubApp = createGithubAppWithSecrets($this->team);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', null)
+        ->assertSet('webhookSecret', null)
+        ->assertDontSee('stored-client-secret')
+        ->assertDontSee('stored-webhook-secret');
+});
+
+it('does not serialize secrets from a system-wide GitHub App for another team', function () {
+    $githubApp = createGithubAppWithSecrets($this->team, isSystemWide: true);
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherTeam->members()->attach($otherUser, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', null)
+        ->assertSet('webhookSecret', null)
+        ->assertDontSee('stored-client-secret')
+        ->assertDontSee('stored-webhook-secret');
+});
+
+it('keeps GitHub App secrets available to an owner who can update it', function () {
+    $githubApp = createGithubAppWithSecrets($this->team);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', 'stored-client-secret')
+        ->assertSet('webhookSecret', 'stored-webhook-secret');
+});
+
+function createGithubAppWithSecrets(Team $team, bool $isSystemWide = false): GithubApp
+{
+    return GithubApp::query()->create([
+        'team_id' => $team->id,
+        'name' => 'security-test-app',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'client_secret' => 'stored-client-secret',
+        'webhook_secret' => 'stored-webhook-secret',
+        'is_system_wide' => $isSystemWide,
+    ]);
+}
diff --git a/tests/Feature/Authorization/NotificationAuthorizationTest.php b/tests/Feature/Authorization/NotificationAuthorizationTest.php
index 793f76b1f2..d4fa8dfc94 100644
--- a/tests/Feature/Authorization/NotificationAuthorizationTest.php
+++ b/tests/Feature/Authorization/NotificationAuthorizationTest.php
@@ -10,6 +10,7 @@ use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -43,13 +44,14 @@ test('member cannot send test notification on discord', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update discord notification settings', function () {
+test('the private discord syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(DiscordNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(DiscordNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update discord notification settings', function () {
@@ -78,13 +80,14 @@ test('member cannot send test notification on slack', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update slack notification settings', function () {
+test('the private slack syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(SlackNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(SlackNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update slack notification settings', function () {
@@ -114,13 +117,14 @@ test('member cannot send test notification on telegram', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update telegram notification settings', function () {
+test('the private telegram syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(TelegramNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(TelegramNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update telegram notification settings', function () {
@@ -132,6 +136,83 @@ test('admin can update telegram notification settings', function () {
     expect($this->admin->can('update', $settings))->toBeTrue();
 });
 
+test('telegram restart limit thread id accepts 255 characters', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 255))
+        ->call('submit')
+        ->assertHasNoErrors(['telegramNotificationsRestartLimitReachedThreadId']);
+
+    expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
+        ->toBe(str_repeat('a', 255));
+});
+
+test('telegram restart limit thread id rejects 256 characters', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 256))
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
+        ->not->toBe(str_repeat('a', 256));
+});
+
+test('member cannot view telegram thread ids', function () {
+    $threadIds = [
+        'telegram_notifications_deployment_success_thread_id' => 'deployment-success-thread',
+        'telegram_notifications_deployment_failure_thread_id' => 'deployment-failure-thread',
+        'telegram_notifications_status_change_thread_id' => 'status-change-thread',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'restart-limit-thread',
+        'telegram_notifications_backup_success_thread_id' => 'backup-success-thread',
+        'telegram_notifications_backup_failure_thread_id' => 'backup-failure-thread',
+        'telegram_notifications_scheduled_task_success_thread_id' => 'scheduled-task-success-thread',
+        'telegram_notifications_scheduled_task_failure_thread_id' => 'scheduled-task-failure-thread',
+        'telegram_notifications_docker_cleanup_success_thread_id' => 'docker-cleanup-success-thread',
+        'telegram_notifications_docker_cleanup_failure_thread_id' => 'docker-cleanup-failure-thread',
+        'telegram_notifications_server_disk_usage_thread_id' => 'server-disk-usage-thread',
+        'telegram_notifications_server_reachable_thread_id' => 'server-reachable-thread',
+        'telegram_notifications_server_unreachable_thread_id' => 'server-unreachable-thread',
+        'telegram_notifications_server_patch_thread_id' => 'server-patch-thread',
+        'telegram_notifications_traefik_outdated_thread_id' => 'traefik-outdated-thread',
+    ];
+
+    $this->team->telegramNotificationSettings->update($threadIds);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(TelegramNotification::class);
+
+    foreach ($threadIds as $column => $threadId) {
+        $component
+            ->assertSet(str($column)->camel()->toString(), null)
+            ->assertDontSee($threadId);
+    }
+});
+
+test('admin can view telegram thread ids', function () {
+    $threadIds = [
+        'telegram_notifications_deployment_success_thread_id' => 'deployment-success-thread',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'restart-limit-thread',
+    ];
+
+    $this->team->telegramNotificationSettings->update($threadIds);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(TelegramNotification::class);
+
+    foreach ($threadIds as $column => $threadId) {
+        $component->assertSet(str($column)->camel()->toString(), $threadId);
+    }
+});
+
 // --- Email ---
 
 test('member cannot send test email notification', function () {
@@ -152,13 +233,14 @@ test('member cannot send test email notification', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update email notification settings', function () {
+test('the private email syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(EmailNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(EmailNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('member cannot update smtp email transport directly', function () {
@@ -256,13 +338,14 @@ test('member cannot send test notification on pushover', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update pushover notification settings', function () {
+test('the private pushover syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(PushoverNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(PushoverNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update pushover notification settings', function () {
@@ -291,13 +374,14 @@ test('member cannot send test notification on webhook', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update webhook notification settings', function () {
+test('the private webhook syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(WebhookNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(WebhookNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update webhook notification settings', function () {
diff --git a/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php b/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
new file mode 100644
index 0000000000..5a44b26c40
--- /dev/null
+++ b/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
@@ -0,0 +1,180 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\Add;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Events\RouteMatched;
+use Illuminate\Support\Facades\Event;
+use Livewire\Exceptions\MethodNotFoundException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $this->project->environments()->first();
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $this->application->id,
+        'name' => 'validate-benign',
+        'command' => 'echo scheduled-ok',
+        'frequency' => '0 0 * * *',
+        'timeout' => 300,
+        'enabled' => true,
+    ]);
+});
+
+afterEach(function () {
+    Event::forget(RouteMatched::class);
+});
+
+function bindApplicationScheduledTaskRoute(Application $application, ScheduledTask $task): void
+{
+    $application->loadMissing('environment.project');
+
+    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($application, $task): void {
+        $event->route->setParameter('task_uuid', $task->uuid);
+        $event->route->setParameter('project_uuid', $application->environment->project->uuid);
+        $event->route->setParameter('environment_uuid', $application->environment->uuid);
+        $event->route->setParameter('application_uuid', $application->uuid);
+    });
+}
+
+function originalScheduledTaskState(ScheduledTask $task): array
+{
+    return $task->only(['name', 'command', 'frequency', 'timeout', 'enabled', 'container']);
+}
+
+test('read-only member can view an existing scheduled task', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    Livewire::test(Show::class)
+        ->assertSuccessful()
+        ->assertSet('name', 'validate-benign')
+        ->assertSet('command', 'echo scheduled-ok')
+        ->assertSet('frequency', '0 0 * * *');
+});
+
+test('the private syncData helper is not remotely callable through Livewire', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    $original = originalScheduledTaskState($this->task);
+
+    $component = Livewire::test(Show::class)
+        ->set('name', 'member-edited')
+        ->set('command', 'echo member-edited')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 120)
+        ->set('isEnabled', true);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect(originalScheduledTaskState($this->task->fresh()))->toBe($original);
+});
+
+test('read-only member cannot persist scheduled task changes through submit', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    $original = originalScheduledTaskState($this->task);
+
+    Livewire::test(Show::class)
+        ->set('name', 'member-edited')
+        ->set('command', 'echo member-edited')
+        ->set('frequency', '* * * * *')
+        ->call('submit');
+
+    expect(originalScheduledTaskState($this->task->fresh()))->toBe($original);
+});
+
+test('the private saveScheduledTask helper is not remotely callable through Livewire', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(Add::class, [
+        'id' => (string) $this->application->id,
+        'type' => 'application',
+        'containerNames' => collect(),
+    ])
+        ->set('name', 'member-created')
+        ->set('command', 'id')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 300);
+
+    expect(fn () => $component->call('saveScheduledTask'))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect(ScheduledTask::query()->where('name', 'member-created')->exists())->toBeFalse();
+});
+
+test('read-only member cannot create a scheduled task through submit', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Add::class, [
+        'id' => (string) $this->application->id,
+        'type' => 'application',
+        'containerNames' => collect(),
+    ])
+        ->set('name', 'member-created')
+        ->set('command', 'id')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 300)
+        ->call('submit');
+
+    expect(ScheduledTask::query()->where('name', 'member-created')->exists())->toBeFalse();
+});
+
+test('admin can persist scheduled task changes through submit', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    Livewire::test(Show::class)
+        ->set('name', 'updated-by-admin')
+        ->set('command', 'echo admin-ok')
+        ->set('frequency', '0 1 * * *')
+        ->set('timeout', 600)
+        ->call('submit')
+        ->assertSuccessful();
+
+    $this->task->refresh();
+
+    expect($this->task->name)->toBe('updated-by-admin')
+        ->and($this->task->command)->toBe('echo admin-ok')
+        ->and($this->task->frequency)->toBe('0 1 * * *')
+        ->and($this->task->timeout)->toBe(600);
+});
diff --git a/tests/Feature/Authorization/SecurityAuthorizationTest.php b/tests/Feature/Authorization/SecurityAuthorizationTest.php
new file mode 100644
index 0000000000..b36bcc3e49
--- /dev/null
+++ b/tests/Feature/Authorization/SecurityAuthorizationTest.php
@@ -0,0 +1,57 @@
+<?php
+
+use App\Livewire\Security\CloudInitScripts;
+use App\Livewire\Security\CloudProviderTokenForm;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+});
+
+test('member cannot create a cloud provider token through the public action', function () {
+    Http::fake(['*' => Http::response([], 200)]);
+
+    Livewire::test(CloudProviderTokenForm::class)
+        ->set('provider', 'hetzner')
+        ->set('token', 'secret-token')
+        ->set('name', 'Unauthorized token')
+        ->call('addToken')
+        ->assertForbidden();
+
+    expect(CloudProviderToken::query()->count())->toBe(0);
+});
+
+test('member cannot load cloud-init scripts through the public action', function () {
+    $script = CloudInitScript::query()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Protected script',
+        'script' => '#cloud-config',
+    ]);
+
+    CloudInitScript::query()->whereKey($script)->update(['uuid' => null]);
+
+    $component = app(CloudInitScripts::class);
+
+    expect(fn () => $component->loadScripts())
+        ->toThrow(AuthorizationException::class);
+
+    expect($script->refresh()->uuid)->toBeNull();
+});
diff --git a/tests/Feature/Authorization/ServerAuthorizationTest.php b/tests/Feature/Authorization/ServerAuthorizationTest.php
index c9e7ec10d6..353c6a687d 100644
--- a/tests/Feature/Authorization/ServerAuthorizationTest.php
+++ b/tests/Feature/Authorization/ServerAuthorizationTest.php
@@ -3,7 +3,9 @@
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Livewire\Server\Create as ServerCreate;
 use App\Livewire\Server\Index as ServerIndex;
+use App\Livewire\Server\LogDrains;
 use App\Livewire\Server\Navbar as ServerNavbar;
+use App\Livewire\Server\ValidateAndInstall;
 use App\Models\CloudProviderToken;
 use App\Models\InstanceSettings;
 use App\Models\Server;
@@ -12,6 +14,7 @@ use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -59,6 +62,24 @@ test('member cannot update server', function () {
     expect($this->member->can('update', $this->server))->toBeFalse();
 });
 
+test('member cannot invoke server validation write steps', function (string $method) {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    $before = $this->server->fresh()->getAttributes();
+
+    Livewire::test(ValidateAndInstall::class, ['server' => $this->server])
+        ->call($method)
+        ->assertForbidden();
+
+    expect($this->server->fresh()->getAttributes())->toBe($before);
+})->with([
+    'init',
+    'validateOS',
+    'validatePrerequisites',
+    'validateDockerEngine',
+    'validateDockerVersion',
+]);
+
 // --- Server Policy: delete ---
 
 test('admin can delete server', function () {
@@ -79,6 +100,20 @@ test('member can view server', function () {
     expect($this->member->can('view', $this->server))->toBeTrue();
 });
 
+test('the private log drain syncData helper is not remotely callable', function () {
+    $this->withoutVite();
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('isLogDrainAxiomEnabled', true);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect((bool) $this->server->settings->fresh()->is_logdrain_axiom_enabled)->toBeFalse();
+});
+
 // --- Server Policy: manageProxy ---
 
 test('admin can manage proxy', function () {
diff --git a/tests/Feature/CheckDomainDnsJobTest.php b/tests/Feature/CheckDomainDnsJobTest.php
index 74502268a0..d760fdcc45 100644
--- a/tests/Feature/CheckDomainDnsJobTest.php
+++ b/tests/Feature/CheckDomainDnsJobTest.php
@@ -3,6 +3,7 @@
 use App\Actions\Shared\CheckDomainDns;
 use App\Jobs\CheckDomainDnsJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -57,6 +58,34 @@ it('persists a skipped result when dns validation is disabled', function () {
         ->and($status['checked_at'])->not->toBeNull();
 });
 
+it('persists dns results for application previews', function () {
+    $statusKey = hash('sha256', 'https://preview.example.com|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 41,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/41',
+        'fqdn' => 'https://preview.example.com',
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'preview-check',
+            ],
+        ],
+    ]);
+
+    (new CheckDomainDnsJob(
+        $preview,
+        $statusKey,
+        'https://preview.example.com',
+        null,
+        null,
+        'preview-check',
+    ))->handle();
+
+    expect($preview->fresh()->domain_dns_statuses[$statusKey]['status'])->toBe('skipped');
+});
+
 it('does not restore a dns status removed before the job finishes', function () {
     $this->application->update(['domain_dns_statuses' => null]);
 
diff --git a/tests/Feature/CleanupStuckedResourcesTest.php b/tests/Feature/CleanupStuckedResourcesTest.php
new file mode 100644
index 0000000000..24229cf3d1
--- /dev/null
+++ b/tests/Feature/CleanupStuckedResourcesTest.php
@@ -0,0 +1,44 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+it('deletes scheduled tasks whose configured owner no longer exists', function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    Queue::fake();
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = $project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $validTask = ScheduledTask::factory()->create([
+        'team_id' => $team->id,
+        'application_id' => $application->id,
+    ]);
+    $orphanedTask = ScheduledTask::factory()->create([
+        'team_id' => $team->id,
+        'application_id' => PHP_INT_MAX,
+    ]);
+
+    $this->artisan('cleanup:stucked-resources')->assertSuccessful();
+
+    expect($validTask->fresh())->not->toBeNull()
+        ->and($orphanedTask->fresh())->toBeNull();
+});
diff --git a/tests/Feature/ComposeEditorLayoutTest.php b/tests/Feature/ComposeEditorLayoutTest.php
index d8538e82d7..d3fe92e45d 100644
--- a/tests/Feature/ComposeEditorLayoutTest.php
+++ b/tests/Feature/ComposeEditorLayoutTest.php
@@ -48,6 +48,27 @@ it('renders the compose editor with clear guidance settings and actions', functi
         ->not->toContain('Show Deployable Compose');
 });
 
+it('keeps the compose modal usable on mobile screens', function () {
+    $stackForm = file_get_contents(resource_path('views/livewire/project/service/stack-form.blade.php'));
+    $editor = file_get_contents(resource_path('views/livewire/project/service/edit-compose.blade.php'));
+    $modal = file_get_contents(resource_path('views/components/modal-input.blade.php'));
+
+    expect($modal)
+        ->toContain('justify-center p-2')
+        ->toContain('sm:p-4')
+        ->toContain('flex-wrap! sm:flex-nowrap!')
+        ->toContain('order-3 w-full sm:order-none sm:w-auto')
+        ->toContain('order-2 sm:order-none')
+        ->toContain("'mt-2 sm:mt-0' => isset(\$headerActions)");
+
+    expect($stackForm)
+        ->toContain('w-full items-center gap-2 overflow-x-auto sm:w-auto');
+
+    expect($editor)
+        ->toContain('flex-col items-stretch')
+        ->toContain('sm:flex-row sm:flex-wrap sm:items-center');
+});
+
 it('keeps the save button loading until the parent compose save finishes', function () {
     $component = file_get_contents(app_path('Livewire/Project/Service/StackForm.php'));
 
diff --git a/tests/Feature/DatabaseRestoreDialogTest.php b/tests/Feature/DatabaseRestoreDialogTest.php
index 0086a6cf2f..5f78706a8c 100644
--- a/tests/Feature/DatabaseRestoreDialogTest.php
+++ b/tests/Feature/DatabaseRestoreDialogTest.php
@@ -8,3 +8,13 @@ test('database restore output opens in the centered process dialog', function ()
         ->toContain('<livewire:activity-monitor wire:key="database-restore-{{ $resourceUuid }}" header="Logs" fullHeight />')
         ->not->toContain('<x-slide-over @databaserestore.window="slideOverOpen = true"');
 });
+
+test('postgresql dump all restore warns that administrator passwords are overwritten', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/database/import-form.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($dumpAll)')
+        ->toContain('Full restore overwrites administrator passwords')
+        ->toContain('The backup replaces PostgreSQL administrator role passwords, including the destination administrator password.')
+        ->toContain("If the administrator password changes, update it in Coolify's database configuration after the restore.");
+});
diff --git a/tests/Feature/DeleteResourceJobAtomicityTest.php b/tests/Feature/DeleteResourceJobAtomicityTest.php
index 11955a82cd..801db44d14 100644
--- a/tests/Feature/DeleteResourceJobAtomicityTest.php
+++ b/tests/Feature/DeleteResourceJobAtomicityTest.php
@@ -2,13 +2,17 @@
 
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\ScheduledVolumeBackup;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
+use Illuminate\Foundation\Console\QueuedCommand;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Queue;
 
@@ -45,6 +49,7 @@ it('deletes the Coolify resource when remote cleanup fails', function () {
     (new DeleteResourceJob($this->application))->handle();
 
     expect(Application::withTrashed()->find($this->application->id))->toBeNull();
+    Queue::assertNotPushed(QueuedCommand::class);
 });
 
 it('rolls back local metadata deletion when deleting the resource fails', function () {
@@ -62,3 +67,47 @@ it('rolls back local metadata deletion when deleting the resource fails', functi
     expect($this->storage->fresh())->not->toBeNull()
         ->and(Application::withTrashed()->find($this->application->id))->not->toBeNull();
 });
+
+it('deletes scheduled volume backups outside the local deletion transaction', function () {
+    $backup = $this->storage->scheduledBackups()->create([
+        'team_id' => $this->application->environment->project->team_id,
+        'frequency' => 'daily',
+        'timeout' => 3600,
+    ]);
+    $transactionLevel = DB::transactionLevel();
+    $deletingTransactionLevel = null;
+
+    ScheduledVolumeBackup::deleting(function (ScheduledVolumeBackup $deletingBackup) use ($backup, &$deletingTransactionLevel): void {
+        if ($deletingBackup->is($backup)) {
+            $deletingTransactionLevel = DB::transactionLevel();
+        }
+    });
+    Process::fake(['*' => Process::result(output: '')]);
+
+    (new DeleteResourceJob($this->application))->handle();
+
+    expect($deletingTransactionLevel)->toBe($transactionLevel);
+});
+
+it('deletes preview metadata locally when its application destination is missing', function () {
+    $this->application->restore();
+    $this->application->update(['destination_id' => PHP_INT_MAX]);
+    $preview = ApplicationPreview::create([
+        'uuid' => 'preview-without-destination',
+        'application_id' => $this->application->id,
+        'pull_request_id' => 45,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/45',
+    ]);
+    $previewStorage = $preview->persistentStorages()->create([
+        'name' => 'preview-without-destination-data',
+        'mount_path' => '/preview-data',
+        'host_path' => null,
+    ]);
+    Process::fake();
+
+    (new DeleteResourceJob($preview))->handle();
+
+    Process::assertNothingRan();
+    expect(ApplicationPreview::withTrashed()->find($preview->id))->toBeNull()
+        ->and($previewStorage->fresh())->toBeNull();
+});
diff --git a/tests/Feature/DeploymentLogsLayoutTest.php b/tests/Feature/DeploymentLogsLayoutTest.php
index dc0b921003..be825c663b 100644
--- a/tests/Feature/DeploymentLogsLayoutTest.php
+++ b/tests/Feature/DeploymentLogsLayoutTest.php
@@ -4,6 +4,7 @@ use App\Enums\ApplicationDeploymentStatus;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
+use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -214,6 +215,40 @@ it('keeps deployment history fields and the log status badge accessible on mobil
         ->toContain(".logs-viewer-primary .logs-viewer-actions {\n    width: auto;\n    flex: 1 1 auto;");
 });
 
