diff --git a/.ai/lessons.md b/.ai/lessons.md
deleted file mode 100644
index 0c08f5d495..0000000000
--- a/.ai/lessons.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Lessons
-
-## Alpine x-transition + tw-animate-css exit animations flash at the end
-- Symptom: a modal/overlay fades out, then flashes fully visible for 1-2 frames before it disappears.
-- Cause: `animate-out` keyframes default to `animation-fill-mode: none`. The element snaps back to its natural state when the keyframe ends. Alpine hides the element (display: none) only after its own timer (read from `transition-duration`), which starts ~2 rAF later than the animation. The gap shows the element at full opacity.
-- Rule: every `x-transition:leave` that uses tw-animate-css `animate-out` MUST also include `fill-mode-forwards`.
-- Rule: when a user reports UI flicker, check ALL layers of the animation stack (state reset timing, spinner flash, keyframe fill mode, focus restore) before you report the fix as complete. My first fix covered state reset and spinner only; the fill-mode snap was the visible one.
diff --git a/.env.development.example b/.env.development.example
index 380f10a446..56c17128ce 100644
--- a/.env.development.example
+++ b/.env.development.example
@@ -53,3 +53,4 @@ DUSK_DRIVER_URL=http://selenium:4444
 BUNNY_API_KEY=
 # For asset uploads
 BUNNY_STORAGE_API_KEY=
+AVATAR_CDN_URL=
diff --git a/.env.windows-docker-desktop.example b/.env.windows-docker-desktop.example
index b067b4c5c0..626d76ff63 100644
--- a/.env.windows-docker-desktop.example
+++ b/.env.windows-docker-desktop.example
@@ -11,3 +11,4 @@ REDIS_PASSWORD=coolify
 PUSHER_APP_ID=coolify
 PUSHER_APP_KEY=coolify
 PUSHER_APP_SECRET=coolify
+AVATAR_CDN_URL=
diff --git a/.github/workflows/coolify-helper.yml b/.github/workflows/coolify-helper.yml
index f5d0c3f0ad..de0cf3b8d7 100644
--- a/.github/workflows/coolify-helper.yml
+++ b/.github/workflows/coolify-helper.yml
@@ -1,6 +1,7 @@
 name: Coolify Helper Image
 
 on:
+  workflow_dispatch:
   push:
     branches: [ "main" ]
     paths:
diff --git a/AGENTS.md b/AGENTS.md
index 5563a18ec1..f9f8ca563a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -99,9 +99,30 @@ function loginAsRoot(): mixed
 ```
 
 - See `tests/v4/Browser/LoginTest.php`, `tests/v4/Browser/DashboardTest.php`, and `tests/v4/Browser/RegistrationTest.php` for conventions.
-- Chrome driver runs on `localhost:4444`, app on `localhost:8000` (configured in `tests/DuskTestCase.php`).
 - Legacy Dusk macros in `app/Providers/DuskServiceProvider.php` use the old `type()`/`press()` API — do not mix with Pest Browser Plugin's `fill()`/`click()` API.
 
+### How Browser Tests Actually Run (no Docker, no display needed)
+
+`visit()` does NOT hit the dev app on `localhost:8000` and does NOT use the Dusk ChromeDriver on `:4444` (that config in `tests/DuskTestCase.php` is legacy). Instead the Pest Browser Plugin:
+
+1. Starts a local Playwright server (`node node_modules/.bin/playwright run-server`) and launches a **headless Chromium** from `~/.cache/ms-playwright` (install once with `npm install && npx playwright install chromium`).
+2. Boots an **in-process amphp HTTP server** on a random port that serves the Laravel app from the test process itself.
+
+Because the "server" and the test share one PHP process, they share the phpunit env (sqlite `:memory:`, array cache) — so `config()->set(...)`, model writes, and `Cache` calls in the test are visible to browser-issued requests, and `RefreshDatabase` never touches the dev Postgres.
+
+`->screenshot(filename: '...')` writes real PNGs to `tests/Browser/Screenshots/` — read them to visually verify UI state (toasts, modals, stray elements).
+
+### Browser Test Gotchas
+
+- **`Class "Redis" not found` thrown by the HTTP server**: host PHP has no phpredis, and the maintenance-mode store is hard-wired to redis (`config/app.php` → `'maintenance' => ['store' => 'redis']`). Add `config()->set('app.maintenance.store', 'array');` in `beforeEach`.
+- **Every path redirects to onboarding** for a fresh user (`DecideWhatToDoWithUser` + `showBoarding()`). Finish boarding before navigating: `Team::query()->update(['show_boarding' => false]); Cache::flush();` — the `Cache::flush()` is required because `User::currentTeam()` caches the Team for an hour and the in-process server shares that cache.
+- **`->navigate('/path')` races form-submit redirects.** After `->click('Login')`, assert something on the destination page (e.g. `->assertSee('Welcome to Coolify')`) before calling `navigate()`.
+- **Failure messages print the *initial* `visit()` URL**, not the current URL. Read the auto-saved screenshot in `tests/Browser/Screenshots/` to see where the browser actually ended up.
+- **Runs hang forever**: stale Playwright servers from a previously killed run. Fix: `pkill -f "playwright run-server"` and rerun. Healthy runs take seconds.
+- **Guest pages miss `DOMPurify`** (`public/js/purify.min.js` loads only `@auth` in `layouts/base.blade.php`), so toast descriptions fail on unauthenticated pages — log in first for toast-related assertions.
+- Layouts that call `@livewireScripts` manually must also call `@livewireStyles`, otherwise Livewire's asset auto-injection is disabled and `[wire\:loading]`/`[x-cloak]` elements render visible.
+- Run browser test files in their own `php artisan test` invocation — combining them with non-browser test paths in one command can hang the runner.
+
 ## Architecture
 
 ### Backend Structure (app/)
@@ -127,6 +148,11 @@ function loginAsRoot(): mixed
 - Custom gates: `createAnyResource`, `canAccessTerminal`
 - Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
 - Multi-tenancy via Teams — team auto-initializes notification settings on creation
+- Authorize every server-side read and mutation where access can vary by user, role, team, or resource. Use policies, gates, or `$this->authorize(...)`; never rely on hidden Blade/Livewire controls such as `@can` for security.
+- Scope queries to the current team before returning records. Treat route and model identifiers as untrusted, and prevent users from reading or changing resources owned by another team.
+- Apply authorization consistently across Livewire actions, API and web controllers, actions, downloads, exports, search, event listeners, and any other path that exposes or changes protected data.
+- Default to denying access when a policy or ownership relationship is missing or ambiguous. Members must not gain access to administrative, credential, security, billing, or instance-wide data merely because they belong to the team.
+- Add authorization regression tests for protected changes. Cover permitted access, member restrictions where applicable, and cross-team access; verify unauthorized reads and writes return `403` or otherwise reveal no protected data.
 
 ### Event Broadcasting
 - Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
@@ -170,6 +196,23 @@ Coolify seeds **instance-owned** rows at primary key `0`. That value is a sentin
 - Exception handler: `app/Exceptions/Handler.php`
 - Service providers in `app/Providers/`
 
+## Livewire conventions
+
+### Dynamic lists and snapshot errors
+
+When an add, delete, or conversion leaves controls unresponsive and the browser reports `Snapshot missing on Livewire component`, inspect both component keys and refresh events. Stable keys alone may not fix it.
+
+- Give every Livewire component rendered in a loop a stable key based on the record ID, UUID, filename, or another immutable identity. Never include a collection count, `$loop->index`, or a reindexed array position in the key.
+- Pass the same stable identity to edit/delete actions. A keyed row can survive reordering while a `wire:ignore` or teleported Alpine modal keeps its original `submitAction`; an action such as `removeItem($index)` then targets a stale position after the first deletion. Resolve the current row server-side from an ID, UUID, or stable row hash instead.
+- Do not broadcast one refresh event to both a parent list component and children that the parent may insert, remove, or hide during the same operation. This can queue a child update after its snapshot has been removed from the DOM.
+- Split refresh responsibilities into targeted events. Refresh the parent for counts and tab visibility, and refresh an existing child list with a separate event. Use `$this->dispatch('event')->to(Component::class)` instead of a page-wide event when possible.
+- Before targeting a child list, confirm that it existed before the mutation, still exists afterward, and is on the active tab. A newly inserted child loads current data during `mount()` and does not need an immediate refresh. A removed or hidden child must not receive one.
+- A child that deletes itself should finish its own update, then target only the parent to refresh counts. The parent should not send a refresh back to that child when the list became empty.
+- Apply the same pattern to file, directory, conversion, and external reload paths such as Compose edits. One remaining broad event can reproduce the race.
+- Add regression tests that assert the scoped event names, assert the old broad event is not dispatched, and verify that keys do not depend on counts or positions. Manually repeat add/delete operations while watching the browser console.
+
+The persistent-storage implementation is the reference pattern: `Project\Service\Storage` handles `storageCountsChanged`, while `Project\Shared\Storages\All` handles `refreshVolumeList`.
+
 ## Key Conventions
 
 - Use `php artisan make:*` commands with `--no-interaction` to create files
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 73b048f4b6..626f6d7b93 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -228,6 +228,35 @@ A: Yes, but keep in mind a PR closure is feedback, not a rejection of your effor
 ## Local Development
 To build and run Coolify locally, see: [Development](./DEVELOPMENT.md)
 
+### Testing the Coolify Helper Locally
+
+Use `scripts/dev-helper` to build a local helper image and test it with the running development instance. The script requires the standard local Coolify container and the seeded Dockerfile, Docker Compose, and Nixpacks applications.
+
+Run the complete workflow:
+
+```bash
+./scripts/dev-helper test my-helper-test
+```
+
+This builds and selects the helper image, verifies its bundled tools and Docker socket access, runs a Docker Compose smoke test, and deploys all three seeded applications.
+
+You can also run each step separately:
+
+```bash
+./scripts/dev-helper build my-helper-test
+./scripts/dev-helper use my-helper-test
+./scripts/dev-helper verify my-helper-test
+./scripts/dev-helper deploy my-helper-test
+```
+
+Clear the helper override when finished:
+
+```bash
+./scripts/dev-helper reset
+```
+
+The default image repository is `docker.io/coollabsio/coolify-helper`. Set `HELPER_IMAGE_REPOSITORY` to test another repository, or `COOLIFY_CONTAINER` if the local Coolify container has a different name.
+
 ### macOS Development with Lima
 Mac users can use [Lima](https://lima-vm.io/) to run a lightweight Linux virtual machine for local Coolify development. This is useful if you prefer a Linux-based Docker environment on macOS.
 
diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index 66ceb95f64..3feb5117d8 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -13,8 +13,9 @@ class StopApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true)
+    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true, bool $removeContainers = true): ?string
     {
+        $containerPresent = ! $removeContainers;
         $servers = collect([$application->destination->server]);
         if ($application?->additional_servers?->count() > 0) {
             $servers = $servers->merge($application->additional_servers);
@@ -26,6 +27,7 @@ class StopApplication
                 }
 
                 if ($server->isSwarm()) {
+                    $containerPresent = false;
                     instant_remote_process(["docker stack rm {$application->uuid}"], $server);
 
                     continue;
@@ -39,13 +41,17 @@ class StopApplication
                 $timeout = $application->settings->stopGracePeriodSeconds();
 
                 foreach ($containersToStop as $containerName) {
-                    instant_remote_process(command: [
-                        dockerStopCommand($timeout, $containerName, $server),
-                        "docker rm -f $containerName",
-                    ], server: $server, throwError: false);
+                    $commands = [dockerStopCommand($timeout, $containerName, $server)];
+                    if ($removeContainers) {
+                        $commands[] = "docker rm -f $containerName";
+                    } else {
+                        array_unshift($commands, "docker update --restart=no $containerName");
+                    }
+
+                    instant_remote_process(command: $commands, server: $server, throwError: false);
                 }
 
-                if ($application->build_pack === 'dockercompose') {
+                if ($removeContainers && $application->build_pack === 'dockercompose') {
                     $application->deleteConnectedNetworks();
                 }
 
@@ -57,12 +63,16 @@ class StopApplication
             }
         }
 
-        $status = ['status' => 'exited'];
+        $status = [
+            'status' => 'exited',
+            'container_present' => $containerPresent,
+        ];
         if ($resetRestartCount) {
             $status = array_merge($status, [
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
+                'restart_limit_reached' => false,
             ]);
         }
         $application->update($status);
diff --git a/app/Actions/Application/StopApplicationOneServer.php b/app/Actions/Application/StopApplicationOneServer.php
index 10f5b85f21..b25eb481b6 100644
--- a/app/Actions/Application/StopApplicationOneServer.php
+++ b/app/Actions/Application/StopApplicationOneServer.php
@@ -29,7 +29,7 @@ class StopApplicationOneServer
                         instant_remote_process(
                             [
                                 dockerStopCommand($timeout, $containerName, $server),
-                                "docker rm -f $containerName",
+                                dockerRemoveCommand($containerName),
                             ],
                             $server
                         );
diff --git a/app/Actions/Application/StopApplicationPreview.php b/app/Actions/Application/StopApplicationPreview.php
new file mode 100644
index 0000000000..af5f3fc0f0
--- /dev/null
+++ b/app/Actions/Application/StopApplicationPreview.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Actions\Application;
+
+use App\Events\ServiceStatusChanged;
+use App\Models\ApplicationPreview;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class StopApplicationPreview
+{
+    use AsAction;
+
+    public function handle(ApplicationPreview $preview, bool $resetRestartCount = true, bool $removeContainer = true): void
+    {
+        $application = $preview->application;
+        $server = $application->destination->server;
+        $containers = getCurrentApplicationContainerStatus($server, $application->id, $preview->pull_request_id);
+
+        foreach ($containers->pluck('Names') as $containerName) {
+            $commands = [dockerStopCommand($application->settings->stopGracePeriodSeconds(), $containerName, $server)];
+            if ($removeContainer) {
+                $commands[] = "docker rm -f $containerName";
+            } else {
+                array_unshift($commands, "docker update --restart=no $containerName");
+            }
+            instant_remote_process($commands, $server, false);
+        }
+
+        $preview->update(['status' => 'exited']);
+        if ($resetRestartCount) {
+            $preview->resetRestartLimit();
+        }
+
+        ServiceStatusChanged::dispatch($application->environment->project->team->id);
+    }
+}
diff --git a/app/Actions/Database/StartClickhouse.php b/app/Actions/Database/StartClickhouse.php
index b256eb2255..f9e92e08f1 100644
--- a/app/Actions/Database/StartClickhouse.php
+++ b/app/Actions/Database/StartClickhouse.php
@@ -3,12 +3,14 @@
 namespace App\Actions\Database;
 
 use App\Models\StandaloneClickhouse;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartClickhouse
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneClickhouse $database;
 
@@ -16,7 +18,11 @@ class StartClickhouse
 
     public string $configuration_dir;
 
-    public function handle(StandaloneClickhouse $database)
+    private string $resolvedClickhouseUser;
+
+    private string $resolvedClickhousePassword;
+
+    public function handle(StandaloneClickhouse $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -51,7 +57,7 @@ class StartClickhouse
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'clickhouse-client', '--user', (string) $this->database->clickhouse_admin_user, '--password', (string) $this->database->clickhouse_admin_password, '--query', 'SELECT 1',
+                        'CMD', 'clickhouse-client', '--user', $this->resolvedClickhouseUser, '--password', $this->resolvedClickhousePassword, '--query', 'SELECT 1',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -109,7 +115,7 @@ class StartClickhouse
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -147,8 +153,17 @@ class StartClickhouse
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedClickhouseUser = (string) $this->database->clickhouse_admin_user;
+        $this->resolvedClickhousePassword = (string) $this->database->clickhouse_admin_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'CLICKHOUSE_USER') {
+                $this->resolvedClickhouseUser = $rawValue;
+            } elseif ($env->key === 'CLICKHOUSE_PASSWORD') {
+                $this->resolvedClickhousePassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('CLICKHOUSE_USER'))->isEmpty()) {
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index 4b55b0c1df..c7fbff37b5 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -2,6 +2,9 @@
 
 namespace App\Actions\Database;
 
+use App\Enums\ActivityTypes;
+use App\Enums\ProcessStatus;
+use App\Jobs\DatabaseStartJob;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -12,6 +15,7 @@ use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use Lorisleiva\Actions\Concerns\AsAction;
 use Lorisleiva\Actions\Decorators\JobDecorator;
+use Spatie\Activitylog\Models\Activity;
 
 class StartDatabase
 {
@@ -22,38 +26,40 @@ class StartDatabase
         $job->onQueue(deployment_queue());
     }
 
-    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database)
+    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database): Activity|string
     {
         $server = $database->destination->server;
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
-        switch ($database->getMorphClass()) {
-            case StandalonePostgresql::class:
-                $activity = StartPostgresql::run($database);
-                break;
-            case StandaloneRedis::class:
-                $activity = StartRedis::run($database);
-                break;
-            case StandaloneMongodb::class:
-                $activity = StartMongodb::run($database);
-                break;
-            case StandaloneMysql::class:
-                $activity = StartMysql::run($database);
-                break;
-            case StandaloneMariadb::class:
-                $activity = StartMariadb::run($database);
-                break;
-            case StandaloneKeydb::class:
-                $activity = StartKeydb::run($database);
-                break;
-            case StandaloneDragonfly::class:
-                $activity = StartDragonfly::run($database);
-                break;
-            case StandaloneClickhouse::class:
-                $activity = StartClickhouse::run($database);
-                break;
+        $database->resetRestartLimit();
+
+        $activity = activity()
+            ->withProperties([
+                'server_uuid' => $server->uuid,
+                'type' => ActivityTypes::INLINE->value,
+                'type_uuid' => $database->uuid,
+                'status' => ProcessStatus::QUEUED->value,
+                'team_id' => $server->team_id,
+                'operation' => 'database-start',
+            ])
+            ->performedOn($database)
+            ->event(ActivityTypes::INLINE->value)
+            ->log('[]');
+
+        if ($activity === null) {
+            return 'Database start could not be queued because activity logging is disabled.';
+
         }
+
+        DatabaseStartJob::dispatch(
+            $database->getMorphClass(),
+            (int) $database->getKey(),
+            (int) $database->team()->id,
+            (int) $activity->getKey(),
+            auth()->id(),
+        );
+
         if ($database->is_public && $database->public_port) {
             StartDatabaseProxy::dispatch($database);
         }
diff --git a/app/Actions/Database/StartDragonfly.php b/app/Actions/Database/StartDragonfly.php
index ddd930f278..078d557f57 100644
--- a/app/Actions/Database/StartDragonfly.php
+++ b/app/Actions/Database/StartDragonfly.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneDragonfly;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartDragonfly
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneDragonfly $database;
 
@@ -20,7 +22,9 @@ class StartDragonfly
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneDragonfly $database)
+    private string $resolvedRedisPassword;
+
+    public function handle(StandaloneDragonfly $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -107,7 +111,7 @@ class StartDragonfly
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'redis-cli', '-a', (string) $this->database->dragonfly_password, 'ping',
+                        'CMD', 'redis-cli', '-a', $this->resolvedRedisPassword, 'ping',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -196,12 +200,13 @@ class StartDragonfly
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function buildStartCommand(): string
     {
-        $command = "dragonfly --requirepass {$this->database->dragonfly_password}";
+        $escapedRedisPassword = escapeshellarg($this->resolvedRedisPassword);
+        $command = "dragonfly --requirepass {$escapedRedisPassword}";
 
         if ($this->database->enable_ssl) {
             $sslArgs = [
@@ -251,8 +256,14 @@ class StartDragonfly
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedRedisPassword = (string) $this->database->dragonfly_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'REDIS_PASSWORD') {
+                $this->resolvedRedisPassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('REDIS_PASSWORD'))->isEmpty()) {
diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index cc017e3514..3b9cba28f4 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneKeydb;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartKeydb
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneKeydb $database;
 
@@ -20,7 +22,9 @@ class StartKeydb
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneKeydb $database)
+    private string $resolvedRedisPassword;
+
+    public function handle(StandaloneKeydb $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -109,7 +113,7 @@ class StartKeydb
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'keydb-cli', '--pass', (string) $this->database->keydb_password, 'ping',
+                        'CMD', 'keydb-cli', '--pass', $this->resolvedRedisPassword, 'ping',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -214,7 +218,7 @@ class StartKeydb
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -252,8 +256,14 @@ class StartKeydb
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedRedisPassword = (string) $this->database->keydb_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'REDIS_PASSWORD') {
+                $this->resolvedRedisPassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('REDIS_PASSWORD'))->isEmpty()) {
@@ -280,6 +290,7 @@ class StartKeydb
     {
         $hasKeydbConf = ! is_null($this->database->keydb_conf) && ! empty($this->database->keydb_conf);
         $keydbConfPath = '/etc/keydb/keydb.conf';
+        $escapedRedisPassword = escapeshellarg($this->resolvedRedisPassword);
 
         if ($hasKeydbConf) {
             $confContent = $this->database->keydb_conf;
@@ -288,10 +299,10 @@ class StartKeydb
             if ($hasRequirePass) {
                 $command = "keydb-server $keydbConfPath";
             } else {
-                $command = "keydb-server $keydbConfPath --requirepass {$this->database->keydb_password}";
+                $command = "keydb-server $keydbConfPath --requirepass {$escapedRedisPassword}";
             }
         } else {
-            $command = "keydb-server --requirepass {$this->database->keydb_password} --appendonly yes";
+            $command = "keydb-server --requirepass {$escapedRedisPassword} --appendonly yes";
         }
 
         if ($this->database->enable_ssl) {
diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index 2f030ae299..a05da25efd 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneMariadb;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartMariadb
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneMariadb $database;
 
@@ -20,7 +22,7 @@ class StartMariadb
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneMariadb $database)
+    public function handle(StandaloneMariadb $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -216,7 +218,7 @@ class StartMariadb
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -255,7 +257,7 @@ class StartMariadb
     {
         $environment_variables = collect();
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $environment_variables->push($env->key.'='.$this->database->resolveSecretManagerEnvironmentVariable($env));
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('MARIADB_ROOT_PASSWORD'))->isEmpty()) {
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 097e19f7b2..ff338aa99f 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneMongodb;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartMongodb
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneMongodb $database;
 
@@ -20,7 +22,13 @@ class StartMongodb
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneMongodb $database)
+    private string $resolvedMongoUsername;
+
+    private string $resolvedMongoPassword;
+
+    private string $resolvedMongoDatabase;
+
+    public function handle(StandaloneMongodb $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -265,7 +273,7 @@ class StartMongodb
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -303,8 +311,20 @@ class StartMongodb
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedMongoUsername = (string) $this->database->mongo_initdb_root_username;
+        $this->resolvedMongoPassword = (string) $this->database->mongo_initdb_root_password;
+        $this->resolvedMongoDatabase = (string) $this->database->mongo_initdb_database;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'MONGO_INITDB_ROOT_USERNAME') {
+                $this->resolvedMongoUsername = $rawValue;
+            } elseif ($env->key === 'MONGO_INITDB_ROOT_PASSWORD') {
+                $this->resolvedMongoPassword = $rawValue;
+            } elseif ($env->key === 'MONGO_INITDB_DATABASE') {
+                $this->resolvedMongoDatabase = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('MONGO_INITDB_ROOT_USERNAME'))->isEmpty()) {
@@ -337,9 +357,9 @@ class StartMongodb
 
     private function add_default_database()
     {
-        $dbJson = json_encode($this->database->mongo_initdb_database, JSON_UNESCAPED_SLASHES);
-        $userJson = json_encode($this->database->mongo_initdb_root_username, JSON_UNESCAPED_SLASHES);
-        $pwdJson = json_encode($this->database->mongo_initdb_root_password, JSON_UNESCAPED_SLASHES);
+        $dbJson = json_encode($this->resolvedMongoDatabase, JSON_UNESCAPED_SLASHES);
+        $userJson = json_encode($this->resolvedMongoUsername, JSON_UNESCAPED_SLASHES);
+        $pwdJson = json_encode($this->resolvedMongoPassword, JSON_UNESCAPED_SLASHES);
         $content = "db = db.getSiblingDB({$dbJson});db.createCollection('init_collection');db.createUser({user: {$userJson}, pwd: {$pwdJson}, roles: [{role:\"readWrite\",db:{$dbJson}}]});";
         $content_base64 = base64_encode($content);
         $this->commands[] = "mkdir -p $this->configuration_dir/docker-entrypoint-initdb.d";
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index d21ee02fb1..cff8d0b363 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneMysql;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartMysql
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneMysql $database;
 
@@ -20,7 +22,9 @@ class StartMysql
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneMysql $database)
+    private string $resolvedMysqlRootPassword;
+
+    public function handle(StandaloneMysql $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -104,7 +108,7 @@ class StartMysql
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'mysqladmin', 'ping', '-h', 'localhost', '-u', 'root', "-p{$this->database->mysql_root_password}",
+                        'CMD', 'mysqladmin', 'ping', '-h', 'localhost', '-u', 'root', "-p{$this->resolvedMysqlRootPassword}",
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -218,7 +222,7 @@ class StartMysql
 
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -256,8 +260,14 @@ class StartMysql
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedMysqlRootPassword = (string) $this->database->mysql_root_password;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'MYSQL_ROOT_PASSWORD') {
+                $this->resolvedMysqlRootPassword = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('MYSQL_ROOT_PASSWORD'))->isEmpty()) {
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index f70e8f3cfd..f9dd7a3c4f 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandalonePostgresql;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartPostgresql
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandalonePostgresql $database;
 
@@ -22,7 +24,11 @@ class StartPostgresql
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandalonePostgresql $database)
+    private string $resolvedPostgresUser;
+
+    private string $resolvedPostgresDatabase;
+
+    public function handle(StandalonePostgresql $database, ?Activity $activity = null)
     {
         $this->database = $database;
         $container_name = $this->database->uuid;
@@ -111,7 +117,7 @@ class StartPostgresql
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => $this->database->healthCheckConfiguration([
-                        'CMD', 'psql', '-U', (string) $this->database->postgres_user, '-d', (string) $this->database->postgres_db, '-c', 'SELECT 1',
+                        'CMD', 'psql', '-U', $this->resolvedPostgresUser, '-d', $this->resolvedPostgresDatabase, '-c', 'SELECT 1',
                     ]),
                     'mem_limit' => $this->database->limits_memory,
                     'memswap_limit' => $this->database->limits_memory_swap,
@@ -227,7 +233,7 @@ class StartPostgresql
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -265,8 +271,17 @@ class StartPostgresql
     private function generate_environment_variables()
     {
         $environment_variables = collect();
+        $this->resolvedPostgresUser = (string) $this->database->postgres_user;
+        $this->resolvedPostgresDatabase = (string) $this->database->postgres_db;
         foreach ($this->database->runtime_environment_variables as $env) {
-            $environment_variables->push("$env->key=$env->real_value");
+            $rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+            $resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);
+            $environment_variables->push($env->key.'='.$resolvedValue);
+            if ($env->key === 'POSTGRES_USER') {
+                $this->resolvedPostgresUser = $rawValue;
+            } elseif ($env->key === 'POSTGRES_DB') {
+                $this->resolvedPostgresDatabase = $rawValue;
+            }
         }
 
         if ($environment_variables->filter(fn ($env) => str($env)->contains('POSTGRES_USER'))->isEmpty()) {
diff --git a/app/Actions/Database/StartRedis.php b/app/Actions/Database/StartRedis.php
index 8d65453f70..41ece532b1 100644
--- a/app/Actions/Database/StartRedis.php
+++ b/app/Actions/Database/StartRedis.php
@@ -5,12 +5,14 @@ namespace App\Actions\Database;
 use App\Helpers\SslHelper;
 use App\Models\SslCertificate;
 use App\Models\StandaloneRedis;
+use App\Traits\ExecutesDatabaseStartCommands;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Spatie\Activitylog\Models\Activity;
 use Symfony\Component\Yaml\Yaml;
 
 class StartRedis
 {
-    use AsAction;
+    use AsAction, ExecutesDatabaseStartCommands;
 
     public StandaloneRedis $database;
 
@@ -20,7 +22,11 @@ class StartRedis
 
     private ?SslCertificate $ssl_certificate = null;
 
-    public function handle(StandaloneRedis $database)
+    private ?string $resolvedRedisPassword = null;
+
+    private ?string $resolvedRedisUsername = null;
+
+    public function handle(StandaloneRedis $database, ?Activity $activity = null)
     {
         $this->database = $database;
 
@@ -209,7 +215,7 @@ class StartRedis
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
-        return remote_process($this->commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+        return $this->executeDatabaseStartCommands($this->commands, $database, $activity);
     }
 
     private function generate_local_persistent_volumes()
@@ -249,23 +255,40 @@ class StartRedis
         $environment_variables = collect();
 
         foreach ($this->database->runtime_environment_variables as $env) {
+            $usesSecretManager = $this->database->environmentVariableUsesSecretManager($env);
+
             if ($env->is_shared) {
-                $environment_variables->push("$env->key=$env->real_value");
+                $environment_variables->push($env->key.'='.$this->database->resolveSecretManagerEnvironmentVariable($env));
 
                 if ($env->key === 'REDIS_PASSWORD') {
-                    $this->database->update(['redis_password' => $env->real_value]);
+                    $this->resolvedRedisPassword = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+
+                    if (! $usesSecretManager) {
+                        $this->database->update(['redis_password' => $this->resolvedRedisPassword]);
+                    }
                 }
 
                 if ($env->key === 'REDIS_USERNAME') {
-                    $this->database->update(['redis_username' => $env->real_value]);
+                    $this->resolvedRedisUsername = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+
+                    if (! $usesSecretManager) {
+                        $this->database->update(['redis_username' => $this->resolvedRedisUsername]);
+                    }
                 }
             } else {
-                if ($env->key === 'REDIS_PASSWORD') {
+                if ($env->key === 'REDIS_PASSWORD' && ! $usesSecretManager) {
                     $env->update(['value' => $this->database->redis_password]);
-                } elseif ($env->key === 'REDIS_USERNAME') {
+                } elseif ($env->key === 'REDIS_USERNAME' && ! $usesSecretManager) {
                     $env->update(['value' => $this->database->redis_username]);
                 }
-                $environment_variables->push("$env->key=$env->real_value");
+
+                if ($env->key === 'REDIS_PASSWORD') {
+                    $this->resolvedRedisPassword = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+                } elseif ($env->key === 'REDIS_USERNAME') {
+                    $this->resolvedRedisUsername = $this->database->resolveSecretManagerEnvironmentVariableValue($env);
+                }
+
+                $environment_variables->push($env->key.'='.$this->database->resolveSecretManagerEnvironmentVariable($env));
             }
         }
 
@@ -276,6 +299,7 @@ class StartRedis
 
     private function buildStartCommand(): string
     {
+        $redisPassword = $this->resolvedRedisPassword ?? $this->database->redis_password;
         $hasRedisConf = ! is_null($this->database->redis_conf) && ! empty($this->database->redis_conf);
         $redisConfPath = '/usr/local/etc/redis/redis.conf';
 
@@ -286,10 +310,10 @@ class StartRedis
             if ($hasRequirePass) {
                 $command = "redis-server $redisConfPath";
             } else {
-                $command = "redis-server $redisConfPath --requirepass {$this->database->redis_password}";
+                $command = "redis-server $redisConfPath --requirepass {$redisPassword}";
             }
         } else {
-            $command = "redis-server --requirepass {$this->database->redis_password} --appendonly yes";
+            $command = "redis-server --requirepass {$redisPassword} --appendonly yes";
         }
 
         if ($this->database->enable_ssl) {
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index a3a7f16ef0..f3c591acfc 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -4,6 +4,7 @@ namespace App\Actions\Database;
 
 use App\Actions\Server\CleanupDocker;
 use App\Events\ServiceStatusChanged;
+use App\Models\BaseModel;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -18,7 +19,7 @@ class StopDatabase
 {
     use AsAction;
 
-    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database, bool $dockerCleanup = true)
+    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database, bool $dockerCleanup = true, bool $resetRestartCount = true, bool $removeContainer = true): string
     {
         try {
             $server = $database->destination->server;
@@ -26,15 +27,13 @@ class StopDatabase
                 return 'Server is not functional';
             }
 
-            $this->stopContainer($database, $database->uuid, 30);
+            $this->stopContainer($database, $database->uuid, 30, $removeContainer);
 
             // Reset restart tracking when database is manually stopped
-            $database->update([
-                'status' => 'exited',
-                'restart_count' => 0,
-                'last_restart_at' => null,
-                'last_restart_type' => null,
-            ]);
+            $database->update(['status' => 'exited']);
+            if ($resetRestartCount) {
+                $database->resetRestartLimit();
+            }
 
             if ($dockerCleanup) {
                 CleanupDocker::dispatch($server, false, false);
@@ -53,12 +52,15 @@ class StopDatabase
 
     }
 
-    private function stopContainer($database, string $containerName, int $timeout = 30): void
+    private function stopContainer(BaseModel $database, string $containerName, int $timeout = 30, bool $removeContainer = true): void
     {
         $server = $database->destination->server;
-        instant_remote_process(command: [
-            dockerStopCommand($timeout, $containerName, $server),
-            "docker rm -f $containerName",
-        ], server: $server, throwError: false);
+        $commands = [dockerStopCommand($timeout, $containerName, $server)];
+        if ($removeContainer) {
+            $commands[] = "docker rm -f $containerName";
+        } else {
+            array_unshift($commands, "docker update --restart=no $containerName");
+        }
+        instant_remote_process(command: $commands, server: $server, throwError: false);
     }
 }
diff --git a/app/Actions/Database/StopDatabaseProxy.php b/app/Actions/Database/StopDatabaseProxy.php
index 96a1097662..e6789202f3 100644
--- a/app/Actions/Database/StopDatabaseProxy.php
+++ b/app/Actions/Database/StopDatabaseProxy.php
@@ -24,10 +24,10 @@ class StopDatabaseProxy
     {
         $server = data_get($database, 'destination.server');
         $uuid = $database->uuid;
-        if ($database->getMorphClass() === \App\Models\ServiceDatabase::class) {
+        if ($database->getMorphClass() === ServiceDatabase::class) {
             $server = data_get($database, 'service.server');
         }
-        instant_remote_process(["docker rm -f {$uuid}-proxy"], $server);
+        instant_remote_process([dockerRemoveCommand("{$uuid}-proxy")], $server);
 
         $database->save();
 
diff --git a/app/Actions/Destination/RemoveStandaloneDockerNetwork.php b/app/Actions/Destination/RemoveStandaloneDockerNetwork.php
index 21c40a50ad..3e1b5380b6 100644
--- a/app/Actions/Destination/RemoveStandaloneDockerNetwork.php
+++ b/app/Actions/Destination/RemoveStandaloneDockerNetwork.php
@@ -11,6 +11,6 @@ class RemoveStandaloneDockerNetwork
         $safeNetwork = escapeshellarg($destination->network);
 
         instant_remote_process(["docker network disconnect {$safeNetwork} coolify-proxy"], $destination->server, throwError: false);
-        instant_remote_process(["docker network rm -f {$safeNetwork}"], $destination->server);
+        instant_remote_process([dockerNetworkRemoveCommand($destination->network)], $destination->server);
     }
 }
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index 904885dfc5..be098e481c 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -3,15 +3,20 @@
 namespace App\Actions\Docker;
 
 use App\Actions\Application\StopApplication;
+use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
+use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
+use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
 use App\Events\ServiceChecked;
+use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\Server;
 use App\Models\ServiceDatabase;
 use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Services\ContainerStatusAggregator;
+use App\Services\RestartCountTracker;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
@@ -37,8 +42,12 @@ class GetContainersStatus
 
     protected ?Collection $applicationContainerRestartCounts;
 
+    protected ?Collection $previewContainerRestartCounts;
+
     protected ?Collection $serviceContainerStatuses;
 
+    protected ?Collection $serviceContainerRestartCounts;
+
     public function handle(Server $server, ?Collection $containers = null, ?Collection $containerReplicates = null)
     {
         $this->containers = $containers;
@@ -117,6 +126,9 @@ class GetContainersStatus
                 $containerStatus = "$containerStatus:$healthSuffix";
             }
             $labels = Arr::undot(format_docker_labels_to_json($labels));
+            if (filter_var(data_get($labels, 'com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)) {
+                continue;
+            }
             $applicationId = data_get($labels, 'coolify.applicationId');
             if ($applicationId) {
                 $pullRequestId = data_get($labels, 'coolify.pullRequestId');
@@ -133,6 +145,12 @@ class GetContainersStatus
                         } else {
                             $preview->update(['last_online_at' => now()]);
                         }
+                        $key = $applicationId.':'.$pullRequestId;
+                        $this->previewContainerRestartCounts ??= collect();
+                        $this->previewContainerRestartCounts->push([
+                            'key' => $key,
+                            'count' => (int) data_get($container, 'RestartCount', 0),
+                        ]);
                     } else {
                         // Notify user that this container should not be there.
                     }
@@ -140,6 +158,9 @@ class GetContainersStatus
                     $application = $this->applications->where('id', $applicationId)->first();
                     if ($application) {
                         $foundApplications[] = $application->id;
+                        if ($application->container_present !== true) {
+                            $application->update(['container_present' => true]);
+                        }
                         // Store container status for aggregation
                         if (! isset($this->applicationContainerStatuses)) {
                             $this->applicationContainerStatuses = collect();
@@ -220,23 +241,19 @@ class GetContainersStatus
 
                             // Track restart count for databases (single-container)
                             $restartCount = data_get($container, 'RestartCount', 0);
-                            $previousRestartCount = $database->restart_count ?? 0;
-
                             if ($statusFromDb !== $containerStatus) {
                                 $updateData = ['status' => $containerStatus];
                             } else {
                                 $updateData = ['last_online_at' => now()];
                             }
 
-                            // Update restart tracking if restart count increased
-                            if ($restartCount > $previousRestartCount) {
-                                $updateData['restart_count'] = $restartCount;
-                                $updateData['last_restart_at'] = now();
-                                $updateData['last_restart_type'] = 'crash';
-                            }
-
                             $database->update($updateData);
 
+                            if ($database->trackRestartCount((int) $restartCount)) {
+                                StopDatabase::dispatch($database, false, false, false);
+                                $database->team()?->notify(new ApplicationRestartLimitReached($database));
+                            }
+
                             if ($isPublic) {
                                 $foundTcpProxy = $this->containers->filter(function ($value, $key) use ($uuid) {
                                     if ($this->server->isSwarm()) {
@@ -292,6 +309,11 @@ class GetContainersStatus
                 $containerName = data_get($labels, 'com.docker.compose.service');
                 if ($containerName) {
                     $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                    $this->serviceContainerRestartCounts ??= collect();
+                    if (! $this->serviceContainerRestartCounts->has($key)) {
+                        $this->serviceContainerRestartCounts->put($key, collect());
+                    }
+                    $this->serviceContainerRestartCounts->get($key)->put($containerName, (int) data_get($container, 'RestartCount', 0));
                 }
 
                 // Mark service as found
@@ -335,46 +357,35 @@ class GetContainersStatus
                 continue;
             }
 
-            $name = data_get($exitedService, 'name');
-            $fqdn = data_get($exitedService, 'fqdn');
-            if ($name) {
-                if ($fqdn) {
-                    $containerName = "$name, available at $fqdn";
-                } else {
-                    $containerName = $name;
-                }
-            } else {
-                if ($fqdn) {
-                    $containerName = $fqdn;
-                } else {
-                    $containerName = null;
-                }
+            if (! $exitedService->stoppedAfterRestartLimit()) {
+                $exitedService->update([
+                    'status' => 'exited',
+                    'restart_count' => 0,
+                    'restart_limit_reached' => false,
+                    'last_restart_at' => null,
+                    'last_restart_type' => null,
+                ]);
             }
-            $projectUuid = data_get($service, 'environment.project.uuid');
-            $serviceUuid = data_get($service, 'uuid');
-            $environmentName = data_get($service, 'environment.name');
-
-            if ($projectUuid && $serviceUuid && $environmentName) {
-                $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/service/'.$serviceUuid;
-            } else {
-                $url = null;
-            }
-            // $this->server->team?->notify(new ContainerStopped($containerName, $this->server, $url));
-            $exitedService->update(['status' => 'exited']);
         }
 
         $notRunningApplications = $this->applications->pluck('id')->diff($foundApplications);
         foreach ($notRunningApplications as $applicationId) {
             $application = $this->applications->where('id', $applicationId)->first();
-            if (str($application->status)->startsWith('exited')) {
-                continue;
-            }
 
             // Only protection: If no containers at all, Docker query might have failed
             if ($this->containers->isEmpty()) {
                 continue;
             }
 
+            if (str($application->status)->startsWith('exited')) {
+                $application->update([
+                    'container_present' => false,
+                    'restart_limit_reached' => false,
+                ]);
+
+                continue;
+            }
+
             // If container was recently restarting (crash loop), keep it as degraded for a grace period
             // This prevents false "exited" status during the brief moment between container removal and recreation
             $recentlyRestarted = $application->restart_count > 0 &&
@@ -388,9 +399,11 @@ class GetContainersStatus
                 // Reset restart count when application exits completely
                 $application->update([
                     'status' => 'exited',
+                    'container_present' => false,
                     'restart_count' => 0,
                     'last_restart_at' => null,
                     'last_restart_type' => null,
+                    'restart_limit_reached' => false,
                 ]);
             }
         }
@@ -411,6 +424,9 @@ class GetContainersStatus
         $notRunningDatabases = $databases->pluck('id')->diff($foundDatabases);
         foreach ($notRunningDatabases as $database) {
             $database = $databases->where('id', $database)->first();
+            if ($database->stoppedAfterRestartLimit()) {
+                continue;
+            }
             if (str($database->status)->startsWith('exited')) {
                 continue;
             }
@@ -426,6 +442,7 @@ class GetContainersStatus
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
+                'restart_limit_reached' => false,
             ]);
 
             // Stop proxy if database was public
@@ -433,23 +450,10 @@ class GetContainersStatus
                 StopDatabaseProxy::run($database);
             }
 
-            $name = data_get($database, 'name');
-            $fqdn = data_get($database, 'fqdn');
-
-            $containerName = $name;
-
-            $projectUuid = data_get($database, 'environment.project.uuid');
-            $environmentName = data_get($database, 'environment.name');
-            $databaseUuid = data_get($database, 'uuid');
-
-            if ($projectUuid && $databaseUuid && $environmentName) {
-                $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/database/'.$databaseUuid;
-            } else {
-                $url = null;
-            }
-            // $this->server->team?->notify(new ContainerStopped($containerName, $this->server, $url));
         }
 
+        $this->trackPreviewRestartCounts($previews);
+
         // Aggregate multi-container application statuses
         if (isset($this->applicationContainerStatuses) && $this->applicationContainerStatuses->isNotEmpty()) {
             foreach ($this->applicationContainerStatuses as $applicationId => $containerStatuses) {
@@ -470,21 +474,21 @@ class GetContainersStatus
 
                 DB::transaction(function () use ($application, $maxRestartCount, $containerStatuses, &$restartLimitReached) {
                     $previousRestartCount = $application->restart_count ?? 0;
+                    $restartState = (new RestartCountTracker)->evaluate(
+                        previousRestartCount: $previousRestartCount,
+                        observedRestartCount: $maxRestartCount,
+                        maxRestartCount: $application->max_restart_count ?? 0,
+                    );
 
-                    if ($maxRestartCount > $previousRestartCount) {
-                        // Restart count increased - this is a crash restart
+                    if ($restartState['restart_count_changed']) {
+                        $hasCrashRestarts = $restartState['restart_count'] > 0;
                         $application->update([
-                            'restart_count' => $maxRestartCount,
-                            'last_restart_at' => now(),
-                            'last_restart_type' => 'crash',
+                            'restart_count' => $restartState['restart_count'],
+                            'last_restart_at' => $hasCrashRestarts ? now() : null,
+                            'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
                         ]);
-
-                        // Check if restart limit has been reached
-                        $maxAllowedRestarts = $application->max_restart_count ?? 0;
-                        if ($maxAllowedRestarts > 0 && $maxRestartCount >= $maxAllowedRestarts && $previousRestartCount < $maxAllowedRestarts) {
-                            $restartLimitReached = true;
-                        }
                     }
+                    $restartLimitReached = $restartState['restart_limit_reached'];
 
                     // Aggregate status after tracking restart counts
                     $aggregatedStatus = $this->aggregateApplicationStatus($application, $containerStatuses, $maxRestartCount);
@@ -499,9 +503,22 @@ class GetContainersStatus
                 });
 
                 if ($restartLimitReached) {
-                    $application->refresh();
-                    StopApplication::dispatch($application, false, true, false);
-                    $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    $restartLimitClaimed = Application::query()
+                        ->whereKey($application->getKey())
+                        ->where('restart_limit_reached', false)
+                        ->update(['restart_limit_reached' => true]) === 1;
+
+                    if ($restartLimitClaimed) {
+                        $application->refresh();
+                        StopApplication::dispatch(
+                            application: $application,
+                            previewDeployments: false,
+                            dockerCleanup: false,
+                            resetRestartCount: false,
+                            removeContainers: false,
+                        );
+                        $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    }
                 }
             }
         }
@@ -562,6 +579,16 @@ class GetContainersStatus
                 continue;
             }
 
+            $restartCount = isset($this->serviceContainerRestartCounts)
+                ? ($this->serviceContainerRestartCounts->get($key)?->max() ?? 0)
+                : 0;
+            if ($subResource->trackRestartCount($restartCount)) {
+                StopServiceApplication::dispatch($subResource, false, false);
+                $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
+
+                continue;
+            }
+
             // Parse docker compose from service to check for excluded containers
             $dockerComposeRaw = data_get($service, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -602,4 +629,24 @@ class GetContainersStatus
             }
         }
     }
+
+    private function trackPreviewRestartCounts(Collection $previews): void
+    {
+        if (! isset($this->previewContainerRestartCounts)) {
+            return;
+        }
+
+        $this->previewContainerRestartCounts
+            ->groupBy('key')
+            ->each(function (Collection $counts, string $key) use ($previews): void {
+                [$applicationId, $pullRequestId] = explode(':', $key);
+                $preview = $previews->first(fn (ApplicationPreview $preview): bool => (string) $preview->application_id === $applicationId
+                    && (string) $preview->pull_request_id === $pullRequestId
+                );
+                if ($preview?->trackRestartCount((int) $counts->max('count'))) {
+                    StopApplicationPreview::dispatch($preview, false, false);
+                    $preview->application->environment->project->team?->notify(new ApplicationRestartLimitReached($preview));
+                }
+            });
+    }
 }
diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php
index d437a3a176..c69863c572 100644
--- a/app/Actions/Fortify/CreateNewUser.php
+++ b/app/Actions/Fortify/CreateNewUser.php
@@ -2,9 +2,9 @@
 
 namespace App\Actions\Fortify;
 
+use App\Jobs\SendVerificationEmailJob;
 use App\Models\Team;
 use App\Models\User;
-use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Validator;
@@ -22,8 +22,6 @@ class CreateNewUser implements CreatesNewUsers
 
     private const REGISTRATION_EMAIL_IDENTITY_DECAY_SECONDS = 3600;
 
-    public function __construct(private readonly Request $request) {}
-
     /**
      * Validate and create a newly registered user.
      *
@@ -77,7 +75,7 @@ class CreateNewUser implements CreatesNewUsers
             ]);
             $team = $user->teams()->first();
             if (isCloud()) {
-                $user->sendVerificationEmail();
+                SendVerificationEmailJob::dispatch($user);
             } else {
                 $user->markEmailAsVerified();
             }
@@ -95,7 +93,7 @@ class CreateNewUser implements CreatesNewUsers
     {
         $keys = [
             [
-                'key' => 'registration:ip:'.sha1($this->realIp()),
+                'key' => 'registration:ip:'.sha1(auth_rate_limit_ip(request())),
                 'max' => self::REGISTRATION_IP_MAX_ATTEMPTS,
                 'decay' => self::REGISTRATION_IP_DECAY_SECONDS,
             ],
@@ -120,9 +118,4 @@ class CreateNewUser implements CreatesNewUsers
             RateLimiter::hit($limit['key'], $limit['decay']);
         }
     }
-
-    private function realIp(): string
-    {
-        return $this->request->server('REMOTE_ADDR') ?? $this->request->ip();
-    }
 }
diff --git a/app/Actions/Server/StartSentinel.php b/app/Actions/Server/StartSentinel.php
index 9d0f16c293..f7c73523b3 100644
--- a/app/Actions/Server/StartSentinel.php
+++ b/app/Actions/Server/StartSentinel.php
@@ -79,7 +79,7 @@ class StartSentinel
         $trafficMount = $server->isTrafficAnalyticsEnabled()
             ? '-v '.escapeshellarg($server->proxyPath().':'.$server->proxyPath().':ro').' '
             : '';
-        $dockerCommand = "docker run -d $dockerEnvironments --name coolify-sentinel -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db {$trafficMount}--pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
+        $dockerCommand = "docker run -d $dockerEnvironments --name coolify-sentinel -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db {$trafficMount}--pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-start-period 120s --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
 
         instant_remote_process([
             'docker rm -f coolify-sentinel || true',
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 463a8ad5bf..13371d1265 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -24,6 +24,8 @@ class StartService
         }
         $service->saveComposeConfigs();
         $service->isConfigurationChanged(save: true);
+        $service->applications()->get()->each->resetRestartLimit();
+        $service->databases()->get()->each->resetRestartLimit();
         $workdir = $service->workdir();
         // $commands[] = "cd {$workdir}";
         $commands[] = "echo 'Saved configuration files to {$workdir}.'";
diff --git a/app/Actions/Service/StopService.php b/app/Actions/Service/StopService.php
index 5e34c8e6a2..341687d0d2 100644
--- a/app/Actions/Service/StopService.php
+++ b/app/Actions/Service/StopService.php
@@ -49,8 +49,14 @@ class StopService
                 $this->stopContainersInParallel($containersToStop, $server);
             }
 
-            $applications->each->update(['status' => 'exited']);
-            $dbs->each->update(['status' => 'exited']);
+            $applications->each(function ($application): void {
+                $application->update(['status' => 'exited']);
+                $application->resetRestartLimit();
+            });
+            $dbs->each(function ($database): void {
+                $database->update(['status' => 'exited']);
+                $database->resetRestartLimit();
+            });
 
             if ($deleteConnectedNetworks) {
                 $service->deleteConnectedNetworks();
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index 184dcb4919..fa93a78807 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -13,17 +13,26 @@ class StopServiceApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(ServiceApplication|ServiceDatabase $serviceApplication): void
+    public function handle(ServiceApplication|ServiceDatabase $serviceApplication, bool $resetRestartCount = true, bool $removeContainer = false): void
     {
         $service = $serviceApplication->service;
         $server = $service->destination->server;
         $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
 
-        instant_remote_process([
-            "docker stop {$containerName}",
-        ], $server);
+        if ($removeContainer) {
+            $commands = ["docker rm -f {$containerName}"];
+        } else {
+            $commands = [
+                "docker update --restart=no {$containerName}",
+                "docker stop {$containerName}",
+            ];
+        }
+        instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
         $serviceApplication->update(['status' => 'exited']);
+        if ($resetRestartCount) {
+            $serviceApplication->resetRestartLimit();
+        }
         ServiceStatusChanged::dispatch($service->environment->project->team->id);
     }
 }
diff --git a/app/Actions/Service/UpdateServiceApplicationFromApi.php b/app/Actions/Service/UpdateServiceApplicationFromApi.php
index 123b752c0f..004403975b 100644
--- a/app/Actions/Service/UpdateServiceApplicationFromApi.php
+++ b/app/Actions/Service/UpdateServiceApplicationFromApi.php
@@ -56,7 +56,7 @@ class UpdateServiceApplicationFromApi
                 }
             }
 
-            $serviceApplication->fqdn = $parsed['normalized'];
+            $serviceApplication->setEditableUrls($parsed['normalized']);
         }
 
         if (array_key_exists('noindex_domains', $payload)) {
diff --git a/app/Actions/Shared/CheckDomainDns.php b/app/Actions/Shared/CheckDomainDns.php
new file mode 100644
index 0000000000..d0cea0fb1c
--- /dev/null
+++ b/app/Actions/Shared/CheckDomainDns.php
@@ -0,0 +1,142 @@
+<?php
+
+namespace App\Actions\Shared;
+
+use App\Models\Server;
+use Lorisleiva\Actions\Concerns\AsAction;
+use PurplePixie\PhpDns\DNSQuery;
+use PurplePixie\PhpDns\DNSTypes;
+use Spatie\Url\Url;
+
+class CheckDomainDns
+{
+    use AsAction;
+
+    /**
+     * @param  array<string, string>  $entries
+     * @return array<string, array{status: string, message: string, expected_ip: ?string, checked_at: string}>
+     */
+    public function handle(
+        array $entries,
+        ?Server $server,
+        ?string $expectedIp,
+        bool $skipForMultipleServers = false,
+        int $timeoutSeconds = 5,
+    ): array {
+        if (! data_get(instanceSettings(), 'is_dns_validation_enabled')) {
+            return $this->sameResultForAll($entries, 'skipped', 'DNS validation is disabled in instance settings.', $expectedIp);
+        }
+
+        if (! $server) {
+            return $this->sameResultForAll($entries, 'skipped', 'No server available for DNS validation.', null);
+        }
+
+        if ($skipForMultipleServers) {
+            return $this->sameResultForAll($entries, 'skipped', 'DNS check skipped for multi-server applications.', $expectedIp);
+        }
+
+        $deadline = hrtime(true) + ($timeoutSeconds * 1_000_000_000);
+        $dnsServers = str(data_get(instanceSettings(), 'custom_dns_servers'))
+            ->explode(',')
+            ->map(fn ($dnsServer) => trim((string) $dnsServer))
+            ->filter()
+            ->values();
+        $results = [];
+
+        foreach ($entries as $key => $url) {
+            $results[$key] = $this->check($url, $server, $expectedIp, $dnsServers->all(), $deadline);
+        }
+
+        return $results;
+    }
+
+    /**
+     * @param  array<int, string>  $dnsServers
+     * @return array{status: string, message: string, expected_ip: ?string, checked_at: string}
+     */
+    private function check(string $url, Server $server, ?string $expectedIp, array $dnsServers, int $deadline): array
+    {
+        try {
+            $host = Url::fromString($url)->getHost();
+        } catch (\Throwable) {
+            return $this->result('failed', 'Could not validate DNS for this domain.', $expectedIp);
+        }
+        if (str($host)->contains('sslip.io')) {
+            return $this->result('ok', 'DNS looks correct.', $expectedIp);
+        }
+
+        $type = dnsRecordTypeForIp($expectedIp) === 'AAAA' ? DNSTypes::NAME_AAAA : DNSTypes::NAME_A;
+
+        foreach ($dnsServers as $dnsServer) {
+            $remainingNanoseconds = $deadline - hrtime(true);
+            if ($remainingNanoseconds < 1_000_000_000) {
+                return $this->result('failed', 'Could not validate DNS for this domain.', $expectedIp);
+            }
+
+            try {
+                $query = app()->make(DNSQuery::class, [
+                    'server' => $dnsServer,
+                    'port' => 53,
+                    'timeout' => min(5, (int) floor($remainingNanoseconds / 1_000_000_000)),
+                ]);
+                $records = $query->query($host, $type);
+
+                if ($records === false || $query->hasError()) {
+                    continue;
+                }
+
+                foreach ($records as $record) {
+                    if ($record->getType() !== $type) {
+                        continue;
+                    }
+
+                    if (isCloudflareIp($record->getData()) || ($expectedIp && $record->getData() === $expectedIp)) {
+                        return $this->result('ok', $this->successMessage($server, $expectedIp), $expectedIp);
+                    }
+                }
+            } catch (\Throwable) {
+                continue;
+            }
+        }
+
+        return $this->result('failed', dnsMismatchGuidanceMessage($expectedIp, $expectedIp), $expectedIp);
+    }
+