+it('links deployment commit hashes to the source commit page', function () {
+    $githubApp = GithubApp::query()->create([
+        'team_id' => $this->team->id,
+        'name' => 'GitHub',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+    ]);
+    $this->application->update([
+        'source_id' => $githubApp->id,
+        'source_type' => $githubApp->getMorphClass(),
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+    ]);
+    ApplicationDeploymentQueue::query()->create([
+        'application_id' => $this->application->id,
+        'deployment_uuid' => 'deploy-commit-link-test',
+        'server_id' => $this->server->id,
+        'status' => ApplicationDeploymentStatus::FINISHED->value,
+        'commit' => '1234567890abcdef1234567890abcdef12345678',
+    ]);
+
+    $response = $this->get(route('project.application.deployment.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee(
+        'href="https://github.com/coollabsio/coolify/commit/1234567890abcdef1234567890abcdef12345678" target="_blank" rel="noopener noreferrer"',
+        false,
+    );
+});
+
 it('places cancel deployment controls inside the deployment logs toolbar', function () {
     $deployment = ApplicationDeploymentQueue::create([
         'application_id' => $this->application->id,
diff --git a/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php b/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
index c98a200caf..77df86e2d8 100644
--- a/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
+++ b/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
@@ -29,6 +29,8 @@ it('lazy-loads decrypted values only when opening the edit modal', function () {
         ->toContain('wireOpen="editorOpen"')
         ->toContain('$valuesLoaded')
         ->toContain('Loading value...');
+
+    expect($view)->toContain('<x-forms.input loading loadingText="Loading value..."');
 });
 
 it('keeps the environment variable delete button compact', function () {
diff --git a/tests/Feature/FileStorageMountPathTest.php b/tests/Feature/FileStorageMountPathTest.php
index b43aae4b19..cd301c2557 100644
--- a/tests/Feature/FileStorageMountPathTest.php
+++ b/tests/Feature/FileStorageMountPathTest.php
@@ -4,7 +4,6 @@ use App\Jobs\ServerStorageSaveJob;
 use App\Livewire\Project\Service\FileStorage;
 use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Shared\Storages\All;
-use App\Livewire\Project\Shared\Storages\Show;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
@@ -135,13 +134,44 @@ test('livewire volume storage refreshes the storage list and configuration warni
         ->set('mount_path', '/app/data')
         ->call('submitPersistentVolume')
         ->assertDispatched('success')
-        ->assertDispatched('refreshStorages')
+        ->assertNotDispatched('refreshStorages')
+        ->assertNotDispatched('refreshVolumeList')
         ->assertDispatched('configurationChanged')
         ->assertSet('activeTab', 'volumes')
         ->assertSet('volumeCount', 1)
         ->assertSee($this->application->uuid.'-data');
 });
 
+test('adding another volume refreshes only the mounted volume list', function () {
+    LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-first',
+        'mount_path' => '/app/first',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('name', 'second')
+        ->set('mount_path', '/app/second')
+        ->call('submitPersistentVolume')
+        ->assertDispatched('refreshVolumeList')
+        ->assertNotDispatched('refreshStorages');
+});
+
+test('deleting a volume asks only the parent storage component to refresh its counts', function () {
+    $volume = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-data',
+        'mount_path' => '/app/data',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    Livewire::test(All::class, ['resource' => $this->application])
+        ->call('delete', $volume->id, 'password')
+        ->assertDispatched('storageCountsChanged')
+        ->assertNotDispatched('refreshStorages');
+});
+
 test('volume storage list shows volumes added after it was mounted', function () {
     $firstVolume = LocalPersistentVolume::create([
         'name' => $this->application->uuid.'-first',
@@ -191,7 +221,9 @@ test('deleting a file mount refreshes the configuration warning', function () {
 
     Livewire::test(FileStorage::class, ['fileStorage' => $file])
         ->call('delete', 'password')
-        ->assertDispatched('configurationChanged');
+        ->assertDispatched('configurationChanged')
+        ->assertDispatched('storageCountsChanged')
+        ->assertNotDispatched('refreshStorages');
 
     expect($file->fresh())->toBeNull();
 });
@@ -214,8 +246,8 @@ test('deleting a volume mount refreshes the configuration warning', function ()
         'resource_type' => $database->getMorphClass(),
     ]);
 
-    Livewire::test(Show::class, ['storage' => $volume, 'resource' => $database])
-        ->call('delete', 'password')
+    Livewire::test(All::class, ['resource' => $database])
+        ->call('delete', $volume->id, 'password')
         ->assertDispatched('configurationChanged');
 
     expect($volume->fresh())->toBeNull();
diff --git a/tests/Feature/ForgotPasswordRateLimitTest.php b/tests/Feature/ForgotPasswordRateLimitTest.php
index 02dbce6507..20fbd22596 100644
--- a/tests/Feature/ForgotPasswordRateLimitTest.php
+++ b/tests/Feature/ForgotPasswordRateLimitTest.php
@@ -6,6 +6,8 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+
     InstanceSettings::query()->forceCreate(['id' => 0]);
 });
 
diff --git a/tests/Feature/ImportBackupUploadIconTest.php b/tests/Feature/ImportBackupUploadIconTest.php
index 2729278de6..6fc9158bef 100644
--- a/tests/Feature/ImportBackupUploadIconTest.php
+++ b/tests/Feature/ImportBackupUploadIconTest.php
@@ -28,11 +28,11 @@ it('uses the upload reicon for import backup in database configuration nav', fun
         ->toContain("'icon' => 'upload'");
 });
 
-it('uses the upload reicon for import backup in service database sidebar', function () {
-    $contents = file_get_contents(resource_path('views/components/service-database/sidebar.blade.php'));
+it('uses the upload reicon for import backup in service navigation', function () {
+    $contents = file_get_contents(resource_path('views/components/service/configuration-sidebar.blade.php'));
 
     expect($contents)
         ->toContain("'label' => 'Import Backup'")
         ->toContain("'icon' => 'upload'")
-        ->not->toMatch("/'label' => 'Import Backup',\s*'route' => 'project\.service\.database\.import',\s*'icon' => 'storages'/s");
+        ->toContain("'route' => 'project.service.import-backup'");
 });
diff --git a/tests/Feature/LayoutPopupsUiTest.php b/tests/Feature/LayoutPopupsUiTest.php
index 167a23a04f..d405268d02 100644
--- a/tests/Feature/LayoutPopupsUiTest.php
+++ b/tests/Feature/LayoutPopupsUiTest.php
@@ -36,3 +36,30 @@ test('non-critical reminders collapse after ten seconds', function () {
         ->toContain('reminders.sponsorship.compact = true')
         ->toContain('reminders.notification.compact = true');
 });
+
+test('sponsorship reminder is disabled in development', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+
+    expect($view)
+        ->toContain('this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup')
+        ->toContain('x-on:show-sponsorship-reminder.window="popups.sponsorship = true')
+        ->toContain('x-on:show-sponsorship-reminder.window="bannerVisible = true"');
+});
+
+test('sponsorship reminder listener is not parsed as a blade directive', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+    $compiledView = Blade::compileString($view);
+
+    expect($compiledView)
+        ->toContain('x-on:show-sponsorship-reminder.window=')
+        ->not->toContain('$__env->yieldSection()');
+});
+
+test('advanced settings provides a development-only sponsorship reminder preview', function () {
+    $view = file_get_contents(resource_path('views/livewire/settings/advanced.blade.php'));
+
+    expect($view)
+        ->toContain('@if (isDev())')
+        ->toContain("@click=\"\$dispatch('show-sponsorship-reminder')\"")
+        ->toContain('Show sponsorship reminder');
+});
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index c8644a2c1d..0e7bc1d0c7 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -53,6 +53,57 @@ it('hides resource action menus when the user cannot manage the resource', funct
     'server actions' => ['views/livewire/server/navbar.blade.php', 'manageProxy', 'server', 'server'],
 ]);
 
+it('declares deploy authorization on the application stop confirmation', function () {
+    $source = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+
+    expect($source)->toMatch(
+        '/<x-modal-confirmation\s+canGate="deploy" :canResource="\$application"/'
+    );
+});
+
+it('declares deploy authorization on the service container removal confirmation', function () {
+    $source = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+
+    expect($source)->toMatch(
+        '/<x-modal-confirmation(?=[^>]*title="Confirm Container Removal\?")(?=[^>]*canGate="deploy")(?=[^>]*:canResource="\$service")[^>]*>/'
+    );
+});
+
+it('declares update authorization on service backup mutation controls', function () {
+    $importBackupView = file_get_contents(resource_path('views/livewire/project/service/import-backup.blade.php'));
+    $volumeBackupView = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($importBackupView)->toMatch(
+        '/<x-forms\.listbox(?=[^>]*id="selectedDatabaseUuid")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/'
+    );
+
+    expect($volumeBackupView)
+        ->toMatch('/<x-modal-input(?=[^>]*:title="\'Edit backup schedule\'")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'database\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'storage\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/');
+});
+
+it('declares update authorization on application port controls', function () {
+    $domainsView = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
+    $previewDomainsView = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+    $generalView = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
+
+    expect($domainsView)
+        ->toMatch('/<x-forms\.button(?=[^>]*canGate="update")(?=[^>]*:canResource="\$application")[^>]*>\s*Cancel/s')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click="confirmUseUnknownPort")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$application")[^>]*>/s');
+
+    expect($previewDomainsView)
+        ->toMatch('/<x-forms\.button[^\n]*canGate="update" :canResource="\$preview->application"[\s\S]{0,150}?Cancel/')
+        ->toMatch('/<x-forms\.button[^\n]*wire:click="confirmUseUnknownPort" canGate="update"\s+:canResource="\$preview->application"/');
+
+    $portsExposesControls = str($generalView)
+        ->after("@if (\$isStatic || \$buildPack === 'static')")
+        ->before('<p class="mt-1.5 text-xs');
+
+    expect($portsExposesControls->substrCount('id="portsExposes"'))->toBe(3)
+        ->and($portsExposesControls->substrCount('canGate="update" :canResource="$application"'))->toBe(3);
+});
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
diff --git a/tests/Feature/NotificationRestartLimitSettingTest.php b/tests/Feature/NotificationRestartLimitSettingTest.php
new file mode 100644
index 0000000000..e068ea594b
--- /dev/null
+++ b/tests/Feature/NotificationRestartLimitSettingTest.php
@@ -0,0 +1,48 @@
+<?php
+
+it('uses a dedicated notification event for restart limits', function () {
+    $notification = file_get_contents(app_path('Notifications/Application/RestartLimitReached.php'));
+    $telegramChannel = file_get_contents(app_path('Notifications/Channels/TelegramChannel.php'));
+    $eventGrid = file_get_contents(resource_path('views/components/notification/event-grid.blade.php'));
+
+    expect($notification)->toContain("getEnabledChannels('restart_limit_reached')")
+        ->and($eventGrid)
+        ->toContain("'Resources' => [")
+        ->toContain("'key' => 'statusChange'")
+        ->toContain("'helper' => 'Notify when a resource stops or Coolify automatically restarts it.'")
+        ->toContain("'key' => 'restartLimitReached'")
+        ->toContain("'label' => 'Restart limit reached'")
+        ->and($telegramChannel)
+        ->toContain('RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id');
+});
+
+it('persists a restart limit notification preference for every channel', function (string $channel) {
+    $studly = Str::studly($channel);
+    $component = file_get_contents(app_path("Livewire/Notifications/{$studly}.php"));
+    $model = file_get_contents(app_path('Models/'.$studly.'NotificationSettings.php'));
+    $column = "restart_limit_reached_{$channel}_notifications";
+    $property = "restartLimitReached{$studly}Notifications";
+
+    expect($component)
+        ->toContain("public bool \${$property} = true;")
+        ->toContain("\$this->settings->{$column} = \$this->{$property};")
+        ->toContain("\$this->{$property} = \$this->settings->{$column};")
+        ->and($model)
+        ->toContain("'{$column}'");
+})->with(['email', 'discord', 'telegram', 'slack', 'pushover', 'webhook']);
+
+it('enables restart limit notifications by default in every channel migration', function () {
+    $migrations = collect(glob(database_path('migrations/*_add_restart_limit_reached_notifications_to_*')));
+
+    expect($migrations)->toHaveCount(6);
+    $migrations->each(fn (string $migration) => expect(file_get_contents($migration))->toContain('->default(true)'));
+});
+
+it('uses the inline validator facade for notification API updates', function () {
+    $controller = file_get_contents(app_path('Http/Controllers/Api/NotificationsController.php'));
+
+    expect($controller)
+        ->toContain('use Illuminate\\Support\\Facades\\Validator;')
+        ->toContain("Validator::make(\$body, \$config['rules'])")
+        ->not->toContain("customApiValidator(\$body, \$config['rules'])");
+});
diff --git a/tests/Feature/PersistentStoragePerformanceTest.php b/tests/Feature/PersistentStoragePerformanceTest.php
index caad5822a1..6d1df54607 100644
--- a/tests/Feature/PersistentStoragePerformanceTest.php
+++ b/tests/Feature/PersistentStoragePerformanceTest.php
@@ -91,7 +91,7 @@ function createPerfApplicationWithVolumes(int $volumeCount = 5): array
     return [$application, $firstVolume, $team];
 }
 
-it('renders volume rows without nesting Livewire Show components', function () {
+it('renders volume rows inline without nested Livewire row components', function () {
     [$application] = createPerfApplicationWithVolumes(5);
 
     $html = Livewire::test(All::class, ['resource' => $application])->html();
@@ -100,7 +100,6 @@ it('renders volume rows without nesting Livewire Show components', function () {
         ->toContain('data-table')
         ->toContain('openBackupModal')
         ->toContain('wire:submit="submit(')
-        ->not->toContain('livewire:project.shared.storages.show')
         ->not->toContain('shared-configure-volume-backup-');
 });
 
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index d906cfb6a1..6546a00e31 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -33,6 +33,18 @@ it('keeps storage backup schedule tables horizontally scrollable on mobile', fun
         ->and($css)->toMatch('/\.backup-table-grid\s*\{[^}]*min-width:\s*50rem;/');
 });
 
+
+it('keeps nested storage component keys stable when mounts are added or deleted', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
+
+    expect($view)
+        ->toContain('wire:key="volumes-{{ $resource->id }}"')
+        ->toContain('wire:key="svc-volumes-{{ $resource->id }}"')
+        ->not->toContain('wire:key="volumes-{{ $resource->id }}-{{ $this->volumeCount }}"')
+        ->not->toContain('wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"');
+});
+
+
 use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
 use App\Livewire\Project\Shared\Storages\All;
@@ -129,7 +141,6 @@ function createApplicationWithVolume(array $applicationAttributes = [], array $v
 
 it('renders volumes as a data table with shared column headers', function () {
     $allView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
-    $showView = file_get_contents(resource_path('views/livewire/project/shared/storages/show.blade.php'));
     $storageView = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
 
     expect($allView)
@@ -147,17 +158,10 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toContain('data-table-row')
         ->toContain('volumes-mobile-label')
         ->not->toContain('table-badge table-badge-success')
-        ->not->toContain('livewire:project.shared.storages.show')
         ->not->toContain('x-status-badge')
         ->not->toContain('font-mono')
         ->not->toContain('Service volume mounts are read-only here.');
 
-    // Show remains available for isolated embeds/tests but is no longer nested from All.
-    expect($showView)
-        ->toContain('data-table-row')
-        ->toContain('volumes-table-grid')
-        ->not->toContain('font-mono');
-
     // Service stack page: one settings-section card per compose service/resource.
     expect($storageView)
         ->toContain('Str::headline($resource->name)')
@@ -422,16 +426,13 @@ it('hides PR deployment suffix for databases', function () {
 });
 
 it('uses a compact table badge for enabled backups instead of status-badge', function () {
-    $showView = file_get_contents(resource_path('views/livewire/project/shared/storages/show.blade.php'));
+    $allView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
 
-    expect($showView)
-        ->toContain('table-badge-success')
+    expect($allView)
+        ->toContain("'table-badge-success' => \$hasS3Backup")
         ->toContain('Volume backup is enabled')
         ->not->toContain('x-status-badge')
         ->not->toContain('status="Backup enabled"');
-
-    // Badge label is the short "Backup" text, not the old pill-with-label that broke the input row.
-    expect(preg_match('/table-badge-success[^>]*>\s*Backup\s*</', $showView))->toBeGreaterThan(0);
 });
 