+    private function successMessage(Server $server, ?string $expectedIp): string
+    {
+        if (
+            filled($expectedIp)
+            && filled($server->ip)
+            && $server->ip !== $expectedIp
+            && filter_var($server->ip, FILTER_VALIDATE_IP) === false
+        ) {
+            return "DNS points to {$expectedIp} ({$server->ip}) (or Cloudflare).";
+        }
+
+        return $expectedIp ? "DNS points to {$expectedIp} (or Cloudflare)." : 'DNS looks correct.';
+    }
+
+    /**
+     * @return array{status: string, message: string, expected_ip: ?string, checked_at: string}
+     */
+    private function result(string $status, string $message, ?string $expectedIp): array
+    {
+        return [
+            'status' => $status,
+            'message' => $message,
+            'expected_ip' => $expectedIp,
+            'checked_at' => now()->toIso8601String(),
+        ];
+    }
+
+    /**
+     * @param  array<string, string>  $entries
+     * @return array<string, array{status: string, message: string, expected_ip: ?string, checked_at: string}>
+     */
+    private function sameResultForAll(array $entries, string $status, string $message, ?string $expectedIp): array
+    {
+        $result = $this->result($status, $message, $expectedIp);
+
+        return array_fill_keys(array_keys($entries), $result);
+    }
+}
diff --git a/app/Console/Commands/CleanupDatabase.php b/app/Console/Commands/CleanupDatabase.php
index 347ea94193..65f686ba61 100644
--- a/app/Console/Commands/CleanupDatabase.php
+++ b/app/Console/Commands/CleanupDatabase.php
@@ -2,6 +2,7 @@
 
 namespace App\Console\Commands;
 
+use App\Models\AuditEvent;
 use Illuminate\Console\Command;
 use Illuminate\Support\Facades\DB;
 
@@ -49,6 +50,12 @@ class CleanupDatabase extends Command
             $activity_log->delete();
         }
 
+        $count = DB::table('audit_events')->where('created_at', '<', now()->subDays(90))->count();
+        echo "Delete $count entries from audit_events.\n";
+        if ($this->option('yes')) {
+            AuditEvent::pruneExpired();
+        }
+
         // Cleanup application_deployment_queues table
         $application_deployment_queues = DB::table('application_deployment_queues')->where('created_at', '<', now()->subDays($keep_days))->orderBy('created_at', 'desc')->skip(10);
         $count = $application_deployment_queues->count();
diff --git a/app/Console/Commands/CleanupStuckedResources.php b/app/Console/Commands/CleanupStuckedResources.php
index 165a3ae219..0874970fb6 100644
--- a/app/Console/Commands/CleanupStuckedResources.php
+++ b/app/Console/Commands/CleanupStuckedResources.php
@@ -13,7 +13,6 @@ use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
-use App\Models\SslCertificate;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -39,13 +38,14 @@ class CleanupStuckedResources extends Command
     private function cleanup_stucked_resources()
     {
         try {
-            $teams = Team::all()->filter(function ($team) {
-                return $team->members()->count() === 0 && $team->servers()->count() === 0;
-            });
+            $teams = Team::query()
+                ->whereDoesntHave('members')
+                ->whereDoesntHave('servers')
+                ->lazyById();
             foreach ($teams as $team) {
                 $team->delete();
             }
-            $servers = Server::all()->filter(function ($server) {
+            $servers = Server::query()->with('team.subscription')->lazyById()->filter(function ($server) {
                 return $server->isFunctional();
             });
             if (isCloud()) {
@@ -60,7 +60,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stucked resources: {$e->getMessage()}\n";
         }
         try {
-            $servers = Server::onlyTrashed()->get();
+            $servers = Server::onlyTrashed()->lazyById();
             foreach ($servers as $server) {
                 echo "Force deleting stuck server: {$server->name}\n";
                 $server->forceDelete();
@@ -69,7 +69,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck servers: {$e->getMessage()}\n";
         }
         try {
-            $applicationsDeploymentQueue = ApplicationDeploymentQueue::get();
+            $applicationsDeploymentQueue = ApplicationDeploymentQueue::query()->lazyById();
             foreach ($applicationsDeploymentQueue as $applicationDeploymentQueue) {
                 if (is_null($applicationDeploymentQueue->application)) {
                     echo "Deleting stuck application deployment queue: {$applicationDeploymentQueue->id}\n";
@@ -80,7 +80,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck application deployment queue: {$e->getMessage()}\n";
         }
         try {
-            $applications = Application::withTrashed()->whereNotNull('deleted_at')->get();
+            $applications = Application::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($applications as $application) {
                 echo "Deleting stuck application: {$application->name}\n";
                 DeleteResourceJob::dispatch($application);
@@ -89,18 +89,18 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck application: {$e->getMessage()}\n";
         }
         try {
-            $applicationsPreviews = ApplicationPreview::get();
+            $applicationsPreviews = ApplicationPreview::query()
+                ->whereDoesntHave('application')
+                ->lazyById();
             foreach ($applicationsPreviews as $applicationPreview) {
-                if (! data_get($applicationPreview, 'application')) {
-                    echo "Deleting stuck application preview: {$applicationPreview->uuid}\n";
-                    DeleteResourceJob::dispatch($applicationPreview);
-                }
+                echo "Deleting stuck application preview: {$applicationPreview->uuid}\n";
+                DeleteResourceJob::dispatch($applicationPreview);
             }
         } catch (\Throwable $e) {
             echo "Error in cleaning stuck application: {$e->getMessage()}\n";
         }
         try {
-            $applicationsPreviews = ApplicationPreview::withTrashed()->whereNotNull('deleted_at')->get();
+            $applicationsPreviews = ApplicationPreview::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($applicationsPreviews as $applicationPreview) {
                 echo "Deleting stuck application preview: {$applicationPreview->fqdn}\n";
                 DeleteResourceJob::dispatch($applicationPreview);
@@ -109,7 +109,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck application: {$e->getMessage()}\n";
         }
         try {
-            $postgresqls = StandalonePostgresql::withTrashed()->whereNotNull('deleted_at')->get();
+            $postgresqls = StandalonePostgresql::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($postgresqls as $postgresql) {
                 echo "Deleting stuck postgresql: {$postgresql->name}\n";
                 DeleteResourceJob::dispatch($postgresql);
@@ -118,7 +118,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck postgresql: {$e->getMessage()}\n";
         }
         try {
-            $rediss = StandaloneRedis::withTrashed()->whereNotNull('deleted_at')->get();
+            $rediss = StandaloneRedis::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($rediss as $redis) {
                 echo "Deleting stuck redis: {$redis->name}\n";
                 DeleteResourceJob::dispatch($redis);
@@ -127,7 +127,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck redis: {$e->getMessage()}\n";
         }
         try {
-            $keydbs = StandaloneKeydb::withTrashed()->whereNotNull('deleted_at')->get();
+            $keydbs = StandaloneKeydb::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($keydbs as $keydb) {
                 echo "Deleting stuck keydb: {$keydb->name}\n";
                 DeleteResourceJob::dispatch($keydb);
@@ -136,7 +136,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck keydb: {$e->getMessage()}\n";
         }
         try {
-            $dragonflies = StandaloneDragonfly::withTrashed()->whereNotNull('deleted_at')->get();
+            $dragonflies = StandaloneDragonfly::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($dragonflies as $dragonfly) {
                 echo "Deleting stuck dragonfly: {$dragonfly->name}\n";
                 DeleteResourceJob::dispatch($dragonfly);
@@ -145,7 +145,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck dragonfly: {$e->getMessage()}\n";
         }
         try {
-            $clickhouses = StandaloneClickhouse::withTrashed()->whereNotNull('deleted_at')->get();
+            $clickhouses = StandaloneClickhouse::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($clickhouses as $clickhouse) {
                 echo "Deleting stuck clickhouse: {$clickhouse->name}\n";
                 DeleteResourceJob::dispatch($clickhouse);
@@ -154,7 +154,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck clickhouse: {$e->getMessage()}\n";
         }
         try {
-            $mongodbs = StandaloneMongodb::withTrashed()->whereNotNull('deleted_at')->get();
+            $mongodbs = StandaloneMongodb::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($mongodbs as $mongodb) {
                 echo "Deleting stuck mongodb: {$mongodb->name}\n";
                 DeleteResourceJob::dispatch($mongodb);
@@ -163,7 +163,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck mongodb: {$e->getMessage()}\n";
         }
         try {
-            $mysqls = StandaloneMysql::withTrashed()->whereNotNull('deleted_at')->get();
+            $mysqls = StandaloneMysql::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($mysqls as $mysql) {
                 echo "Deleting stuck mysql: {$mysql->name}\n";
                 DeleteResourceJob::dispatch($mysql);
@@ -172,7 +172,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck mysql: {$e->getMessage()}\n";
         }
         try {
-            $mariadbs = StandaloneMariadb::withTrashed()->whereNotNull('deleted_at')->get();
+            $mariadbs = StandaloneMariadb::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($mariadbs as $mariadb) {
                 echo "Deleting stuck mariadb: {$mariadb->name}\n";
                 DeleteResourceJob::dispatch($mariadb);
@@ -181,7 +181,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck mariadb: {$e->getMessage()}\n";
         }
         try {
-            $services = Service::withTrashed()->whereNotNull('deleted_at')->get();
+            $services = Service::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($services as $service) {
                 echo "Deleting stuck service: {$service->name}\n";
                 DeleteResourceJob::dispatch($service);
@@ -190,7 +190,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck service: {$e->getMessage()}\n";
         }
         try {
-            $serviceApps = ServiceApplication::withTrashed()->whereNotNull('deleted_at')->get();
+            $serviceApps = ServiceApplication::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($serviceApps as $serviceApp) {
                 echo "Deleting stuck serviceapp: {$serviceApp->name}\n";
                 $serviceApp->forceDelete();
@@ -199,7 +199,7 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck serviceapp: {$e->getMessage()}\n";
         }
         try {
-            $serviceDbs = ServiceDatabase::withTrashed()->whereNotNull('deleted_at')->get();
+            $serviceDbs = ServiceDatabase::withTrashed()->whereNotNull('deleted_at')->lazyById();
             foreach ($serviceDbs as $serviceDb) {
                 echo "Deleting stuck serviceapp: {$serviceDb->name}\n";
                 $serviceDb->forceDelete();
@@ -208,19 +208,27 @@ class CleanupStuckedResources extends Command
             echo "Error in cleaning stuck serviceapp: {$e->getMessage()}\n";
         }
         try {
-            $scheduled_tasks = ScheduledTask::all();
+            $scheduled_tasks = ScheduledTask::query()
+                ->where(function ($query): void {
+                    $query->where(function ($query): void {
+                        $query->whereNull('application_id')->whereNull('service_id');
+                    })->orWhere(function ($query): void {
+                        $query->whereNotNull('application_id')->whereDoesntHave('application');
+                    })->orWhere(function ($query): void {
+                        $query->whereNotNull('service_id')->whereDoesntHave('service');
+                    });
+                })
+                ->lazyById();
             foreach ($scheduled_tasks as $scheduled_task) {
-                if (! $scheduled_task->service && ! $scheduled_task->application) {
-                    echo "Deleting stuck scheduledtask: {$scheduled_task->name}\n";
-                    $scheduled_task->delete();
-                }
+                echo "Deleting stuck scheduledtask: {$scheduled_task->name}\n";
+                $scheduled_task->delete();
             }
         } catch (\Throwable $e) {
             echo "Error in cleaning stuck scheduledtasks: {$e->getMessage()}\n";
         }
 
         try {
-            $scheduled_backups = ScheduledDatabaseBackup::all();
+            $scheduled_backups = ScheduledDatabaseBackup::query()->lazyById();
             foreach ($scheduled_backups as $scheduled_backup) {
                 try {
                     $server = $scheduled_backup->server();
@@ -238,7 +246,7 @@ class CleanupStuckedResources extends Command
 
         // Cleanup any resources that are not attached to any environment or destination or server
         try {
-            $applications = Application::all();
+            $applications = Application::query()->lazyById();
             foreach ($applications as $application) {
                 if (! data_get($application, 'environment')) {
                     echo 'Application without environment: '.$application->name.'\n';
@@ -263,7 +271,7 @@ class CleanupStuckedResources extends Command
             echo "Error in application: {$e->getMessage()}\n";
         }
         try {
-            $postgresqls = StandalonePostgresql::all()->where('id', '!=', 0);
+            $postgresqls = StandalonePostgresql::query()->where('id', '!=', 0)->lazyById();
             foreach ($postgresqls as $postgresql) {
                 if (! data_get($postgresql, 'environment')) {
                     echo 'Postgresql without environment: '.$postgresql->name.'\n';
@@ -288,7 +296,7 @@ class CleanupStuckedResources extends Command
             echo "Error in postgresql: {$e->getMessage()}\n";
         }
         try {
-            $redis = StandaloneRedis::all();
+            $redis = StandaloneRedis::query()->lazyById();
             foreach ($redis as $redis) {
                 if (! data_get($redis, 'environment')) {
                     echo 'Redis without environment: '.$redis->name.'\n';
@@ -314,7 +322,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $mongodbs = StandaloneMongodb::all();
+            $mongodbs = StandaloneMongodb::query()->lazyById();
             foreach ($mongodbs as $mongodb) {
                 if (! data_get($mongodb, 'environment')) {
                     echo 'Mongodb without environment: '.$mongodb->name.'\n';
@@ -340,7 +348,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $mysqls = StandaloneMysql::all();
+            $mysqls = StandaloneMysql::query()->lazyById();
             foreach ($mysqls as $mysql) {
                 if (! data_get($mysql, 'environment')) {
                     echo 'Mysql without environment: '.$mysql->name.'\n';
@@ -366,7 +374,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $mariadbs = StandaloneMariadb::all();
+            $mariadbs = StandaloneMariadb::query()->lazyById();
             foreach ($mariadbs as $mariadb) {
                 if (! data_get($mariadb, 'environment')) {
                     echo 'Mariadb without environment: '.$mariadb->name.'\n';
@@ -392,7 +400,7 @@ class CleanupStuckedResources extends Command
         }
 
         try {
-            $services = Service::all();
+            $services = Service::query()->lazyById();
             foreach ($services as $service) {
                 if (! data_get($service, 'environment')) {
                     echo 'Service without environment: '.$service->name.'\n';
@@ -417,43 +425,23 @@ class CleanupStuckedResources extends Command
             echo "Error in service: {$e->getMessage()}\n";
         }
         try {
-            $serviceApplications = ServiceApplication::all();
+            $serviceApplications = ServiceApplication::query()->whereDoesntHave('service')->lazyById();
             foreach ($serviceApplications as $service) {
-                if (! data_get($service, 'service')) {
-                    echo 'ServiceApplication without service: '.$service->name.'\n';
-                    $service->forceDelete();
-
-                    continue;
-                }
+                echo 'ServiceApplication without service: '.$service->name.'\n';
+                $service->forceDelete();
             }
         } catch (\Throwable $e) {
             echo "Error in serviceApplications: {$e->getMessage()}\n";
         }
         try {
-            $serviceDatabases = ServiceDatabase::all();
+            $serviceDatabases = ServiceDatabase::query()->whereDoesntHave('service')->lazyById();
             foreach ($serviceDatabases as $service) {
-                if (! data_get($service, 'service')) {
-                    echo 'ServiceDatabase without service: '.$service->name.'\n';
-                    $service->forceDelete();
-
-                    continue;
-                }
+                echo 'ServiceDatabase without service: '.$service->name.'\n';
+                $service->forceDelete();
             }
         } catch (\Throwable $e) {
             echo "Error in ServiceDatabases: {$e->getMessage()}\n";
         }
 
-        try {
-            $orphanedCerts = SslCertificate::whereNotIn('server_id', function ($query) {
-                $query->select('id')->from('servers');
-            })->get();
-
-            foreach ($orphanedCerts as $cert) {
-                echo "Deleting orphaned SSL certificate: {$cert->id} (server_id: {$cert->server_id})\n";
-                $cert->delete();
-            }
-        } catch (\Throwable $e) {
-            echo "Error in cleaning orphaned SSL certificates: {$e->getMessage()}\n";
-        }
     }
 }
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index e6dc323838..8d4d017c81 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -46,6 +46,10 @@ class Kernel extends ConsoleKernel
             ->hourly()
             ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
+        $this->scheduleInstance->command('cleanup:stucked-resources')
+            ->daily()
+            ->onOneServer()
+            ->withoutOverlapping(60);
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
diff --git a/app/Http/Controllers/Api/ApplicationSecretManagerController.php b/app/Http/Controllers/Api/ApplicationSecretManagerController.php
new file mode 100644
index 0000000000..c8c311766d
--- /dev/null
+++ b/app/Http/Controllers/Api/ApplicationSecretManagerController.php
@@ -0,0 +1,123 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\Application;
+use App\Models\IntegrationToken;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use OpenApi\Attributes as OA;
+
+class ApplicationSecretManagerController extends Controller
+{
+    #[OA\Patch(
+        summary: 'Configure Application Secret Manager',
+        description: 'Configure the secret manager source used by an application.',
+        path: '/applications/{uuid}/secret-manager',
+        operationId: 'configure-application-secret-manager',
+        security: [['bearerAuth' => []]],
+        tags: ['Secret Managers'],
+        parameters: [new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string'))],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: new OA\JsonContent(
+                required: ['integration_token_uuid'],
+                properties: [
+                    new OA\Property(property: 'integration_token_uuid', type: 'string'),
+                    new OA\Property(property: 'settings', type: 'object'),
+                ],
+            ),
+        ),
+        responses: [
+            new OA\Response(response: 200, description: 'Secret manager configured.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function update(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)
+            ->where('uuid', $request->route('uuid'))
+            ->first();
+
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $body = $request->json()->all();
+        $token = IntegrationToken::query()
+            ->where('team_id', $teamId)
+            ->where('uuid', $body['integration_token_uuid'] ?? '')
+            ->whereIn('provider', IntegrationToken::SECRET_MANAGER_PROVIDERS)
+            ->first();
+
+        if (! $token || ! in_array('secrets', $token->capabilities ?? [], true)) {
+            return response()->json(['message' => 'Secret manager integration token not found.'], 404);
+        }
+
+        $rules = [
+            'integration_token_uuid' => ['required', 'string'],
+            'settings' => ['sometimes', 'array'],
+        ];
+        $rules += match ($token->provider) {
+            'doppler' => $token->dopplerTokenType() === 'service_account' ? [
+                'settings.project' => ['required', 'string'],
+                'settings.config' => ['required', 'string'],
+            ] : [],
+            'infisical' => [
+                'settings.project_id' => ['required', 'string'],
+                'settings.environment' => ['required', 'string'],
+                'settings.secret_path' => ['nullable', 'string'],
+            ],
+            'vault' => [
+                'settings.mount' => ['required', 'string'],
+                'settings.path' => ['required', 'string'],
+            ],
+            default => [],
+        };
+
+        $validator = customApiValidator($body, $rules);
+        $extraFields = array_diff(array_keys($body), ['integration_token_uuid', 'settings']);
+
+        if ($validator->fails() || $extraFields !== []) {
+            $errors = $validator->errors();
+            foreach ($extraFields as $field) {
+                $errors->add($field, 'This field is not allowed.');
+            }
+
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+
+        $settings = array_filter($validator->validated()['settings'] ?? [], fn ($value) => filled($value));
+        $application->secretManagerLink()->updateOrCreate([], [
+            'integration_token_id' => $token->id,
+            'settings' => $settings ?: null,
+        ]);
+
+        auditLog('api.application.secret_manager.updated', [
+            'team_id' => $teamId,
+            'application_uuid' => $application->uuid,
+            'integration_token_uuid' => $token->uuid,
+        ]);
+
+        return response()->json([
+            'integration_token_uuid' => $token->uuid,
+            'provider' => $token->provider,
+            'settings' => $settings ?: null,
+        ]);
+    }
+}
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 601c364de2..727f34f801 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -23,6 +23,7 @@ use App\Rules\DockerImageFormat;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Services\DockerImageParser;
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -1604,7 +1605,12 @@ class ApplicationsController extends Controller
             if ($return instanceof JsonResponse) {
                 return $return;
             }
-            $githubApp = GithubApp::whereTeamId($teamId)->where('uuid', $githubAppUuid)->first();
+            $githubApp = GithubApp::where('uuid', $githubAppUuid)
+                ->where(function ($query) use ($teamId) {
+                    $query->where('team_id', $teamId)
+                        ->orWhere('is_system_wide', true);
+                })
+                ->first();
             if (! $githubApp) {
                 return response()->json(['message' => 'Github App not found.'], 404);
             }
@@ -2482,6 +2488,256 @@ class ApplicationsController extends Controller
         ]);
     }
 
+    #[OA\Patch(
+        summary: 'Update Preview Domains',
+        description: 'Replace domains for a preview deployment. Use domains for regular applications or docker_compose_domains for Docker Compose applications. Ports are stored as internal overrides while public domains remain portless.',
+        path: '/applications/{uuid}/previews/{pull_request_id}',
+        operationId: 'update-preview-domains-by-pull-request-id',
+        security: [['bearerAuth' => []]],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'pull_request_id', in: 'path', required: true, schema: new OA\Schema(type: 'integer')),
+        ],
+        requestBody: new OA\RequestBody(required: true, content: new OA\JsonContent(
+            properties: [
+                new OA\Property(property: 'domains', type: 'string', nullable: true, example: 'https://pr.example.com:3000'),
+                new OA\Property(
+                    property: 'docker_compose_domains',
+                    type: 'array',
+                    nullable: true,
+                    items: new OA\Items(properties: [
+                        new OA\Property(property: 'name', type: 'string'),
+                        new OA\Property(property: 'domain', type: 'string', nullable: true),
+                        new OA\Property(property: 'redirect', type: 'string', nullable: true, enum: ['www', 'non-www', 'both']),
+                    ], type: 'object'),
+                ),
+                new OA\Property(property: 'force_domain_override', type: 'boolean', default: false),
+            ],
+        )),
+        responses: [
+            new OA\Response(response: 200, description: 'Preview domains updated.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, ref: '#/components/responses/403'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 409, description: 'Domain conflict.'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function update_preview_by_pull_request_id(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $pullRequestIdRaw = $request->route('pull_request_id');
+        if (! ctype_digit((string) $pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+            return response()->json(['message' => 'Invalid pull_request_id.'], 422);
+        }
+
+        $preview = ApplicationPreview::where('application_id', $application->id)
+            ->where('pull_request_id', (int) $pullRequestIdRaw)
+            ->first();
+        if (! $preview) {
+            return response()->json(['message' => 'Preview not found.'], 404);
+        }
+
+        $isCompose = $application->build_pack === BuildPackTypes::DOCKERCOMPOSE->value;
+        $validationRules = ['force_domain_override' => 'boolean'];
+        if ($isCompose) {
+            $validationRules = array_merge($validationRules, [
+                'domains' => 'missing',
+                'docker_compose_domains' => 'present|array',
+                'docker_compose_domains.*' => 'array:name,domain,redirect',
+                'docker_compose_domains.*.name' => 'required|string|distinct',
+                'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
+                'docker_compose_domains.*.redirect' => 'nullable|string|in:www,non-www,both',
+            ]);
+        } else {
+            $validationRules['domains'] = ['present', ...ValidationPatterns::applicationDomainRules()];
+            $validationRules['docker_compose_domains'] = 'missing';
+        }
+
+        $validator = Validator::make($request->all(), $validationRules);
+        if ($validator->fails()) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $validator->errors()], 422);
+        }
+
+        $dockerComposeDomains = null;
+        $dockerComposeDomainsResponse = null;
+        if ($isCompose) {
+            try {
+                $compose = Yaml::parse($application->docker_compose_raw ?? '');
+            } catch (\Throwable) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'The Docker Compose configuration could not be parsed.'],
+                ], 422);
+            }
+
+            $services = data_get($compose, 'services');
+            if (! is_array($services) || $services === []) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'The Docker Compose configuration must define at least one service.'],
+                ], 422);
+            }
+
+            $composeServices = collect($services)
+                ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
+                ->keys()
+                ->map(fn (mixed $name): string => (string) $name)
+                ->values();
+            $requestedServices = collect($request->input('docker_compose_domains'))->pluck('name');
+            if ($requestedServices->diff($composeServices)->isNotEmpty()) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'One or more Docker Compose services are invalid.'],
+                ], 422);
+            }
+
+            $existingComposeDomains = json_decode($preview->docker_compose_domains ?? '[]', true) ?: [];
+            $dockerComposeDomains = $composeServices
+                ->mapWithKeys(function (string $service) use ($existingComposeDomains): array {
+                    $entry = ['domain' => ''];
+                    $redirect = $existingComposeDomains[$service]['redirect'] ?? null;
+                    if (in_array($redirect, ['www', 'non-www', 'both'], true)) {
+                        $entry['redirect'] = $redirect;
+                    }
+
+                    return [$service => $entry];
+                })
+                ->all();
+            foreach ($request->input('docker_compose_domains') as $item) {
+                $entry = ['domain' => ValidationPatterns::normalizeApplicationDomains(data_get($item, 'domain')) ?? ''];
+                $redirect = array_key_exists('redirect', $item)
+                    ? data_get($item, 'redirect')
+                    : ($existingComposeDomains[data_get($item, 'name')]['redirect'] ?? null);
+                if (in_array($redirect, ['www', 'non-www', 'both'], true)) {
+                    $entry['redirect'] = $redirect;
+                }
+                $dockerComposeDomains[data_get($item, 'name')] = $entry;
+            }
+            $domains = collect($dockerComposeDomains)
+                ->pluck('domain')
+                ->filter()
+                ->implode(',') ?: null;
+        } else {
+            $domains = ValidationPatterns::normalizeApplicationDomains($request->input('domains'));
+        }
+
+        $submittedUrls = collect(ValidationPatterns::applicationDomainList($domains))
+            ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain));
+        if ($submittedUrls->duplicates()->isNotEmpty()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [
+                    $isCompose ? 'docker_compose_domains' : 'domains' => 'The same domain cannot be configured more than once.',
+                ],
+            ], 422);
+        }
+
+        $normalized = DomainPortOverrides::normalize($domains, null);
+        $portlessDomains = $normalized['fqdn'];
+        if ($isCompose) {
+            foreach ($dockerComposeDomains as $service => $entry) {
+                $dockerComposeDomains[$service]['domain'] = collect(ValidationPatterns::applicationDomainList($entry['domain']))
+                    ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                    ->implode(',');
+            }
+            $dockerComposeDomainsResponse = collect($dockerComposeDomains)
+                ->map(fn (array $entry, string $name): array => ['name' => $name, ...$entry])
+                ->values()
+                ->all();
+        }
+        $urls = collect(ValidationPatterns::applicationDomainList($portlessDomains));
+        $conflicts = checkIfDomainIsAlreadyUsedViaAPI($urls, $teamId);
+        if (isset($conflicts['error'])) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [$isCompose ? 'docker_compose_domains' : 'domains' => $conflicts['error']],
+            ], 422);
+        }
+        if ($conflicts['hasConflicts'] && ! $request->boolean('force_domain_override')) {
+            return response()->json([
+                'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                'conflicts' => $conflicts['conflicts'],
+                'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+            ], 409);
+        }
+
+        $hostCandidates = $urls
+            ->map(fn (string $url): string => (string) parse_url($url, PHP_URL_HOST))
+            ->filter();
+        $conflictingPreview = null;
+        if ($hostCandidates->isNotEmpty()) {
+            $conflictingPreview = ApplicationPreview::query()
+                ->whereIn('application_id', Application::ownedByCurrentTeamAPI($teamId)
+                    ->withoutGlobalScope('withRelations')
+                    ->reorder()
+                    ->select('applications.id'))
+                ->whereKeyNot($preview->id)
+                ->whereNotNull('fqdn')
+                ->where(function ($query) use ($hostCandidates): void {
+                    foreach ($hostCandidates as $host) {
+                        $query->orWhere('fqdn', 'like', '%'.$host.'%');
+                    }
+                })
+                ->get(['uuid', 'pull_request_id', 'fqdn'])
+                ->first(fn (ApplicationPreview $otherPreview): bool => collect(ValidationPatterns::applicationDomainList($otherPreview->fqdn))
+                    ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                    ->intersect($urls)
+                    ->isNotEmpty());
+        }
+
+        if ($conflictingPreview && ! $request->boolean('force_domain_override')) {
+            return response()->json([
+                'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                'conflicts' => [[
+                    'domain' => collect(ValidationPatterns::applicationDomainList($conflictingPreview->fqdn))
+                        ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                        ->intersect($urls)
+                        ->first(),
+                    'resource_name' => 'Preview deployment #'.$conflictingPreview->pull_request_id,
+                    'resource_uuid' => $conflictingPreview->uuid,
+                    'resource_type' => 'application',
+                    'message' => 'Domain is already in use by another preview deployment.',
+                ]],
+                'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+            ], 409);
+        }
+
+        $preview->domain_port_overrides = $normalized['overrides'];
+        $preview->fqdn = $portlessDomains;
+        if ($isCompose) {
+            $preview->docker_compose_domains = json_encode($dockerComposeDomains);
+        }
+        $preview->save();
+
+        auditLog('api.application.preview_updated', [
+            'team_id' => $teamId,
+            'application_uuid' => $application->uuid,
+            'pull_request_id' => $preview->pull_request_id,
+            'changed_fields' => [$isCompose ? 'docker_compose_domains' : 'domains'],
+        ]);
+
+        return response()->json([
+            'uuid' => $preview->uuid,
+            'pull_request_id' => $preview->pull_request_id,
+            'domains' => $preview->fqdn,
+            'docker_compose_domains' => $dockerComposeDomainsResponse,
+            'domain_port_overrides' => $preview->domain_port_overrides,
+        ]);
+    }
+
     #[OA\Delete(
         summary: 'Delete',
         description: 'Delete application by UUID.',
@@ -2555,6 +2811,8 @@ class ApplicationsController extends Controller
 
         $this->authorize('delete', $application);
 
+        $application->delete();
+
         DeleteResourceJob::dispatch(
             resource: $application,
             deleteVolumes: $request->boolean('delete_volumes', true),
@@ -2811,6 +3069,7 @@ class ApplicationsController extends Controller
             'http_basic_auth_username' => 'string',
             'http_basic_auth_password' => 'string',
             'include_source_commit_in_build' => 'boolean',
+            'ports_exposes' => 'nullable|string|regex:/^(\d+)(,\d+)*$/',
         ];
         $validationRules = array_merge(sharedDataApplications(), $validationRules);
         $validationMessages = [
@@ -2819,10 +3078,10 @@ class ApplicationsController extends Controller
         $validator = Validator::make($request->all(), $validationRules, $validationMessages);
 
         // Validate ports_exposes
-        if ($request->has('ports_exposes')) {
+        if ($request->filled('ports_exposes')) {
             $ports = explode(',', $request->ports_exposes);
             foreach ($ports as $port) {
-                if (! is_numeric($port)) {
+                if (! is_numeric($port) || (int) $port < 1 || (int) $port > 65535) {
                     return response()->json([
                         'message' => 'Validation failed.',
                         'errors' => [
@@ -3122,7 +3381,7 @@ class ApplicationsController extends Controller
         if ($application->settings->is_container_label_readonly_enabled && ($requestHasDomains || $requestHasNoindexDomains || $requestHasHttpBasicAuth) && $server->isProxyShouldRun()) {
             $application->custom_labels = str(implode('|coolify|', generateLabelsApplication($application)))->replace('|coolify|', "\n");
         }
-        $application->save();
+        $application->withoutAuditLogging(fn () => $application->save());
 
         auditLog('api.application.updated', [
             'team_id' => $teamId,
@@ -5145,7 +5404,7 @@ class ApplicationsController extends Controller
         $this->authorize('delete', $application);
 
         $pullRequestIdRaw = $request->route('pull_request_id');
-        if (! is_numeric($pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+        if (! ctype_digit((string) $pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
             return response()->json(['message' => 'Invalid pull_request_id.'], 422);
         }
         $pullRequestId = (int) $pullRequestIdRaw;
@@ -5630,14 +5889,6 @@ class ApplicationsController extends Controller
             return response()->json(['message' => $result['message']], 200);
         }
 
-        auditLog('api.application.rollback', [
-            'team_id' => $teamId,
-            'application_uuid' => $application->uuid,
-            'application_name' => $application->name,
-            'deployment_uuid' => $deployment_uuid,
-            'commit' => $commit,
-        ]);
-
         return response()->json([
             'message' => 'Rollback deployment queued.',
             'deployment_uuid' => $deployment_uuid,
diff --git a/app/Http/Controllers/Api/AuditEventsController.php b/app/Http/Controllers/Api/AuditEventsController.php
new file mode 100644
index 0000000000..da452bb303
--- /dev/null
+++ b/app/Http/Controllers/Api/AuditEventsController.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditEvent;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rule;
+
+class AuditEventsController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        if (! $request->user()->isAdminOfTeam($teamId)) {
+            return response()->json(['message' => 'Only team admins and owners can view audit logs.'], 403);
+        }
+
+        $validator = Validator::make($request->all(), [
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'search' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'action' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'source' => ['sometimes', 'nullable', 'string', Rule::in(['all', 'ui', 'api', 'mcp', 'webhook', 'system', 'scheduler'])],
+        ]);
+
+        if ($validator->fails()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $validator->errors(),
+            ], 422);
+        }
+
+        $validated = $validator->validated();
+        $perPage = (int) ($validated['per_page'] ?? 25);
+        $search = trim((string) ($validated['search'] ?? ''));
+        $canReadSensitive = $request->attributes->get('can_read_sensitive', false) === true;
+        $events = AuditEvent::query()
+            ->select([
+                'id',
+                'team_id',
+                'event',
+                'source',
+                'action',
+                'actor_type',
+                'actor_id',
+                'actor_name',
+                'resource_type',
+                'resource_uuid',
+                'resource_name',
+                'description',
+                'created_at',
+            ])
+            ->when($canReadSensitive, fn ($query) => $query->addSelect([
+                'actor_email',
+                'actor_token_id',
+                'actor_token_name',
+                'metadata',
+                'ip_address',
+                'user_agent',
+            ]))
+            ->visibleToTeam($teamId)
+            ->filtered(
+                search: $search,
+                action: (string) ($validated['action'] ?? 'all'),
+                source: (string) ($validated['source'] ?? 'all'),
+                searchSensitiveFields: $canReadSensitive,
+            )
+            ->latestFirst()
+            ->paginate($perPage);
+
+        return response()->json(serializeApiResponse($events));
+    }
+}
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 7b62b4980a..aeb69ac8b4 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -2586,6 +2586,8 @@ class DatabasesController extends Controller
 
         $this->authorize('delete', $database);
 
+        $database->delete();
+
         DeleteResourceJob::dispatch(
             resource: $database,
             deleteVolumes: $request->boolean('delete_volumes', true),
diff --git a/app/Http/Controllers/Api/GithubController.php b/app/Http/Controllers/Api/GithubController.php
index 840a11f692..5a0e74d0d9 100644
--- a/app/Http/Controllers/Api/GithubController.php
+++ b/app/Http/Controllers/Api/GithubController.php
@@ -642,7 +642,7 @@ class GithubController extends Controller
                 $rules['webhook_secret'] = 'string';
             }
             if (isset($payload['private_key_uuid'])) {
-                $rules['private_key_uuid'] = 'string|uuid';
+                $rules['private_key_uuid'] = 'string';
             }
             if (! isCloud() && isset($payload['is_system_wide'])) {
                 $rules['is_system_wide'] = 'boolean';
diff --git a/app/Http/Controllers/Api/IntegrationTokensController.php b/app/Http/Controllers/Api/IntegrationTokensController.php
new file mode 100644
index 0000000000..13a225a107
--- /dev/null
+++ b/app/Http/Controllers/Api/IntegrationTokensController.php
@@ -0,0 +1,108 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\IntegrationToken;
+use App\Services\IntegrationTokenValidator;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use OpenApi\Attributes as OA;
+
+class IntegrationTokensController extends Controller
+{
+    #[OA\Post(
+        summary: 'Create Secret Manager Token',
+        description: 'Create and validate a Doppler, Infisical, or Vault integration token.',
+        path: '/security/integration-tokens',
+        operationId: 'create-secret-manager-integration-token',
+        security: [['bearerAuth' => []]],
+        tags: ['Secret Managers'],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: new OA\JsonContent(
+                required: ['provider', 'name', 'token'],
+                properties: [
+                    new OA\Property(property: 'provider', type: 'string', enum: ['doppler', 'infisical', 'vault']),
+                    new OA\Property(property: 'name', type: 'string'),
+                    new OA\Property(property: 'token', type: 'string'),
+                    new OA\Property(property: 'metadata', type: 'object'),
+                ],
+            ),
+        ),
+        responses: [
+            new OA\Response(response: 201, description: 'Integration token created.'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function store(Request $request, IntegrationTokenValidator $tokenValidator): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $this->authorize('create', IntegrationToken::class);
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $body = $request->json()->all();
+        $rules = [
+            'provider' => ['required', 'string', 'in:'.implode(',', IntegrationToken::SECRET_MANAGER_PROVIDERS)],
+            'name' => ['required', 'string', 'max:255'],
+            'token' => ['required', 'string'],
+            'metadata' => ['sometimes', 'array'],
+        ];
+
+        if (($body['provider'] ?? null) === 'doppler') {
+            $rules['token'][] = 'regex:/^dp\.(st|sa)\./';
+        } elseif (($body['provider'] ?? null) === 'infisical') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.client_id'] = ['required', 'string'];
+        } elseif (($body['provider'] ?? null) === 'vault') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.namespace'] = ['nullable', 'string'];
+        }
+
+        $validator = customApiValidator($body, $rules);
+        $extraFields = array_diff(array_keys($body), ['provider', 'name', 'token', 'metadata']);
+
+        if ($validator->fails() || $extraFields !== []) {
+            $errors = $validator->errors();
+            foreach ($extraFields as $field) {
+                $errors->add($field, 'This field is not allowed.');
+            }
+
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+
+        $validated = $validator->validated();
+        $metadata = array_filter($validated['metadata'] ?? [], fn ($value) => filled($value));
+
+        if (! $tokenValidator->validate($validated['provider'], $validated['token'], ['secrets'], $metadata)) {
+            return response()->json(['message' => $tokenValidator->errorMessage($validated['provider'])], 400);
+        }
+
+        $integrationToken = IntegrationToken::query()->create([
+            'team_id' => $teamId,
+            'provider' => $validated['provider'],
+            'name' => $validated['name'],
+            'token' => $validated['token'],
+            'capabilities' => ['secrets'],
+            'metadata' => $metadata ?: null,
+        ]);
+
+        auditLog('api.integration_token.created', [
+            'team_id' => $teamId,
+            'integration_token_uuid' => $integrationToken->uuid,
+            'provider' => $integrationToken->provider,
+        ]);
+
+        return response()->json(['uuid' => $integrationToken->uuid], 201);
+    }
+}
diff --git a/app/Http/Controllers/Api/NotificationsController.php b/app/Http/Controllers/Api/NotificationsController.php
index f5493d0249..1cca69a663 100644
--- a/app/Http/Controllers/Api/NotificationsController.php
+++ b/app/Http/Controllers/Api/NotificationsController.php
@@ -15,6 +15,7 @@ use App\Rules\ValidHostname;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
 use OpenApi\Attributes as OA;
 
 class NotificationsController extends Controller
@@ -45,6 +46,7 @@ class NotificationsController extends Controller
                     'deployment_success_email_notifications' => 'sometimes|boolean',
                     'deployment_failure_email_notifications' => 'sometimes|boolean',
                     'status_change_email_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_email_notifications' => 'sometimes|boolean',
                     'backup_success_email_notifications' => 'sometimes|boolean',
                     'backup_failure_email_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_email_notifications' => 'sometimes|boolean',
@@ -66,6 +68,7 @@ class NotificationsController extends Controller
                     'deployment_success_discord_notifications' => 'sometimes|boolean',
                     'deployment_failure_discord_notifications' => 'sometimes|boolean',
                     'status_change_discord_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_discord_notifications' => 'sometimes|boolean',
                     'backup_success_discord_notifications' => 'sometimes|boolean',
                     'backup_failure_discord_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_discord_notifications' => 'sometimes|boolean',
@@ -88,6 +91,7 @@ class NotificationsController extends Controller
                     'deployment_success_slack_notifications' => 'sometimes|boolean',
                     'deployment_failure_slack_notifications' => 'sometimes|boolean',
                     'status_change_slack_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_slack_notifications' => 'sometimes|boolean',
                     'backup_success_slack_notifications' => 'sometimes|boolean',
                     'backup_failure_slack_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_slack_notifications' => 'sometimes|boolean',
@@ -110,6 +114,7 @@ class NotificationsController extends Controller
                     'deployment_success_telegram_notifications' => 'sometimes|boolean',
                     'deployment_failure_telegram_notifications' => 'sometimes|boolean',
                     'status_change_telegram_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_telegram_notifications' => 'sometimes|boolean',
                     'backup_success_telegram_notifications' => 'sometimes|boolean',
                     'backup_failure_telegram_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_telegram_notifications' => 'sometimes|boolean',
@@ -124,6 +129,7 @@ class NotificationsController extends Controller
                     'telegram_notifications_deployment_success_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_deployment_failure_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_status_change_thread_id' => 'sometimes|nullable|string|max:255',
+                    'telegram_notifications_restart_limit_reached_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_backup_success_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_backup_failure_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_scheduled_task_success_thread_id' => 'sometimes|nullable|string|max:255',
@@ -146,6 +152,7 @@ class NotificationsController extends Controller
                     'deployment_success_pushover_notifications' => 'sometimes|boolean',
                     'deployment_failure_pushover_notifications' => 'sometimes|boolean',
                     'status_change_pushover_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_pushover_notifications' => 'sometimes|boolean',
                     'backup_success_pushover_notifications' => 'sometimes|boolean',
                     'backup_failure_pushover_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_pushover_notifications' => 'sometimes|boolean',
@@ -167,6 +174,7 @@ class NotificationsController extends Controller
                     'deployment_success_webhook_notifications' => 'sometimes|boolean',
                     'deployment_failure_webhook_notifications' => 'sometimes|boolean',
                     'status_change_webhook_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_webhook_notifications' => 'sometimes|boolean',
                     'backup_success_webhook_notifications' => 'sometimes|boolean',
                     'backup_failure_webhook_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_webhook_notifications' => 'sometimes|boolean',
@@ -249,7 +257,7 @@ class NotificationsController extends Controller
         $body = $request->json()->all();
         $config = $this->channelConfig($channel);
 
-        $validator = customApiValidator($body, $config['rules']);
+        $validator = Validator::make($body, $config['rules']);
 
         $extraFields = array_diff(array_keys($body), $allowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
diff --git a/app/Http/Controllers/Api/ProjectController.php b/app/Http/Controllers/Api/ProjectController.php
index eb137c5349..16eff1ba18 100644
--- a/app/Http/Controllers/Api/ProjectController.php
+++ b/app/Http/Controllers/Api/ProjectController.php
@@ -271,12 +271,6 @@ class ProjectController extends Controller
             'team_id' => $teamId,
         ]);
 
-        auditLog('api.project.created', [
-            'team_id' => $teamId,
-            'project_uuid' => $project->uuid,
-            'project_name' => $project->name,
-        ]);
-
         return response()->json([
             'uuid' => $project->uuid,
         ])->setStatusCode(201);
@@ -396,13 +390,6 @@ class ProjectController extends Controller
 
         $project->update($request->only($allowedFields));
 
-        auditLog('api.project.updated', [
-            'team_id' => $teamId,
-            'project_uuid' => $project->uuid,
-            'project_name' => $project->name,
-            'changed_fields' => array_values(array_intersect($allowedFields, array_keys($request->all()))),
-        ]);
-
         return response()->json([
             'uuid' => $project->uuid,
             'name' => $project->name,
@@ -482,16 +469,8 @@ class ProjectController extends Controller
             return response()->json(['message' => 'Project has resources, so it cannot be deleted.'], 400);
         }
 
-        $projectUuid = $project->uuid;
-        $projectName = $project->name;
         $project->delete();
 
-        auditLog('api.project.deleted', [
-            'team_id' => $teamId,
-            'project_uuid' => $projectUuid,
-            'project_name' => $projectName,
-        ]);
-
         return response()->json(['message' => 'Project deleted.']);
     }
 
diff --git a/app/Http/Controllers/Api/SentinelController.php b/app/Http/Controllers/Api/SentinelController.php
index b3685daa4b..81b932365d 100644
--- a/app/Http/Controllers/Api/SentinelController.php
+++ b/app/Http/Controllers/Api/SentinelController.php
@@ -138,7 +138,7 @@ class SentinelController extends Controller
     /**
      * Build a stable hash of container state.
      *
-     * Covers [name, state] only — metrics, filesystem_usage_root, and
+     * Covers [name, state, restart_count] only — metrics, filesystem_usage_root, and
      * health_status are excluded on purpose. Disk % churns constantly, and
      * health checks can flap between starting/healthy/unhealthy while the
      * container lifecycle state remains unchanged. Both would otherwise defeat
@@ -153,6 +153,7 @@ class SentinelController extends Controller
             ->map(fn ($c) => [
                 'name' => data_get($c, 'name'),
                 'state' => data_get($c, 'state'),
+                'restart_count' => data_get($c, 'restart_count'),
             ])
             ->sortBy('name')
             ->values()
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index d7d4953f9c..9bfcfd8539 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -1020,6 +1020,8 @@ class ServicesController extends Controller
 
         $this->authorize('delete', $service);
 
+        $service->delete();
+
         DeleteResourceJob::dispatch(
             resource: $service,
             deleteVolumes: $request->boolean('delete_volumes', true),
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index aca4293919..b1cb8d853d 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -29,6 +29,7 @@ use Illuminate\Auth\Middleware\RequirePassword;
 use Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
 use Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull;
+use Illuminate\Foundation\Http\Middleware\InvokeDeferredCallbacks;
 use Illuminate\Foundation\Http\Middleware\ValidatePostSize;
 use Illuminate\Http\Middleware\HandleCors;
 use Illuminate\Http\Middleware\SetCacheHeaders;
@@ -59,6 +60,7 @@ class Kernel extends HttpKernel
         ValidatePostSize::class,
         TrimStrings::class,
         ConvertEmptyStringsToNull::class,
+        InvokeDeferredCallbacks::class,
 
     ];
 
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 1e8450c1b9..0887e7e864 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -19,6 +19,7 @@ use App\Models\StandaloneDocker;
 use App\Models\SwarmDocker;
 use App\Notifications\Application\DeploymentFailed;
 use App\Notifications\Application\DeploymentSuccess;
+use App\Support\RemoteSecretReferences;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
 use App\Traits\ExecuteRemoteCommand;
@@ -44,6 +45,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     public const BUILD_TIME_ENV_PATH = '/artifacts/build-time.env';
 
+    public const BUILD_TIME_SHELL_ENV_PATH = '/artifacts/build-time-shell.env';
+
+    public const BUILD_TIME_ENV_LAUNCHER_PATH = '/artifacts/run-with-build-time-env';
+
     private const BUILD_SCRIPT_PATH = '/artifacts/build.sh';
 
     private const NIXPACKS_PLAN_PATH = '/artifacts/thegameplan.json';
@@ -143,6 +148,9 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private $env_args;
 
+    /** @var array<string, string>|null */
+    private ?array $remote_secrets_cache = null;
+
     private $env_nixpacks_args;
 
     private $env_railpack_args;
@@ -201,6 +209,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private bool $dockerSecretsSupported = false;
 
+    private bool $dockerSecretsAvailable = false;
+
+    private bool $useBuildtimeEnvironmentLauncher = false;
+
     private bool $skip_build = false;
 
     private Collection|string $build_secrets;
@@ -261,14 +273,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $this->configuration_dir = application_configuration_dir()."/{$this->application->uuid}";
         $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
 
-        $this->container_name = generateApplicationContainerName($this->application, $this->pull_request_id);
-        if ($this->application->settings->custom_internal_name && ! $this->application->settings->is_consistent_container_name_enabled) {
-            if ($this->pull_request_id === 0) {
-                $this->container_name = $this->application->settings->custom_internal_name;
-            } else {
-                $this->container_name = addPreviewDeploymentSuffix($this->application->settings->custom_internal_name, $this->pull_request_id);
-            }
-        }
+        $this->container_name = $this->resolveContainerName();
 
         $this->saved_outputs = collect();
 
@@ -425,6 +430,11 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private function detectBuildKitCapabilities(): void
     {
+        $this->dockerBuildkitSupported = false;
+        $this->dockerBuildxAvailable = false;
+        $this->dockerSecretsSupported = false;
+        $this->dockerSecretsAvailable = false;
+
         $serverToCheck = $this->use_build_server ? $this->build_server : $this->server;
         $serverName = $this->use_build_server ? "build server ({$serverToCheck->name})" : "deployment server ({$serverToCheck->name})";
 
@@ -475,18 +485,19 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
-            // If build secrets are enabled and BuildKit is available, verify --secret flag support
-            if ($this->application->settings->use_build_secrets && $this->dockerBuildkitSupported) {
+            if ($this->dockerBuildkitSupported) {
                 $secretsTest = instant_remote_process(
                     ["docker build --help 2>&1 | grep -q 'secret' && echo 'supported' || echo 'not-supported'"],
                     $serverToCheck
                 );
 
                 if (trim($secretsTest) === 'supported') {
-                    $this->dockerSecretsSupported = true;
-                    $this->application_deployment_queue->addLogEntry('Build secrets are enabled and will be used for enhanced security.');
-                } else {
-                    $this->dockerSecretsSupported = false;
+                    $this->dockerSecretsAvailable = true;
+                    if ($this->application->settings->use_build_secrets) {
+                        $this->dockerSecretsSupported = true;
+                        $this->application_deployment_queue->addLogEntry('Build secrets are enabled and will be used for enhanced security.');
+                    }
+                } elseif ($this->application->settings->use_build_secrets) {
                     $this->application_deployment_queue->addLogEntry("Docker on {$serverName} does not support build secrets. Using traditional build arguments.");
                 }
             }
@@ -494,6 +505,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $this->dockerBuildkitSupported = false;
             $this->dockerBuildxAvailable = false;
             $this->dockerSecretsSupported = false;
+            $this->dockerSecretsAvailable = false;
             $this->application_deployment_queue->addLogEntry("Could not detect BuildKit capabilities on {$serverName}: {$e->getMessage()}");
         }
     }
@@ -614,6 +626,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             return $this->dockerImagePreviewTag;
         }
 
+        if ($this->rollback && str($this->commit)->isNotEmpty()) {
+            return $this->commit;
+        }
+
         if (str($this->application->docker_registry_image_tag)->isNotEmpty()) {
             return $this->application->docker_registry_image_tag;
         }
@@ -1275,6 +1291,11 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
                 return true;
             }
+            if ($this->has_remote_buildtime_secret_references()) {
+                $this->application_deployment_queue->addLogEntry('Remote build-time secrets are configured. Running the build to check for updated values.');
+
+                return false;
+            }
             $configurationDiff = $this->application->pendingDeploymentConfigurationDiff();
             if (! $configurationDiff->requiresBuild()) {
                 $this->application_deployment_queue->addLogEntry("No build configuration changed & image found ({$this->production_image_name}) with the same Git Commit SHA. Build step skipped.");
@@ -1302,6 +1323,18 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         return false;
     }
 
+    private function has_remote_buildtime_secret_references(): bool
+    {
+        $environmentVariables = $this->pull_request_id === 0
+            ? $this->application->environment_variables()
+            : $this->application->environment_variables_preview();
+
+        return $environmentVariables
+            ->where('is_buildtime', true)
+            ->get(['value'])
+            ->contains(fn (EnvironmentVariable $environmentVariable) => RemoteSecretReferences::containsReference($environmentVariable->value));
+    }
+
     private function check_image_locally_or_remotely()
     {
         $this->execute_remote_command([
@@ -1323,6 +1356,101 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    /**
+     * Fetch the secrets from the application's secret manager source. Values
+     * live only in memory during the deployment and in the generated .env on
+     * the server — they are never persisted in the Coolify database. Fetched
+     * lazily (only when a variable references a secret), once per deployment.
+     * A fetch failure fails the deployment.
+     *
+     * @return array<string, string>
+     */
+    private function remote_secrets(): array
+    {
+        if ($this->remote_secrets_cache !== null) {
+            return $this->remote_secrets_cache;
+        }
+
+        $link = $this->application->secretManagerLink()->with('integrationToken')->first();
+
+        if (! $link) {
+            throw new DeploymentException('Environment variables reference remote secrets ({{vault.KEY}}), but no secret manager source is configured for this application.');
+        }
+
+        $provider = $link->integrationToken->providerName();
+        $tokenName = $link->integrationToken->name;
+
+        try {
+            $secrets = $link->fetchSecrets();
+        } catch (Throwable $e) {
+            $this->application_deployment_queue->addLogEntry("Failed to fetch secrets from {$provider} ({$tokenName}, {$link->sourceSummary()}): {$e->getMessage()}", 'stderr');
+
+            throw new DeploymentException("Could not fetch secrets from {$provider}. The deployment was stopped so the application does not start with missing secrets.");
+        }
+
+        $this->application_deployment_queue->addLogEntry('Fetched '.count($secrets)." secrets from {$provider} ({$tokenName}, {$link->sourceSummary()}).");
+
+        return $this->remote_secrets_cache = $secrets;
+    }
+
+    /**
+     * Replace {{vault.KEY}} references with values from the configured secret
+     * manager source. Missing keys fail the deployment with a
+     * list — changing the source never re-checks references, so this is the
+     * moment problems surface.
+     */
+    private function substitute_remote_secrets(string $value, string $envKey): string
+    {
+        $secrets = $this->remote_secrets();
+        $missing = RemoteSecretReferences::missingKeys($value, $secrets);
+
+        if ($missing !== []) {
+            $message = 'Missing secret keys: '.implode(', ', $missing)." (referenced by {$envKey}).";
+            $this->application_deployment_queue->addLogEntry($message, 'stderr');
+
+            throw new DeploymentException($message.' Check the secret manager source of this application.');
+        }
+
+        return RemoteSecretReferences::substitute($value, $secrets);
+    }
+
+    /**
+     * Resolve shared variables, then secret references, in a raw variable value.
+     */
+    private function resolve_environment_variable_raw(EnvironmentVariable $env): string
+    {
+        $value = $env->get_real_environment_variables_with_server($env->value, $this->application, $this->mainServer);
+
+        return $this->substitute_remote_secrets($value ?? '', $env->key);
+    }
+
+    /**
+     * Resolve a runtime variable to its dotenv representation. Values with
+     * secret references are substituted and written as literals.
+     */
+    private function resolve_environment_variable(EnvironmentVariable $env): ?string
+    {
+        if (! RemoteSecretReferences::containsReference($env->value)) {
+            return $env->getResolvedValueWithServer($this->mainServer);
+        }
+
+        return $this->format_remote_secret_value($this->resolve_environment_variable_raw($env));
+    }
+
+    /**
+     * Format a remote secret value for the runtime .env file (dotenv syntax read
+     * by docker compose). Values are treated as literals — no interpolation.
+     */
+    private function format_remote_secret_value(string $value): string
+    {
+        if (! str_contains($value, "'")) {
+            return "'".$value."'";
+        }
+
+        // Fall back to double quotes; $$ escapes compose interpolation.