 it('gates file storage PR suffix markup behind git_based applications', function () {
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
new file mode 100644
index 0000000000..b40193cb29
--- /dev/null
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -0,0 +1,674 @@
+<?php
+
+use App\Livewire\Project\Application\PreviewDomains;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        [
+            'id' => 0,
+            'is_dns_validation_enabled' => false,
+        ]
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+        'ip' => '203.0.113.10',
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'generate_exact_labels' => false,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Preview Port App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => null,
+        'redirect' => 'both',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000,8080',
+        'is_http_basic_auth_enabled' => false,
+    ]);
+});
+
+function createPreviewForPortTests(Application $application, int $pullRequestId, array $attributes = []): ApplicationPreview
+{
+    return ApplicationPreview::create(array_merge([
+        'application_id' => $application->id,
+        'pull_request_id' => $pullRequestId,
+        'pull_request_html_url' => "https://github.com/coollabsio/coolify/pull/{$pullRequestId}",
+    ], $attributes));
+}
+
+it('saves preview domain port overrides separately from the public FQDN', function () {
+    $preview = createPreviewForPortTests($this->application, 101);
+
+    $preview->update([
+        'fqdn' => 'https://one-pr-101.example.com:3000,https://two-pr-101.example.com:8080',
+    ]);
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toBe('https://one-pr-101.example.com,https://two-pr-101.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe([
+            'https://one-pr-101.example.com' => 3000,
+            'https://two-pr-101.example.com' => 8080,
+        ]);
+});
+
+it('retains an existing preview port override when saving a portless domain', function () {
+    $preview = createPreviewForPortTests($this->application, 102, [
+        'fqdn' => 'https://one-pr-102.example.com:3000',
+    ]);
+
+    $preview->update([
+        'fqdn' => 'https://one-pr-102.example.com',
+    ]);
+
+    expect($preview->fresh()->fqdn)
+        ->toBe('https://one-pr-102.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://one-pr-102.example.com' => 3000]);
+});
+
+it('saves a preview port override from the add-domain form', function () {
+    $preview = createPreviewForPortTests($this->application, 103);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('https://preview.example.com:8080');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toBe('https://preview.example.com')
+        ->and($preview->domain_port_overrides['https://preview.example.com'] ?? null)
+        ->toBe(8080);
+});
+
+it('retains different port overrides for two preview domains', function () {
+    $preview = createPreviewForPortTests($this->application, 104);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'one-preview.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainParts.host', 'two-preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+
+    expect($preview->domain_port_overrides['https://one-preview.example.com'] ?? null)->toBe(3000)
+        ->and($preview->domain_port_overrides['https://two-preview.example.com'] ?? null)->toBe(8080)
+        ->and(explode(',', (string) $preview->fqdn))
+        ->toContain('https://one-preview.example.com')
+        ->toContain('https://two-preview.example.com')
+        ->not->toContain('https://one-preview.example.com:3000')
+        ->not->toContain('https://two-preview.example.com:8080');
+});
+
+it('reopens preview domain edit with the saved port override', function () {
+    $preview = createPreviewForPortTests($this->application, 105, [
+        'fqdn' => 'https://preview.example.com:8080',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.url', 'https://preview.example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'preview.example.com');
+});
+
+it('does not prefill the default internal port when editing a preview domain without an override', function () {
+    $preview = createPreviewForPortTests($this->application, 106, [
+        'fqdn' => 'https://preview.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '');
+});
+
+it('clears a preview domain port override and shows the default internal port', function () {
+    $preview = createPreviewForPortTests($this->application, 107, [
+        'fqdn' => 'https://one-preview.example.com:8080,https://two-preview.example.com:9090',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSee('Internal port 8080')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertSee('Internal port 9090')
+        ->assertDontSee('Internal port 8080');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toContain('https://one-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->not->toHaveKey('https://one-preview.example.com')
+        ->toHaveKey('https://two-preview.example.com', 9090);
+});
+
+it('prunes a preview domain port override when removing the domain', function () {
+    $preview = createPreviewForPortTests($this->application, 108, [
+        'fqdn' => 'https://one-preview.example.com:8080,https://two-preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)->toBe('https://two-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe(['https://two-preview.example.com' => 3000]);
+});
+
+it('shows an error badge when a preview domain has no internal port and ports exposes is empty', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 109, [
+        'fqdn' => 'https://preview.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSee('No internal port')
+        ->assertDontSee('Internal port');
+});
+
+it('rejects adding a preview domain whose portless URL is already configured', function () {
+    $preview = createPreviewForPortTests($this->application, 110, [
+        'fqdn' => 'https://preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasErrors('newDomainParts.host');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 3000]);
+});
+
+it('saves compose preview domain port overrides per service without putting the port in the public URL', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 111);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainService', 'web')
+        ->set('newDomainParts.host', 'web-preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainService', 'api')
+        ->set('newDomainParts.host', 'api-preview.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+    $composeDomains = json_decode($preview->docker_compose_domains, true);
+
+    expect(data_get($composeDomains, 'web.domain'))->toBe('https://web-preview.example.com')
+        ->and(data_get($composeDomains, 'api.domain'))->toBe('https://api-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe([
+            'https://web-preview.example.com' => 8080,
+            'https://api-preview.example.com' => 3000,
+        ]);
+});
+
+it('copies the parent domain port override onto a generated preview domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com:8080',
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 112);
+    $preview->generate_preview_fqdn();
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toContain('112.')
+        ->not->toContain(':8080')
+        ->and($preview->domain_port_overrides)
+        ->toHaveCount(1)
+        ->and(array_values($preview->domain_port_overrides))
+        ->toBe([8080]);
+});
+
+it('saves generated preview domains once in the application parser', function () {
+    $parser = file_get_contents(base_path('bootstrap/helpers/parsers.php'));
+    $previewGeneration = Str::of($parser)
+        ->after('// If the domain is set, we need to generate the FQDNs for the preview')
+        ->before('$defaultLabels = defaultLabels');
+
+    expect($previewGeneration->substrCount('$preview->save();'))->toBe(1)
+        ->and((string) $previewGeneration)->toContain('$preview->fqdn = $fqdns->implode(\',\');');
+});
+
+it('keeps every generated preview domain port override in the legacy compose parser', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: nginx:alpine
+YAML,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://one.example.com:3000,https://two.example.com:8080'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 124);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 124, preview_id: $preview->id);
+
+    $preview->refresh();
+
+    $previewDomains = explode(',', (string) $preview->fqdn);
+
+    expect($previewDomains)->toHaveCount(2)
+        ->and(collect($previewDomains)
+            ->filter(fn (string $domain): bool => parse_url($domain, PHP_URL_PORT) !== null))
+        ->toBeEmpty()
+        ->and($preview->domain_port_overrides)->toHaveCount(2)
+        ->and(array_keys($preview->domain_port_overrides))->toBe($previewDomains)
+        ->and(array_values($preview->domain_port_overrides))->toBe([3000, 8080]);
+});
+
+it('finds the legacy compose preview by pull request when its id is unavailable', function (?int $previewId) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com:3000'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 125);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 125, preview_id: $previewId);
+
+    expect($preview->fresh()->fqdn)->not->toBeNull();
+})->with([
+    'missing id' => null,
+    'stale id' => PHP_INT_MAX,
+]);
+
+it('throws a controlled exception when the legacy compose preview does not exist', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com:3000'],
+        ]),
+    ]);
+
+    expect(fn () => parseDockerComposeFile(
+        $this->application->fresh(),
+        pull_request_id: 126,
+        preview_id: PHP_INT_MAX,
+    ))->toThrow(RuntimeException::class, 'Preview not found.');
+});
+
+it('preserves an existing preview port override in the legacy compose parser', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: nginx:alpine
+YAML,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 126, [
+        'fqdn' => 'https://126.frontend.example.com',
+        'domain_port_overrides' => [
+            'https://126.frontend.example.com' => 8080,
+        ],
+    ]);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 126, preview_id: $preview->id);
+
+    expect($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://126.frontend.example.com' => 8080]);
+});
+
+it('does not copy production domain port overrides onto preview proxy labels', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'domain_port_overrides' => [
+            'https://app.example.com' => 9090,
+        ],
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 113, [
+        'fqdn' => 'https://113.app.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-113.loadbalancer.server.port=3000')
+        ->not->toContain('loadbalancer.server.port=9090');
+});
+
+it('routes portless preview domains to saved preview internal port overrides', function () {
+    $preview = createPreviewForPortTests($this->application, 114, [
+        'fqdn' => 'https://one-pr.example.com,https://two-pr.example.com',
+        'domain_port_overrides' => [
+            'https://one-pr.example.com' => 3000,
+            'https://two-pr.example.com' => 8080,
+        ],
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+    $uuid = $this->application->uuid.'-pr-114';
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$uuid.'.rule=Host(`one-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$uuid.'.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-'.$uuid.'.rule=Host(`two-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-'.$uuid.'.loadbalancer.server.port=8080')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('Host(`one-pr.example.com:3000`)')
+        ->not->toContain('Host(`two-pr.example.com:8080`)');
+});
+
+it('uses the first ports_exposes value for a portless preview domain without an override', function () {
+    $preview = createPreviewForPortTests($this->application, 115, [
+        'fqdn' => 'https://plain-pr.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-115.loadbalancer.server.port=3000')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}');
+});
+
+it('keeps routing a legacy port-bearing preview FQDN without an override map', function () {
+    $preview = createPreviewForPortTests($this->application, 116, [
+        'fqdn' => 'https://legacy-pr.example.com',
+    ]);
+
+    DB::table('application_previews')->where('id', $preview->id)->update([
+        'fqdn' => 'https://legacy-pr.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$this->application->uuid.'-pr-116.rule=Host(`legacy-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-116.loadbalancer.server.port=9090')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
+
+it('passes preview domain port overrides into compose pull-request labels', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+        'domain_port_overrides' => [
+            'https://frontend.example.com' => 80,
+        ],
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 117, [
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://117.frontend.example.com'],
+        ]),
+        'fqdn' => 'https://117.frontend.example.com',
+        'domain_port_overrides' => [
+            'https://117.frontend.example.com' => 8080,
+        ],
+    ]);
+
+    $parsedCompose = applicationParser($this->application->fresh(), 117, $preview->id);
+    $labels = collect(data_get($parsedCompose, 'services.frontend-pr-117.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8080')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8080}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`117.frontend.example.com`)')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=80')))
+        ->toBeFalse();
+});
+
+it('uses ports_exposes as the compose preview fallback when a domain has no override', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'ports_exposes' => '4000,5000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 118, [
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://118.frontend.example.com'],
+        ]),
+        'fqdn' => 'https://118.frontend.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $parsedCompose = applicationParser($this->application->fresh(), 118, $preview->id);
+    $labels = collect(data_get($parsedCompose, 'services.frontend-pr-118.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=4000')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 4000}}')))
+        ->toBeTrue();
+});
+
+it('shows a port warning when a preview domain uses a port that is not exposed or used by the application', function () {
+    $preview = createPreviewForPortTests($this->application, 119);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 9090)
+        ->assertSee('Use a different port?')
+        ->assertSee('9090');
+
+    expect($preview->fresh()->fqdn)->toBeNull();
+});
+
+it('does not warn when a preview domain port is listed in ports exposes', function () {
+    $preview = createPreviewForPortTests($this->application, 120);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
+it('does not warn when a preview domain port is already used by an application domain', function () {
+    $this->application->update([
+        'ports_exposes' => '3000',
+        'fqdn' => 'https://app.example.com:9090',
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 121);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
+it('saves an unrecognized preview domain port after confirming the warning', function () {
+    $preview = createPreviewForPortTests($this->application, 122);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 9090]);
+});
+
+it('cancels an unrecognized preview domain port without saving', function () {
+    $preview = createPreviewForPortTests($this->application, 123);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('cancelUseUnknownPort')
+        ->assertSet('showPortWarningModal', false);
+
+    expect($preview->fresh()->fqdn)->toBeNull();
+});
+
+it('warns when editing a preview domain to an unrecognized port', function () {
+    $preview = createPreviewForPortTests($this->application, 124, [
+        'fqdn' => 'https://preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '5555')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 5555);
+
+    expect($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 3000]);
+});
+
+it('does not warn when re-saving a preview domain with the same custom port', function () {
+    $preview = createPreviewForPortTests($this->application, 125, [
+        'fqdn' => 'https://preview.example.com:9090',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '9090')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
diff --git a/tests/Feature/PreviewStatusSummaryTest.php b/tests/Feature/PreviewStatusSummaryTest.php
index 6c17135618..a31fd836df 100644
--- a/tests/Feature/PreviewStatusSummaryTest.php
+++ b/tests/Feature/PreviewStatusSummaryTest.php
@@ -19,6 +19,16 @@ it('aggregates preview container and health check status', function () {
         ->toContain('w-[min(16rem,calc(100vw-1.5rem))]!');
 });
 
+it('shows degraded aggregate service status as a warning', function () {
+    $html = Blade::render('<x-status-summary status="degraded:unhealthy" title="Service status" container-name="Containers" />');
+    $summaryButton = str($html)->between('<button', '</button>')->toString();
+
+    expect($summaryButton)
+        ->toContain('Degraded')
+        ->toContain('bg-warning')
+        ->not->toContain('bg-error');
+});
+
 it('uses the aggregated preview status in the previews list', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
 
@@ -42,7 +52,7 @@ it('uses the aggregated status badge for databases and services', function () {
     expect($databaseStatus)
         ->toContain('<x-status-summary :status="$database->status" title="Database status" />')
         ->and($serviceStatus)
-        ->toContain('<x-status-summary :status="$service->status" title="Service status" container-name="Containers" />');
+        ->toContain('<x-status-summary :status="$displayStatus" :title="$selectedResource ? \'Resource status\' : \'Service status\'"');
 });
 
 it('groups preview deployment actions in a dropdown', function () {
@@ -77,3 +87,22 @@ it('places links and logs dropdowns beside preview actions', function () {
         ->toContain('title="Preview logs"')
         ->toContain('title="Preview actions"');
 });
+
+it('uses the shared domain list treatment for preview domains', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
+    $domainsView = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+
+    expect($view)
+        ->toContain('<livewire:project.application.preview-domains')
+        ->and($domainsView)
+        ->toContain('Recheck DNS')
+        ->toContain('Add domain')
+        ->toContain('data-table-header')
+        ->toContain('domains-table-grid-service')
+        ->toContain('class="env-table-item"')
+        ->toContain('No domains configured')
+        ->toContain('class="data-table-row')
+        ->toContain('DNS OK')
+        ->toContain('Edit domain')
+        ->toContain('Remove domain');
+});
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index cf313882f4..68ced553d5 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -2,6 +2,8 @@
 
 use App\Livewire\Profile\Index;
 use App\Models\InstanceSettings;
+use App\Models\S3Storage;
+use App\Models\Team;
 use App\Models\User;
 use App\Services\AvatarStorageService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -73,6 +75,71 @@ it('serves the authenticated users profile picture', function () {
         ->assertHeader('content-type', 'image/jpeg');
 });
 
+it('loads an S3 profile picture from the configured CDN', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe("https://avatars.example.com/media/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+});
+
+it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
+    config()->set('constants.coolify.avatar_cdn_url');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe("https://s3.example.com/avatars/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+});
+
+it('does not use an unrelated S3 storage URL for a profile picture', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
+    $storage = S3Storage::query()->create([
+        'team_id' => Team::factory()->create()->id,
+        'name' => 'Unrelated storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://unrelated.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe(route('profile.avatar', ['v' => $user->updated_at->timestamp]));
+});
+
 it('removes the current profile picture', function () {
     Storage::fake('images');
     $user = User::factory()->create([
@@ -120,7 +187,7 @@ it('automatically uploads a selected profile picture and keeps the current avata
         ->not->toContain('Upload picture')
         ->not->toContain('type="file" x-on:change')
         ->and($menu)
-        ->toContain("route('profile.avatar',");
+        ->toContain('profile_avatar_url($user)');
 });
 
 it('offers runtime local or existing S3 profile picture storage', function () {
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index b5b6ed0887..fc03c9f30e 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -6,6 +6,7 @@ use App\Livewire\Project\Index;
 use App\Livewire\SharedVariables\Project\Index as SharedVariablesProjectIndex;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -102,6 +103,76 @@ it('exposes the icon URL on the projects index', function () {
         ]));
 });
 
+it('loads an S3 project icon from the configured CDN', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    Livewire::test(Index::class)
+        ->assertViewHas('projectsJs', fn (array $projects): bool => $projects[0]['iconUrl'] === "https://avatars.example.com/media/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+});
+
+it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
+    config()->set('constants.coolify.avatar_cdn_url');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    expect(project_icon_url($this->project))->toBe("https://s3.example.com/avatars/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+});
+
+it('does not use an unusable S3 storage URL for a project icon', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Unusable storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://unusable.example.com',
+        'is_usable' => false,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    expect(project_icon_url($this->project))->toBe(route('project.icon', [
+        'project_uuid' => $this->project->uuid,
+        'v' => $this->project->updated_at->timestamp,
+    ]));
+});
+
 it('displays the project icon on the dashboard', function () {
     $this->project->forceFill([
         'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
diff --git a/tests/Feature/RegistrationRateLimitTest.php b/tests/Feature/RegistrationRateLimitTest.php
index 7130ed36e6..3f7c4920db 100644
--- a/tests/Feature/RegistrationRateLimitTest.php
+++ b/tests/Feature/RegistrationRateLimitTest.php
@@ -1,13 +1,17 @@
 <?php
 
+use App\Jobs\SendVerificationEmailJob;
 use App\Models\InstanceSettings;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\RateLimiter;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+
     InstanceSettings::query()->forceCreate([
         'id' => 0,
         'is_registration_enabled' => true,
@@ -72,6 +76,43 @@ it('rate limits dotted plus-address variants of the same email identity across i
         ->assertTooManyRequests();
 });
 
+it('keeps clients behind the same reverse proxy in separate ip rate limit buckets', function () {
+    foreach (range(1, 3) as $attempt) {
+        $this->withServerVariables(['REMOTE_ADDR' => '172.18.0.2'])
+            ->withHeaders(['X-Forwarded-For' => '203.0.113.50'])
+            ->post('/register', [
+                'name' => "Proxied User {$attempt}",
+                'email' => "proxied{$attempt}@example.com",
+                'password' => 'Password1!@',
+                'password_confirmation' => 'Password1!@',
+            ])
+            ->assertRedirect();
+
+        auth()->logout();
+        $this->flushSession();
+    }
+
+    $this->withServerVariables(['REMOTE_ADDR' => '172.18.0.2'])
+        ->withHeaders(['X-Forwarded-For' => '203.0.113.50'])
+        ->post('/register', [
+            'name' => 'Blocked User',
+            'email' => 'blocked-proxied@example.com',
+            'password' => 'Password1!@',
+            'password_confirmation' => 'Password1!@',
+        ])
+        ->assertTooManyRequests();
+
+    $this->withServerVariables(['REMOTE_ADDR' => '172.18.0.2'])
+        ->withHeaders(['X-Forwarded-For' => '203.0.113.51'])
+        ->post('/register', [
+            'name' => 'Other Client',
+            'email' => 'other-proxied@example.com',
+            'password' => 'Password1!@',
+            'password_confirmation' => 'Password1!@',
+        ])
+        ->assertRedirect();
+});
+
 it('keeps distinct dotted and plus-addressed mailboxes in separate rate limit buckets on ordinary domains', function () {
     $registrationIpKey = 'registration:ip:'.sha1('127.0.0.1');
     $emails = [
@@ -95,3 +136,24 @@ it('keeps distinct dotted and plus-addressed mailboxes in separate rate limit bu
         RateLimiter::clear($registrationIpKey);
     }
 });
+
+it('queues the verification email for cloud registrations', function () {
+    config()->set('constants.coolify.self_hosted', false);
+    Queue::fake();
+
+    $this->withHeader('CF-Connecting-IP', '2001:db8::30')
+        ->post('/register', [
+            'name' => 'Cloud User',
+            'email' => 'cloud-user@example.com',
+            'password' => 'Password1!@',
+            'password_confirmation' => 'Password1!@',
+        ])
+        ->assertRedirect();
+
+    $user = User::query()->where('email', 'cloud-user@example.com')->firstOrFail();
+
+    Queue::assertPushed(
+        SendVerificationEmailJob::class,
+        fn (SendVerificationEmailJob $job) => $job->user->is($user)
+    );
+});
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 6404092e77..278f50f2ee 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -251,6 +251,25 @@ it('promotes the primary application action in the desktop split control', funct
         ->not->toContain('Force deploy without cache');
 });
 
+it('shows stop in application action menus when the application is exited', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $desktopExitedActions = str($heading)
+        ->after("@if (str(\$application->status)->startsWith('exited'))")
+        ->before('@else')
+        ->toString();
+
+    $mobileActions = str($heading)
+        ->after('id="application-mobile-actions"')
+        ->before('<div class="hidden" aria-hidden="true">')
+        ->toString();
+
+    expect($mobileActions)->toContain('application-mobile-stop-trigger')
+        ->and($desktopExitedActions)->toContain('application-mobile-stop-trigger')
+        ->and($mobileActions)->toContain('Deploy (without cache)')
+        ->and(strrpos($mobileActions, 'Deploy (without cache)'))
+        ->toBeLessThan(strrpos($mobileActions, 'application-mobile-stop-trigger'));
+});
+
 it('places the state-aware no-cache action immediately after deploy or redeploy', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $actions = str($heading)->after('id="application-desktop-actions"')->before('@endteleport')->toString();
diff --git a/tests/Feature/ResourceIndexDescriptionSubtitleTest.php b/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
index ab570b7f34..eec80be0a2 100644
--- a/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
+++ b/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
@@ -9,3 +9,12 @@ test('resource table subtitle shows description only and never falls back to uui
         ->not->toContain('item.description || item.fqdn || item.uuid')
         ->not->toContain('item.fqdn || item.uuid');
 });
+
+test('resource grid does not show a placeholder when a domain is missing', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/resource/index.blade.php'));
+    $gridView = explode('x-show="viewMode === \'grid\'"', $view, 2)[1];
+
+    expect($gridView)
+        ->not->toContain('x-show="!item.fqdn"')
+        ->not->toContain('>-</span>');
+});
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index 49d5926892..ef2d80e648 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -58,3 +58,15 @@ it('does not schedule Stripe subscription reconciliation automatically', functio
 
     expect($event)->toBeNull();
 });
+
+it('schedules stuck resource cleanup once per day on one server', function () {
+    $schedule = app(Schedule::class);
+
+    $event = collect($schedule->events())->first(
+        fn ($event) => str_contains($event->command, 'cleanup:stucked-resources')
+    );
+
+    expect($event)->not->toBeNull()
+        ->and($event->expression)->toBe('0 0 * * *')
+        ->and($event->onOneServer)->toBeTrue();
+});
diff --git a/tests/Feature/Security/PrivateKeyDropdownTest.php b/tests/Feature/Security/PrivateKeyDropdownTest.php
index 5724af568e..ba32faf21d 100644
--- a/tests/Feature/Security/PrivateKeyDropdownTest.php
+++ b/tests/Feature/Security/PrivateKeyDropdownTest.php
@@ -70,8 +70,8 @@ test('saving a private key from its modal editor closes the modal', function ()
         'modalMode' => true,
     ])->set('name', 'Updated SSH key')
         ->call('changePrivateKey')
-        ->assertDispatched('securityResourceChanged')
-        ->assertDispatched('close-modal');
+        ->assertDispatched('privateKeyUpdated')
+        ->assertNoRedirect();
 
     expect($privateKey->fresh()->name)->toBe('Updated SSH key');
 });
diff --git a/tests/Feature/SecurityResourceModalEditorsTest.php b/tests/Feature/SecurityResourceModalEditorsTest.php
index b2cb0a5883..06d07a1676 100644
--- a/tests/Feature/SecurityResourceModalEditorsTest.php
+++ b/tests/Feature/SecurityResourceModalEditorsTest.php
@@ -1,11 +1,15 @@
 <?php
 
 use App\Livewire\Security\CloudInitScript\Show as CloudInitScriptShow;
+use App\Livewire\Security\PrivateKey\Index as PrivateKeyIndex;
+use App\Livewire\Security\PrivateKey\Show as PrivateKeyShow;
 use App\Models\CloudInitScript;
 use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
 