+        return '"'.str_replace(['\\', '"', '$'], ['\\\\', '\\"', '$$'], $value).'"';
+    }
+
     private function generate_runtime_environment_variables()
     {
         $envs = collect([]);
@@ -1391,7 +1519,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             });
 
             foreach ($runtime_environment_variables as $env) {
-                $envs->push($env->key.'='.$env->getResolvedValueWithServer($this->mainServer));
+                $envs->push($env->key.'='.$this->resolve_environment_variable($env));
             }
 
             // Check for PORT environment variable mismatch with ports_exposes
@@ -1458,7 +1586,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             });
 
             foreach ($runtime_environment_variables_preview as $env) {
-                $envs->push($env->key.'='.$env->getResolvedValueWithServer($this->mainServer));
+                $envs->push($env->key.'='.$this->resolve_environment_variable($env));
             }
 
             // Fall back to production env vars for keys not overridden by preview vars,
@@ -1472,7 +1600,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     return $env->is_runtime && ! in_array($env->key, $previewKeys);
                 });
                 foreach ($fallback_production_vars as $env) {
-                    $envs->push($env->key.'='.$env->getResolvedValueWithServer($this->mainServer));
+                    $envs->push($env->key.'='.$this->resolve_environment_variable($env));
                 }
             }
 
@@ -1580,6 +1708,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         $this->execute_remote_command(
             [
                 executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee $this->workdir/.env > /dev/null"),
+                'skip_command_log' => true,
             ]
         );
 
@@ -1598,6 +1727,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $this->execute_remote_command(
                 [
                     "echo '$envs_base64' | base64 -d | tee $this->configuration_dir/.env > /dev/null",
+                    'skip_command_log' => true,
                 ]
             );
             $this->server = $this->build_server;
@@ -1605,6 +1735,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $this->execute_remote_command(
                 [
                     "echo '$envs_base64' | base64 -d | tee $this->configuration_dir/.env > /dev/null",
+                    'skip_command_log' => true,
                 ]
             );
         }
@@ -1634,11 +1765,14 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 }
 
                 foreach ($planVariables as $key => $value) {
+                    $key = (string) $key;
+
                     // Skip COOLIFY_* and SERVICE_* - they'll be added later with higher priority
                     if (str_starts_with($key, 'COOLIFY_') || str_starts_with($key, 'SERVICE_')) {
                         continue;
                     }
 
+                    $key = $this->validatedBuildtimeEnvironmentVariableKey($key, 'the Nixpacks plan');
                     $escapedValue = escapeBashEnvValue($value);
                     $envs_dict[$key] = $escapedValue;
 
@@ -1728,6 +1862,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     continue;
                 }
 
+                if (RemoteSecretReferences::containsReference($env->value)) {
+                    $envs_dict[$env->key] = escapeBashEnvValue($this->resolve_environment_variable_raw($env));
+
+                    continue;
+                }
+
                 $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
                 // For literal/multiline vars, real_value includes quotes that we need to remove
                 if ($env->is_literal || $env->is_multiline) {
@@ -1783,6 +1923,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                     continue;
                 }
 
+                if (RemoteSecretReferences::containsReference($env->value)) {
+                    $envs_dict[$env->key] = escapeBashEnvValue($this->resolve_environment_variable_raw($env));
+
+                    continue;
+                }
+
                 $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
                 // For literal/multiline vars, real_value includes quotes that we need to remove
                 if ($env->is_literal || $env->is_multiline) {
@@ -1826,6 +1972,7 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         // Convert dictionary back to collection in KEY=VALUE format
         $envs = collect([]);
         foreach ($envs_dict as $key => $value) {
+            $key = $this->validatedBuildtimeEnvironmentVariableKey((string) $key, 'the build-time environment');
             $envs->push($key.'='.$value);
         }
 
@@ -1839,44 +1986,132 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         return $envs;
     }
 
-    private function save_buildtime_environment_variables()
+    private function validatedBuildtimeEnvironmentVariableKey(string $key, string $origin): string
     {
-        // Generate build-time environment variables locally
-        $environment_variables = $this->generate_buildtime_environment_variables();
 
-        // Save .env file for build phase in /artifacts to prevent it from being copied into Docker images
-        if ($environment_variables->isNotEmpty()) {
-            $envs_base64 = base64_encode($environment_variables->implode("\n"));
+        try {
+            if (! ValidationPatterns::isValidEnvironmentVariableKey($key)) {
+                throw new \InvalidArgumentException('Invalid build-time environment variable key.');
 
-            $this->application_deployment_queue->addLogEntry('Creating build-time .env file in /artifacts (outside Docker context).', hidden: true);
-
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee ".self::BUILD_TIME_ENV_PATH.' > /dev/null'),
-                ]
-            );
-
-            if (isDev()) {
-                $this->execute_remote_command(
-                    [
-                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
-                        'hidden' => true,
-                    ]
-                );
             }
-        } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
-            // For build packs that source the build-time .env file, create an empty file even if there are no build-time variables
-            // This ensures the file exists when referenced in build commands
-            $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
 
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, 'touch '.self::BUILD_TIME_ENV_PATH),
-                ]
+            return $key;
+        } catch (\InvalidArgumentException $exception) {
+            $this->logInvalidBuildtimeEnvironmentVariableKey($key, $origin);
+
+            throw new DeploymentException(
+                "Invalid environment variable name from {$origin}: ".ValidationPatterns::displayShellEnvironmentVariableKey($key).'. Names must start with a letter or underscore and contain only letters, numbers, underscores, and dots.',
+                previous: $exception,
             );
         }
     }
 
+    private function logInvalidBuildtimeEnvironmentVariableKey(string $key, string $origin): void
+    {
+        $displayKey = ValidationPatterns::displayShellEnvironmentVariableKey($key);
+
+        $this->application_deployment_queue->addLogEntry('----------------------------------------', 'stderr');
+        $this->application_deployment_queue->addLogEntry("⚠️ Invalid environment variable name from {$origin}: {$displayKey}", 'stderr');
+        $this->application_deployment_queue->addLogEntry('Build-time variable names must start with a letter or underscore and contain only letters, numbers, underscores, and dots.', 'stderr');
+        $this->application_deployment_queue->addLogEntry('💡 How to fix:', type: 'info');
+
+        if ($origin === 'the Nixpacks plan') {
+            $this->application_deployment_queue->addLogEntry('   1. Open nixpacks.toml and check the [variables] section. Quoted keys can contain characters that are not valid environment variable names.', type: 'info');
+            $this->application_deployment_queue->addLogEntry('   2. Rename the key to a plain name like MY_VARIABLE (no spaces, shell syntax, or command substitutions).', type: 'info');
+            $this->logSuggestedShellEnvironmentVariableKey($key);
+            $this->application_deployment_queue->addLogEntry('   3. Commit, push, and redeploy.', type: 'info');
+            $this->application_deployment_queue->addLogEntry('Docs: https://nixpacks.com/docs/configuration/file', type: 'info');
+        } else {
+            $this->application_deployment_queue->addLogEntry('   Rename the environment variable to use only letters, numbers, and underscores, then redeploy.', type: 'info');
+            $this->logSuggestedShellEnvironmentVariableKey($key);
+        }
+
+        $this->application_deployment_queue->addLogEntry('----------------------------------------', 'stderr');
+    }
+
+    private function logSuggestedShellEnvironmentVariableKey(string $key): void
+    {
+        $suggestedKey = str_replace('.', '_', $key);
+        if ($suggestedKey === $key || preg_match(ValidationPatterns::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $suggestedKey) !== 1) {
+            return;
+        }
+
+        $displaySuggestedKey = ValidationPatterns::displayShellEnvironmentVariableKey($suggestedKey);
+
+        $this->application_deployment_queue->addLogEntry("   Suggested name: {$displaySuggestedKey}", type: 'info');
+    }
+
+    private function save_buildtime_environment_variables()
+    {
+        $environment_variables = $this->generate_buildtime_environment_variables();
+        [$shell_environment_variables, $dotted_environment_variables] = $environment_variables->partition(function (string $environmentVariable): bool {
+            [$key] = explode('=', $environmentVariable, 2);
+
+            return preg_match(ValidationPatterns::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $key) === 1;
+        });
+
+        if ($dotted_environment_variables->isEmpty()) {
+            $this->useBuildtimeEnvironmentLauncher = false;
+
+            if ($environment_variables->isNotEmpty()) {
+                $envs_base64 = base64_encode($environment_variables->implode("\n"));
+
+                $this->application_deployment_queue->addLogEntry('Creating build-time .env file in /artifacts (outside Docker context).', hidden: true);
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee ".self::BUILD_TIME_ENV_PATH.' > /dev/null'),
+                ]);
+
+                if (isDev()) {
+                    $this->execute_remote_command([
+                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
+                        'hidden' => true,
+                    ]);
+                }
+            } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
+                $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, 'touch '.self::BUILD_TIME_ENV_PATH),
+                ]);
+            }
+
+            return;
+        }
+
+        $this->useBuildtimeEnvironmentLauncher = true;
+
+        $launcher = [
+            '#!/bin/bash',
+            'set -a',
+            'source '.self::BUILD_TIME_SHELL_ENV_PATH,
+            'set +a',
+        ];
+
+        $launcher[] = 'exec env \\';
+        foreach ($dotted_environment_variables as $environmentVariable) {
+            $launcher[] = "    {$environmentVariable} \\";
+        }
+        $launcher[] = '    "$@"';
+
+        $files = [
+            self::BUILD_TIME_ENV_PATH => $environment_variables->implode("\n"),
+            self::BUILD_TIME_SHELL_ENV_PATH => $shell_environment_variables->implode("\n"),
+            self::BUILD_TIME_ENV_LAUNCHER_PATH => implode("\n", $launcher)."\n",
+        ];
+
+        $this->application_deployment_queue->addLogEntry('Creating build-time environment files in /artifacts (outside Docker context).', hidden: true);
+
+        foreach ($files as $path => $contents) {
+            $contents_base64 = base64_encode($contents);
+            $this->execute_remote_command([
+                executeInDocker($this->deployment_uuid, "echo '$contents_base64' | base64 -d | tee {$path} > /dev/null"),
+            ]);
+        }
+
+        $this->execute_remote_command([
+            executeInDocker($this->deployment_uuid, 'chmod 700 '.self::BUILD_TIME_ENV_LAUNCHER_PATH),
+        ]);
+    }
+
     private function elixir_finetunes()
     {
         if ($this->pull_request_id === 0) {
@@ -1982,6 +2217,19 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function resolveContainerName(): string
+    {
+        if (str($this->application->settings->custom_internal_name)->isEmpty()) {
+            return generateApplicationContainerName($this->application, $this->pull_request_id);
+        }
+
+        if ($this->pull_request_id === 0) {
+            return $this->application->settings->custom_internal_name;
+        }
+
+        return addPreviewDeploymentSuffix($this->application->settings->custom_internal_name, $this->pull_request_id);
+    }
+
     private function health_check()
     {
         try {
@@ -2270,9 +2518,9 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
             $fqdn = $this->preview->fqdn;
         }
         if (isset($fqdn)) {
-            $url = Url::fromString($fqdn);
-            $fqdn = $url->getHost();
-            $url = $url->withHost($fqdn)->withPort(null)->__toString();
+            $domains = str($fqdn)->explode(',')->map(fn (string $domain) => trim($domain))->filter();
+            $url = $domains->map(fn (string $domain) => Url::fromString($domain)->withPort(null)->__toString())->implode(',');
+            $fqdn = $domains->map(fn (string $domain) => Url::fromString($domain)->getHost())->implode(',');
             if ((int) $this->application->compose_parsing_version >= 3) {
                 $this->coolify_variables .= 'COOLIFY_URL='.escapeShellValue($url).' ';
                 $this->coolify_variables .= 'COOLIFY_FQDN='.escapeShellValue($fqdn).' ';
@@ -2651,6 +2899,12 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private function normalize_resolved_build_variable_value(EnvironmentVariable $environmentVariable): ?string
     {
+        if (RemoteSecretReferences::containsReference($environmentVariable->value)) {
+            $resolved = $this->resolve_environment_variable_raw($environmentVariable);
+
+            return $resolved === '' ? null : $resolved;
+        }
+
         $resolvedValue = $environmentVariable->getResolvedValueWithServer($this->mainServer);
         if (is_null($resolvedValue) || $resolvedValue === '') {
             return null;
@@ -3194,7 +3448,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
 
             foreach ($envs as $env) {
-                $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
+                $resolvedValue = RemoteSecretReferences::containsReference($env->value)
+                    ? $this->resolve_environment_variable_raw($env)
+                    : $env->getResolvedValueWithServer($this->mainServer);
                 if (! is_null($resolvedValue)) {
                     $this->env_args->put($env->key, $resolvedValue);
                 }
@@ -3210,7 +3466,9 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
 
             foreach ($envs as $env) {
-                $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
+                $resolvedValue = RemoteSecretReferences::containsReference($env->value)
+                    ? $this->resolve_environment_variable_raw($env)
+                    : $env->getResolvedValueWithServer($this->mainServer);
                 if (! is_null($resolvedValue)) {
                     $this->env_args->put($env->key, $resolvedValue);
                 }
@@ -3297,6 +3555,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         // Always use .env file
         $docker_compose['services'][$this->container_name]['env_file'] = ['.env'];
 
+        if ($this->application->settings->stop_grace_period !== null) {
+            $docker_compose['services'][$this->container_name]['stop_grace_period'] = $this->application->settings->stopGracePeriodSeconds().'s';
+        }
+
         // Only add Coolify healthcheck if no custom HEALTHCHECK found in Dockerfile
         // If custom_healthcheck_found is true, the Dockerfile's HEALTHCHECK will be used
         // If healthcheck is disabled, no healthcheck will be added
@@ -3419,24 +3681,22 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         if ($this->pull_request_id === 0) {
             $custom_compose = convertDockerRunToCompose($this->application->custom_docker_run_options);
             if ((bool) $this->application->settings->is_consistent_container_name_enabled) {
-                if (! $this->application->settings->custom_internal_name) {
-                    $docker_compose['services'][$this->application->uuid] = $docker_compose['services'][$this->container_name];
-                    if (count($custom_compose) > 0) {
-                        $ipv4 = data_get($custom_compose, 'ip.0');
-                        $ipv6 = data_get($custom_compose, 'ip6.0');
-                        data_forget($custom_compose, 'ip');
-                        data_forget($custom_compose, 'ip6');
-                        if ($ipv4 || $ipv6) {
-                            data_forget($docker_compose['services'][$this->application->uuid], 'networks');
-                        }
-                        if ($ipv4) {
-                            $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv4_address'] = $ipv4;
-                        }
-                        if ($ipv6) {
-                            $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv6_address'] = $ipv6;
-                        }
-                        $docker_compose['services'][$this->application->uuid] = array_merge_recursive($docker_compose['services'][$this->application->uuid], $custom_compose);
+                $docker_compose['services'][$this->application->uuid] = $docker_compose['services'][$this->container_name];
+                if ($this->container_name !== $this->application->uuid) {
+                    unset($docker_compose['services'][$this->container_name]);
+                }
+                if (count($custom_compose) > 0) {
+                    $ipv4 = data_get($custom_compose, 'ip.0');
+                    $ipv6 = data_get($custom_compose, 'ip6.0');
+                    data_forget($custom_compose, 'ip');
+                    data_forget($custom_compose, 'ip6');
+                    if ($ipv4) {
+                        $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv4_address'] = $ipv4;
                     }
+                    if ($ipv6) {
+                        $docker_compose['services'][$this->application->uuid]['networks'][$this->destination->network]['ipv6_address'] = $ipv6;
+                    }
+                    $docker_compose['services'][$this->application->uuid] = array_merge_recursive($docker_compose['services'][$this->application->uuid], $custom_compose);
                 }
             } else {
                 if (count($custom_compose) > 0) {
@@ -3641,7 +3901,13 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
      */
     private function wrap_build_command_with_env_export(string $build_command): string
     {
-        return "cd {$this->workdir} && set -a && source ".self::BUILD_TIME_ENV_PATH." && set +a && {$build_command}";
+        if (! $this->useBuildtimeEnvironmentLauncher) {
+            return "cd {$this->workdir} && set -a && source ".self::BUILD_TIME_ENV_PATH." && set +a && {$build_command}";
+        }
+
+        $escapedBuildCommand = escapeBashEnvValue($build_command);
+
+        return "cd {$this->workdir} && bash ".self::BUILD_TIME_ENV_LAUNCHER_PATH." /bin/bash -c {$escapedBuildCommand}";
     }
 
     private function build_image()
@@ -4024,7 +4290,10 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->application_deployment_queue->addLogEntry('Removing old containers.');
             if ($this->newVersionIsHealthy || $force) {
                 if ($this->application->settings->is_consistent_container_name_enabled || str($this->application->settings->custom_internal_name)->isNotEmpty()) {
-                    $this->graceful_shutdown_container($this->container_name);
+                    $containers = getCurrentApplicationContainerStatus($this->server, $this->application->id, $this->pull_request_id);
+                    $this->containerNamesToRemove($containers)->each(function (string $containerName) {
+                        $this->graceful_shutdown_container($containerName);
+                    });
                 } else {
                     $containers = getCurrentApplicationContainerStatus($this->server, $this->application->id, $this->pull_request_id);
                     if ($this->pull_request_id === 0) {
@@ -4063,6 +4332,16 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         }
     }
 
+    private function containerNamesToRemove(Collection $containers): Collection
+    {
+        return $containers
+            ->pluck('Names')
+            ->push($this->container_name)
+            ->filter()
+            ->unique()
+            ->values();
+    }
+
     private function start_by_compose_file()
     {
         try {
@@ -4151,6 +4430,21 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->analyzeBuildTimeVariables($variables);
         }
 
+        $requiresDottedEnvironmentSecrets = $this->application->build_pack === 'nixpacks'
+            && $variables->keys()->contains(fn ($key): bool => str_contains((string) $key, '.'));
+
+        if ($requiresDottedEnvironmentSecrets) {
+            if (! $this->dockerSecretsAvailable) {
+                $dottedKeys = $variables->keys()
+                    ->filter(fn ($key): bool => str_contains((string) $key, '.'))
+                    ->implode(', ');
+
+                throw new DeploymentException("Dotted Nixpacks build-time environment variable names require Docker BuildKit secret support: {$dottedKeys}. Rename these keys to use underscores instead of dots, or upgrade Docker on the build server.");
+            }
+
+            $this->dockerSecretsSupported = true;
+        }
+
         if ($this->dockerSecretsSupported) {
             $this->generate_build_secrets($variables);
             $this->build_args = '';
@@ -4268,7 +4562,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         } else {
             $secrets_string = $variables
                 ->map(function ($env) {
-                    return "{$env->key}={$env->getResolvedValueWithServer($this->mainServer)}";
+                    return "{$env->key}={$this->resolve_environment_variable($env)}";
                 })
                 ->sort()
                 ->implode('|');
@@ -4334,7 +4628,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 if (data_get($env, 'is_multiline') === true) {
                     $argsToInsert->push("ARG {$env->key}");
                 } else {
-                    $argsToInsert->push("ARG {$env->key}={$env->getResolvedValueWithServer($this->mainServer)}");
+                    $argsToInsert->push("ARG {$env->key}=".escapeBashEnvValue($this->resolve_environment_variable_raw($env)));
                 }
             }
             // Add Coolify variables as ARGs
@@ -4356,7 +4650,7 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                 if (data_get($env, 'is_multiline') === true) {
                     $argsToInsert->push("ARG {$env->key}");
                 } else {
-                    $argsToInsert->push("ARG {$env->key}={$env->getResolvedValueWithServer($this->mainServer)}");
+                    $argsToInsert->push("ARG {$env->key}=".escapeBashEnvValue($this->resolve_environment_variable_raw($env)));
                 }
             }
             // Add Coolify variables as ARGs
@@ -4370,6 +4664,14 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             }
         }
 
+        if ($argsToInsert->isNotEmpty()) {
+            $environmentVariables = $envs->mapWithKeys(function ($environmentVariable) {
+                return [$environmentVariable->key => escapeBashEnvValue($this->resolve_environment_variable_raw($environmentVariable))];
+            });
+            $secretsHash = $this->generate_secrets_hash($environmentVariables);
+            $argsToInsert->push("ARG COOLIFY_BUILD_SECRETS_HASH={$secretsHash}");
+        }
+
         // Development logging to show what ARGs are being injected
         if (isDev()) {
             $this->application_deployment_queue->addLogEntry('[DEBUG] ========================================');
@@ -4391,11 +4693,6 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
                     $dockerfile->splice($fromLineIndex + 1, 0, [$arg]);
                 }
             }
-            $envs_mapped = $envs->mapWithKeys(function ($env) {
-                return [$env->key => $env->getResolvedValueWithServer($this->mainServer)];
-            });
-            $secrets_hash = $this->generate_secrets_hash($envs_mapped);
-            $argsToInsert->push("ARG COOLIFY_BUILD_SECRETS_HASH={$secrets_hash}");
         }
 
         $dockerfile_base64 = base64_encode($dockerfile->implode("\n"));
@@ -4404,18 +4701,14 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             [
                 executeInDocker($this->deployment_uuid, "echo '{$dockerfile_base64}' | base64 -d | tee {$this->workdir}{$this->dockerfile_location} > /dev/null"),
                 'hidden' => true,
-            ],
-            [
-                executeInDocker($this->deployment_uuid, "cat {$this->workdir}{$this->dockerfile_location}"),
-                'hidden' => true,
-                'ignore_errors' => true,
+                'skip_command_log' => true,
             ]);
     }
 
     private function modify_dockerfile_for_secrets($dockerfile_path)
     {
         // Only process if build secrets are enabled and we have secrets to mount
-        if (! $this->application->settings->use_build_secrets || empty($this->build_secrets)) {
+        if (empty($this->build_secrets)) {
             return;
         }
 
@@ -4439,18 +4732,51 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
             $this->generate_env_variables();
         }
 
-        $variables = $this->env_args;
+        $variables = $this->application->build_pack === 'nixpacks'
+            ? collect($this->nixpacks_plan_json->get('variables'))
+            : $this->env_args;
         if ($variables->isEmpty()) {
             return;
         }
 
+        $dottedKeys = $variables->keys()
+            ->map(fn ($key): string => (string) $key)
+            ->filter(fn (string $key): bool => str_contains($key, '.'));
+
+        if ($dottedKeys->isNotEmpty()) {
+            $originalDockerfile = $dockerfile;
+            $dockerfile = $dockerfile->map(function (string $line) use ($dottedKeys): ?string {
+                $trimmedLine = trim($line);
+
+                if (! str_starts_with($trimmedLine, 'ARG ') && ! str_starts_with($trimmedLine, 'ENV ')) {
+                    return $line;
+                }
+
+                [$instruction, $arguments] = explode(' ', $trimmedLine, 2);
+                $filteredArguments = collect(preg_split('/\s+/', $arguments))
+                    ->reject(function (string $argument) use ($dottedKeys): bool {
+                        $key = str($argument)->before('=')->toString();
+
+                        return $dottedKeys->contains($key);
+                    });
+
+                if ($filteredArguments->isEmpty()) {
+                    return null;
+                }
+
+                return $instruction.' '.$filteredArguments->implode(' ');
+            })->filter()->values();
+
+            $modified = $dockerfile->all() !== $originalDockerfile->values()->all();
+        }
+
         // Generate mount strings for all secrets
         $mountStrings = $variables->map(fn ($value, $key) => "--mount=type=secret,id={$key},env={$key}")->implode(' ');
 
         // Add mount for the secrets hash to ensure cache invalidation
         $mountStrings .= ' --mount=type=secret,id=COOLIFY_BUILD_SECRETS_HASH,env=COOLIFY_BUILD_SECRETS_HASH';
 
-        $modified = false;
+        $modified ??= false;
         $dockerfile = $dockerfile->map(function ($line) use ($mountStrings, &$modified) {
             $trimmed = ltrim($line);
 
@@ -4947,11 +5273,21 @@ COPY ./nginx.conf /etc/nginx/conf.d/default.conf");
         // Reset restart count after successful deployment
         // This is done here (not in Livewire) to avoid race conditions
         // with GetContainersStatus reading old container restart counts
-        $this->application->update([
+        $restartState = [
             'restart_count' => 0,
             'last_restart_at' => null,
             'last_restart_type' => null,
-        ]);
+        ];
+
+        if ($this->pull_request_id === 0) {
+            $restartState['restart_limit_reached'] = false;
+        }
+
+        if ($this->pull_request_id === 0) {
+            $this->application->update($restartState);
+        } else {
+            $this->preview?->resetRestartLimit();
+        }
 
         try {
             $this->application->markDeploymentConfigurationApplied($this->application_deployment_queue);
diff --git a/app/Jobs/CheckDomainDnsJob.php b/app/Jobs/CheckDomainDnsJob.php
new file mode 100644
index 0000000000..c013da25a6
--- /dev/null
+++ b/app/Jobs/CheckDomainDnsJob.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Actions\Shared\CheckDomainDns;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Server;
+use App\Models\ServiceApplication;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\DB;
+
+class CheckDomainDnsJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 30;
+
+    public function __construct(
+        public Application|ApplicationPreview|ServiceApplication $resource,
+        public string $statusKey,
+        public string $url,
+        public ?Server $server,
+        public ?string $expectedIp,
+        public string $checkId,
+        public bool $skipForMultipleServers = false,
+    ) {}
+
+    public function handle(): void
+    {
+        $this->persistResults(CheckDomainDns::run(
+            [$this->statusKey => $this->url],
+            $this->server,
+            $this->expectedIp,
+            $this->skipForMultipleServers,
+        ));
+    }
+
+    public function failed(?\Throwable $exception): void
+    {
+        $this->persistResults([
+            $this->statusKey => $this->status('failed', 'Could not validate DNS for this domain.'),
+        ]);
+    }
+
+    /**