@@ -22,6 +26,7 @@ beforeEach(function () {
     $this->actingAs($user);
     session(['currentTeam' => $team]);
     $this->team = $team;
+    Storage::fake('ssh-keys');
 });
 
 it('opens security resources in modal editors and keeps create actions in card headers', function () {
@@ -40,12 +45,24 @@ it('opens security resources in modal editors and keeps create actions in card h
             ->toContain('<x-modal-input title="Edit')
             ->toContain('<x-reicon name="settings"')
             ->toContain(':contentClicks="false"')
-            ->toContain('@click="modalOpen=true"')
-            ->not->toContain('wire:click="openEditor(')
             ->not->toContain('href="{{ route(\'security.');
     }
 
-    expect(file_get_contents($views[0]))->toContain('>Private key</div>', '>Status</div>');
+    expect(file_get_contents($views[0]))
+        ->toContain('>Private key</div>', '>Status</div>')
+        ->toContain('wire:click="openEditor(\'{{ $key->uuid }}\')"')
+        ->toContain("\$dispatch('open-private-key-editor', { name:")
+        ->toContain('$refs.loadingPrivateKeyName.value = $event.detail.name')
+        ->toContain('wire:loading.flex wire:target="openEditor"')
+        ->toContain('aria-label="Loading private key editor"')
+        ->toContain('class="w-full flex-col gap-4"')
+        ->toContain('<x-forms.input label="Public key" loading')
+        ->toContain('<x-forms.input loading :allowToPeak="false" />')
+        ->toContain('<x-forms.input label="Name" required x-ref="loadingPrivateKeyName" />')
+        ->toContain('<x-forms.input label="Description" x-ref="loadingPrivateKeyDescription" />')
+        ->not->toContain('class="flex flex-col gap-1.5 lg:col-span-2"')
+        ->not->toContain('animate-pulse')
+        ->and(substr_count(file_get_contents($views[0]), '<livewire:security.private-key.show'))->toBe(1);
     expect(file_get_contents($views[1]))->toContain('>Token</div>', '>Provider</div>');
     expect(file_get_contents($views[2]))->toContain('>Script</div>', '>Last updated</div>');
 
@@ -82,3 +99,71 @@ it('deletes a cloud-init script from its modal editor without redirecting to a d
 
     $this->assertModelMissing($script);
 });
+
+it('keeps the remaining private key editor populated after deleting multiple keys', function () {
+    $privateKeys = collect(range(1, 3))->map(fn (int $index) => PrivateKey::factory()->create([
+        'name' => "private-key-regression-marker-{$index}",
+        'team_id' => $this->team->id,
+        'private_key' => PrivateKey::generateNewKeyPair('ed25519')['private_key'],
+    ]));
+    $index = Livewire::test(PrivateKeyIndex::class);
+
+    foreach ($privateKeys->take(2) as $privateKey) {
+        Livewire::test(PrivateKeyShow::class, [
+            'private_key_uuid' => $privateKey->uuid,
+            'modalMode' => true,
+        ])->call('delete')
+            ->assertDispatched('privateKeyDeleted')
+            ->assertNoRedirect();
+    }
+
+    $remainingPrivateKey = $privateKeys->last();
+
+    $index->dispatch('securityResourceChanged')
+        ->assertDontSee($privateKeys->get(0)->name)
+        ->assertDontSee($privateKeys->get(1)->name)
+        ->assertSee($remainingPrivateKey->name);
+
+    Livewire::test(PrivateKeyShow::class, [
+        'private_key_uuid' => $remainingPrivateKey->uuid,
+        'modalMode' => true,
+    ])->assertSet('name', $remainingPrivateKey->name)
+        ->assertSee($remainingPrivateKey->name);
+});
+
+it('loads only the selected private key editor and refreshes mutations without navigation', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->call('openEditor', $privateKey->uuid)
+        ->assertSet('selectedPrivateKeyUuid', $privateKey->uuid)
+        ->dispatch('modalClosed')
+        ->assertSet('selectedPrivateKeyUuid', null)
+        ->dispatch('privateKeyCreated', keyId: $privateKey->id)
+        ->assertNoRedirect();
+});
+
+it('loads the public key with the editor instead of making a follow-up request', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    Livewire::test(PrivateKeyShow::class, [
+        'private_key_uuid' => $privateKey->uuid,
+        'modalMode' => true,
+    ])->assertSet('public_key', $privateKey->getPublicKey());
+
+    expect(file_get_contents(resource_path('views/livewire/security/private-key/show.blade.php')))
+        ->not->toContain('x-init="$wire.loadPublicKey()"');
+});
+
+it('shows deletion progress in the underlying private key editor', function () {
+    $view = file_get_contents(resource_path('views/livewire/security/private-key/show.blade.php'));
+
+    expect($view)
+        ->toContain('wire:loading.class="pointer-events-none opacity-50" wire:target="delete"')
+        ->toContain('wire:loading.flex wire:target="delete"')
+        ->toContain('<x-loading text="Deleting private key..." />');
+});
diff --git a/tests/Feature/SentinelPushDeduplicationTest.php b/tests/Feature/SentinelPushDeduplicationTest.php
index aef1b74849..bc6f2d260e 100644
--- a/tests/Feature/SentinelPushDeduplicationTest.php
+++ b/tests/Feature/SentinelPushDeduplicationTest.php
@@ -147,6 +147,16 @@ it('dispatches the job when container state changes', function () use ($running)
     Queue::assertPushed(PushServerUpdateJob::class, 2);
 });
 
+it('dispatches the job when only the container restart count changes', function () {
+    $beforeRestart = [['name' => 'app-1', 'state' => 'running', 'restart_count' => 0]];
+    $afterRestart = [['name' => 'app-1', 'state' => 'running', 'restart_count' => 1]];
+
+    pushSentinel($this->token, sentinelPayload($beforeRestart))->assertOk();
+    pushSentinel($this->token, sentinelPayload($afterRestart))->assertOk();
+
+    Queue::assertPushed(PushServerUpdateJob::class, 2);
+});
+
 it('ignores health status changes while container lifecycle state is unchanged', function () {
     $healthy = [['name' => 'app-1', 'state' => 'running', 'health_status' => 'healthy']];
     $unhealthy = [['name' => 'app-1', 'state' => 'running', 'health_status' => 'unhealthy']];
diff --git a/tests/Feature/ServerConnectionCheckIsolationTest.php b/tests/Feature/ServerConnectionCheckIsolationTest.php
index d098c39b55..895304c7d1 100644
--- a/tests/Feature/ServerConnectionCheckIsolationTest.php
+++ b/tests/Feature/ServerConnectionCheckIsolationTest.php
@@ -78,3 +78,21 @@ it('does not call cloud provider APIs during an SSH connection check', function
 
     Http::assertNothingSent();
 });
+
+it('resets unreachable_count after a successful connection check', function () {
+    $server = createServerForConnectionIsolationTest(['ip' => '203.0.113.10']);
+    // unreachable_count is not mass-assignable, so it must be set directly.
+    $server->unreachable_count = 5;
+    $server->save();
+
+    Process::fake([
+        '*' => Process::result(
+            output: '{"Server":{"Version":"27.0.0"}}',
+            exitCode: 0,
+        ),
+    ]);
+
+    (new ServerConnectionCheckJob($server->fresh(), disableMux: false))->handle();
+
+    expect($server->fresh()->unreachable_count)->toBe(0);
+});
diff --git a/tests/Feature/Service/EditDomainPortValidationTest.php b/tests/Feature/Service/EditDomainPortValidationTest.php
index c86fdca4db..0d569574ff 100644
--- a/tests/Feature/Service/EditDomainPortValidationTest.php
+++ b/tests/Feature/Service/EditDomainPortValidationTest.php
@@ -2,7 +2,9 @@
 
 use App\Livewire\Project\Service\Domains;
 use App\Livewire\Project\Service\EditDomain;
+use App\Livewire\Project\Service\Index;
 use App\Models\Environment;
+use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
@@ -10,14 +12,21 @@ use App\Models\ServiceApplication;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
 
+uses(RefreshDatabase::class);
+
 beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
     // Create user and team
     $this->user = User::factory()->create();
     $this->team = Team::factory()->create();
     $this->user->teams()->attach($this->team, ['role' => 'owner']);
     $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
 
     // Create server
     $this->server = Server::factory()->create([
@@ -25,9 +34,7 @@ beforeEach(function () {
     ]);
 
     // Create standalone docker destination
-    $this->destination = StandaloneDocker::factory()->create([
-        'server_id' => $this->server->id,
-    ]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
 
     // Create project and environment
     $this->project = Project::factory()->create([
@@ -48,8 +55,10 @@ beforeEach(function () {
     ]);
 
     // Create service application
-    $this->serviceApplication = ServiceApplication::factory()->create([
+    $this->serviceApplication = ServiceApplication::create([
         'service_id' => $this->service->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
         'fqdn' => 'http://example.com:8000',
     ]);
 
@@ -68,6 +77,42 @@ beforeEach(function () {
     }
 });
 
+it('loads a persisted port override in the service application editor', function () {
+    $this->serviceApplication->update([
+        'fqdn' => 'https://web.example.com',
+        'domain_port_overrides' => [
+            'https://web.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication->fresh(),
+        'parameters' => [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'service_uuid' => $this->service->uuid,
+            'stack_service_uuid' => $this->serviceApplication->uuid,
+        ],
+        'query' => [],
+    ])
+        ->assertSet('fqdn', 'https://web.example.com:8080')
+        ->assertOk();
+});
+
+it('initializes route state when mounting a service application directly', function () {
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication,
+    ])
+        ->assertSet('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'service_uuid' => $this->service->uuid,
+            'stack_service_uuid' => $this->serviceApplication->uuid,
+        ])
+        ->assertSet('query', [])
+        ->assertOk();
+});
+
 it('loads the EditDomain component with required port', function () {
     Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
         ->assertSet('requiredPort', 8000)
@@ -75,6 +120,28 @@ it('loads the EditDomain component with required port', function () {
         ->assertOk();
 });
 
+it('loads a persisted port override and moves it when the hostname changes', function () {
+    $this->serviceApplication->update([
+        'fqdn' => 'https://old.example.com',
+        'domain_port_overrides' => [
+            'https://old.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->assertSet('fqdn', 'https://old.example.com:8080')
+        ->set('fqdn', 'https://new.example.com:8080')
+        ->call('submit')
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('fqdn', 'https://new.example.com:8080');
+
+    expect($this->serviceApplication->fresh())
+        ->fqdn->toBe('https://new.example.com')
+        ->domain_port_overrides->toBe([
+            'https://new.example.com' => 8080,
+        ]);
+});
+
 it('marks noindex changes as pending configuration', function () {
     $this->service->isConfigurationChanged(save: true);
 
@@ -107,7 +174,7 @@ it('allows port removal when user confirms', function () {
 });
 
 it('cancels port removal when user cancels', function () {
-    $originalFqdn = $this->serviceApplication->fqdn;
+    $originalFqdn = $this->serviceApplication->url;
 
     Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
         ->set('fqdn', 'http://example.com') // Remove port
@@ -126,7 +193,10 @@ it('allows saving when port is changed to different port', function () {
 
     // Verify the FQDN was updated
     $this->serviceApplication->refresh();
-    expect($this->serviceApplication->fqdn)->toBe('http://example.com:3000');
+    expect($this->serviceApplication->fqdn)->toBe('http://example.com')
+        ->and($this->serviceApplication->domain_port_overrides)->toBe([
+            'http://example.com' => 3000,
+        ]);
 });
 
 it('allows saving when all domains have ports (multiple domains)', function () {
@@ -153,8 +223,10 @@ it('does not show warning for services without required port', function () {
         'environment_id' => $this->environment->id,
     ]);
 
-    $appWithoutPort = ServiceApplication::factory()->create([
+    $appWithoutPort = ServiceApplication::create([
         'service_id' => $serviceWithoutPort->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
         'fqdn' => 'http://example.com',
     ]);
 
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index c8dd33a46b..d6c687fbc5 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -20,6 +20,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     Queue::fake();
+    config()->set('app.maintenance.store', 'array');
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
 
     $this->team = Team::factory()->create();
@@ -173,6 +174,23 @@ describe('GET /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         $response->assertStatus(200);
         $response->assertJsonFragment(['uuid' => $ctx->serviceApplication->uuid, 'name' => 'web']);
     });
+
+    test('returns an editable url with persisted port overrides', function () {
+        $ctx = createServiceWithApplicationForApiTest($this);
+        $ctx->serviceApplication->update([
+            'fqdn' => 'https://web.example.com',
+            'domain_port_overrides' => [
+                'https://web.example.com' => 8080,
+            ],
+        ]);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
+            ->assertSuccessful()
+            ->assertJsonPath('url', 'https://web.example.com:8080')
+            ->assertJsonMissingPath('domain_port_overrides');
+    });
 });
 
 describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
@@ -199,6 +217,34 @@ describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         expect($ctx->serviceApplication->human_name)->toBe('Web UI');
     });
 
+    test('round trips and moves a port override when renaming a domain', function () {
+        $ctx = createServiceWithApplicationForApiTest($this);
+        $ctx->serviceApplication->update([
+            'fqdn' => 'https://old.example.com',
+            'domain_port_overrides' => [
+                'https://old.example.com' => 8080,
+            ],
+        ]);
+
+        $url = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
+            ->json('url');
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'url' => str_replace('old.example.com', 'new.example.com', $url),
+        ])->assertSuccessful()
+            ->assertJsonPath('url', 'https://new.example.com:8080');
+
+        expect($ctx->serviceApplication->fresh())
+            ->fqdn->toBe('https://new.example.com')
+            ->domain_port_overrides->toBe([
+                'https://new.example.com' => 8080,
+            ]);
+    });
+
     test('updates the HTTP to HTTPS redirect setting', function () {
         config(['app.maintenance.driver' => 'file']);
         $ctx = createServiceWithApplicationForApiTest($this);
@@ -225,6 +271,19 @@ describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         $response->assertStatus(422);
     });
 
+    test('returns 422 for a url port outside the valid TCP range', function (string $url) {
+        $ctx = createServiceWithApplicationForApiTest($this);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'url' => $url,
+        ])->assertUnprocessable();
+    })->with([
+        'zero' => 'https://example.com:0',
+        'above maximum' => 'https://example.com:65536',
+    ]);
+
     test('returns 422 when enabling log drain but server has no log drain', function () {
         $ctx = createServiceWithApplicationForApiTest($this);
 
diff --git a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
index f2b5758dbb..bdb7b77a1b 100644
--- a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
+++ b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use App\Livewire\Project\Service\DatabaseBackups;
+
 it('moves service and database page navigation into their sidebars', function () {
     $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
     $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
@@ -58,7 +60,7 @@ it('groups database and service navigation by user workflow', function () {
         expect($serviceSidebar)
             ->toContain("'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage']")
             ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal']")
-            ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups']")
+            ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup']")
             ->toContain("'Operations' => ['Resource Operations', 'Tags', 'Danger Zone']");
     }
 });
@@ -110,7 +112,7 @@ it('combines service database and storage backups in one section', function () {
         ->toContain('class="data-table w-full overflow-x-auto"')
         ->toContain('backup-table-grid service-backup-table-grid')
         ->not->toContain('<span class="text-right">Executions</span>')
-        ->toContain('class="data-table-row backup-table-grid text-[13px]')
+        ->toMatch('/class="(?=[^"]*\\bdata-table-row\\b)(?=[^"]*\\bbackup-table-grid\\b)(?=[^"]*text-\\[13px\\])[^\"]*"/')
         ->toContain('class="listbox-option justify-start! gap-2.5!"')
         ->toContain('x-data="{ dropdownOpen: false }"')
         ->toContain('class="listbox-panel left-0! right-auto! z-[90]! w-52! min-w-52! sm:left-auto! sm:right-0!"')
@@ -119,15 +121,147 @@ it('combines service database and storage backups in one section', function () {
     expect($styles)->toContain('.service-backup-table-grid');
 });
 
-it('links compose database backups to the unified service backups page', function () {
+it('keeps backup navigation out of compose database settings', function () {
     $sidebar = file_get_contents(resource_path('views/components/service-database/sidebar.blade.php'));
 
     expect($sidebar)
-        ->toContain("'route' => 'project.service.volume-backups.index'")
-        ->toContain("'parameters' => \$serviceParameters")
+        ->not->toContain("'label' => 'Backups'")
+        ->not->toContain("'label' => 'Import Backup'")
         ->not->toContain("'route' => 'project.service.database.backups'");
 });
 
+it('links service backup details back to the unified service backups page', function () {
+    $sidebar = file_get_contents(resource_path('views/components/backup-sidebar.blade.php'));
+
+    expect($sidebar)->toContain("'back' => 'project.service.volume-backups.index'");
+});
+
+it('declares the database backup mount return type', function () {
+    $returnType = (new ReflectionMethod(DatabaseBackups::class, 'mount'))->getReturnType();
+
+    expect($returnType)->not->toBeNull()
+        ->and($returnType->getName())->toBe('mixed');
+});
+
+it('keeps service navigation visible on backup detail pages and uses section tabs', function () {
+    $databaseBackup = file_get_contents(resource_path('views/livewire/project/service/database-backups.blade.php'));
+    $storageBackup = file_get_contents(resource_path('views/livewire/project/service/volume-backup/show.blade.php'));
+
+    foreach ([$databaseBackup, $storageBackup] as $view) {
+        expect($view)
+            ->toContain('<x-service.configuration-sidebar :service="$service"')
+            ->toContain('<x-backup-tabs')
+            ->not->toContain('<x-backup-sidebar');
+    }
+
+    expect($databaseBackup)->toContain('context="service"')
+        ->and($storageBackup)->toContain('context="service-volume"');
+});
+
+it('opens service backup schedules in place without navigating', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)
+        ->toContain('wire:click="openSchedule(')
+        ->toContain('wireOpen="scheduleModalOpen"')
+        ->toContain('<x-backup-tabs')
+        ->not->toContain("route('project.service.backups.schedule.show'");
+});
+
+it('shows service backup executions below schedules without a separate view tab', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+    $executions = file_get_contents(resource_path('views/livewire/project/service/backup-executions.blade.php'));
+
+    expect($index)
+        ->toContain('<livewire:project.service.backup-executions :service="$service"')
+        ->not->toContain('aria-label="Backup views"')
+        ->not->toContain("route('project.service.backups.executions'");
+
+    expect($executions)
+        ->toContain('title="Executions"')
+        ->toContain('flush>');
+});
+
+it('wraps backup modal tabs and shows schedule loading feedback', function () {
+    $tabs = file_get_contents(resource_path('views/components/backup-tabs.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($tabs)
+        ->toContain('flex-wrap')
+        ->not->toContain('overflow-x-auto');
+
+    expect($index)
+        ->toContain('<x-table.loading target="openSchedule" text="Loading schedule..."')
+        ->not->toContain('Loading schedule\n');
+});
+
+it('loads every backup editor section when the modal opens and switches tabs locally', function () {
+    $tabs = file_get_contents(resource_path('views/components/backup-tabs.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)
+        ->toContain("x-data=\"{ activeSection: 'general' }\"")
+        ->toContain("@foreach (['general', 's3', 'retention', 'danger'] as \$modalSection)")
+        ->toContain("x-show=\"activeSection === '{{ \$modalSection }}'\"");
+
+    expect($tabs)
+        ->toContain("@click=\"activeSection = '{{ \$item['key'] }}'\"")
+        ->not->toContain('wire:click="selectScheduleSection');
+});
+
+it('adds a back up now action to every service backup schedule row', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+    $styles = file_get_contents(resource_path('css/app.css'));
+
+    expect($index)
+        ->toContain('<span class="text-right">Actions</span>')
+        ->toContain('<div class="min-w-[59rem]">')
+        ->toContain("wire:click.stop=\"backupNow('database',")
+        ->toContain("wire:click.stop=\"backupNow('storage',")
+        ->toContain('<x-forms.button')
+        ->toContain('Back up now</x-forms.button>')
+        ->not->toContain('class="icon-button shrink-0"')
+        ->not->toContain('class="contents cursor-pointer"');
+
+    expect($styles)
+        ->toContain('.service-backup-table-grid')
+        ->toContain('width: 100%;')
+        ->toContain('.data-table-row.service-backup-table-grid {')
+        ->not->toContain('.data-table-header.service-backup-table-grid > :last-child')
+        ->not->toContain('.data-table-row.service-backup-table-grid > :last-child');
+});
+
+it('refreshes backup executions from backup broadcasts on the current team channel', function () {
+    $serviceExecutions = file_get_contents(app_path('Livewire/Project/Service/BackupExecutions.php'));
+    $serviceBackups = file_get_contents(app_path('Livewire/Project/Service/VolumeBackup/Index.php'));
+    $databaseExecutions = file_get_contents(app_path('Livewire/Project/Database/BackupExecutions.php'));
+    $databaseBackupJob = file_get_contents(app_path('Jobs/DatabaseBackupJob.php'));
+
+    expect($serviceExecutions)
+        ->toContain('echo-private:team.{$teamId},BackupCreated')
+        ->toContain("=> '\$refresh'")
+        ->and($serviceBackups)
+        ->toContain('echo-private:team.{$teamId},BackupCreated')
+        ->and($databaseExecutions)
+        ->toContain('$teamId = currentTeam()->id')
+        ->not->toContain('$userId = Auth::id()')
+        ->and(strpos($databaseBackupJob, "'finished_at' => Carbon::now()->toImmutable()"))
+        ->toBeLessThan(strrpos($databaseBackupJob, 'BackupCreated::dispatch($this->team->id)'));
+});
+
+it('offers downloads from the service backup executions list', function () {
+    $component = file_get_contents(app_path('Livewire/Project/Service/BackupExecutions.php'));
+    $view = file_get_contents(resource_path('views/livewire/project/service/backup-executions.blade.php'));
+
+    expect($component)
+        ->toContain("route('download.backup'")
+        ->toContain("route('download.volume-backup'")
+        ->and($view)
+        ->toContain('<span class="text-right">Actions</span>')
+        ->toContain('aria-label="Download backup"')
+        ->toContain('@click.stop');
+});
+
 it('uses a distinct backup icon across resource sidebars', function () {
     $sidebars = [
         resource_path('views/components/application/configuration-sidebar.blade.php'),
diff --git a/tests/Feature/ServiceDomainPortCorruptionTest.php b/tests/Feature/ServiceDomainPortCorruptionTest.php
index 89a4b6bc21..37be302f92 100644
--- a/tests/Feature/ServiceDomainPortCorruptionTest.php
+++ b/tests/Feature/ServiceDomainPortCorruptionTest.php
@@ -63,7 +63,8 @@ YAML;
 
     $serviceApp->refresh();
 
-    expect($serviceApp->fqdn)->toBe('http://git.example.com:80')
+    expect($serviceApp->fqdn)->toBe('http://git.example.com')
+        ->and($serviceApp->domain_port_overrides['http://git.example.com'] ?? null)->toBe(80)
         ->and($serviceApp->fqdn)->not->toContain('//:80')
         ->and(fn () => Url::fromString($serviceApp->fqdn))->not->toThrow(Throwable::class);
 
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 76ca4f2a8a..4f825f8e24 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -92,6 +92,40 @@ beforeEach(function () {
     ]);
 });
 
+it('marks service application port-only changes as pending configuration', function () {
+    $this->webApp->update([
+        'fqdn' => 'http://example.com',
+        'domain_port_overrides' => ['http://example.com' => 8000],
+    ]);
+    $this->service->isConfigurationChanged(save: true);
+
+    $this->webApp->update([
+        'domain_port_overrides' => ['http://example.com' => 3000],
+    ]);
+
+    expect($this->service->refresh()->isConfigurationChanged())->toBeTrue();
+});
+
+it('does not mark reordered service application port overrides as changed', function () {
+    $this->webApp->update([
+        'fqdn' => 'http://one.example.com,http://two.example.com',
+        'domain_port_overrides' => [
+            'http://one.example.com' => 8000,
+            'http://two.example.com' => 3000,
+        ],
+    ]);
+    $this->service->isConfigurationChanged(save: true);
+
+    $this->webApp->update([
+        'domain_port_overrides' => [
+            'http://two.example.com' => 3000,
+            'http://one.example.com' => 8000,
+        ],
+    ]);
+
+    expect($this->service->refresh()->isConfigurationChanged())->toBeFalse();
+});
+
 it('groups configured domains and shows redirect settings in the table', function () {
     $this->apiApp->update([
         'fqdn' => 'https://api.example.com,https://admin.example.com',
@@ -127,6 +161,21 @@ it('groups configured domains and shows redirect settings in the table', functio
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
+it('removes consecutive service domains by stable row identity after indexes change', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://first.example.com,https://second.example.com,https://third.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
+
+    $component
+        ->call('removeDomainByKey', hash('sha256', 'https://first.example.com|'.$this->apiApp->id))
+        ->call('removeDomainByKey', hash('sha256', 'https://second.example.com|'.$this->apiApp->id))
+        ->assertDispatched('success');
+
+    expect($this->apiApp->fresh()->fqdn)->toBe('https://third.example.com');
+});
+
 it('shows and persists the HTTP redirect control for HTTPS service applications', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSee('Redirect HTTP to HTTPS')
@@ -178,6 +227,18 @@ it('resets the add domain dns gate when segmented domain fields change', functio
         ->assertSet('forceSaveDns', false);
 });
 
+it('does not add a single-label hostname as a service domain', function () {
+    $this->apiApp->update(['fqdn' => null]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->apiApp->id)
+        ->set('newDomainParts.host', 'aaa')
+        ->call('addDomain')
+        ->assertDispatched('error');
+
+    expect($this->apiApp->fresh()->fqdn)->toBeNull();
+});
+
 it('shows dns entries control next to Add', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSuccessful()
@@ -429,7 +490,8 @@ it('prunes the previous dns status when a service domain is renamed', function (
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertDispatched('edit-domain-saved')
-        ->assertDispatched('success');
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
 
     $this->apiApp->refresh();
 
@@ -476,6 +538,133 @@ it('does not restore stale dns status when a removed service domain is re-added'
         ->and($this->apiApp->domain_dns_statuses['https://api.example.com']['message'] ?? null)->not->toBe('Stale DNS result.');
 });
 
+it('shows the port warning modal when adding a domain with a non-default port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('requiredPort', 8000)
+        ->assertSee('Use a different port?');
+
+    expect($this->webApp->fresh()->fqdn)->toBeNull();
+});
+
+it('saves a non-default domain port after confirming the warning', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmRemovePort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    $this->webApp->refresh();
+
+    expect($this->webApp->fqdn)->toContain('https://web.example.com')
+        ->and($this->webApp->domain_port_overrides['https://web.example.com'] ?? null)->toBe(3000);
+});
+
+it('clears a service domain port override when saving without a port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  api:
+    image: node:alpine
+    environment:
+      - SERVICE_FQDN_API_3000
+  web:
+    image: nginx:alpine
+YAML,
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertDontSee('Internal port 8080');
+
+    expect($this->apiApp->fresh()->domain_port_overrides ?? [])
+        ->not->toHaveKey('https://api.example.com');
+});
+
+it('reopens service domain edit with the saved port override', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.url', 'https://api.example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'api.example.com');
+});
+
+it('does not show the port warning modal when the domain uses the required port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '8000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
 it('saves after confirming both a domain conflict and a missing required port', function () {
     $this->service->update([
         'docker_compose_raw' => <<<'YAML'
@@ -497,7 +686,10 @@ YAML,
         ->call('confirmDomainUsage')
         ->assertSet('showDomainConflictModal', false)
         ->assertSet('showPortWarningModal', true)
-        ->assertSet('forceSaveDomains', true);
+        ->assertSet('forceSaveDomains', true)
+        ->assertSee('Use a different port?')
+        ->assertSee('Keep required port')
+        ->assertSee('Use this port anyway');
 
     $component
         ->call('confirmRemovePort')
@@ -659,3 +851,65 @@ it('updates search engine indexing from the service domains view', function () {
     expect(file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php')))
         ->not->toContain('<select');
 });
+
+it('keeps noindex domains when normalizing a custom service domain port', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com:8080',
+        'noindex_domains' => ['https://api.example.com:8080'],
+    ]);
+
+    expect($this->apiApp->refresh())
+        ->fqdn->toBe('https://api.example.com')
+        ->noindex_domains->toBe(['https://api.example.com'])
+        ->and($this->apiApp->domain_port_overrides)
+        ->toBe(['https://api.example.com' => 8080]);
+});
+
+it('shows an inherited internal port badge from the coolify service env port', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  api:\n    image: node:alpine\n    environment:\n      - SERVICE_FQDN_API_3000\n",
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 3000')
+        ->assertSee('Inherited from the Coolify service port', false)
+        ->assertDontSee('No internal port');
+});
+
+it('shows a custom internal port badge for a service domain override', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  api:\n    image: node:alpine\n    environment:\n      - SERVICE_FQDN_API_3000\n",
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->assertSee('Internal port 8080')
+        ->assertSee('Custom internal port for this domain', false)
+        ->assertDontSee('Internal port 3000');
+});
+
+it('does not show an internal port badge when the service has no env port', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertDontSee('No internal port')
+        ->assertDontSee('Internal port ')
+        ->assertDontSee('table-badge-danger', false);
+});
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index da730d97dd..9d5ac5a8a8 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -1,11 +1,16 @@
 <?php
 
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
 use App\Livewire\Project\Database\Import as DatabaseImport;
 use App\Livewire\Project\Service\Heading;
+use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -16,6 +21,7 @@ use App\Models\User;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -113,6 +119,14 @@ test('does not open service database backups route from another team', function
     ]));
 })->throws(NotFoundHttpException::class);
 
+test('does not open service import backup route from another team', function () {
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->otherService->uuid,
+    ]))->assertForbidden();
+});
+
 test('does not resolve service database import component from another team', function () {
     $component = app(DatabaseImport::class);
     $component->parameters = [
@@ -141,7 +155,7 @@ test('owner can still hydrate service heading with own service', function () {
         ->assertOk();
 });
 
-test('service database backup schedules use dedicated general retention and executions urls', function () {
+test('legacy service database backup detail urls redirect to unified backup views', function () {
     $backup = ScheduledDatabaseBackup::create([
         'team_id' => $this->teamA->id,
         'frequency' => 'daily',
@@ -156,51 +170,254 @@ test('service database backup schedules use dedicated general retention and exec
         'stack_service_uuid' => $this->ownServiceDatabase->uuid,
     ]);
     $generalUrl = $listUrl.'/'.$backup->uuid;
+    $parameters = [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ];
 
-    $this->get($listUrl)
-        ->assertOk()
-        ->assertSee('href="'.$generalUrl.'"', false);
+    $this->get($generalUrl)->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/s3')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/retention')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/danger')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/executions')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+});
 
-    $this->get($generalUrl)
-        ->assertOk()
-        ->assertSee('Frequency')
-        ->assertDontSee('S3 Enabled')
-        ->assertDontSee('Number of backups to keep')
-        ->assertDontSee('Cleanup Failed Backups')
-        ->assertDontSee('Delete Backups and Schedule');
+test('legacy service database backup list redirects to unified service backups', function () {
+    $legacyUrl = route('project.service.database.backups', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+    $centralBackupsUrl = route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]);
 
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
-        ->assertSee('S3 Storage')
-        ->assertDontSee('S3 Storage Retention')
-        ->assertDontSee('Local Backup Retention')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Cleanup Failed Backups');
+    $this->get($legacyUrl)->assertRedirect($centralBackupsUrl);
+});
 
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
-        ->assertSee('Local Backup Retention')
-        ->assertSee('S3 Storage Retention')
-        ->assertSee('Number of backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Cleanup Failed Backups');
+test('service backup schedules open in place from the unified view', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
 
-    $this->get($generalUrl.'/executions')
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
         ->assertOk()
-        ->assertSee('<h2 class="py-0">Executions</h2>', false)
-        ->assertDontSee('Executions <span', false)
-        ->assertSee('Cleanup Failed Backups')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Number of backups to keep');
+        ->assertSee("wire:click=\"openSchedule('{$backup->uuid}')\"", false);
+});
 
-    $this->get($generalUrl.'/danger')
+test('service database backup schedules open in the Livewire component', function () {
+    Queue::fake();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('openSchedule', $backup->uuid)
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('selectedDatabaseBackup.uuid', $backup->uuid)
+        ->assertSet('selectedVolumeBackup', null);
+});
+
+test('service database backups can be queued from the Livewire component', function () {
+    Queue::fake();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('backupNow', 'database', $backup->uuid)
+        ->assertDispatched('success', 'Backup queued.');
+
+    Queue::assertPushed(DatabaseBackupJob::class, fn (DatabaseBackupJob $job): bool => $job->backup->is($backup));
+});
+
+test('service storage backups can be queued from the Livewire component', function () {
+    Queue::fake();
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('backupNow', 'storage', $backup->uuid)
+        ->assertDispatched('success', 'Backup queued.');
+
+    Queue::assertPushed(VolumeBackupJob::class, fn (VolumeBackupJob $job): bool => $job->backup->is($backup));
+});
+
+test('service backup executions combine database execution history', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'coolify',
+        'size' => 2048,
+        'finished_at' => now(),
+    ]);
+
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
         ->assertOk()
-        ->assertSee('Danger Zone')
-        ->assertSee('Delete Scheduled Backup')
-        ->assertSee('Delete Backups and Schedule')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Number of backups to keep')
-        ->assertDontSee('Cleanup Failed Backups');
+        ->assertSee('own-db')
+        ->assertSee('Success')
+        ->assertSee('2 KB');
+
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))->assertSee("wire:click=\"openExecution('{$execution->uuid}')\"", false);
+});
+
+test('service import backup page selects from compatible databases', function () {
+    $secondDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'analytics-db',
+        'image' => 'mysql:8',
+        'custom_type' => 'mysql',
+    ]);
+    $importUrl = route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]);
+
+    $this->get($importUrl)
+        ->assertOk()
+        ->assertSee('Import Backup')
+        ->assertSee('own-db')
+        ->assertSee('analytics-db');
+
+    $this->get($importUrl.'/'.$secondDatabase->uuid)
+        ->assertOk()
+        ->assertSee('analytics-db')
+        ->assertSee('Start the database first');
+});
+
+test('service import backup redirects when exactly one compatible database exists', function () {
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))->assertRedirectToRoute('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+});
+
+test('service import backup excludes unsupported databases', function () {
+    $unsupportedDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'cache-db',
+        'image' => 'redis:7-alpine',
+        'custom_type' => 'redis',
+    ]);
+
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
+        ->assertRedirectToRoute('project.service.import-backup.database', [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+            'service_uuid' => $this->ownService->uuid,
+            'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+        ]);
+
+    $this->get(route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $unsupportedDatabase->uuid,
+    ]))->assertNotFound();
+});
+
+test('service import backup opens the selected compatible database', function () {
+    $secondDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'analytics-db',
+        'image' => 'mysql:8',
+        'custom_type' => 'mysql',
+    ]);
+
+    $this->get(route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $secondDatabase->uuid,
+    ]))
+        ->assertOk()
+        ->assertSee('analytics-db')
+        ->assertSee('Start the database first');
+});
+
+test('service import backup requires update authorization for the service and selected database', function () {
+    $member = User::factory()->create();
+    $member->teams()->attach($this->teamA, ['role' => 'member']);
+    $this->actingAs($member);
+
+    $parameters = [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ];
+
+    $this->get(route('project.service.import-backup', $parameters))->assertForbidden();
+    $this->get(route('project.service.import-backup.database', [
+        ...$parameters,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]))->assertForbidden();
+});
+
+test('legacy service database import redirects to the service import page with its database selected', function () {
+    $legacyUrl = route('project.service.database.import', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+    $selectedImportUrl = route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+
+    $this->get($legacyUrl)->assertRedirect($selectedImportUrl);
 });
 
 test('service storage backups page includes schedules from all compose databases', function () {
@@ -211,15 +428,15 @@ test('service storage backups page includes schedules from all compose databases
         'custom_type' => 'postgresql',
     ]);
 
-    foreach ([$this->ownServiceDatabase, $secondDatabase] as $database) {
-        ScheduledDatabaseBackup::create([
+    $backups = collect([$this->ownServiceDatabase, $secondDatabase])->map(function (ServiceDatabase $database) {
+        return ScheduledDatabaseBackup::create([
             'team_id' => $this->teamA->id,
             'description' => $database->name.' backup',
             'frequency' => 'daily',
             'database_id' => $database->id,
             'database_type' => $database->getMorphClass(),
         ]);
-    }
+    });
 
     $this->get(route('project.service.volume-backups.index', [
         'project_uuid' => $this->projectA->uuid,
@@ -230,10 +447,6 @@ test('service storage backups page includes schedules from all compose databases
         ->assertSee('>Database</span>', false)
         ->assertSee('own-db')
         ->assertSee('analytics-db')
-        ->assertSee(route('project.service.database.backups', [
-            'project_uuid' => $this->projectA->uuid,
-            'environment_uuid' => $this->environmentA->uuid,
-            'service_uuid' => $this->ownService->uuid,
-            'stack_service_uuid' => $this->ownServiceDatabase->uuid,
-        ]), false);
+        ->assertSee("wire:click=\"openSchedule('{$backups->first()->uuid}')\"", false)
+        ->assertSee("wire:click=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
 });
diff --git a/tests/Feature/ServiceTemplatePortCoverageTest.php b/tests/Feature/ServiceTemplatePortCoverageTest.php
new file mode 100644
index 0000000000..4cf832bea4
--- /dev/null
+++ b/tests/Feature/ServiceTemplatePortCoverageTest.php
@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * One-click templates that expose SERVICE_URL / SERVICE_FQDN without a _PORT
+ * suffix (WordPress-style) must declare `# port:` so getRequiredPort() can
+ * fall back for the badge and proxy.
+ */
+it('requires a template port for HTTP compose services that omit SERVICE_*_PORT', function () {
+    $templates = get_service_templates();
+    $missing = [];
+
+    foreach (glob(base_path('templates/compose/*.{yaml,yml}'), GLOB_BRACE) as $file) {
+        $name = pathinfo($file, PATHINFO_FILENAME);
+        if (! $templates->has($name)) {
+            continue;
+        }
+
+        $text = file_get_contents($file);
+        $declaresHttpUrlWithoutPort = false;
+        foreach (preg_split("/\r\n|\n|\r/", $text) as $line) {
+            $line = trim($line);
+            if (! preg_match('/^- SERVICE_(?:URL|FQDN)_([A-Z0-9_]+)$/', $line, $match)
+                && ! preg_match('/^SERVICE_(?:URL|FQDN)_([A-Z0-9_]+):/', $line, $match)) {
+                continue;
+            }
+            if (! preg_match('/_\d+$/', $match[1])) {
+                $declaresHttpUrlWithoutPort = true;
+                break;
+            }
+        }
+
+        if (! $declaresHttpUrlWithoutPort) {
+            continue;
+        }
+
+        $yamlPort = null;
+        if (preg_match('/^#\s*port:\s*(\d+)/m', $text, $portMatch)) {
+            $yamlPort = $portMatch[1];
+        }
+        $jsonPort = data_get($templates, "{$name}.port");
+
+        if (! $yamlPort || ! filled($jsonPort)) {
+            $missing[] = $name;
+        }
+    }
+
+    expect($missing)->toBeEmpty('HTTP templates without SERVICE_*_PORT need # port: and JSON port: '.implode(', ', $missing));
+});
diff --git a/tests/Feature/ServiceTemplatePortLookupTest.php b/tests/Feature/ServiceTemplatePortLookupTest.php
new file mode 100644
index 0000000000..1e228811dd
--- /dev/null
+++ b/tests/Feature/ServiceTemplatePortLookupTest.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Models\Service;
+use App\Models\ServiceApplication;
+
+it('resolves the wordpress template port from service_type even when the display name differs', function () {
+    expect(data_get(get_service_templates(), 'wordpress-without-database.port'))->toBe('80');
+
+    $service = new Service([
+        'name' => 'api-smoke-wp',
+        'service_type' => 'wordpress-without-database',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  wordpress:
+    image: wordpress:latest
+    environment:
+      - SERVICE_URL_WORDPRESS
+YAML,
+    ]);
+
+    expect($service->getRequiredPort())->toBe(80);
+
+    $app = new ServiceApplication(['name' => 'wordpress']);
+    $app->setRelation('service', $service);
+
+    expect($app->getRequiredPort())->toBe(80);
+});
diff --git a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
index 08ae87821a..affea0c895 100644
--- a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
+++ b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
@@ -36,11 +36,14 @@ it('returns each service template last updated timestamp from the generated bund
         ->toBe(CarbonImmutable::parse($templateTimestamp)->timezone(config('app.timezone'))->format('M j, Y H:i'));
 });
 