+     * @return array{status: string, message: string, expected_ip: ?string, checked_at: string}
+     */
+    private function status(string $status, string $message): array
+    {
+        return [
+            'status' => $status,
+            'message' => $message,
+            'expected_ip' => $this->expectedIp,
+            'checked_at' => now()->toIso8601String(),
+        ];
+    }
+
+    /**
+     * @param  array<string, array{status: string, message: string, expected_ip: ?string, checked_at: string}>  $results
+     */
+    private function persistResults(array $results): void
+    {
+        DB::transaction(function () use ($results): void {
+            $resource = $this->resource::query()->lockForUpdate()->find($this->resource->getKey());
+            if (! $resource) {
+                return;
+            }
+
+            $statuses = $resource->domain_dns_statuses ?? [];
+
+            foreach ($results as $key => $result) {
+                if (($statuses[$key]['status'] ?? null) !== 'checking' || ($statuses[$key]['check_id'] ?? null) !== $this->checkId) {
+                    continue;
+                }
+
+                $statuses[$key] = $result;
+            }
+
+            $resource->domain_dns_statuses = $statuses === [] ? null : $statuses;
+            $resource->save();
+        });
+    }
+}
diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 1838feb9e7..b1f2c38b96 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -322,6 +322,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_postgresql($database);
                     } elseif (str($databaseType)->contains('mongo')) {
                         if ($database === '*') {
@@ -343,6 +344,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mongodb($database);
                     } elseif (str($databaseType)->contains('mysql')) {
                         $this->backup_file = "/mysql-dump-$database-".Carbon::now()->timestamp.'.dmp';
@@ -357,6 +359,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mysql($database);
                     } elseif (str($databaseType)->contains('mariadb')) {
                         $this->backup_file = "/mariadb-dump-$database-".Carbon::now()->timestamp.'.dmp';
@@ -371,6 +374,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mariadb($database);
                     } elseif ($this->database instanceof StandaloneClickhouse) {
                         $this->backup_file = '/clickhouse-backup-'.Carbon::now()->timestamp."-{$this->backup_log_uuid}.zip";
@@ -382,6 +386,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_clickhouse($database);
                     } else {
                         throw new \Exception('Unsupported database type');
@@ -480,14 +485,14 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         } catch (Throwable $e) {
             throw $e;
         } finally {
-            if ($this->team) {
-                BackupCreated::dispatch($this->team->id);
-            }
             if ($this->backup_log) {
                 $this->backup_log->update([
                     'finished_at' => Carbon::now()->toImmutable(),
                 ]);
             }
+            if ($this->team) {
+                BackupCreated::dispatch($this->team->id);
+            }
         }
     }
 
@@ -798,7 +803,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
             $this->add_to_error_output($e->getMessage());
             throw $e;
         } finally {
-            $command = "docker rm -f backup-of-{$this->backup_log_uuid}";
+            $command = dockerRemoveCommand("backup-of-{$this->backup_log_uuid}");
             instant_remote_process([$command], $this->server, true, false, null, disableMultiplexing: true);
         }
     }
diff --git a/app/Jobs/DatabaseStartJob.php b/app/Jobs/DatabaseStartJob.php
new file mode 100644
index 0000000000..e21ee38c61
--- /dev/null
+++ b/app/Jobs/DatabaseStartJob.php
@@ -0,0 +1,88 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Actions\Database\StartClickhouse;
+use App\Actions\Database\StartDragonfly;
+use App\Actions\Database\StartKeydb;
+use App\Actions\Database\StartMariadb;
+use App\Actions\Database\StartMongodb;
+use App\Actions\Database\StartMysql;
+use App\Actions\Database\StartPostgresql;
+use App\Actions\Database\StartRedis;
+use App\Enums\ProcessStatus;
+use App\Events\DatabaseStatusChanged;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Spatie\Activitylog\Models\Activity;
+use Throwable;
+
+class DatabaseStartJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 1;
+
+    public int $timeout = 600;
+
+    public function __construct(
+        public string $databaseClass,
+        public int $databaseId,
+        public int $teamId,
+        public int $activityId,
+        public ?int $userId,
+    ) {
+        $this->onQueue(deployment_queue());
+    }
+
+    public function handle(): void
+    {
+        $database = $this->databaseClass::query()->findOrFail($this->databaseId);
+        abort_unless((int) $database->team()->id === $this->teamId, 403);
+        $activity = Activity::query()->findOrFail($this->activityId);
+
+        match ($database->getMorphClass()) {
+            StandalonePostgresql::class => StartPostgresql::run($database, $activity),
+            StandaloneRedis::class => StartRedis::run($database, $activity),
+            StandaloneMongodb::class => StartMongodb::run($database, $activity),
+            StandaloneMysql::class => StartMysql::run($database, $activity),
+            StandaloneMariadb::class => StartMariadb::run($database, $activity),
+            StandaloneKeydb::class => StartKeydb::run($database, $activity),
+            StandaloneDragonfly::class => StartDragonfly::run($database, $activity),
+            StandaloneClickhouse::class => StartClickhouse::run($database, $activity),
+        };
+
+        event(new DatabaseStatusChanged($this->userId));
+    }
+
+    public function failed(?Throwable $exception): void
+    {
+        try {
+            $activity = Activity::query()->find($this->activityId);
+            if (! $activity) {
+                return;
+            }
+
+            $activity->properties = $activity->properties->merge([
+                'status' => ProcessStatus::ERROR->value,
+                'error' => 'Database start failed.',
+                'failed_at' => now()->toIso8601String(),
+            ]);
+            $activity->save();
+        } finally {
+            event(new DatabaseStatusChanged($this->userId));
+        }
+    }
+}
diff --git a/app/Jobs/DeleteResourceJob.php b/app/Jobs/DeleteResourceJob.php
index dff7d88de1..d07f346e56 100644
--- a/app/Jobs/DeleteResourceJob.php
+++ b/app/Jobs/DeleteResourceJob.php
@@ -26,7 +26,6 @@ use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 
@@ -47,9 +46,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
     public function handle(): void
     {
         if ($this->resource instanceof ApplicationPreview) {
-            DB::transaction(function (): void {
-                $this->deleteApplicationPreview();
-            });
+            $this->deleteApplicationPreview();
 
             return;
         }
@@ -99,17 +96,17 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             ]);
         }
 
-        DB::transaction(function (): void {
-            try {
-                $this->deleteScheduledVolumeBackups();
-            } catch (\Throwable $e) {
-                Log::warning('Remote backup cleanup failed while deleting resource; continuing with local deletion.', [
-                    'resource_id' => $this->resource->id,
-                    'resource_type' => $this->resource->type(),
-                    'error' => $e->getMessage(),
-                ]);
-            }
+        try {
+            $this->deleteScheduledVolumeBackups();
+        } catch (\Throwable $e) {
+            Log::warning('Remote backup cleanup failed while deleting resource; continuing with local deletion.', [
+                'resource_id' => $this->resource->id,
+                'resource_type' => $this->resource->type(),
+                'error' => $e->getMessage(),
+            ]);
+        }
 
+        DB::transaction(function (): void {
             if ($this->resource instanceof Service) {
                 app(DeleteService::class)->deleteLocal($this->resource);
 
@@ -130,7 +127,6 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             $this->resource->forceDelete();
         });
 
-        Artisan::queue('cleanup:stucked-resources');
     }
 
     private function isDatabase(): bool
@@ -163,10 +159,22 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
-    private function deleteApplicationPreview()
+    private function deleteApplicationPreview(): void
     {
         $application = $this->resource->application;
-        $server = $application->destination->server;
+
+        if (! $application) {
+            $this->deleteApplicationPreviewLocally();
+
+            return;
+        }
+
+        $server = $application->destination?->server;
+        if (! $server) {
+            $this->deleteApplicationPreviewLocally();
+
+            return;
+        }
         $pull_request_id = $this->resource->pull_request_id;
 
         // Ensure the preview is soft deleted (may already be done in Livewire component)
@@ -239,6 +247,14 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         $this->resource->forceDelete();
     }
 
+    private function deleteApplicationPreviewLocally(): void
+    {
+        DB::transaction(function (): void {
+            $this->resource->persistentStorages()->delete();
+            ApplicationPreview::withoutEvents(fn () => $this->resource->forceDelete());
+        });
+    }
+
     private function stopPreviewContainers(array $containers, $server, int $timeout = 30)
     {
         if (empty($containers)) {
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index 9c4a2531a9..0e73ee41b2 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -2,11 +2,15 @@
 
 namespace App\Jobs;
 
+use App\Actions\Application\StopApplication;
+use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
+use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
 use App\Actions\Server\StartLogDrain;
+use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
@@ -23,8 +27,10 @@ use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use App\Models\SwarmDocker;
+use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Notifications\Container\ContainerRestarted;
 use App\Services\ContainerStatusAggregator;
+use App\Services\RestartCountTracker;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -95,8 +101,14 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
     public Collection $applicationContainerStatuses;
 
+    public Collection $applicationContainerRestartCounts;
+
     public Collection $serviceContainerStatuses;
 
+    public Collection $previewContainerRestartCounts;
+
+    public Collection $serviceContainerRestartCounts;
+
     public bool $foundProxy = false;
 
     public bool $foundLogDrainContainer = false;
@@ -122,7 +134,10 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         $this->foundApplicationPreviewsIds = collect();
         $this->foundServiceDatabaseIds = collect();
         $this->applicationContainerStatuses = collect();
+        $this->applicationContainerRestartCounts = collect();
         $this->serviceContainerStatuses = collect();
+        $this->previewContainerRestartCounts = collect();
+        $this->serviceContainerRestartCounts = collect();
         $this->allApplicationIds = collect();
         $this->allDatabaseUuids = collect();
         $this->allTcpProxyUuids = collect();
@@ -140,7 +155,10 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
     {
         // Defensive initialization for Collection properties to handle queue deserialization edge cases
         $this->serviceContainerStatuses ??= collect();
+        $this->previewContainerRestartCounts ??= collect();
+        $this->serviceContainerRestartCounts ??= collect();
         $this->applicationContainerStatuses ??= collect();
+        $this->applicationContainerRestartCounts ??= collect();
         $this->foundApplicationIds ??= collect();
         $this->foundDatabaseUuids ??= collect();
         $this->foundServiceApplicationIds ??= collect();
@@ -231,6 +249,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             if (! $coolify_managed) {
                 continue;
             }
+            if (filter_var($labels->get('com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)) {
+                continue;
+            }
 
             $name = data_get($container, 'name');
             if ($name === 'coolify-log-drain' && $this->isRunning($containerStatus)) {
@@ -241,6 +262,10 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 $pullRequestId = $labels->get('coolify.pullRequestId', '0');
                 try {
                     if ($pullRequestId === '0') {
+                        $application = $this->applicationsById->get((string) $applicationId);
+                        if ($application && $application->container_present !== true) {
+                            $application->update(['container_present' => true]);
+                        }
                         if ($this->allApplicationIds->contains($applicationId)) {
                             $this->foundApplicationIds->push($applicationId);
                         }
@@ -251,6 +276,13 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                         $containerName = $labels->get('com.docker.compose.service');
                         if ($containerName) {
                             $this->applicationContainerStatuses->get($applicationId)->put($containerName, $containerStatus);
+                            $restartCount = data_get($container, 'restart_count');
+                            if (is_numeric($restartCount)) {
+                                if (! $this->applicationContainerRestartCounts->has($applicationId)) {
+                                    $this->applicationContainerRestartCounts->put($applicationId, collect());
+                                }
+                                $this->applicationContainerRestartCounts->get($applicationId)->put($containerName, (int) $restartCount);
+                            }
                         }
                     } else {
                         $previewKey = $applicationId.':'.$pullRequestId;
@@ -258,6 +290,13 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                             $this->foundApplicationPreviewsIds->push($previewKey);
                         }
                         $this->updateApplicationPreviewStatus($applicationId, $pullRequestId, $containerStatus);
+                        $restartCount = data_get($container, 'restart_count');
+                        if (is_numeric($restartCount)) {
+                            $this->previewContainerRestartCounts->push([
+                                'key' => $previewKey,
+                                'count' => (int) $restartCount,
+                            ]);
+                        }
                     }
                 } catch (\Exception $e) {
                 }
@@ -278,6 +317,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                     $containerName = $labels->get('com.docker.compose.service');
                     if ($containerName) {
                         $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                        $this->storeServiceRestartCount($key, $containerName, data_get($container, 'restart_count'));
                     }
                 } elseif ($subType === 'database') {
                     $this->foundServiceDatabaseIds->push($subId);
@@ -289,6 +329,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                     $containerName = $labels->get('com.docker.compose.service');
                     if ($containerName) {
                         $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                        $this->storeServiceRestartCount($key, $containerName, data_get($container, 'restart_count'));
                     }
                 }
             } else {
@@ -302,9 +343,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                         $this->foundDatabaseUuids->push($uuid);
                         // TCP proxy should only be started/managed when database is actually running
                         if ($this->allTcpProxyUuids->contains($uuid) && $this->isRunning($containerStatus)) {
-                            $this->updateDatabaseStatus($uuid, $containerStatus, tcpProxy: true);
+                            $this->updateDatabaseStatus($uuid, $containerStatus, data_get($container, 'restart_count'), tcpProxy: true);
                         } else {
-                            $this->updateDatabaseStatus($uuid, $containerStatus, tcpProxy: false);
+                            $this->updateDatabaseStatus($uuid, $containerStatus, data_get($container, 'restart_count'), tcpProxy: false);
                         }
                     }
                 }
@@ -317,6 +358,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
         $this->updateProxyStatus();
 
+        Application::whereIn('id', $this->foundApplicationIds->unique())
+            ->update(['container_present' => true]);
+
         $this->updateNotFoundApplicationStatus();
         $this->updateNotFoundApplicationPreviewStatus();
         $this->updateNotFoundDatabaseStatus();
@@ -324,6 +368,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
         $this->updateAdditionalServersStatus();
 
+        $this->trackPreviewRestartCounts();
+
         // Aggregate multi-container application statuses
         $this->aggregateMultiContainerStatuses();
 
@@ -349,11 +395,18 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                     'uuid',
                     'name',
                     'status',
+                    'container_present',
                     'build_pack',
                     'docker_compose_raw',
+                    'environment_id',
                     'destination_id',
                     'destination_type',
                     'last_online_at',
+                    'restart_count',
+                    'max_restart_count',
+                    'restart_limit_reached',
+                    'last_restart_at',
+                    'last_restart_type',
                 ])
                 ->withCount('additional_servers')
                 ->where(fn ($query) => $this->scopeDestination($query, $standaloneDockerIds, $swarmDockerIds))
@@ -372,11 +425,18 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                         'uuid',
                         'name',
                         'status',
+                        'container_present',
                         'build_pack',
                         'docker_compose_raw',
+                        'environment_id',
                         'destination_id',
                         'destination_type',
                         'last_online_at',
+                        'restart_count',
+                        'max_restart_count',
+                        'restart_limit_reached',
+                        'last_restart_at',
+                        'last_restart_type',
                     ])
                     ->withCount('additional_servers')
                     ->whereIn('id', $additionalApplicationIds)
@@ -402,6 +462,11 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 'pull_request_id',
                 'status',
                 'last_online_at',
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
             ])
             ->whereIn('application_id', $applicationIds)
             ->get();
@@ -417,8 +482,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 'docker_compose_raw',
             ])
             ->with([
-                'applications:id,service_id,status,last_online_at',
-                'databases:id,service_id,status,last_online_at,is_public,name',
+                'applications:id,service_id,status,last_online_at,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
+                'databases:id,service_id,status,last_online_at,is_public,name,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
             ])
             ->get();
     }
@@ -441,6 +506,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             'restart_count',
             'last_restart_at',
             'last_restart_type',
+            'max_restart_count',
+            'restart_limit_reached',
         ];
 
         return collect([
@@ -495,6 +562,53 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 continue;
             }
 
+            $maxRestartCount = 0;
+            $restartCountsAvailable = $this->applicationContainerRestartCounts->has($applicationId);
+            if ($restartCountsAvailable) {
+                $maxRestartCount = $this->applicationContainerRestartCounts->get($applicationId)->max() ?? 0;
+                $restartState = (new RestartCountTracker)->evaluate(
+                    previousRestartCount: $application->restart_count ?? 0,
+                    observedRestartCount: $maxRestartCount,
+                    maxRestartCount: $application->max_restart_count ?? 0,
+                );
+
+                if ($restartState['restart_count_changed']) {
+                    $hasCrashRestarts = $restartState['restart_count'] > 0;
+                    $application->update([
+                        'restart_count' => $restartState['restart_count'],
+                        'last_restart_at' => $hasCrashRestarts ? now() : null,
+                        'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
+                    ]);
+                }
+
+                if ($restartState['restart_limit_reached']) {
+                    $restartLimitClaimed = Application::query()
+                        ->whereKey($application->getKey())
+                        ->where('restart_limit_reached', false)
+                        ->update(['restart_limit_reached' => true]) === 1;
+
+                    if ($restartLimitClaimed) {
+                        $application->refresh();
+                        StopApplication::dispatch(
+                            application: $application,
+                            previewDeployments: false,
+                            dockerCleanup: false,
+                            resetRestartCount: false,
+                            removeContainers: false,
+                        );
+                        $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    }
+                }
+            }
+
+            if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(
+                fn (string $status): bool => str($status)->contains('exited')
+            )) {
+                $application->update(['status' => 'exited']);
+
+                continue;
+            }
+
             // Parse docker compose to check for excluded containers
             $dockerComposeRaw = data_get($application, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -519,7 +633,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             // Use ContainerStatusAggregator service for state machine logic
             // Use preserveRestarting: true so applications show "Restarting" instead of "Degraded"
             $aggregator = new ContainerStatusAggregator;
-            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, 0, preserveRestarting: true);
+            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, $maxRestartCount, preserveRestarting: true);
 
             // Update application status with aggregated result
             if ($aggregatedStatus && $application->status !== $aggregatedStatus) {
@@ -560,6 +674,14 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
                 continue;
             }
 
+            $restartCount = $this->serviceContainerRestartCounts->get($key)?->max() ?? 0;
+            if ($subResource->trackRestartCount($restartCount)) {
+                StopServiceApplication::dispatch($subResource, false, false);
+                $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
+
+                continue;
+            }
+
             // Parse docker compose from service to check for excluded containers
             $dockerComposeRaw = data_get($service, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -581,10 +703,9 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             }
 
             // Use ContainerStatusAggregator service for state machine logic
-            // NOTE: Sentinel does NOT provide restart count data, so maxRestartCount is always 0
             // Use preserveRestarting: true so individual sub-resources show "Restarting" instead of "Degraded"
             $aggregator = new ContainerStatusAggregator;
-            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, 0, preserveRestarting: true);
+            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, $restartCount, preserveRestarting: true);
 
             // Update service sub-resource status with aggregated result
             if ($aggregatedStatus && $subResource->status !== $aggregatedStatus) {
@@ -627,8 +748,11 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
         // Batch update: mark all not-found applications as exited (excluding already exited ones)
         Application::whereIn('id', $notFoundApplicationIds)
-            ->where('status', 'not like', 'exited%')
-            ->update(['status' => 'exited']);
+            ->update([
+                'status' => 'exited',
+                'container_present' => false,
+                'restart_limit_reached' => false,
+            ]);
     }
 
     private function updateNotFoundApplicationPreviewStatus()
@@ -687,7 +811,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         }
     }
 
-    private function updateDatabaseStatus(string $databaseUuid, string $containerStatus, bool $tcpProxy = false)
+    private function updateDatabaseStatus(string $databaseUuid, string $containerStatus, mixed $restartCount = null, bool $tcpProxy = false): void
     {
         $database = $this->databasesByUuid->get($databaseUuid);
         if (! $database) {
@@ -697,6 +821,12 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             $database->status = $containerStatus;
             $database->save();
         }
+        if (is_numeric($restartCount) && $database->trackRestartCount((int) $restartCount)) {
+            StopDatabase::dispatch($database, false, false, false);
+            $database->team()?->notify(new ApplicationRestartLimitReached($database));
+
+            return;
+        }
         if (! $this->isCompleteSnapshot()) {
             return;
         }
@@ -719,6 +849,30 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         }
     }
 
+    private function storeServiceRestartCount(string $key, string $containerName, mixed $restartCount): void
+    {
+        if (! is_numeric($restartCount)) {
+            return;
+        }
+        if (! $this->serviceContainerRestartCounts->has($key)) {
+            $this->serviceContainerRestartCounts->put($key, collect());
+        }
+        $this->serviceContainerRestartCounts->get($key)->put($containerName, (int) $restartCount);
+    }
+
+    private function trackPreviewRestartCounts(): void
+    {
+        $this->previewContainerRestartCounts
+            ->groupBy('key')
+            ->each(function (Collection $counts, string $key): void {
+                $preview = $this->previewsByKey->get($key);
+                if ($preview?->trackRestartCount((int) $counts->max('count'))) {
+                    StopApplicationPreview::dispatch($preview, false, false);
+                    $preview->application->environment->project->team?->notify(new ApplicationRestartLimitReached($preview));
+                }
+            });
+    }
+
     private function updateNotFoundDatabaseStatus()
     {
         $notFoundDatabaseUuids = $this->allDatabaseUuids->diff($this->foundDatabaseUuids);
@@ -729,12 +883,16 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {
+                if ($database->stoppedAfterRestartLimit()) {
+                    return;
+                }
                 if (! str($database->status)->startsWith('exited')) {
                     $database->update([
                         'status' => 'exited',
                         'restart_count' => 0,
                         'last_restart_at' => null,
                         'last_restart_type' => null,
+                        'restart_limit_reached' => false,
                     ]);
                 }
                 if ($database->is_public) {
@@ -752,15 +910,17 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         // Batch update service applications
         if ($notFoundServiceApplicationIds->isNotEmpty()) {
             ServiceApplication::whereIn('id', $notFoundServiceApplicationIds)
+                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited']);
+                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
         }
 
         // Batch update service databases
         if ($notFoundServiceDatabaseIds->isNotEmpty()) {
             ServiceDatabase::whereIn('id', $notFoundServiceDatabaseIds)
+                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited']);
+                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
         }
     }
 
diff --git a/app/Jobs/SendVerificationEmailJob.php b/app/Jobs/SendVerificationEmailJob.php
new file mode 100644
index 0000000000..b9d2c8e11e
--- /dev/null
+++ b/app/Jobs/SendVerificationEmailJob.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\User;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Queue\Queueable;
+
+class SendVerificationEmailJob implements ShouldQueue
+{
+    use Queueable;
+
+    public $tries = 3;
+
+    public $backoff = 10;
+
+    public function __construct(public User $user)
+    {
+        $this->onQueue('high');
+    }
+
+    /**
+     * Execute the job.
+     */
+    public function handle(): void
+    {
+        $this->user->sendVerificationEmail();
+    }
+}
diff --git a/app/Jobs/ServerConnectionCheckJob.php b/app/Jobs/ServerConnectionCheckJob.php
index fe7a20972c..97d211d247 100644
--- a/app/Jobs/ServerConnectionCheckJob.php
+++ b/app/Jobs/ServerConnectionCheckJob.php
@@ -100,7 +100,10 @@ class ServerConnectionCheckJob implements ShouldBeEncrypted, ShouldQueue
             ]);
 
             if ($this->server->unreachable_count > 0) {
-                $this->server->update(['unreachable_count' => 0]);
+                // Direct assignment: unreachable_count is not mass-assignable,
+                // so update() would silently drop the reset.