-it('uses a valid local icon or the default icon for every service', function () {
+it('returns local, CDN, and default logo fallbacks for every service', function () {
     $services = (new Select)->loadServices()['services'];
 
     expect($services['opnform']['logo'])->toBe(asset('svgs/opnform.svg'))
-        ->and($services['pydio-cells']['logo'])->toBe(asset('svgs/default.webp'));
+        ->and($services['pydio-cells']['logo'])->toBe(asset('svgs/cells.svg'))
+        ->and($services['pydio-cells']['logo_cdn_url'])
+        ->toBe('https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/svgs/cells.svg')
+        ->and($services['pydio-cells']['logo_default_url'])->toBe(asset('svgs/default.webp'));
 });
 
 it('crops wide database wordmarks to their icon artwork', function () {
@@ -127,6 +130,22 @@ it('renders the service templates last updated hint placeholder', function () {
     $view->assertSee('@keydown.escape.stop="closeCategoryFilter(true)"', false);
 });
 
+it('renders the local, CDN, and default service logo fallback chain', function () {
+    View::share('errors', new ViewErrorBag);
+
+    $view = $this->view('livewire.project.new.select', [
+        'current_step' => 'type',
+        'environments' => collect(),
+    ]);
+
+    $view->assertSee('service.logo_cdn_url', false);
+    $view->assertSee('service.logo_default_url', false);
+
+    expect(file_get_contents(resource_path('views/livewire/global-search.blade.php')))
+        ->toContain('item.logo_cdn_url')
+        ->toContain('item.logo_default_url');
+});
+
 it('keeps service template keys for service selection and docs links', function () {
     $services = collect((new Select)->loadServices()['services']);
     $denoKv = $services->firstWhere('id', 'denoKV');
diff --git a/tests/Feature/StableNestedLivewireKeysTest.php b/tests/Feature/StableNestedLivewireKeysTest.php
new file mode 100644
index 0000000000..c9b90bca99
--- /dev/null
+++ b/tests/Feature/StableNestedLivewireKeysTest.php
@@ -0,0 +1,64 @@
+<?php
+
+it('does not key nested Livewire components by mutable list positions', function () {
+    $postgresView = file_get_contents(resource_path('views/livewire/project/database/postgresql/general.blade.php'));
+    $proxyView = file_get_contents(resource_path('views/livewire/server/proxy/dynamic-configurations.blade.php'));
+
+    expect($postgresView)
+        ->toContain(':wire:key="\'init-script-\'.md5($script[\'filename\'])"')
+        ->not->toContain(':wire:key="$script[\'index\']"');
+
+    expect($proxyView)
+        ->toContain('wire:key="proxy-navbar-{{ $fileName }}"')
+        ->not->toContain('wire:key="{{ $fileName }}-{{ $loop->index }}"');
+});
+
+it('saves reindexed PostgreSQL scripts by their original stable identity', function () {
+    $editor = file_get_contents(app_path('Livewire/Project/Database/InitScript.php'));
+    $parent = file_get_contents(app_path('Livewire/Project/Database/Postgresql/General.php'));
+
+    expect($editor)
+        ->toContain('public string $originalFilename;')
+        ->toContain("dispatch('save_init_script', \$this->script, \$this->originalFilename)");
+
+    expect($parent)
+        ->toContain('public function save_init_script($script, string $originalFilename)')
+        ->toContain("firstWhere('filename', \$originalFilename)");
+});
+
+it('keeps editable and refreshed list row keys independent of their positions', function () {
+    $applicationDomains = file_get_contents(resource_path('views/livewire/project/application/partials/domain-row.blade.php'));
+    $serviceDomains = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+    $scheduledJobs = file_get_contents(resource_path('views/livewire/settings/scheduled-jobs.blade.php'));
+
+    expect($applicationDomains)
+        ->not->toContain('wire:key="domain-row-{{ $index }}-')
+        ->toContain('wire:key="domain-row-{{ md5(');
+
+    expect($serviceDomains)
+        ->not->toContain('-{{ $index }}-')
+        ->toContain('wire:key="svc-domain-{{ $row[\'service_application_id\'] ?? \'x\' }}-{{ md5(');
+
+    expect($scheduledJobs)
+        ->not->toContain('wire:key="run-{{ $loop->index }}"')
+        ->not->toContain('wire:key="skip-{{ $loop->index }}"')
+        ->toContain('wire:key="run-{{ md5(serialize($run)) }}"')
+        ->toContain('wire:key="skip-{{ md5(serialize($skip)) }}"');
+});
+
+it('keys nested Livewire status components rendered inside navigation loops', function () {
+    $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
+
+    expect($sidebar)
+        ->toContain(':key="\'application-server-status-\'.$application->uuid"');
+});
+
+it('keys rolling log lines by content occurrence instead of list position', function () {
+    $logs = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+
+    expect($logs)
+        ->toContain('$lineOccurrences = [];')
+        ->toContain('$lineFingerprint = md5($line);')
+        ->toContain('wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}"')
+        ->not->toContain("'line-' . \$index");
+});
diff --git a/tests/Feature/StandardTableComponentsTest.php b/tests/Feature/StandardTableComponentsTest.php
index 9741268bc7..30437c05b5 100644
--- a/tests/Feature/StandardTableComponentsTest.php
+++ b/tests/Feature/StandardTableComponentsTest.php
@@ -3,6 +3,12 @@
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\File;
 
+it('contains wide data tables without overflowing their layout', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)->toContain(".data-table {\n    min-width: 0;\n    max-width: 100%;\n    overflow-x: auto;");
+});
+
 it('renders the standard table toolbar controls', function () {
     $html = Blade::render(<<<'BLADE'
         <x-table.toolbar>
diff --git a/tests/Feature/Team/TeamDeletionTest.php b/tests/Feature/Team/TeamDeletionTest.php
index 1c11d13802..e449a55639 100644
--- a/tests/Feature/Team/TeamDeletionTest.php
+++ b/tests/Feature/Team/TeamDeletionTest.php
@@ -59,6 +59,65 @@ test('the danger zone resource list can be refreshed', function () {
         ->assertSuccessful();
 });
 
+test('unused private keys do not block team deletion', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->teamToDelete->id,
+        'description' => 'Created by Coolify',
+    ]);
+
+    expect($this->teamToDelete->isEmpty())->toBeTrue();
+
+    app(DeleteTeam::class)->handle($this->teamToDelete, $this->owner);
+
+    expect(Team::find($this->teamToDelete->id))->toBeNull()
+        ->and(PrivateKey::find($privateKey->id))->toBeNull();
+});
+
+test('system-wide git sources do not block team deletion', function () {
+    Team::forceCreate([
+        'id' => 0,
+        'name' => 'Root Team',
+        'personal_team' => false,
+    ]);
+
+    $githubApp = GithubApp::forceCreate([
+        'name' => 'System-wide GitHub source',
+        'team_id' => $this->teamToDelete->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+        'is_system_wide' => true,
+    ]);
+    $gitlabApp = GitlabApp::forceCreate([
+        'name' => 'System-wide GitLab source',
+        'team_id' => $this->teamToDelete->id,
+        'api_url' => 'https://gitlab.com/api/v4',
+        'html_url' => 'https://gitlab.com',
+        'is_public' => false,
+        'is_system_wide' => true,
+    ]);
+
+    expect($this->teamToDelete->isEmpty())->toBeTrue();
+
+    app(DeleteTeam::class)->handle($this->teamToDelete, $this->owner);
+
+    expect(Team::find($this->teamToDelete->id))->toBeNull()
+        ->and($githubApp->refresh()->team_id)->toBe(0)
+        ->and($gitlabApp->refresh()->team_id)->toBe(0);
+});
+
+test('the danger zone names and links blocking resource types', function () {
+    Project::factory()->count(2)->create(['team_id' => $this->teamToDelete->id]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(DangerZone::class)
+        ->assertSee('This team still owns:')
+        ->assertSee('2 projects')
+        ->assertSeeHtml('href="'.route('project.index').'"');
+});
+
 test('a team with a running application cannot be deleted', function () {
     $server = Server::factory()->create(['team_id' => $this->teamToDelete->id]);
     $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
diff --git a/tests/Feature/TeamScopedDestinationTest.php b/tests/Feature/TeamScopedDestinationTest.php
index 3088fb4db3..be4ee0e4c8 100644
--- a/tests/Feature/TeamScopedDestinationTest.php
+++ b/tests/Feature/TeamScopedDestinationTest.php
@@ -275,6 +275,23 @@ describe('StandaloneDocker/SwarmDocker ownedByCurrentTeam scope', function () {
 });
 
 describe('Destination/Show team scope', function () {
+    test('deleting a destination redirects without rendering the deleted destination', function () {
+        $destination = SwarmDocker::create([
+            'uuid' => fake()->uuid(),
+            'name' => 'swarm-a-'.fake()->unique()->word(),
+            'network' => 'swarm-a-'.fake()->unique()->word(),
+            'server_id' => $this->serverA->id,
+        ]);
+
+        $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $destination->uuid])
+            ->call('delete')
+            ->assertRedirect(route('destination.index'));
+
+        expect($component->effects)
+            ->toHaveKey('redirectUsingNavigate', true);
+        expect($destination->fresh())->toBeNull();
+    });
+
     test('mount with other team destination UUID redirects to index', function () {
         $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destinationB->uuid]);
 
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
index 9068683f69..3dad5423e5 100644
--- a/tests/Feature/TraefikVersionStateTest.php
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -35,6 +35,126 @@ it('ignores stale minor upgrade information for the detected Traefik version', f
     expect($component->getNewerTraefikBranchAvailableProperty())->toBeNull();
 });
 
+it('does not offer the Traefik branch already configured on a running proxy', function () {
+    Cache::put('coolify:versions:all', [
+        'traefik' => [
+            'v3.7' => '3.7.8',
+            'v3.6' => '3.6.23',
+        ],
+    ]);
+
+    $server = Server::factory()->make([
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->proxySettings = <<<'YAML'
+services:
+  traefik:
+    image: 'traefik:v3.7'
+YAML;
+
+    expect($component->getNewerTraefikBranchAvailableProperty())->toBeNull();
+});
+
+it('still offers a newer Traefik branch than the configured image', function () {
+    Cache::put('coolify:versions:all', [
+        'traefik' => [
+            'v3.7' => '3.7.8',
+            'v3.6' => '3.6.23',
+        ],
+    ]);
+
+    $server = Server::factory()->make([
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->proxySettings = 'services:'.PHP_EOL.'  traefik:'.PHP_EOL.'    image: traefik:v3.6';
+
+    expect($component->getNewerTraefikBranchAvailableProperty())->toBe('v3.7');
+});
+
+it('clears the stale minor warning after the configured branch is applied', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+            'last_saved_proxy_configuration' => <<<'YAML'
+services:
+  traefik:
+    image: traefik:v3.7
+YAML,
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->mount();
+
+    expect($server->refresh()->traefik_outdated_info)->toBeNull();
+});
+
+it('preserves a newer Traefik warning stored after the warning was inspected', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->proxySettings = 'services:'.PHP_EOL.'  traefik:'.PHP_EOL.'    image: traefik:v3.7';
+
+    $newerWarning = [
+        'current' => '3.7.8',
+        'latest' => '3.8.1',
+        'type' => 'minor_upgrade',
+        'upgrade_target' => 'v3.8',
+    ];
+    Server::query()->whereKey($server->id)->update(['traefik_outdated_info' => $newerWarning]);
+
+    $method = new ReflectionMethod($component, 'clearAppliedTraefikBranchWarning');
+    $method->invoke($component);
+
+    expect($server->refresh()->traefik_outdated_info)->toBe($newerWarning);
+});
+
 it('does not mark stale Traefik outdated information as a current warning', function () {
     $server = Server::factory()->make([
         'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index aa7da543be..519b323f6b 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -7,7 +7,8 @@ use App\Jobs\VolumeBackupRecoveryJob;
 use App\Livewire\Project\Application\Backup\Create as CreateScheduledVolumeBackup;
 use App\Livewire\Project\Service\FileStorage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
-use App\Livewire\Project\Shared\Storages\Show;
+use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
+use App\Livewire\Project\Shared\Storages\All;
 use App\Livewire\Project\Shared\Storages\VolumeBackups;
 use App\Models\Application;
 use App\Models\Environment;
@@ -26,6 +27,7 @@ use App\Models\ServiceDatabase;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
@@ -44,6 +46,14 @@ use Symfony\Component\HttpKernel\Exception\HttpException;
 
 uses(RefreshDatabase::class);
 
+it('types service backup S3 storage state as a nullable Eloquent collection', function () {
+    $property = new ReflectionProperty(ServiceVolumeBackupIndex::class, 's3s');
+
+    expect($property->getType()?->getName())->toBe(Collection::class)
+        ->and($property->getType()?->allowsNull())->toBeTrue()
+        ->and($property->getDefaultValue())->toBeNull();
+});
+
 it('provides the volume backup domain classes and relationship', function () {
     expect(class_exists(ScheduledVolumeBackup::class))->toBeTrue()
         ->and(class_exists(ScheduledVolumeBackupExecution::class))->toBeTrue()
@@ -473,11 +483,8 @@ it('shows the configure backup modal trigger inside the volume card instead of i
     signInForVolumeBackups($this, $team);
     [$application, $volume] = createVolumeBackupApplication($team);
 
-    $component = Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])
-        ->set('isReadOnly', true)
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set("forms.{$volume->id}.isReadOnly", true)
         ->assertSee('Backup')
         ->assertDontSee('Backups made while the application is writing');
 
@@ -487,6 +494,7 @@ it('shows the configure backup modal trigger inside the volume card instead of i
     expect($html)
         ->toContain('Configure Volume Backup')
         ->toContain('data-table-row')
+        ->not->toContain('wire:submit="submit('.$volume->id.')"')
         ->toContain('Backup');
 });
 
@@ -502,10 +510,10 @@ it('only shows the backup enabled badge for an enabled volume backup', function
         'enabled' => false,
     ]);
 
-    $component = Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])->assertDontSee('table-badge-success', false);
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->assertDontSee('Volume backup is enabled');
+
+    expect($component->get("volumeBackupMeta.{$volume->id}.enabled"))->toBeFalse();
 
     $backup->update(['enabled' => true]);
 
@@ -518,17 +526,10 @@ it('only shows the backup enabled badge for an enabled volume backup', function
 
     $component
         ->dispatch('refreshVolumeBackups')
-        ->assertSee('table-badge-success', false)
         ->assertSee('Volume backup is enabled')
         ->assertSee('href="'.$backupUrl.'"', false);
 
-    Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-        'isFirst' => false,
-    ])
-        ->assertSee('table-badge-success', false)
-        ->assertSee('Volume backup is enabled');
+    expect($component->get("volumeBackupMeta.{$volume->id}.url"))->toBe($backupUrl);
 });
 
 it('links the backup enabled badge to a filtered backup list when the application has multiple schedules', function () {
@@ -554,11 +555,7 @@ it('links the backup enabled badge to a filtered backup list when the applicatio
         'search' => $volume->name,
     ]);
 
-    Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])
-        ->assertSee('table-badge-success', false)
+    Livewire::test(All::class, ['resource' => $application])
         ->assertSee('Volume backup is enabled')
         ->assertSee('href="'.$backupUrl.'"', false);
 });
diff --git a/tests/Unit/ApplicationDeploymentContainerNamingTest.php b/tests/Unit/ApplicationDeploymentContainerNamingTest.php
new file mode 100644
index 0000000000..b7b63ae544
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentContainerNamingTest.php
@@ -0,0 +1,58 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use Illuminate\Support\Collection;
+
+function containerNamingJob(Application $application, int $pullRequestId = 0): array
+{
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $reflection->getProperty('application')->setValue($job, $application);
+    $reflection->getProperty('pull_request_id')->setValue($job, $pullRequestId);
+
+    return [$job, $reflection];
+}
+
+function applicationWithContainerNaming(string $customName = 'shadowuw'): Application
+{
+    $application = new Application;
+    $application->forceFill(['uuid' => 'application-uuid']);
+    $application->setRelation('settings', new ApplicationSetting([
+        'custom_internal_name' => $customName,
+        'is_consistent_container_name_enabled' => true,
+    ]));
+
+    return $application;
+}
+
+it('uses the custom container name when consistent naming is enabled', function () {
+    $application = applicationWithContainerNaming();
+
+    [$job, $reflection] = containerNamingJob($application);
+
+    expect($reflection->getMethod('resolveContainerName')->invoke($job))->toBe('shadowuw');
+});
+
+it('adds the pull request suffix to a custom container name', function () {
+    $application = applicationWithContainerNaming();
+
+    [$job, $reflection] = containerNamingJob($application, 42);
+
+    expect($reflection->getMethod('resolveContainerName')->invoke($job))->toBe('shadowuw-pr-42');
+});
+
+it('includes old generated containers when cleaning up a consistent deployment', function () {
+    $application = applicationWithContainerNaming();
+    [$job, $reflection] = containerNamingJob($application);
+    $reflection->getProperty('container_name')->setValue($job, 'shadowuw');
+
+    $containers = new Collection([
+        ['Names' => 'application-uuid-192238854305'],
+        ['Names' => 'shadowuw'],
+    ]);
+
+    expect($reflection->getMethod('containerNamesToRemove')->invoke($job, $containers)->all())
+        ->toBe(['application-uuid-192238854305', 'shadowuw']);
+});
diff --git a/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php b/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php
new file mode 100644
index 0000000000..f6684718e3
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableCoolifyUrlDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function coolifyVariablesForFqdn(string $fqdn, string $composeParsingVersion = '3'): string
+{
+    $team = Team::create([
+        'name' => 'Coolify Url Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Coolify Url Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'fqdn' => $fqdn,
+    ]);
+
+    // The created hook resets this, so it has to be set afterwards.
+    $application->compose_parsing_version = $composeParsingVersion;
+    $application->save();
+
+    $job = new TestableCoolifyUrlDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application->fresh(),
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('set_coolify_variables')->invoke($job);
+
+    return $reflection->getProperty('coolify_variables')->getValue($job);
+}
+
+it('keeps every domain intact when an application has multiple domains', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com,https://b.example.com');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com,https://b.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com,b.example.com'");
+});
+
+it('strips the port from every domain when an application has multiple domains', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com:8080,https://b.example.com:9000');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com,https://b.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com,b.example.com'");
+});
+
+it('keeps every domain intact on the legacy compose parsing version', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com,https://b.example.com', '2');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='a.example.com,b.example.com'")
+        ->toContain("COOLIFY_FQDN='https://a.example.com,https://b.example.com'");
+});
+
+it('still resolves a single domain', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com'");
+});
diff --git a/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php b/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
new file mode 100644
index 0000000000..234f216bd2
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
@@ -0,0 +1,98 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Symfony\Component\Yaml\Yaml;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableCustomDockerOptionsDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function generateComposeServiceWithCustomDockerOptions(string $customDockerOptions): array
+{
+    $team = Team::create([
+        'name' => 'Custom Docker Options Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Custom Docker Options Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockerimage',
+        'custom_docker_run_options' => $customDockerOptions,
+        'custom_network_aliases' => json_encode(['custom-alias'], JSON_THROW_ON_ERROR),
+    ]);
+    $application->settings()->update([
+        'is_consistent_container_name_enabled' => true,
+        'custom_internal_name' => 'custom-internal-name',
+    ]);
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+    $queue->status = 'queued';
+    $queue->shouldReceive('refresh')->once()->andReturnSelf();
+
+    $application = $application->fresh();
+    $job = new TestableCustomDockerOptionsDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application,
+        'application_deployment_queue' => $queue,
+        'destination' => $destination,
+        'server' => $server,
+        'mainServer' => $server,
+        'pull_request_id' => 0,
+        'container_name' => 'custom-internal-name',
+        'production_image_name' => 'example/app:latest',
+        'deployment_uuid' => 'deployment-uuid',
+        'workdir' => '/artifacts/custom-docker-options-app',
+        'configuration_dir' => '/data/coolify/applications/test',
+        'saved_outputs' => new Collection,
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('generate_compose_file')->invoke($job);
+    $compose = Yaml::parse($reflection->getProperty('docker_compose')->getValue($job));
+
+    return $compose['services'][$application->uuid];
+}
+
+it('applies an entrypoint when consistent naming and a custom internal name are configured', function () {
+    expect(generateComposeServiceWithCustomDockerOptions('--entrypoint "/bin/echo hello world"'))
+        ->toHaveKey('entrypoint', '/bin/echo hello world')
+        ->toHaveKey('container_name', 'custom-internal-name');
+});
+
+it('preserves custom network aliases when a static IP is configured', function () {
+    $service = generateComposeServiceWithCustomDockerOptions('--ip 10.0.0.25 --ip6 2001:db8::25');
+    $network = $service['networks'][array_key_first($service['networks'])];
+
+    expect($network)
+        ->toHaveKey('ipv4_address', '10.0.0.25')
+        ->toHaveKey('ipv6_address', '2001:db8::25')
+        ->toHaveKey('aliases')
+        ->and($network['aliases'])->toContain('custom-alias');
+});
diff --git a/tests/Unit/ApplicationDeploymentStopGracePeriodTest.php b/tests/Unit/ApplicationDeploymentStopGracePeriodTest.php
new file mode 100644
index 0000000000..4aa45c0431
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentStopGracePeriodTest.php
@@ -0,0 +1,85 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Symfony\Component\Yaml\Yaml;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableStopGracePeriodDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function generateComposeServiceWithStopGracePeriod(?int $stopGracePeriod): array
+{
+    $team = Team::create([
+        'name' => 'Stop Grace Period Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Stop Grace Period Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+    ]);
+    $application->settings()->update(['stop_grace_period' => $stopGracePeriod]);
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+    $queue->status = 'queued';
+    $queue->shouldReceive('refresh')->once()->andReturnSelf();
+
+    $job = new TestableStopGracePeriodDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application->fresh(),
+        'application_deployment_queue' => $queue,
+        'destination' => $destination,
+        'server' => $server,
+        'mainServer' => $server,
+        'pull_request_id' => 0,
+        'container_name' => 'stop-grace-period-app',
+        'production_image_name' => 'example/app:latest',
+        'deployment_uuid' => 'deployment-uuid',
+        'workdir' => '/artifacts/stop-grace-period-app',
+        'configuration_dir' => '/data/coolify/applications/test',
+        'saved_outputs' => new Collection,
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('generate_compose_file')->invoke($job);
+    $compose = Yaml::parse($reflection->getProperty('docker_compose')->getValue($job));
+
+    return $compose['services']['stop-grace-period-app'];
+}
+
+it('adds an explicitly configured stop grace period to generated compose services', function () {
+    expect(generateComposeServiceWithStopGracePeriod(700))
+        ->toHaveKey('stop_grace_period', '700s');
+});
+
+it('omits the stop grace period from generated compose services when it is not configured', function () {
+    expect(generateComposeServiceWithStopGracePeriod(null))
+        ->not->toHaveKey('stop_grace_period');
+});
diff --git a/tests/Unit/ApplicationGitCommitLinkTest.php b/tests/Unit/ApplicationGitCommitLinkTest.php
new file mode 100644
index 0000000000..e1a15e7149
--- /dev/null
+++ b/tests/Unit/ApplicationGitCommitLinkTest.php
@@ -0,0 +1,28 @@
+<?php
+
+use App\Models\Application;
+
+it('generates commit links for direct repository remotes', function (string $repository, string $expected) {
+    $application = new Application;
+    $application->setRelation('source', null);
+    $application->git_repository = $repository;
+
+    expect($application->gitCommitLink('1234567890abcdef'))->toBe($expected);
+})->with([
+    'HTTPS remote' => [
+        'https://github.com/coollabsio/coolify.git',
+        'https://github.com/coollabsio/coolify/commit/1234567890abcdef',
+    ],
+    'SSH remote' => [
+        'git@github.com:coollabsio/coolify.git',
+        'https://github.com/coollabsio/coolify/commit/1234567890abcdef',
+    ],
+    'SSH URL' => [
+        'ssh://git@gitlab.com/coollabsio/coolify.git',
+        'https://gitlab.com/coollabsio/coolify/commit/1234567890abcdef',
+    ],
+    'Bitbucket HTTPS remote' => [
+        'https://bitbucket.org/coollabsio/coolify.git',
+        'https://bitbucket.org/coollabsio/coolify/commits/1234567890abcdef',
+    ],
+]);
diff --git a/tests/Unit/ContainerStatusAggregatorTest.php b/tests/Unit/ContainerStatusAggregatorTest.php
index 71425a21cb..0a40206ac7 100644
--- a/tests/Unit/ContainerStatusAggregatorTest.php
+++ b/tests/Unit/ContainerStatusAggregatorTest.php
@@ -70,12 +70,12 @@ describe('aggregateFromStrings', function () {
         expect($result)->toBe('running:unknown');
     });
 
-    test('returns degraded:unhealthy for crash loop (exited with restart count)', function () {
+    test('returns exited for an exited container with a restart count', function () {
         $statuses = collect(['exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 5);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('returns exited for exited containers without restart count', function () {
@@ -214,12 +214,12 @@ describe('aggregateFromStrings', function () {
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('prioritizes crash loop over running containers', function () {
+    test('returns exited when all containers are exited with restart counts', function () {
         $statuses = collect(['exited', 'exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 3);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('prioritizes mixed state over healthy running', function () {
@@ -238,12 +238,12 @@ describe('aggregateFromStrings', function () {
         expect($result)->toBe('starting:unknown');
     });
 
-    test('prioritizes running over paused/exited when no starting', function () {
+    test('returns degraded for mixed running and exited containers', function () {
         $statuses = collect(['running:healthy', 'paused', 'exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses);
 
-        expect($result)->toBe('running:healthy');
+        expect($result)->toBe('degraded:unhealthy');
     });
 
     test('prioritizes dead over paused/starting/exited', function () {
@@ -357,7 +357,7 @@ describe('aggregateFromContainers', function () {
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('returns degraded:unhealthy for crash loop (exited with restart count)', function () {
+    test('returns exited for an exited container object with a restart count', function () {
         $containers = collect([
             (object) [
                 'State' => (object) [
@@ -368,7 +368,7 @@ describe('aggregateFromContainers', function () {
 
         $result = $this->aggregator->aggregateFromContainers($containers, maxRestartCount: 5);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('returns exited for exited containers without restart count', function () {
@@ -501,7 +501,7 @@ describe('state priority enforcement', function () {
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('crash loop has third highest priority', function () {
+    test('mixed running and exited containers are degraded before paused or starting states', function () {
         $statuses = collect([
             'exited',
             'running:healthy',
@@ -602,31 +602,29 @@ describe('maxRestartCount validation', function () {
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 0);
 
-        // Zero is valid default - no crash loop detection
         expect($result)->toBe('exited');
     });
 
-    test('positive maxRestartCount works correctly', function () {
+    test('positive maxRestartCount does not override an exited state', function () {
         $statuses = collect(['exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 5);
 
-        // Positive value enables crash loop detection
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
-    test('crash loop detection still functions after validation', function () {
+    test('exited state is preserved for any positive restart count', function () {
         $statuses = collect(['exited']);
 
         // Test with various positive restart counts
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 1))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
 
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 100))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
 
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 999))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
     });
 
     test('default maxRestartCount parameter works', function () {
diff --git a/tests/Unit/DockerComposeLabelParsingTest.php b/tests/Unit/DockerComposeLabelParsingTest.php
index a2a3c08833..7f3c18c1eb 100644
--- a/tests/Unit/DockerComposeLabelParsingTest.php
+++ b/tests/Unit/DockerComposeLabelParsingTest.php
@@ -29,6 +29,14 @@ it('ensures label parsing converts array values to strings', function () {
         ->toContain('$removedLabel = (string) collect($removedLabel)->first();');
 });
 
+it('falls back to the template port for service application proxy labels', function () {
+    $sharedFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/shared.php');
+
+    expect($sharedFile)->toContain(
+        '? ($savedService->getRequiredPort() ?? $predefinedPort)'
+    );
+});
+
 it('verifies label parsing array check occurs before preg_match', function () {
     // Read the parseDockerComposeFile function from shared.php
     $sharedFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/shared.php');
diff --git a/tests/Unit/DockerNetworkInjectionTest.php b/tests/Unit/DockerNetworkInjectionTest.php
index b3ca4ac60f..9427aa87d9 100644
--- a/tests/Unit/DockerNetworkInjectionTest.php
+++ b/tests/Unit/DockerNetworkInjectionTest.php
@@ -27,6 +27,14 @@ it('StandaloneDocker accepts valid network names', function (string $network) {
     'alphanumeric' => 'network123',
 ]);
 
+it('creates standalone destinations with a bridge network', function () {
+    $model = new StandaloneDocker;
+    $model->network = 'test-network';
+
+    expect($model->networkCreateCommand())
+        ->toBe("docker network inspect 'test-network' >/dev/null 2>&1 || docker network create --attachable 'test-network' >/dev/null");
+});
+
 it('SwarmDocker rejects network names with shell metacharacters', function (string $network) {
     $model = new SwarmDocker;
     $model->network = $network;
diff --git a/tests/Unit/DomainPortOverridesTest.php b/tests/Unit/DomainPortOverridesTest.php
new file mode 100644
index 0000000000..42345e5dfd
--- /dev/null
+++ b/tests/Unit/DomainPortOverridesTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Support\DomainPortOverrides;
+
+it('copies the source port override to an automatically paired domain', function (string $source, string $counterpart) {
+    $result = DomainPortOverrides::normalize(
+        "$source,$counterpart",
+        [$source => 8080],
+    );
+
+    expect($result['overrides'])->toBe([
+        $source => 8080,
+        $counterpart => 8080,
+    ]);
+})->with([
+    'www redirect' => ['https://example.com', 'https://www.example.com'],
+    'non-www redirect' => ['https://www.example.com', 'https://example.com'],
+]);
+
+it('keeps an explicit override on the paired domain', function (string $source, string $counterpart) {
+    $result = DomainPortOverrides::normalize(
+        "$source,$counterpart",
+        [
+            $source => 8080,
+            $counterpart => 9090,
+        ],
+    );
+
+    expect($result['overrides'])->toBe([
+        $source => 8080,
+        $counterpart => 9090,
+    ]);
+})->with([
+    'www redirect' => ['https://example.com', 'https://www.example.com'],
+    'non-www redirect' => ['https://www.example.com', 'https://example.com'],
+]);
diff --git a/tests/Unit/ExecutorServiceTemplateTest.php b/tests/Unit/ExecutorServiceTemplateTest.php
new file mode 100644
index 0000000000..7e3d0ce50c
--- /dev/null
+++ b/tests/Unit/ExecutorServiceTemplateTest.php
@@ -0,0 +1,49 @@
+<?php
+
+it('includes an Executor one-click service template', function () {
+    $templatePath = __DIR__.'/../../templates/compose/executor.yaml';
+
+    expect($templatePath)->toBeFile();
+
+    $compose = file_get_contents($templatePath);
+
+    expect($compose)
+        ->toContain('ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}')
+        ->toContain('SERVICE_URL_EXECUTOR_4788')
+        ->toContain('EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}')
+        ->toContain('executor-data:/data')
+        ->toContain('http://127.0.0.1:${process.env.PORT||4788}/api/health');
+
+    foreach (['service-templates.json', 'service-templates-latest.json'] as $templateFile) {
+        $templateCatalogPath = __DIR__."/../../templates/{$templateFile}";
+        $templateCatalog = file_get_contents($templateCatalogPath);
+
+        if ($templateCatalog === false) {
+            throw new RuntimeException("Unable to read service template catalog at {$templateCatalogPath}.");
+        }
+
+        $templates = json_decode(
+            $templateCatalog,
+            associative: true,
+            flags: JSON_THROW_ON_ERROR,
+        );
+
+        expect($templates)->toHaveKey('executor');
+        expect($templates['executor']['port'] ?? null)->toBe('4788');
+        expect($templates['executor']['logo'] ?? null)->toBe('svgs/executor.png');
+        expect($templates['executor']['category'] ?? null)->toBe('development');
+
+        $generatedCompose = base64_decode($templates['executor']['compose'], strict: true);
+
+        expect($generatedCompose)
+            ->toContain('ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}')
+            ->toContain('http://127.0.0.1:${process.env.PORT||4788}/api/health')
+            ->toContain($templateFile === 'service-templates.json'
+                ? 'EXECUTOR_WEB_BASE_URL=${SERVICE_FQDN_EXECUTOR_4788}'
+                : 'EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}');
+    }
+});
+
+it('ships the Executor service icon from the public path used by the service picker', function () {
+    expect(__DIR__.'/../../public/svgs/executor.png')->toBeFile();
+});
diff --git a/tests/Unit/FqdnLabelsNoindexTest.php b/tests/Unit/FqdnLabelsNoindexTest.php
index 332d548989..49e9a6e8f1 100644
--- a/tests/Unit/FqdnLabelsNoindexTest.php
+++ b/tests/Unit/FqdnLabelsNoindexTest.php
@@ -232,3 +232,55 @@ describe('Caddy noindex header', function () {
         )->all())->toBeEmpty();
     });
 });
+
+test('fqdnLabelsForCaddy routes each portless domain to its override port', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://one.example.com', 'https://two.example.com']),
+        onlyPort: 80,
+        is_force_https_enabled: true,
+        domainPortOverrides: [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://one.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1=https://two.example.com')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('caddy_0=https://one.example.com:3000')
+        ->not->toContain('caddy_1=https://two.example.com:8080');
+});
+
+test('fqdnLabelsForCaddy uses onlyPort when a portless domain has no override', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://plain.example.com']),
+        onlyPort: 4000,
+        is_force_https_enabled: true,
+        domainPortOverrides: [],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://plain.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}');
+});
+
+test('fqdnLabelsForCaddy keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://legacy.example.com:9090']),
+        onlyPort: 80,
+        is_force_https_enabled: true,
+        domainPortOverrides: [],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://legacy.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
diff --git a/tests/Unit/LivewireInternalRedirectTest.php b/tests/Unit/LivewireInternalRedirectTest.php
new file mode 100644
index 0000000000..7dc19a81b8
--- /dev/null
+++ b/tests/Unit/LivewireInternalRedirectTest.php
@@ -0,0 +1,43 @@
+<?php
+
+it('uses Livewire navigation after deleting or converting page resources', function (string $path, array $redirects) {
+    $contents = file_get_contents(dirname(__DIR__, 2).'/'.$path);
+
+    foreach ($redirects as $redirect) {
+        expect($contents)->toContain($redirect);
+    }
+})->with([
+    'S3 storage' => [
+        'app/Livewire/Storage/Show.php',
+        ["redirectRoute(\$this, 'storage.index')"],
+    ],
+    'database backup schedule' => [
+        'app/Livewire/Project/Database/BackupEdit.php',
+        [
+            "redirectRoute(\$this, 'project.service.database.backups'",
+            "redirectRoute(\$this, 'project.database.backup.index'",
+        ],
+    ],
+    'scheduled task' => [
+        'app/Livewire/Project/Shared/ScheduledTask/Show.php',
+        [
+            "redirectRoute(\$this, 'project.application.scheduled-tasks.show'",
+            "redirectRoute(\$this, 'project.service.scheduled-tasks.show'",
+        ],
+    ],
+    'GitHub source' => [
+        'app/Livewire/Source/Github/Change.php',
+        ["redirectRoute(\$this, 'source.all')"],
+    ],
+    'GitLab source' => [
+        'app/Livewire/Source/Gitlab/Change.php',
+        ["redirectRoute(\$this, 'source.all')"],
+    ],
+    'service resources' => [
+        'app/Livewire/Project/Service/Index.php',
+        [
+            "return redirectRoute(\$this, 'project.service.configuration', \$this->parameters);",
+            "return redirectRoute(\$this, 'project.service.configuration', \$redirectParams);",
+        ],
+    ],
+]);
diff --git a/tests/Unit/LivewireSyncDataAuthorizationTest.php b/tests/Unit/LivewireSyncDataAuthorizationTest.php
new file mode 100644
index 0000000000..7ac6136d5c
--- /dev/null
+++ b/tests/Unit/LivewireSyncDataAuthorizationTest.php
@@ -0,0 +1,196 @@
+<?php
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\ConstFetch;
+use PhpParser\Node\Expr\MethodCall;
+use PhpParser\Node\Identifier;
+use PhpParser\Node\Stmt\ClassMethod;
+use PhpParser\Node\Stmt\If_;
+use PhpParser\Node\Stmt\Return_;
+use PhpParser\Node\Stmt\TryCatch;
+use PhpParser\NodeFinder;
+use PhpParser\ParserFactory;
+
+/** @return list<array{path: string, method: ClassMethod}> */
+function livewireSyncDataMethods(string $directory): array
+{
+    $methods = [];
+    $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory));
+    $parser = (new ParserFactory)->createForNewestSupportedVersion();
+    $finder = new NodeFinder;
+
+    foreach ($iterator as $file) {
+        if (! $file->isFile() || $file->getExtension() !== 'php') {
+            continue;
+        }
+        $path = $file->getPathname();
+        $contents = file_get_contents($path);
+        if ($contents === false) {
+            continue;
+        }
+        foreach ($finder->findInstanceOf($parser->parse($contents) ?? [], ClassMethod::class) as $method) {
+            if (preg_match('/^sync(Data|DatabaseData|ApplicationData)/', $method->name->toString())) {
+                $methods[] = ['path' => $path, 'method' => $method];
+            }
+        }
+    }
+
+    usort($methods, fn (array $a, array $b): int => [$a['path'], $a['method']->name->toString()] <=> [$b['path'], $b['method']->name->toString()]);
+
+    return $methods;
+}
+
+function livewireMethodCallName(MethodCall $call): ?string
+{
+    return $call->name instanceof Identifier ? $call->name->toString() : null;
+}
+
+function livewireIsWriteSyncCall(MethodCall $call, string $syncMethod): bool
+{
+    if (livewireMethodCallName($call) !== $syncMethod) {
+        return false;
+    }
+    foreach ($call->args as $position => $argument) {
+        if (($position === 0 || $argument->name?->toString() === 'toModel') && $argument->value instanceof ConstFetch && $argument->value->name->toLowerString() === 'true') {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+/** @param list<Node\Stmt> $statements @param list<int> $unauthorizedLines */
+function livewireScanStatements(array $statements, string $syncMethod, bool $authorized, array &$unauthorizedLines): bool
+{
+    foreach ($statements as $statement) {
+        $authorized = livewireScanNode($statement, $syncMethod, $authorized, $unauthorizedLines);
+    }
+
+    return $authorized;
+}
+
+/** @param list<int> $unauthorizedLines */
+function livewireScanNode(mixed $node, string $syncMethod, bool $authorized, array &$unauthorizedLines): bool
+{
+    if (! $node instanceof Node && ! is_array($node)) {
+        return $authorized;
+    }
+    if (is_array($node)) {
+        return livewireScanStatements($node, $syncMethod, $authorized, $unauthorizedLines);
+    }
+    if ($node instanceof TryCatch) {
+        $tryAuthorized = livewireScanStatements($node->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        $allCatchesTerminate = $node->catches !== [];
+        foreach ($node->catches as $catch) {
+            livewireScanStatements($catch->stmts, $syncMethod, $authorized, $unauthorizedLines);
+            $allCatchesTerminate = $allCatchesTerminate && collect($catch->stmts)->contains(fn (Node\Stmt $statement): bool => $statement instanceof Return_);
+        }
+        if ($node->finally !== null) {
+            livewireScanStatements($node->finally->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+
+        return $allCatchesTerminate ? $tryAuthorized : $authorized;
+    }
+    if ($node instanceof If_) {
+        livewireScanNode($node->cond, $syncMethod, $authorized, $unauthorizedLines);
+        livewireScanStatements($node->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        foreach ($node->elseifs as $elseif) {
+            livewireScanNode($elseif->cond, $syncMethod, $authorized, $unauthorizedLines);
+            livewireScanStatements($elseif->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+        if ($node->else !== null) {
+            livewireScanStatements($node->else->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+
+        return $authorized;
+    }
+    if ($node instanceof MethodCall) {
+        $name = livewireMethodCallName($node);
+        if ($name === 'authorize') {
+            return true;
+        }
+        if (livewireIsWriteSyncCall($node, $syncMethod) && ! $authorized) {
+            $unauthorizedLines[] = $node->getStartLine();
+        }
+    }
+    foreach ($node->getSubNodeNames() as $name) {
+        $authorized = livewireScanNode($node->{$name}, $syncMethod, $authorized, $unauthorizedLines);
+    }
+
+    return $authorized;
+}
+
+/** @return list<int> */
+function livewireUnauthorizedSyncWriteLines(ClassMethod $method, string $syncMethod): array
+{
+    $lines = [];
+    livewireScanStatements($method->stmts ?? [], $syncMethod, false, $lines);
+
+    return $lines;
+}
+
+function livewireMethodFromSource(string $source, string $method): ClassMethod
+{
+    $nodes = (new ParserFactory)->createForNewestSupportedVersion()->parse($source) ?? [];
+
+    return (new NodeFinder)->findFirst($nodes, fn (Node $node): bool => $node instanceof ClassMethod && $node->name->toString() === $method);
+}
+
+it('keeps every Livewire syncData helper private', function () {
+    $violations = [];
+    foreach (livewireSyncDataMethods(dirname(__DIR__, 2).'/app/Livewire') as $syncMethod) {
+        if (! $syncMethod['method']->isPrivate()) {
+            $relative = str_replace(dirname(__DIR__, 2).'/', '', $syncMethod['path']);
+            $violations[] = "{$relative}::{$syncMethod['method']->name}() is not private";
+        }
+    }
+    expect($violations)->toBeEmpty("Livewire syncData helpers must be private:\n".implode("\n", $violations));
+});
+
+it('discovers files that only define syncApplicationData helpers', function () {
+    $directory = sys_get_temp_dir().'/livewire-sync-'.uniqid();
+    mkdir($directory);
+    file_put_contents($directory.'/Example.php', '<?php class Example { private function syncApplicationData(bool $toModel = false) {} }');
+
+    $methods = livewireSyncDataMethods($directory);
+
+    unlink($directory.'/Example.php');
+    rmdir($directory);
+
+    expect($methods)->toHaveCount(1)
+        ->and($methods[0]['method']->name->toString())->toBe('syncApplicationData');
+});
+
+it('detects named write arguments and does not carry authorization into catch paths', function () {
+    $method = livewireMethodFromSource(<<<'PHP'
+        <?php
+        class Example {
+            public function instantSave() {
+                try {
+                    $this->authorize('update', $this->resource);
+                    $this->syncData(toModel: true);
+                } catch (Throwable $exception) {
+                    $this->syncData(toModel: true);
+                }
+            }
+        }
+        PHP, 'instantSave');
+
+    expect(livewireUnauthorizedSyncWriteLines($method, 'syncData'))->toHaveCount(1);
+});
+
+it('authorizes before every syncData write call', function () {
+    $violations = [];
+    $root = dirname(__DIR__, 2);
+    foreach (livewireSyncDataMethods($root.'/app/Livewire') as $syncMethod) {
+        $contents = file_get_contents($syncMethod['path']);
+        $nodes = (new ParserFactory)->createForNewestSupportedVersion()->parse($contents) ?? [];
+        foreach ((new NodeFinder)->findInstanceOf($nodes, ClassMethod::class) as $caller) {
+            foreach (livewireUnauthorizedSyncWriteLines($caller, $syncMethod['method']->name->toString()) as $line) {
+                $relative = str_replace($root.'/', '', $syncMethod['path']);
+                $violations[] = "{$relative}:{$line}::{$caller->name}() calls {$syncMethod['method']->name}(true) without prior authorization";
+            }
+        }
+    }
+    expect($violations)->toBeEmpty("Missing authorization before syncData write calls:\n".implode("\n", array_unique($violations)));
+});
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 2fafa678e8..293c9422e9 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.11'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.11')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.15'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.15')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
@@ -77,6 +77,7 @@ it('prevents the stable helper workflow from publishing an existing version', fu
     $workflow = file_get_contents(dirname(__DIR__, 2).'/.github/workflows/coolify-helper.yml');
 