+                $this->server->unreachable_count = 0;
+                $this->server->save();
             }
 
             $this->dispatchReachabilityChangedIfNeeded($wasReachable, $wasNotified, true);
diff --git a/app/Listeners/ProxyStatusChangedNotification.php b/app/Listeners/ProxyStatusChangedNotification.php
index 30ecb2d8d5..9b117d4e13 100644
--- a/app/Listeners/ProxyStatusChangedNotification.php
+++ b/app/Listeners/ProxyStatusChangedNotification.php
@@ -61,7 +61,7 @@ class ProxyStatusChangedNotification implements ShouldQueueAfterCommit
 
         if ($status === 'created') {
             instant_remote_process([
-                'docker rm -f coolify-proxy',
+                dockerRemoveCommand('coolify-proxy'),
             ], $server);
         }
     }
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index 1b344c9056..b0ab4d183e 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -43,7 +43,7 @@ class Show extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -81,11 +81,11 @@ class Show extends Component
                 }
                 $safeNetwork = escapeshellarg($this->destination->network);
                 instant_remote_process(["docker network disconnect {$safeNetwork} coolify-proxy"], $this->destination->server, throwError: false);
-                instant_remote_process(["docker network rm -f {$safeNetwork}"], $this->destination->server);
+                instant_remote_process([dockerNetworkRemoveCommand($this->destination->network)], $this->destination->server);
             }
             $this->destination->delete();
 
-            return redirect()->route('destination.index');
+            return redirectRoute($this, 'destination.index');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Dev/LivewireRequestFailurePreview.php b/app/Livewire/Dev/LivewireRequestFailurePreview.php
new file mode 100644
index 0000000000..5cdda5d781
--- /dev/null
+++ b/app/Livewire/Dev/LivewireRequestFailurePreview.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Livewire\Dev;
+
+use Illuminate\Http\Exceptions\HttpResponseException;
+use Livewire\Component;
+use Symfony\Component\HttpFoundation\Response;
+
+class LivewireRequestFailurePreview extends Component
+{
+    /**
+     * @var list<int>
+     */
+    public array $statuses = [502, 503, 504, 520, 521, 522, 523, 524, 525, 526, 527, 530];
+
+    public function fail(int $status): never
+    {
+        abort_unless(in_array($status, $this->statuses, true), Response::HTTP_NOT_FOUND);
+
+        throw new HttpResponseException(response(
+            '<!doctype html><html><body><h1>Gateway time-out</h1><p>cloudflare proxy error '.$status.'</p></body></html>',
+            $status,
+            ['Content-Type' => 'text/html']
+        ));
+    }
+
+    public function render(): mixed
+    {
+        return view('livewire.dev.livewire-request-failure-preview')->layout('layouts.simple');
+    }
+}
diff --git a/app/Livewire/GlobalSearch.php b/app/Livewire/GlobalSearch.php
index bf64ee8e9d..c6ed818e97 100644
--- a/app/Livewire/GlobalSearch.php
+++ b/app/Livewire/GlobalSearch.php
@@ -1507,8 +1507,7 @@ class GlobalSearch extends Component
                 'type' => 'one-click-service-'.$serviceKey,
                 'category' => 'Services',
                 'resourceType' => 'service',
-                'logo' => data_get($service, 'logo'),
-            ] + array_filter([
+            ] + service_logo_urls(data_get($service, 'logo')) + array_filter([
                 'amd_only' => data_get($service, 'amd_only') ? true : null,
                 'arm_only' => data_get($service, 'arm_only') ? true : null,
             ]));
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index 59ecb06e8e..cb31e6c111 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -34,6 +34,9 @@ class Discord extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeDiscordNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedDiscordNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessDiscordNotifications = false;
 
@@ -82,17 +85,17 @@ class Discord extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->discord_enabled = $this->discordEnabled;
             $this->settings->discord_webhook_url = $this->discordWebhookUrl;
 
             $this->settings->deployment_success_discord_notifications = $this->deploymentSuccessDiscordNotifications;
             $this->settings->deployment_failure_discord_notifications = $this->deploymentFailureDiscordNotifications;
             $this->settings->status_change_discord_notifications = $this->statusChangeDiscordNotifications;
+            $this->settings->restart_limit_reached_discord_notifications = $this->restartLimitReachedDiscordNotifications;
             $this->settings->backup_success_discord_notifications = $this->backupSuccessDiscordNotifications;
             $this->settings->backup_failure_discord_notifications = $this->backupFailureDiscordNotifications;
             $this->settings->scheduled_task_success_discord_notifications = $this->scheduledTaskSuccessDiscordNotifications;
@@ -118,6 +121,7 @@ class Discord extends Component
             $this->deploymentSuccessDiscordNotifications = $this->settings->deployment_success_discord_notifications;
             $this->deploymentFailureDiscordNotifications = $this->settings->deployment_failure_discord_notifications;
             $this->statusChangeDiscordNotifications = $this->settings->status_change_discord_notifications;
+            $this->restartLimitReachedDiscordNotifications = $this->settings->restart_limit_reached_discord_notifications;
             $this->backupSuccessDiscordNotifications = $this->settings->backup_success_discord_notifications;
             $this->backupFailureDiscordNotifications = $this->settings->backup_failure_discord_notifications;
             $this->scheduledTaskSuccessDiscordNotifications = $this->settings->scheduled_task_success_discord_notifications;
@@ -193,6 +197,7 @@ class Discord extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -203,6 +208,7 @@ class Discord extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -212,6 +218,8 @@ class Discord extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 2a373a5065..ea626ed57a 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Notifications;
 
+use App\Livewire\Notifications\Concerns\TogglesNotificationEvents;
 use App\Models\EmailNotificationSettings;
 use App\Models\Team;
 use App\Notifications\Test;
@@ -14,7 +15,7 @@ use Livewire\Component;
 
 class Email extends Component
 {
-    use AuthorizesRequests;
+    use AuthorizesRequests, TogglesNotificationEvents;
 
     protected $listeners = ['refresh' => '$refresh'];
 
@@ -78,6 +79,9 @@ class Email extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeEmailNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedEmailNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessEmailNotifications = false;
 
@@ -128,12 +132,11 @@ class Email extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
             $this->validate(['smtpEhloDomain' => ['nullable', 'string', new ValidHostname]]);
-            $this->authorize('update', $this->settings);
             $this->settings->smtp_enabled = $this->smtpEnabled;
             $this->settings->smtp_from_address = $this->smtpFromAddress;
             $this->settings->smtp_from_name = $this->smtpFromName;
@@ -154,6 +157,7 @@ class Email extends Component
             $this->settings->deployment_success_email_notifications = $this->deploymentSuccessEmailNotifications;
             $this->settings->deployment_failure_email_notifications = $this->deploymentFailureEmailNotifications;
             $this->settings->status_change_email_notifications = $this->statusChangeEmailNotifications;
+            $this->settings->restart_limit_reached_email_notifications = $this->restartLimitReachedEmailNotifications;
             $this->settings->backup_success_email_notifications = $this->backupSuccessEmailNotifications;
             $this->settings->backup_failure_email_notifications = $this->backupFailureEmailNotifications;
             $this->settings->scheduled_task_success_email_notifications = $this->scheduledTaskSuccessEmailNotifications;
@@ -192,6 +196,7 @@ class Email extends Component
             $this->deploymentSuccessEmailNotifications = $this->settings->deployment_success_email_notifications;
             $this->deploymentFailureEmailNotifications = $this->settings->deployment_failure_email_notifications;
             $this->statusChangeEmailNotifications = $this->settings->status_change_email_notifications;
+            $this->restartLimitReachedEmailNotifications = $this->settings->restart_limit_reached_email_notifications;
             $this->backupSuccessEmailNotifications = $this->settings->backup_success_email_notifications;
             $this->backupFailureEmailNotifications = $this->settings->backup_failure_email_notifications;
             $this->scheduledTaskSuccessEmailNotifications = $this->settings->scheduled_task_success_email_notifications;
@@ -218,6 +223,8 @@ class Email extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         $this->dispatch('success', 'Email notifications settings updated.');
     }
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index b1608c5ea2..cae1c3d689 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -41,6 +41,9 @@ class Pushover extends Component
     #[Validate(['boolean'])]
     public bool $statusChangePushoverNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedPushoverNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessPushoverNotifications = false;
 
@@ -86,11 +89,10 @@ class Pushover extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->pushover_enabled = $this->pushoverEnabled;
             $this->settings->pushover_user_key = $this->pushoverUserKey;
             $this->settings->pushover_api_token = $this->pushoverApiToken;
@@ -98,6 +100,7 @@ class Pushover extends Component
             $this->settings->deployment_success_pushover_notifications = $this->deploymentSuccessPushoverNotifications;
             $this->settings->deployment_failure_pushover_notifications = $this->deploymentFailurePushoverNotifications;
             $this->settings->status_change_pushover_notifications = $this->statusChangePushoverNotifications;
+            $this->settings->restart_limit_reached_pushover_notifications = $this->restartLimitReachedPushoverNotifications;
             $this->settings->backup_success_pushover_notifications = $this->backupSuccessPushoverNotifications;
             $this->settings->backup_failure_pushover_notifications = $this->backupFailurePushoverNotifications;
             $this->settings->scheduled_task_success_pushover_notifications = $this->scheduledTaskSuccessPushoverNotifications;
@@ -125,6 +128,7 @@ class Pushover extends Component
             $this->deploymentSuccessPushoverNotifications = $this->settings->deployment_success_pushover_notifications;
             $this->deploymentFailurePushoverNotifications = $this->settings->deployment_failure_pushover_notifications;
             $this->statusChangePushoverNotifications = $this->settings->status_change_pushover_notifications;
+            $this->restartLimitReachedPushoverNotifications = $this->settings->restart_limit_reached_pushover_notifications;
             $this->backupSuccessPushoverNotifications = $this->settings->backup_success_pushover_notifications;
             $this->backupFailurePushoverNotifications = $this->settings->backup_failure_pushover_notifications;
             $this->scheduledTaskSuccessPushoverNotifications = $this->settings->scheduled_task_success_pushover_notifications;
@@ -190,6 +194,7 @@ class Pushover extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -202,6 +207,7 @@ class Pushover extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -211,6 +217,8 @@ class Pushover extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index c4ca7da802..644252c1a3 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -39,6 +39,9 @@ class Slack extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeSlackNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedSlackNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessSlackNotifications = false;
 
@@ -84,17 +87,17 @@ class Slack extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->slack_enabled = $this->slackEnabled;
             $this->settings->slack_webhook_url = $this->slackWebhookUrl;
 
             $this->settings->deployment_success_slack_notifications = $this->deploymentSuccessSlackNotifications;
             $this->settings->deployment_failure_slack_notifications = $this->deploymentFailureSlackNotifications;
             $this->settings->status_change_slack_notifications = $this->statusChangeSlackNotifications;
+            $this->settings->restart_limit_reached_slack_notifications = $this->restartLimitReachedSlackNotifications;
             $this->settings->backup_success_slack_notifications = $this->backupSuccessSlackNotifications;
             $this->settings->backup_failure_slack_notifications = $this->backupFailureSlackNotifications;
             $this->settings->scheduled_task_success_slack_notifications = $this->scheduledTaskSuccessSlackNotifications;
@@ -118,6 +121,7 @@ class Slack extends Component
             $this->deploymentSuccessSlackNotifications = $this->settings->deployment_success_slack_notifications;
             $this->deploymentFailureSlackNotifications = $this->settings->deployment_failure_slack_notifications;
             $this->statusChangeSlackNotifications = $this->settings->status_change_slack_notifications;
+            $this->restartLimitReachedSlackNotifications = $this->settings->restart_limit_reached_slack_notifications;
             $this->backupSuccessSlackNotifications = $this->settings->backup_success_slack_notifications;
             $this->backupFailureSlackNotifications = $this->settings->backup_failure_slack_notifications;
             $this->scheduledTaskSuccessSlackNotifications = $this->settings->scheduled_task_success_slack_notifications;
@@ -179,6 +183,7 @@ class Slack extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -191,6 +196,7 @@ class Slack extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -200,6 +206,8 @@ class Slack extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index 9f19b22f5f..f999294477 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -41,6 +41,9 @@ class Telegram extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeTelegramNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedTelegramNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessTelegramNotifications = false;
 
@@ -83,6 +86,9 @@ class Telegram extends Component
     #[Validate(['nullable', 'string'])]
     public ?string $telegramNotificationsStatusChangeThreadId = null;
 
+    #[Validate(['nullable', 'string', 'max:255'])]
+    public ?string $telegramNotificationsRestartLimitReachedThreadId = null;
+
     #[Validate(['nullable', 'string'])]
     public ?string $telegramNotificationsBackupSuccessThreadId = null;
 
@@ -128,11 +134,10 @@ class Telegram extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->telegram_enabled = $this->telegramEnabled;
             $this->settings->telegram_token = $this->telegramToken;
             $this->settings->telegram_chat_id = $this->telegramChatId;
@@ -140,6 +145,7 @@ class Telegram extends Component
             $this->settings->deployment_success_telegram_notifications = $this->deploymentSuccessTelegramNotifications;
             $this->settings->deployment_failure_telegram_notifications = $this->deploymentFailureTelegramNotifications;
             $this->settings->status_change_telegram_notifications = $this->statusChangeTelegramNotifications;
+            $this->settings->restart_limit_reached_telegram_notifications = $this->restartLimitReachedTelegramNotifications;
             $this->settings->backup_success_telegram_notifications = $this->backupSuccessTelegramNotifications;
             $this->settings->backup_failure_telegram_notifications = $this->backupFailureTelegramNotifications;
             $this->settings->scheduled_task_success_telegram_notifications = $this->scheduledTaskSuccessTelegramNotifications;
@@ -155,6 +161,7 @@ class Telegram extends Component
             $this->settings->telegram_notifications_deployment_success_thread_id = $this->telegramNotificationsDeploymentSuccessThreadId;
             $this->settings->telegram_notifications_deployment_failure_thread_id = $this->telegramNotificationsDeploymentFailureThreadId;
             $this->settings->telegram_notifications_status_change_thread_id = $this->telegramNotificationsStatusChangeThreadId;
+            $this->settings->telegram_notifications_restart_limit_reached_thread_id = $this->telegramNotificationsRestartLimitReachedThreadId;
             $this->settings->telegram_notifications_backup_success_thread_id = $this->telegramNotificationsBackupSuccessThreadId;
             $this->settings->telegram_notifications_backup_failure_thread_id = $this->telegramNotificationsBackupFailureThreadId;
             $this->settings->telegram_notifications_scheduled_task_success_thread_id = $this->telegramNotificationsScheduledTaskSuccessThreadId;
@@ -173,6 +180,21 @@ class Telegram extends Component
             if (auth()->user()->can('update', $this->settings)) {
                 $this->telegramToken = $this->settings->telegram_token;
                 $this->telegramChatId = $this->settings->telegram_chat_id;
+                $this->telegramNotificationsDeploymentSuccessThreadId = $this->settings->telegram_notifications_deployment_success_thread_id;
+                $this->telegramNotificationsDeploymentFailureThreadId = $this->settings->telegram_notifications_deployment_failure_thread_id;
+                $this->telegramNotificationsStatusChangeThreadId = $this->settings->telegram_notifications_status_change_thread_id;
+                $this->telegramNotificationsRestartLimitReachedThreadId = $this->settings->telegram_notifications_restart_limit_reached_thread_id;
+                $this->telegramNotificationsBackupSuccessThreadId = $this->settings->telegram_notifications_backup_success_thread_id;
+                $this->telegramNotificationsBackupFailureThreadId = $this->settings->telegram_notifications_backup_failure_thread_id;
+                $this->telegramNotificationsScheduledTaskSuccessThreadId = $this->settings->telegram_notifications_scheduled_task_success_thread_id;
+                $this->telegramNotificationsScheduledTaskFailureThreadId = $this->settings->telegram_notifications_scheduled_task_failure_thread_id;
+                $this->telegramNotificationsDockerCleanupSuccessThreadId = $this->settings->telegram_notifications_docker_cleanup_success_thread_id;
+                $this->telegramNotificationsDockerCleanupFailureThreadId = $this->settings->telegram_notifications_docker_cleanup_failure_thread_id;
+                $this->telegramNotificationsServerDiskUsageThreadId = $this->settings->telegram_notifications_server_disk_usage_thread_id;
+                $this->telegramNotificationsServerReachableThreadId = $this->settings->telegram_notifications_server_reachable_thread_id;
+                $this->telegramNotificationsServerUnreachableThreadId = $this->settings->telegram_notifications_server_unreachable_thread_id;
+                $this->telegramNotificationsServerPatchThreadId = $this->settings->telegram_notifications_server_patch_thread_id;
+                $this->telegramNotificationsTraefikOutdatedThreadId = $this->settings->telegram_notifications_traefik_outdated_thread_id;
             } else {
                 $this->telegramToken = null;
                 $this->telegramChatId = null;
@@ -181,6 +203,7 @@ class Telegram extends Component
             $this->deploymentSuccessTelegramNotifications = $this->settings->deployment_success_telegram_notifications;
             $this->deploymentFailureTelegramNotifications = $this->settings->deployment_failure_telegram_notifications;
             $this->statusChangeTelegramNotifications = $this->settings->status_change_telegram_notifications;
+            $this->restartLimitReachedTelegramNotifications = $this->settings->restart_limit_reached_telegram_notifications;
             $this->backupSuccessTelegramNotifications = $this->settings->backup_success_telegram_notifications;
             $this->backupFailureTelegramNotifications = $this->settings->backup_failure_telegram_notifications;
             $this->scheduledTaskSuccessTelegramNotifications = $this->settings->scheduled_task_success_telegram_notifications;
@@ -193,26 +216,13 @@ class Telegram extends Component
             $this->serverPatchTelegramNotifications = $this->settings->server_patch_telegram_notifications;
             $this->traefikOutdatedTelegramNotifications = $this->settings->traefik_outdated_telegram_notifications;
 
-            $this->telegramNotificationsDeploymentSuccessThreadId = $this->settings->telegram_notifications_deployment_success_thread_id;
-            $this->telegramNotificationsDeploymentFailureThreadId = $this->settings->telegram_notifications_deployment_failure_thread_id;
-            $this->telegramNotificationsStatusChangeThreadId = $this->settings->telegram_notifications_status_change_thread_id;
-            $this->telegramNotificationsBackupSuccessThreadId = $this->settings->telegram_notifications_backup_success_thread_id;
-            $this->telegramNotificationsBackupFailureThreadId = $this->settings->telegram_notifications_backup_failure_thread_id;
-            $this->telegramNotificationsScheduledTaskSuccessThreadId = $this->settings->telegram_notifications_scheduled_task_success_thread_id;
-            $this->telegramNotificationsScheduledTaskFailureThreadId = $this->settings->telegram_notifications_scheduled_task_failure_thread_id;
-            $this->telegramNotificationsDockerCleanupSuccessThreadId = $this->settings->telegram_notifications_docker_cleanup_success_thread_id;
-            $this->telegramNotificationsDockerCleanupFailureThreadId = $this->settings->telegram_notifications_docker_cleanup_failure_thread_id;
-            $this->telegramNotificationsServerDiskUsageThreadId = $this->settings->telegram_notifications_server_disk_usage_thread_id;
-            $this->telegramNotificationsServerReachableThreadId = $this->settings->telegram_notifications_server_reachable_thread_id;
-            $this->telegramNotificationsServerUnreachableThreadId = $this->settings->telegram_notifications_server_unreachable_thread_id;
-            $this->telegramNotificationsServerPatchThreadId = $this->settings->telegram_notifications_server_patch_thread_id;
-            $this->telegramNotificationsTraefikOutdatedThreadId = $this->settings->telegram_notifications_traefik_outdated_thread_id;
         }
     }
 
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -225,6 +235,7 @@ class Telegram extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -282,6 +293,8 @@ class Telegram extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Webhook.php b/app/Livewire/Notifications/Webhook.php
index ee07694767..fb537fc7d9 100644
--- a/app/Livewire/Notifications/Webhook.php
+++ b/app/Livewire/Notifications/Webhook.php
@@ -34,6 +34,9 @@ class Webhook extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeWebhookNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedWebhookNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessWebhookNotifications = false;
 
@@ -79,17 +82,17 @@ class Webhook extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->webhook_enabled = $this->webhookEnabled;
             $this->settings->webhook_url = $this->webhookUrl;
 
             $this->settings->deployment_success_webhook_notifications = $this->deploymentSuccessWebhookNotifications;
             $this->settings->deployment_failure_webhook_notifications = $this->deploymentFailureWebhookNotifications;
             $this->settings->status_change_webhook_notifications = $this->statusChangeWebhookNotifications;
+            $this->settings->restart_limit_reached_webhook_notifications = $this->restartLimitReachedWebhookNotifications;
             $this->settings->backup_success_webhook_notifications = $this->backupSuccessWebhookNotifications;
             $this->settings->backup_failure_webhook_notifications = $this->backupFailureWebhookNotifications;
             $this->settings->scheduled_task_success_webhook_notifications = $this->scheduledTaskSuccessWebhookNotifications;
@@ -113,6 +116,7 @@ class Webhook extends Component
             $this->deploymentSuccessWebhookNotifications = $this->settings->deployment_success_webhook_notifications;
             $this->deploymentFailureWebhookNotifications = $this->settings->deployment_failure_webhook_notifications;
             $this->statusChangeWebhookNotifications = $this->settings->status_change_webhook_notifications;
+            $this->restartLimitReachedWebhookNotifications = $this->settings->restart_limit_reached_webhook_notifications;
             $this->backupSuccessWebhookNotifications = $this->settings->backup_success_webhook_notifications;
             $this->backupFailureWebhookNotifications = $this->settings->backup_failure_webhook_notifications;
             $this->scheduledTaskSuccessWebhookNotifications = $this->settings->scheduled_task_success_webhook_notifications;
@@ -171,6 +175,7 @@ class Webhook extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -181,6 +186,7 @@ class Webhook extends Component
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -190,6 +196,8 @@ class Webhook extends Component
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
 
diff --git a/app/Livewire/Profile/Index.php b/app/Livewire/Profile/Index.php
index ae5d9b3ecd..69f27b0e55 100644
--- a/app/Livewire/Profile/Index.php
+++ b/app/Livewire/Profile/Index.php
@@ -47,7 +47,7 @@ class Index extends Component
 
             $avatarStorage->store(Auth::user(), $this->avatar);
             $this->reset('avatar');
-            $this->dispatch('avatar-updated', url: route('profile.avatar', ['v' => Auth::user()->fresh()->updated_at->timestamp]));
+            $this->dispatch('avatar-updated', url: profile_avatar_url(Auth::user()->fresh()));
             $this->dispatch('success', 'Profile picture updated.');
 
             return true;
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index bf84f385dd..45e284c5dc 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -99,7 +99,7 @@ class Advanced extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/DeploymentNavbar.php b/app/Livewire/Project/Application/DeploymentNavbar.php
index b60f543ba5..3abc2da73c 100644
--- a/app/Livewire/Project/Application/DeploymentNavbar.php
+++ b/app/Livewire/Project/Application/DeploymentNavbar.php
@@ -104,7 +104,6 @@ class DeploymentNavbar extends Component
         $this->application_deployment_queue->update([
             'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
         ]);
-
         try {
             if ($this->application->settings->is_build_server_enabled) {
                 $server = Server::ownedByCurrentTeam()->find($build_server_id);
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 45a76a4c33..9f1e7fc176 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -2,14 +2,18 @@
 
 namespace App\Livewire\Project\Application;
 
+use App\Actions\Shared\CheckDomainDns;
+use App\Jobs\CheckDomainDnsJob;
 use App\Livewire\Concerns\InteractsWithCloudflareDomainConnect;
 use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Application;
 use App\Models\Server;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
 class Domains extends Component
@@ -54,7 +58,7 @@ class Domains extends Component
 
     public ?string $editingService = null;
 
-    /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool}> */
+    /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool, internal_port?: ?int, has_port_override?: bool}> */
     public array $domainRows = [];
 
     /** When set, the next addSuggestedDomain call for this index skips the DNS block. */
@@ -67,6 +71,14 @@ class Domains extends Component
 
     public bool $showDomainConflictModal = false;
 
+    public bool $showPortWarningModal = false;
+
+    public bool $forceUseUnknownPort = false;
+
+    public ?int $unrecognizedPort = null;
+
+    public ?string $pendingPortAction = null;
+
     public bool $forceSaveDomains = false;
 
     public bool $forceSaveDns = false;
@@ -141,6 +153,39 @@ class Domains extends Component
         $this->loadDomainState();
     }
 
+    public function pollDnsChecks(): void
+    {
+        $this->authorize('view', $this->application);
+
+        $checkingRows = collect($this->domainRows)
+            ->where('dns_status', 'checking')
+            ->values();
+
+        $this->refreshDomains();
+
+        foreach ($checkingRows as $checkingRow) {
+            $row = collect($this->domainRows)->first(fn (array $row): bool => $row['url'] === $checkingRow['url']
+                && ($row['service'] ?? null) === ($checkingRow['service'] ?? null));
+
+            if (! is_array($row) || $row['dns_status'] === 'checking') {
+                continue;
+            }
+
+            $this->dispatchDnsCheckNotification($row['url'], $row['dns_status']);
+        }
+    }
+
+    protected function dispatchDnsCheckNotification(string $url, string $status): void
+    {
+        $host = parse_url($url, PHP_URL_HOST) ?: $url;
+
+        match ($status) {
+            'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
+            'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+            default => $this->dispatch('info', "DNS check skipped for {$host}."),
+        };
+    }
+
     public function toggleNoindexDomain(string $domain, string|bool $indexing): void
     {
         $this->authorize('update', $this->application);
@@ -449,40 +494,127 @@ class Domains extends Component
 
     /**
      * @param  array<string, array{status?: string, message?: string, expected_ip?: ?string, checked_at?: ?string}>  $stored
-     * @return array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at: ?string, is_suggested: bool, suggested_for: ?string, suggestion_label: ?string, needs_force_add: bool}
+     * @return array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at: ?string, is_suggested: bool, suggested_for: ?string, suggestion_label: ?string, needs_force_add: bool, internal_port: ?int, has_port_override: bool}
      */
     protected function domainRowFromStored(string $url, ?string $service, array $stored): array
     {
         $key = $this->domainDnsStatusKey($url, $service);
         $entry = $stored[$key] ?? null;
+        $port = $this->effectiveDomainInternalPort($url);
 
-        if (is_array($entry) && filled(data_get($entry, 'status'))) {
-            return [
-                'url' => $url,
-                'service' => $service,
-                'dns_status' => (string) data_get($entry, 'status', 'pending'),
-                'dns_message' => (string) data_get($entry, 'message', 'Not checked yet.'),
-                'expected_ip' => data_get($entry, 'expected_ip') ?: $this->serverIp,
-                'checked_at' => data_get($entry, 'checked_at'),
-                'is_suggested' => false,
-                'suggested_for' => null,
-                'suggestion_label' => null,
-                'needs_force_add' => false,
-            ];
-        }
-
-        return [
+        $row = [
             'url' => $url,
             'service' => $service,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => 'pending',
             'dns_message' => 'Not checked yet.',
             'expected_ip' => $this->serverIp,
             'checked_at' => null,
+            'check_id' => null,
             'is_suggested' => false,
             'suggested_for' => null,
             'suggestion_label' => null,
             'needs_force_add' => false,
         ];
+
+        if (is_array($entry) && filled(data_get($entry, 'status'))) {
+            $row['dns_status'] = (string) data_get($entry, 'status', 'pending');
+            $row['dns_message'] = (string) data_get($entry, 'message', 'Not checked yet.');
+            $row['expected_ip'] = data_get($entry, 'expected_ip') ?: $this->serverIp;
+            $row['checked_at'] = data_get($entry, 'checked_at');
+            $row['check_id'] = data_get($entry, 'check_id');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    protected function effectiveDomainInternalPort(string $url): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $this->application->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+        $hasMapEntry = array_key_exists($canonical, $overrides);
+
+        if ($hasMapEntry) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($this->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
+        $exposed = $this->application->ports_exposes_array;
+        $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
+            ? (int) $exposed[0]
+            : null;
+
+        return [
+            'internal_port' => $defaultPort,
+            'has_port_override' => false,
+        ];
+    }
+
+    /**
+     * @param  array{scheme: string, host: string, port: string, path: string}  $parts
+     */
+    protected function portFromParts(array $parts): ?int
+    {
+        $port = trim((string) ($parts['port'] ?? ''));
+        if ($port === '' || ! ctype_digit($port) || (int) $port <= 0) {
+            return null;
+        }
+
+        return (int) $port;
+    }
+
+    protected function currentRowPort(string $url): ?int
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $override = ($this->application->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($override) && (int) $override > 0) {
+            return (int) $override;
+        }
+
+        $legacy = DomainUrlParts::split($url)['port'] ?? '';
+
+        return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
+    }
+
+    protected function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    {
+        if ($this->forceUseUnknownPort || $port === null) {
+            return false;
+        }
+        if ($currentPort !== null && $port === $currentPort) {
+            return false;
+        }
+
+        return $this->application->portRequiresConfirmation($port);
+    }
+
+    protected function openPortWarning(?int $port, string $action): void
+    {
+        $this->unrecognizedPort = $port;
+        $this->pendingPortAction = $action;
+        $this->showPortWarningModal = true;
     }
 
     /**
@@ -533,6 +665,8 @@ class Domains extends Component
                 || ! $server
                 || $this->application->additional_servers->count() > 0;
 
+            $indexesToCheck = [];
+
             foreach ($this->domainRows as $index => $row) {
                 if ($skipDns) {
                     $reason = ! $this->dnsValidationEnabled
@@ -548,7 +682,11 @@ class Domains extends Component
                     continue;
                 }
 
-                $this->applyDnsStatus($index, $row['url'], $server);
+                $indexesToCheck[] = $index;
+            }
+
+            if ($server && $indexesToCheck !== []) {
+                $this->applyDnsStatuses($indexesToCheck, $server);
             }
 
             $this->persistDomainDnsStatuses();
@@ -575,45 +713,50 @@ class Domains extends Component
             return;
         }
 
-        $this->applyDnsStatus($index, $this->domainRows[$index]['url'], $server);
+        $this->applyDnsStatus($index, $server);
         $this->persistDomainDnsStatuses();
     }
 
-    protected function applyDnsStatus(int $index, string $url, Server $server): void
+    protected function applyDnsStatus(int $index, Server $server): void
     {
-        $target = $this->dnsTargetLabel();
+        $this->applyDnsStatuses([$index], $server);
+    }
 
-        try {
-            $isValid = validateDNSEntry($url, $server);
-            if ($isValid) {
-                $this->domainRows[$index]['dns_status'] = 'ok';
-                $this->domainRows[$index]['dns_message'] = $target
-                    ? "DNS points to {$target} (or Cloudflare)."
-                    : 'DNS looks correct.';
-            } else {
-                $this->domainRows[$index]['dns_status'] = 'failed';
-                $this->domainRows[$index]['dns_message'] = dnsMismatchGuidanceMessage($target, $this->serverIp);
+    /**
+     * @param  array<int, int>  $indexes
+     */
+    protected function applyDnsStatuses(array $indexes, Server $server): void
+    {
+        $entries = [];
+
+        foreach ($indexes as $index) {
+            $entries[(string) $index] = $this->domainRows[$index]['url'];
+        }
+
+        $results = CheckDomainDns::run($entries, $server, $this->serverIp);
+
+        foreach ($results as $index => $result) {
+            $index = (int) $index;
+            $this->domainRows[$index]['dns_status'] = $result['status'];
+            $this->domainRows[$index]['dns_message'] = $result['message'];
+
+            // Keep suggested-row copy short after DNS checks (no role badge).
+            if ($this->domainRows[$index]['is_suggested'] ?? false) {
+                $isWww = str_starts_with(strtolower((string) $this->domainHost((string) $this->domainRows[$index]['url'])), 'www.');
+                $serviceName = $this->domainRows[$index]['service'] ?? null;
+                $meta = $this->suggestedDomainMeta(
+                    $isWww,
+                    $this->serviceRedirectFor(is_string($serviceName) ? $serviceName : null)
+                );
+                $this->domainRows[$index]['dns_message'] = $meta['pending_message'];
+                $this->domainRows[$index]['suggestion_label'] = null;
+                $this->domainRows[$index]['suggestion_role'] = $meta['role'];
             }
-        } catch (\Throwable) {
-            $this->domainRows[$index]['dns_status'] = 'failed';
-            $this->domainRows[$index]['dns_message'] = 'Could not validate DNS for this domain.';
-        }
 
-        // Keep suggested-row copy short after DNS checks (no role badge).
-        if ($this->domainRows[$index]['is_suggested'] ?? false) {
-            $isWww = str_starts_with(strtolower((string) $this->domainHost((string) $this->domainRows[$index]['url'])), 'www.');
-            $serviceName = $this->domainRows[$index]['service'] ?? null;
-            $meta = $this->suggestedDomainMeta(
-                $isWww,
-                $this->serviceRedirectFor(is_string($serviceName) ? $serviceName : null)
-            );
-            $this->domainRows[$index]['dns_message'] = $meta['pending_message'];
-            $this->domainRows[$index]['suggestion_label'] = null;
-            $this->domainRows[$index]['suggestion_role'] = $meta['role'];
+            $this->domainRows[$index]['expected_ip'] = $result['expected_ip'];
+            $this->domainRows[$index]['checked_at'] = $result['checked_at'];
+            $this->domainRows[$index]['check_id'] = null;
         }
-
-        $this->domainRows[$index]['expected_ip'] = $this->serverIp;
-        $this->domainRows[$index]['checked_at'] = now()->toIso8601String();
     }
 
     /**
@@ -647,11 +790,34 @@ class Domains extends Component
                 'message' => (string) ($row['dns_message'] ?? ''),
                 'expected_ip' => $row['expected_ip'] ?? $this->serverIp,
                 'checked_at' => $row['checked_at'] ?? now()->toIso8601String(),
+                'check_id' => $row['check_id'] ?? null,
             ];
         }
 
+        DB::transaction(function () use (&$statuses): void {
+            $application = Application::query()->lockForUpdate()->findOrFail($this->application->id);
+            $storedStatuses = $application->domain_dns_statuses ?? [];
+
+            foreach ($statuses as $key => $status) {
+                $localCheckId = $status['check_id'] ?? null;
+                $storedCheckId = $storedStatuses[$key]['check_id'] ?? null;
+
+                if ($storedCheckId !== null && $localCheckId !== $storedCheckId) {
+                    $statuses[$key] = $storedStatuses[$key];
+
+                    continue;
+                }
+
+                if ($status['status'] === 'checking' && isset($storedStatuses[$key]) && $storedStatuses[$key]['status'] !== 'checking') {
+                    $statuses[$key] = $storedStatuses[$key];
+                }
+            }
+
+            $application->domain_dns_statuses = $statuses === [] ? null : $statuses;
+            $application->save();
+        });
+
         $this->application->domain_dns_statuses = $statuses === [] ? null : $statuses;
-        $this->application->save();
     }
 
     protected function pruneDomainDnsStatusesToCurrentDomains(): void
@@ -752,6 +918,31 @@ class Domains extends Component
         $this->addDomain();
     }
 
+    public function confirmUseUnknownPort(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->forceUseUnknownPort = true;
+        $this->showPortWarningModal = false;
+        $action = $this->pendingPortAction;
+        $this->pendingPortAction = null;
+
+        if ($action === 'update') {
+            $this->updateDomain();
+
+            return;
+        }
+
+        $this->addDomain();
+    }
+
+    public function cancelUseUnknownPort(): void
+    {
+        $this->showPortWarningModal = false;
+        $this->forceUseUnknownPort = false;
+        $this->unrecognizedPort = null;
+        $this->pendingPortAction = null;
+    }
+
     /**
      * Clear pending conflict state when the modal is dismissed without confirmation.