     expect($workflow)
+        ->toContain('workflow_dispatch:')
         ->toContain('check-version:')
         ->toContain('needs: check-version')
         ->toContain('VERSION="${BASE_VERSION}"')
diff --git a/tests/Unit/PushServerUpdateJobReturnTypesTest.php b/tests/Unit/PushServerUpdateJobReturnTypesTest.php
new file mode 100644
index 0000000000..763d456b98
--- /dev/null
+++ b/tests/Unit/PushServerUpdateJobReturnTypesTest.php
@@ -0,0 +1,9 @@
+<?php
+
+use App\Jobs\PushServerUpdateJob;
+
+test('database status update declares a void return type', function () {
+    $method = new ReflectionMethod(PushServerUpdateJob::class, 'updateDatabaseStatus');
+
+    expect($method->getReturnType()?->getName())->toBe('void');
+});
diff --git a/tests/Unit/RemovedContainerStoppedNotificationTest.php b/tests/Unit/RemovedContainerStoppedNotificationTest.php
new file mode 100644
index 0000000000..016801c69d
--- /dev/null
+++ b/tests/Unit/RemovedContainerStoppedNotificationTest.php
@@ -0,0 +1,11 @@
+<?php
+
+it('does not keep the unreliable generic stopped container notification path', function () {
+    $statusAction = file_get_contents(__DIR__.'/../../app/Actions/Docker/GetContainersStatus.php');
+    $telegramChannel = file_get_contents(__DIR__.'/../../app/Notifications/Channels/TelegramChannel.php');
+
+    expect($statusAction)->not->toContain('ContainerStopped')
+        ->and($telegramChannel)->not->toContain('ContainerStopped')
+        ->and(file_exists(__DIR__.'/../../app/Notifications/Container/ContainerStopped.php'))->toBeFalse()
+        ->and(file_exists(__DIR__.'/../../resources/views/emails/container-stopped.blade.php'))->toBeFalse();
+});
diff --git a/tests/Unit/RestartCountTrackerTest.php b/tests/Unit/RestartCountTrackerTest.php
new file mode 100644
index 0000000000..3004ffa16a
--- /dev/null
+++ b/tests/Unit/RestartCountTrackerTest.php
@@ -0,0 +1,95 @@
+<?php
+
+use App\Services\RestartCountTracker;
+
+it('starts a new generation when an active container restart count drops', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 0,
+        maxRestartCount: 2,
+        newGenerationConfirmed: true,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 0,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => false,
+        'new_generation' => true,
+    ]);
+});
+
+it('evaluates the restart limit immediately in a new generation', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 3,
+        maxRestartCount: 2,
+        newGenerationConfirmed: true,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 3,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => true,
+        'new_generation' => true,
+    ]);
+});
+
+it('does not reset the generation without explicit confirmation', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 0,
+        maxRestartCount: 2,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 11,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => false,
+        'new_generation' => false,
+    ]);
+});
+
+it('preserves the previous count when an active payload omits the container with the previous maximum', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 3,
+        maxRestartCount: 20,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 11,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => false,
+        'new_generation' => false,
+    ]);
+});
+
+it('detects a normal threshold crossing', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 1,
+        observedRestartCount: 2,
+        maxRestartCount: 2,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 2,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => true,
+        'new_generation' => false,
+    ]);
+});
+
+it('detects a limit that is enabled below the current observed restart count', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 17,
+        observedRestartCount: 17,
+        maxRestartCount: 10,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 17,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => true,
+        'new_generation' => false,
+    ]);
+});
diff --git a/tests/Unit/SanitizeLogsForExportTest.php b/tests/Unit/SanitizeLogsForExportTest.php
index 285230ea4a..88c5950896 100644
--- a/tests/Unit/SanitizeLogsForExportTest.php
+++ b/tests/Unit/SanitizeLogsForExportTest.php
@@ -108,14 +108,14 @@ it('removes GitHub tokens', function () {
         'gho_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'gho_ OAuth token',
         'ghu_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'ghu_ user-to-server token',
         'ghs_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'ghs_ server-to-server token',
+        'ghs_eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIxMjM0NTY3OCIsInN1YiI6Imluc3RhbGxhdGlvbi10b2tlbiJ9.signature-with_dots-and-hyphens' => 'ghs_ stateless server-to-server token',
         'ghr_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'ghr_ refresh token',
     ];
 
     foreach ($testCases as $token => $description) {
         $input = "Token: {$token}";
         $result = sanitizeLogsForExport($input);
-        expect($result)->not->toContain($token, "Failed to redact {$description}");
-        expect($result)->toContain(REDACTED);
+        expect($result)->toBe('Token: '.REDACTED, "Failed to redact {$description}");
     }
 });
 
diff --git a/tests/Unit/ServiceRequiredPortTest.php b/tests/Unit/ServiceRequiredPortTest.php
index 6ef5bf0305..f6a7d76382 100644
--- a/tests/Unit/ServiceRequiredPortTest.php
+++ b/tests/Unit/ServiceRequiredPortTest.php
@@ -198,6 +198,47 @@ YAML;
     expect($result)->toBe(3000);
 });
 
+it('falls back to the one-click template port when SERVICE_URL has no port suffix', function () {
+    $yaml = <<<'YAML'
+services:
+  wordpress:
+    environment:
+      - SERVICE_URL_WORDPRESS
+      - WORDPRESS_DB_HOST=mysql
+YAML;
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->docker_compose_raw = $yaml;
+    $service->shouldReceive('getRequiredPort')->andReturn(80);
+
+    $app = Mockery::mock(ServiceApplication::class)->makePartial();
+    $app->name = 'wordpress';
+    $app->shouldReceive('getAttribute')->with('service')->andReturn($service);
+    $app->service = $service;
+
+    expect($app->getRequiredPort())->toBe(80);
+});
+
+it('does not apply the template port to a container without SERVICE_URL or SERVICE_FQDN', function () {
+    $yaml = <<<'YAML'
+services:
+  mysql:
+    environment:
+      - MYSQL_DATABASE=wordpress
+YAML;
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->docker_compose_raw = $yaml;
+    $service->shouldReceive('getRequiredPort')->andReturn(80);
+
+    $app = Mockery::mock(ServiceApplication::class)->makePartial();
+    $app->name = 'mysql';
+    $app->shouldReceive('getAttribute')->with('service')->andReturn($service);
+    $app->service = $service;
+
+    expect($app->getRequiredPort())->toBeNull();
+});
+
 it('returns null for map-style environment without port', function () {
     $yaml = <<<'YAML'
 services:
diff --git a/tests/Unit/StartSentinelEndpointFallbackTest.php b/tests/Unit/StartSentinelEndpointFallbackTest.php
index 8da3459b89..20422b2abe 100644
--- a/tests/Unit/StartSentinelEndpointFallbackTest.php
+++ b/tests/Unit/StartSentinelEndpointFallbackTest.php
@@ -15,3 +15,9 @@ test('sentinel startup regenerates an empty endpoint from instance settings', fu
         ->and($component)
         ->toContain('$this->sentinelCustomUrl = $this->server->settings->sentinel_custom_url;');
 });
+
+test('sentinel startup allows legacy metrics migrations to finish before health checks fail', function () {
+    $action = file_get_contents(dirname(__DIR__, 2).'/app/Actions/Server/StartSentinel.php');
+
+    expect($action)->toContain('--health-start-period 120s');
+});
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index a924381bb9..35b6052dd3 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -10,8 +10,7 @@ it('persists exited status for every full application stop path', function () {
     $action = file_get_contents(__DIR__.'/../../app/Actions/Application/StopApplication.php');
 
     expect($action)
-        ->toContain("\$status = ['status' => 'exited'];")
-        ->toContain('$application->update($status);')
+        ->toMatch('/\$status\s*=\s*\[\s*\'status\'\s*=>\s*\'exited\',.*?\];.*?\$application->update\(\$status\);/s')
         ->not->toMatch('/docker stack rm .*?return;/s');
 });
 
@@ -19,8 +18,10 @@ it('persists exited status for all children when stopping a service', function (
     $action = file_get_contents(__DIR__.'/../../app/Actions/Service/StopService.php');
 
     expect($action)
-        ->toContain("\$applications->each->update(['status' => 'exited']);")
-        ->toContain("\$dbs->each->update(['status' => 'exited']);");
+        ->toContain("\$application->update(['status' => 'exited']);")
+        ->toContain('$application->resetRestartLimit();')
+        ->toContain("\$database->update(['status' => 'exited']);")
+        ->toContain('$database->resetRestartLimit();');
 });
 
 it('persists exited status when stopping an individual service resource', function () {
@@ -28,6 +29,8 @@ it('persists exited status when stopping an individual service resource', functi
 
     expect($action)
         ->toContain("\$serviceApplication->update(['status' => 'exited']);")
+        ->toContain('$commands = ["docker rm -f {$containerName}"];')
+        ->toContain('throwError: ! $removeContainer')
         ->toContain('ServiceStatusChanged::dispatch($service->environment->project->team->id);');
 });
 
diff --git a/tests/Unit/StopDatabaseTypesTest.php b/tests/Unit/StopDatabaseTypesTest.php
new file mode 100644
index 0000000000..0295b0c956
--- /dev/null
+++ b/tests/Unit/StopDatabaseTypesTest.php
@@ -0,0 +1,12 @@
+<?php
+
+use App\Actions\Database\StopDatabase;
+use App\Models\BaseModel;
+
+it('declares strict method types', function () {
+    $handle = new ReflectionMethod(StopDatabase::class, 'handle');
+    $stopContainer = new ReflectionMethod(StopDatabase::class, 'stopContainer');
+
+    expect($handle->getReturnType()?->getName())->toBe('string')
+        ->and($stopContainer->getParameters()[0]->getType()?->getName())->toBe(BaseModel::class);
+});
diff --git a/tests/Unit/TraefikServiceNameSegmentTest.php b/tests/Unit/TraefikServiceNameSegmentTest.php
index ef882961e0..2a639d76d6 100644
--- a/tests/Unit/TraefikServiceNameSegmentTest.php
+++ b/tests/Unit/TraefikServiceNameSegmentTest.php
@@ -107,3 +107,49 @@ test('application labels keep redirect capture groups single escaped before comp
     expect($labels)
         ->toContain('traefik.http.middlewares.0-application-uuid-to-www.redirectregex.replacement=${1}://www.${2}');
 });
+
+test('fqdnLabelsForTraefik routes each portless domain to its override port', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://one.example.com', 'https://two.example.com']),
+        onlyPort: 80,
+        domainPortOverrides: [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`one.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-appuuid.rule=Host(`two.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-appuuid.loadbalancer.server.port=8080')
+        ->not->toContain('Host(`one.example.com:3000`)')
+        ->not->toContain('Host(`two.example.com:8080`)');
+});
+
+test('fqdnLabelsForTraefik uses onlyPort when a portless domain has no override', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://plain.example.com']),
+        onlyPort: 4000,
+        domainPortOverrides: [],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`plain.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=4000');
+});
+
+test('fqdnLabelsForTraefik keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://legacy.example.com:9090']),
+        onlyPort: 80,
+        domainPortOverrides: [],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`legacy.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=9090');
+});
diff --git a/tests/Unit/ValidationPatternsTest.php b/tests/Unit/ValidationPatternsTest.php
index cfcceac381..21145c5e7f 100644
--- a/tests/Unit/ValidationPatternsTest.php
+++ b/tests/Unit/ValidationPatternsTest.php
@@ -161,6 +161,33 @@ KEY',
     'empty' => '',
 ]);
 
+it('accepts shell-safe keys for sourced build-time env files', function (string $key) {
+    expect(ValidationPatterns::validatedShellEnvironmentVariableKey($key))->toBe($key);
+})->with([
+    'letters' => 'APP_ENV',
+    'leading underscore' => '_TOKEN',
+    'digits after first character' => 'NODE_VERSION_20',
+]);
+
+it('rejects keys that bash would interpret when sourcing a build-time env file', function (string $key) {
+    expect(fn () => ValidationPatterns::validatedShellEnvironmentVariableKey($key))
+        ->toThrow(InvalidArgumentException::class);
+})->with([
+    'command substitution' => 'X$(id)',
+    'dot notation' => 'X.VALUE',
+    'command substitution with arguments' => 'X$(docker run --rm -v /:/mnt alpine true)',
+]);
+
+it('makes unsafe environment variable keys safe to show in logs', function () {
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey('APP_ENV'))->toBe('APP_ENV');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey("X\nid"))->toBe('X\\nid');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey("X\e[2Jid\x7F"))->toBe('X\\x1B[2Jid\\x7F');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey(''))->toBe('(empty)');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey(str_repeat('A', 100)))
+        ->toEndWith('...')
+        ->toBe(str_repeat('A', 80).'...');
+});
+
 it('generates environment variable key rules with correct defaults', function () {
     $rules = ValidationPatterns::environmentVariableKeyRules();
 
@@ -191,3 +218,23 @@ it('normalizes application domain scheme and host without lowercasing path query
 it('validates application domains with underscores in the hostname', function () {
     expect(ValidationPatterns::validateApplicationDomains('https://myapp_service.example.com'))->toBeEmpty();
 });
+
+it('rejects single-label application hostnames but allows IP addresses', function () {
+    expect(ValidationPatterns::validateApplicationDomains('https://aaa'))->not->toBeEmpty()
+        ->and(ValidationPatterns::validateApplicationDomains('https://localhost'))->not->toBeEmpty()
+        ->and(ValidationPatterns::validateApplicationDomains('http://192.0.2.10:8000'))->toBeEmpty();
+});
+
+it('rejects application domain ports outside the valid TCP range', function (string $domain) {
+    expect(ValidationPatterns::validateApplicationDomains($domain))->not->toBeEmpty();
+})->with([
+    'zero' => 'https://example.com:0',
+    'above maximum' => 'https://example.com:65536',
+]);
+
+it('accepts application domain ports at the TCP range boundaries', function (string $domain) {
+    expect(ValidationPatterns::validateApplicationDomains($domain))->toBeEmpty();
+})->with([
+    'minimum' => 'https://example.com:1',
+    'maximum' => 'https://example.com:65535',
+]);
diff --git a/tests/v4/Feature/DangerDeleteResourceTest.php b/tests/v4/Feature/DangerDeleteResourceTest.php
index 4a275ad484..655aec85fe 100644
--- a/tests/v4/Feature/DangerDeleteResourceTest.php
+++ b/tests/v4/Feature/DangerDeleteResourceTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\DeleteResourceJob;
 use App\Livewire\Project\Shared\Danger;
 use App\Models\Application;
 use App\Models\Environment;
@@ -7,6 +8,7 @@ use App\Models\InstanceSettings;
 use App\Models\OauthIdentity;
 use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
@@ -62,13 +64,28 @@ test('delete returns error string when password is incorrect', function () {
     expect(Application::find($this->application->id))->not->toBeNull();
 });
 
-test('delete succeeds with correct password and redirects', function () {
-    Livewire::test(Danger::class, ['resource' => $this->application])
-        ->call('delete', 'test-password')
-        ->assertHasNoErrors();
+test('delete redirects before dispatching resource cleanup after the response', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
 
-    // Resource should be soft-deleted
-    expect(Application::find($this->application->id))->toBeNull();
+    $component = Livewire::test(Danger::class, ['resource' => $service])
+        ->set('projectUuid', $this->project->uuid)
+        ->set('environmentUuid', $this->environment->uuid)
+        ->call('delete', 'test-password')
+        ->assertHasNoErrors()
+        ->assertRedirectToRoute('project.resource.index', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ]);
+
+    expect($component->effects)->toHaveKey('redirectUsingNavigate', true);
+
+    expect(Service::find($service->id))->not->toBeNull();
+    Queue::assertPushed(DeleteResourceJob::class, fn (DeleteResourceJob $job) => $job->resource->is($service));
 });
 
 test('delete succeeds without password for an oauth user', function () {
diff --git a/versions.json b/versions.json
index d4e5b5c8c9..455918fdc0 100644
--- a/versions.json
+++ b/versions.json
@@ -1,16 +1,16 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.11"
+            "version": "4.3.15"
         },
         "nightly": {
             "version": "4.4-rc.1"
         },
         "helper": {
-            "version": "1.0.15"
+            "version": "1.0.16"
         },
         "realtime": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
             "version": "0.0.22"