      * confirmDomainUsage sets forceSaveDomains before closing the modal.
@@ -776,7 +967,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->newDomainPartsChanged) {
+            if ($this->newDomainPartsChanged || filled($this->newDomainParts['host'] ?? null)) {
                 $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
             }
             $this->validateOnly('newDomain');
@@ -795,23 +986,22 @@ class Domains extends Component
                 ->values()
                 ->all();
             $current = $this->currentDomainList($this->newDomainService);
+            $currentCanonicalDomains = $current->map(
+                fn (string $url): string => DomainPortOverrides::withoutPort($url)
+            );
 
             foreach ($newUrls as $url) {
-                if ($current->contains($url)) {
+                if ($currentCanonicalDomains->contains(DomainPortOverrides::withoutPort($url))) {
                     $this->addError('newDomain', "Domain {$url} is already configured.");
 
                     return;
                 }
             }
 
-            if (! $this->forceSaveDns && $this->shouldValidateDnsForAdd()) {
-                $dnsFailure = $this->findDnsFailureMessage($newUrls);
-                if ($dnsFailure !== null) {
-                    $this->addDomainDnsFailed = true;
-                    $this->addDomainDnsMessage = $dnsFailure;
+            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+                $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
-                    return;
-                }
+                return;
             }
 
             $merged = $current->merge($newUrls)->merge($pairedUrls)->unique()->values();
@@ -822,17 +1012,114 @@ class Domains extends Component
 
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
+            $this->forceUseUnknownPort = false;
             $serviceForCheck = $this->newDomainService;
             $this->resetAddDomainForm();
             $this->dispatch('close-modal');
-            $this->dispatch('success', 'Domain added.');
             $this->refreshDomains();
-            $this->checkUrlsDns(array_values(array_unique(array_merge($newUrls, $pairedUrls))), $serviceForCheck);
+            $urlsToCheck = array_values(array_unique(array_merge($newUrls, $pairedUrls)));
+            $dnsChecks = collect($this->dnsEntriesForUrls($urlsToCheck, $serviceForCheck))
+                ->map(fn (string $url, string $statusKey) => [
+                    'status_key' => $statusKey,
+                    'url' => $url,
+                    'check_id' => new_public_id(),
+                ]);
+
+            foreach ($dnsChecks as $dnsCheck) {
+                $this->markUrlsAsChecking([$dnsCheck['url']], $serviceForCheck, $dnsCheck['check_id']);
+            }
+            $this->persistDomainDnsStatuses();
+
+            $failedDnsChecks = 0;
+            foreach ($dnsChecks as $dnsCheck) {
+                try {
+                    CheckDomainDnsJob::dispatch(
+                        $this->application,
+                        $dnsCheck['status_key'],
+                        $dnsCheck['url'],
+                        $this->application->destination?->server,
+                        $this->serverIp,
+                        $dnsCheck['check_id'],
+                        $this->application->additional_servers->count() > 0,
+                    );
+                } catch (\Throwable) {
+                    $failedDnsChecks++;
+                    $this->markUrlsDnsCheckUnavailable([$dnsCheck['url']], $serviceForCheck, $dnsCheck['check_id']);
+                }
+            }
+
+            if ($failedDnsChecks > 0) {
+                $this->persistDomainDnsStatuses();
+                $this->dispatch('error', 'Some DNS checks could not be started. Try again from the Domains page.');
+            }
+
+            $this->dispatch('success', $failedDnsChecks === $dnsChecks->count()
+                ? 'Domain added.'
+                : 'Domain added. DNS check started.');
         } catch (\Throwable $e) {
             handleError($e, $this);
         }
     }
 
+    /**
+     * @param  array<int, string>  $urls
+     */
+    protected function markUrlsAsChecking(array $urls, ?string $service = null, ?string $checkId = null): void
+    {
+        $indexesToCheck = [];
+
+        foreach ($this->domainRows as $index => $row) {
+            if (! in_array($row['url'], $urls, true)) {
+                continue;
+            }
+
+            if ($service !== null && ($row['service'] ?? null) !== $service) {
+                continue;
+            }
+
+            $this->domainRows[$index]['dns_status'] = 'checking';
+            $this->domainRows[$index]['dns_message'] = 'Checking DNS...';
+            $this->domainRows[$index]['check_id'] = $checkId;
+        }
+    }
+
+    /**
+     * @param  array<int, string>  $urls
+     */
+    protected function markUrlsDnsCheckUnavailable(array $urls, ?string $service = null, ?string $checkId = null): void
+    {
+        $this->markUrlsAsChecking($urls, $service, $checkId);
+
+        foreach ($this->domainRows as $index => $row) {
+            if (! in_array($row['url'], $urls, true)) {
+                continue;
+            }
+
+            if ($service !== null && ($row['service'] ?? null) !== $service) {
+                continue;
+            }
+
+            $this->domainRows[$index]['dns_status'] = 'skipped';
+            $this->domainRows[$index]['dns_message'] = 'DNS check could not be started.';
+            $this->domainRows[$index]['checked_at'] = now()->toIso8601String();
+        }
+    }
+
+    /**
+     * @param  array<int, string>  $urls
+     * @return array<string, string>
+     */
+    protected function dnsEntriesForUrls(array $urls, ?string $service = null): array
+    {
+        $entries = [];
+
+        foreach ($urls as $url) {
+            $entries[$this->domainDnsStatusKey($url, $service)] = $url;
+        }
+
+        return $entries;
+    }
+
     /**
      * Run a first-time DNS check for newly added/updated domain URLs and persist results.
      *
@@ -849,6 +1136,7 @@ class Domains extends Component
         $skipDns = ! $this->dnsValidationEnabled
             || ! $server
             || $this->application->additional_servers->count() > 0;
+        $indexesToCheck = [];
 
         foreach ($this->domainRows as $index => $row) {
             $url = $row['url'] ?? null;
@@ -875,7 +1163,11 @@ class Domains extends Component
                 continue;
             }
 
-            $this->applyDnsStatus($index, $url, $server);
+            $indexesToCheck[] = $index;
+        }
+
+        if ($server && $indexesToCheck !== []) {
+            $this->applyDnsStatuses($indexesToCheck, $server);
         }
 
         $this->persistDomainDnsStatuses();
@@ -909,15 +1201,11 @@ class Domains extends Component
             return null;
         }
 
-        $target = $this->dnsTargetLabel() ?? $server->ip;
+        $results = CheckDomainDns::run(array_combine($urls, $urls), $server, $this->serverIp);
 
-        foreach ($urls as $url) {
-            try {
-                if (! validateDNSEntry($url, $server)) {
-                    return dnsMismatchGuidanceMessage($target, $this->serverIp);
-                }
-            } catch (\Throwable) {
-                return 'Could not validate DNS for this domain.';
+        foreach ($results as $result) {
+            if ($result['status'] === 'failed') {
+                return $result['message'];
             }
         }
 
@@ -951,6 +1239,11 @@ class Domains extends Component
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $canonical = DomainPortOverrides::withoutPort($this->editingDomain);
+        $savedPort = ($this->application->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->editingDomainPartsChanged = false;
         $this->editingService = $this->domainRows[$index]['service'];
         $this->resetEditDomainDnsGate();
@@ -1068,7 +1361,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->editingDomainPartsChanged) {
+            if ($this->editingDomainPartsChanged || filled($this->editingDomainParts['host'] ?? null)) {
                 $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
             }
             $this->validateOnly('editingDomain');
@@ -1085,13 +1378,29 @@ class Domains extends Component
             $service = $this->editingService;
             $wasNoindexed = $this->application->isDomainNoindexed($oldUrl);
 
+            if (blank(DomainUrlParts::split($newUrl)['port'] ?? null)) {
+                $portOverrides = $this->application->domain_port_overrides ?? [];
+                unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+                unset($portOverrides[DomainPortOverrides::withoutPort($newUrl)]);
+                $this->application->domain_port_overrides = $portOverrides ?: null;
+            }
+
             $current = $this->currentDomainList($service);
-            if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
+            $otherCanonicalDomains = $current
+                ->reject(fn (string $url): bool => $url === $oldUrl)
+                ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url));
+            if ($otherCanonicalDomains->contains(DomainPortOverrides::withoutPort($newUrl))) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured.");
 
                 return;
             }
 
+            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+                $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
+
+                return;
+            }
+
             if (! $this->forceSaveEditDns && $this->shouldValidateDnsForAdd()) {
                 $dnsFailure = $this->findDnsFailureMessage([$newUrl]);
                 if ($dnsFailure !== null) {
@@ -1119,6 +1428,7 @@ class Domains extends Component
 
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
+            $this->forceUseUnknownPort = false;
             $this->cancelEdit();
             $this->dispatch('edit-domain-saved');
             $this->dispatch('success', 'Domain updated.');
@@ -1164,6 +1474,28 @@ class Domains extends Component
         }
     }
 
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => ! ($row['is_suggested'] ?? false)
+                && hash_equals($domainKey, $this->domainRowKey($row))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    /**
+     * @param  array{url: string, service?: ?string}  $row
+     */
+    private function domainRowKey(array $row): string
+    {
+        return hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+    }
+
     public function generateDomain(?string $serviceName = null): void
     {
         try {
@@ -1642,6 +1974,8 @@ class Domains extends Component
             }
         }
 
+        $intendedComposeOverrides = null;
+
         if ($this->isCompose) {
             if (blank($serviceName)) {
                 $this->dispatch('error', 'A service is required for compose domains.');
@@ -1657,6 +1991,15 @@ class Domains extends Component
                 $allDomains = [];
             }
 
+            $previousServiceUrls = $this->currentDomainList($serviceName);
+            $normalizedPorts = DomainPortOverrides::normalize($domainString, $this->application->domain_port_overrides);
+            $domainString = $normalizedPorts['fqdn'];
+            $intendedComposeOverrides = $this->mergeComposeDomainPortOverrides(
+                $previousServiceUrls,
+                $domainString,
+                $normalizedPorts['overrides'] ?? null,
+            );
+
             $existing = is_array($allDomains[$serviceName] ?? null) ? $allDomains[$serviceName] : [];
             // Preserve stored redirect only — pending Direction dropdown values must not
             // persist until setServiceRedirect() runs.
@@ -1665,6 +2008,7 @@ class Domains extends Component
             ]);
 
             $this->application->docker_compose_domains = json_encode($allDomains);
+            $this->application->domain_port_overrides = $intendedComposeOverrides;
             $this->application->fqdn = null;
         } else {
             $this->application->fqdn = $domainString;
@@ -1691,12 +2035,47 @@ class Domains extends Component
         }
 
         $this->application->save();
+
+        if ($this->isCompose && ($this->application->domain_port_overrides ?? null) !== $intendedComposeOverrides) {
+            $this->application->domain_port_overrides = $intendedComposeOverrides;
+            $this->application->save();
+        }
+
         $this->resetDefaultLabels();
         $this->dispatch('configurationChanged');
 
         return true;
     }
 
+    /**
+     * @param  Collection<int, string>  $previousServiceUrls
+     * @param  array<string, int>|null  $incomingOverrides
+     * @return array<string, int>|null
+     */
+    protected function mergeComposeDomainPortOverrides(
+        Collection $previousServiceUrls,
+        ?string $newDomainString,
+        ?array $incomingOverrides,
+    ): ?array {
+        $merged = $this->application->domain_port_overrides ?? [];
+        $newCanonical = collect($this->splitDomains($newDomainString))
+            ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url))
+            ->all();
+
+        foreach ($previousServiceUrls as $url) {
+            $canonical = DomainPortOverrides::withoutPort($url);
+            if (! in_array($canonical, $newCanonical, true)) {
+                unset($merged[$canonical]);
+            }
+        }
+
+        foreach ($incomingOverrides ?? [] as $url => $port) {
+            $merged[$url] = (int) $port;
+        }
+
+        return $merged ?: null;
+    }
+
     protected function resetDefaultLabels(): void
     {
         try {
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 34283cd47f..8f0bb2385d 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Application;
 
 use App\Actions\Application\GenerateConfig;
 use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Project\Service\Storage;
 use App\Models\Application;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
@@ -320,17 +321,6 @@ class General extends Component
             }
         }
         $this->initialDockerComposeLocation = $this->application->docker_compose_location;
-        if ($this->application->build_pack === 'dockercompose' && ! $this->application->docker_compose_raw) {
-            // Only load compose file if user has update permission
-            try {
-                $this->authorize('update', $this->application);
-                $this->initLoadingCompose = true;
-                $this->dispatch('info', 'Loading docker compose file.');
-            } catch (AuthorizationException $e) {
-                // User doesn't have update permission, skip loading compose file
-            }
-        }
-
         if (str($this->application->status)->startsWith('running') && is_null($this->application->config_hash)) {
             $this->dispatch('configurationChanged');
         }
@@ -340,7 +330,7 @@ class General extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -530,7 +520,7 @@ class General extends Component
 
             $showToast && $this->dispatch('success', 'Docker compose file loaded.');
             $this->dispatch('compose_loaded');
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
             $this->dispatch('refreshEnvs');
         } catch (\Throwable $e) {
             // Refresh model to get restored values from Application::loadComposeFile
@@ -607,14 +597,9 @@ class General extends Component
             $this->resetDefaultLabels(false);
         }
         if ($this->buildPack === 'dockercompose') {
-            // Only update if user has permission
-            try {
-                $this->authorize('update', $this->application);
-                $this->fqdn = null;
-                $this->application->fqdn = null;
-                $this->application->settings->save();
-            } catch (AuthorizationException $e) {
-                // User doesn't have update permission, just continue without saving
+            if (blank($this->dockerComposeLocation)) {
+                $this->dockerComposeLocation = '/docker-compose.yaml';
+                $this->application->docker_compose_location = $this->dockerComposeLocation;
             }
         }
         if ($this->buildPack === 'static') {
@@ -666,6 +651,8 @@ class General extends Component
 
     public function resetDefaultLabels($manualReset = false)
     {
+        $this->authorize('update', $this->application);
+
         try {
             if (! $this->isContainerLabelReadonlyEnabled && ! $manualReset) {
                 return;
diff --git a/app/Livewire/Project/Application/Heading.php b/app/Livewire/Project/Application/Heading.php
index 6c75cd7a61..830a4eace8 100644
--- a/app/Livewire/Project/Application/Heading.php
+++ b/app/Livewire/Project/Application/Heading.php
@@ -156,6 +156,11 @@ class Heading extends Component
 
             $this->dispatch('info', 'Gracefully stopping application.<br/>It could take a while depending on the application.');
             StopApplication::dispatch($this->application, false, $this->docker_cleanup);
+            auditLog('ui.application.stopped', [
+                'team_id' => $this->application->team()?->id,
+                'application_uuid' => $this->application->uuid,
+                'application_name' => $this->application->name,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
new file mode 100644
index 0000000000..21296978f7
--- /dev/null
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -0,0 +1,609 @@
+<?php
+
+namespace App\Livewire\Project\Application;
+
+use App\Actions\Shared\CheckDomainDns;
+use App\Jobs\CheckDomainDnsJob;
+use App\Models\ApplicationPreview;
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
+use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\DB;
+use Livewire\Component;
+
+class PreviewDomains extends Component
+{
+    use AuthorizesRequests;
+
+    public ApplicationPreview $preview;
+
+    public array $domainRows = [];
+
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public ?string $newDomainService = null;
+
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public ?int $editingIndex = null;
+
+    public bool $showPortWarningModal = false;
+
+    public bool $forceUseUnknownPort = false;
+
+    public ?int $unrecognizedPort = null;
+
+    public ?string $pendingPortAction = null;
+
+    public function mount(): void
+    {
+        $this->refreshDomains();
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            $this->newDomainService = $this->composeServices()[0] ?? null;
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.project.application.preview-domains', [
+            'isCompose' => $this->preview->application->build_pack === 'dockercompose',
+            'composeServices' => $this->composeServices(),
+        ]);
+    }
+
+    public function addDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if ($this->preview->application->build_pack === 'dockercompose'
+            && ($this->newDomainService === null || ! in_array($this->newDomainService, $this->composeServices(), true))) {
+            $this->addError('newDomainService', 'Select a valid Compose service.');
+
+            return;
+        }
+        $domain = $this->validatedDomain($this->newDomainParts, 'newDomainParts.host');
+        if ($domain === null) {
+            return;
+        }
+        $canonicalDomain = DomainPortOverrides::withoutPort($domain);
+        if (collect($this->domainRows)->contains(
+            fn (array $row): bool => DomainPortOverrides::withoutPort($row['url']) === $canonicalDomain
+                && $row['service'] === $this->newDomainService
+        )) {
+            $this->addError('newDomainParts.host', 'This domain is already configured.');
+
+            return;
+        }
+        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+            $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
+
+            return;
+        }
+        $this->domainRows[] = $this->makeRow($domain, $this->newDomainService);
+        $index = array_key_last($this->domainRows);
+        $checkId = new_public_id();
+        $this->domainRows[$index]['dns_status'] = 'checking';
+        $this->domainRows[$index]['dns_message'] = 'Checking DNS...';
+        $this->domainRows[$index]['check_id'] = $checkId;
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $domain = $this->domainRows[$index]['url'] ?? DomainPortOverrides::withoutPort($domain);
+        $this->newDomainParts = DomainUrlParts::empty();
+        $this->newDomainService = $this->preview->application->build_pack === 'dockercompose'
+            ? ($this->composeServices()[0] ?? null)
+            : null;
+        $this->forceUseUnknownPort = false;
+        $this->dispatch('close-modal');
+
+        try {
+            $server = $this->preview->application->destination?->server;
+            CheckDomainDnsJob::dispatch(
+                $this->preview,
+                $this->statusKey($domain, $this->domainRows[$index]['service']),
+                $domain,
+                $server,
+                $server ? serverDnsTargetIp($server) ?? $server->ip : null,
+                $checkId,
+                $this->preview->application->additional_servers->count() > 0,
+            );
+            $this->dispatch('success', 'Domain added. DNS check started.');
+        } catch (\Throwable) {
+            $this->domainRows[$index]['dns_status'] = 'skipped';
+            $this->domainRows[$index]['dns_message'] = 'DNS check could not be started.';
+            $this->domainRows[$index]['check_id'] = null;
+            $this->persistDnsStatuses();
+            $this->dispatch('error', 'Domain added, but the DNS check could not be started. Try again from the preview domains list.');
+        }
+    }
+
+    public function generateDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->preview->refresh();
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            if ($this->newDomainService === null && $this->domainRows === []) {
+                $this->preview->generate_preview_fqdn_compose(generateWithoutApplicationDomain: true);
+            } else {
+                $service = $this->newDomainService ?? data_get($this->domainRows, '0.service');
+                foreach ($this->generateComposeDomains((string) $service) as $domain) {
+                    $alreadyExists = collect($this->domainRows)->contains(
+                        fn (array $row): bool => DomainPortOverrides::withoutPort($row['url']) === DomainPortOverrides::withoutPort($domain)
+                            && $row['service'] === $service
+                    );
+                    if (! $alreadyExists) {
+                        $this->domainRows[] = $this->makeRow($domain, $service);
+                    }
+                }
+
+                if (! $this->persistDomains()) {
+                    return;
+                }
+            }
+        } else {
+            $this->preview->generate_preview_fqdn(generateWithoutApplicationDomain: true);
+        }
+        $this->refreshDomains();
+        $this->dispatch('success', 'Domain generated.');
+    }
+
+    public function startEdit(int $index): void
+    {
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        $this->editingIndex = $index;
+        $this->editingDomainParts = DomainUrlParts::split($this->domainRows[$index]['url']);
+        $canonical = DomainPortOverrides::withoutPort($this->domainRows[$index]['url']);
+        $savedPort = ($this->preview->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
+        $this->dispatch('open-preview-domain-edit');
+    }
+
+    public function updateDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if ($this->editingIndex === null || ! isset($this->domainRows[$this->editingIndex])) {
+            return;
+        }
+        $domain = $this->validatedDomain($this->editingDomainParts, 'editingDomainParts.host');
+        if ($domain === null) {
+            return;
+        }
+        $oldUrl = $this->domainRows[$this->editingIndex]['url'];
+        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+            $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
+
+            return;
+        }
+        if (blank(DomainUrlParts::split($domain)['port'] ?? null)) {
+            $portOverrides = $this->preview->domain_port_overrides ?? [];
+            unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+            unset($portOverrides[DomainPortOverrides::withoutPort($domain)]);
+            $this->preview->domain_port_overrides = $portOverrides ?: null;
+        }
+        $this->domainRows[$this->editingIndex]['url'] = $domain;
+        $this->domainRows[$this->editingIndex]['dns_status'] = 'pending';
+        $this->domainRows[$this->editingIndex]['dns_message'] = 'DNS has not been checked yet.';
+        $index = $this->editingIndex;
+        $this->editingIndex = null;
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->forceUseUnknownPort = false;
+        $this->dispatch('close-preview-domain-edit');
+        $this->dispatch('success', 'Domain updated.');
+        $this->checkDomainDns($index);
+    }
+
+    public function confirmUseUnknownPort(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->forceUseUnknownPort = true;
+        $this->showPortWarningModal = false;
+        $action = $this->pendingPortAction;
+        $this->pendingPortAction = null;
+
+        if ($action === 'update') {
+            $this->updateDomain();
+
+            return;
+        }
+
+        $this->addDomain();
+    }
+
+    public function cancelUseUnknownPort(): void
+    {
+        $this->showPortWarningModal = false;
+        $this->forceUseUnknownPort = false;
+        $this->unrecognizedPort = null;
+        $this->pendingPortAction = null;
+    }
+
+    public function removeDomain(int $index): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        unset($this->domainRows[$index]);
+        $this->domainRows = array_values($this->domainRows);
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->dispatch('success', 'Domain removed.');
+    }
+
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => hash_equals($domainKey, $this->statusKey($row['url'], $row['service']))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    public function checkAllDns(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        foreach (array_keys($this->domainRows) as $index) {
+            $this->applyDnsCheck($index);
+        }
+        $this->persistDnsStatuses();
+    }
+
+    public function checkDomainDns(int $index): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->applyDnsCheck($index);
+        $this->persistDnsStatuses();
+    }
+
+    public function pollDnsChecks(): void
+    {
+        $checkingRows = collect($this->domainRows)
+            ->where('dns_status', 'checking')
+            ->values();
+
+        $this->refreshDomains();
+
+        foreach ($checkingRows as $checkingRow) {
+            $row = collect($this->domainRows)->first(fn (array $row): bool => $row['url'] === $checkingRow['url']
+                && ($row['service'] ?? null) === ($checkingRow['service'] ?? null));
+
+            if (! is_array($row) || $row['dns_status'] === 'checking') {
+                continue;
+            }
+
+            $this->dispatchDnsCheckNotification($row['url'], $row['dns_status']);
+        }
+    }
+
+    private function dispatchDnsCheckNotification(string $url, string $status): void
+    {
+        $host = parse_url($url, PHP_URL_HOST) ?: $url;
+
+        match ($status) {
+            'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
+            'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+            default => $this->dispatch('info', "DNS check skipped for {$host}."),
+        };
+    }
+
+    private function applyDnsCheck(int $index): void
+    {
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        $result = $this->checkUrlDns($this->domainRows[$index]['url'], (string) $index);
+        $this->domainRows[$index]['dns_status'] = $result['status'];
+        $this->domainRows[$index]['dns_message'] = $result['message'];
+    }
+
+    private function checkUrlDns(string $url, string $key = 'domain'): array
+    {
+        $server = $this->preview->application->destination?->server;
+
+        return CheckDomainDns::run(
+            [$key => $url],
+            $server,
+            $server ? serverDnsTargetIp($server) ?? $server->ip : null,
+            $this->preview->application->additional_servers->count() > 0,
+        )[$key];
+    }
+
+    private function refreshDomains(): void
+    {
+        $this->preview->refresh();
+        $statuses = $this->preview->domain_dns_statuses ?? [];
+        $rows = [];
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            foreach (json_decode($this->preview->docker_compose_domains ?: '[]', true) ?: [] as $service => $entry) {
+                foreach ($this->splitDomains(composeDomainEntryString($entry)) as $url) {
+                    $rows[] = $this->makeRow($url, (string) $service, $statuses);
+                }
+            }
+        } else {
+            foreach ($this->splitDomains($this->preview->fqdn) as $url) {
+                $rows[] = $this->makeRow($url, null, $statuses);
+            }
+        }
+        $this->domainRows = $rows;
+    }
+
+    private function persistDomains(): bool
+    {
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            try {
+                $composeServices = $this->composeServices(failOnError: true);
+            } catch (\Throwable) {
+                $this->refreshDomains();
+                $this->dispatch('error', 'Compose configuration could not be parsed. Preview domains were not changed.');
+
+                return false;
+            }
+            $domains = collect($composeServices)
+                ->mapWithKeys(fn (string $service): array => [$service => ['domain' => '']])
+                ->all();
+            $validRows = collect($this->domainRows)
+                ->filter(fn (array $row): bool => in_array($row['service'] ?? null, $composeServices, true));
+            foreach ($validRows->groupBy('service') as $service => $rows) {
+                $domains[$service] = ['domain' => $rows->pluck('url')->implode(',')];
+            }
+            $this->preview->docker_compose_domains = json_encode($domains);
+            $this->preview->fqdn = $validRows->pluck('url')->implode(',') ?: null;
+        } else {
+            $this->preview->fqdn = collect($this->domainRows)->pluck('url')->implode(',') ?: null;
+        }
+        $normalized = DomainPortOverrides::normalize($this->preview->fqdn, $this->preview->domain_port_overrides);
+        $this->preview->fqdn = $normalized['fqdn'];
+        $this->preview->domain_port_overrides = $normalized['overrides'];
+        if ($this->preview->application->build_pack === 'dockercompose' && is_array($domains ?? null)) {
+            foreach ($domains as $service => $entry) {
+                $serviceDomains = $this->splitDomains(composeDomainEntryString($entry));
+                $domains[$service]['domain'] = collect($serviceDomains)
+                    ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url))
+                    ->implode(',');
+            }
+            $this->preview->docker_compose_domains = json_encode($domains);
+        }
+        foreach ($this->domainRows as $index => $row) {
+            $this->domainRows[$index]['url'] = DomainPortOverrides::withoutPort($row['url']);
+        }
+        $this->preview->save();
+        $this->persistDnsStatuses();
+        $this->refreshDomains();
+        $this->dispatch('update_links');
+        $this->dispatch('previewDomainsChanged');
+
+        return true;
+    }
+
+    private function persistDnsStatuses(): void
+    {
+        $statuses = [];
+        foreach ($this->domainRows as $row) {
+            $statuses[$this->statusKey($row['url'], $row['service'])] = [
+                'status' => $row['dns_status'],
+                'message' => $row['dns_message'],
+                'check_id' => $row['check_id'] ?? null,
+            ];
+        }
+
+        DB::transaction(function () use (&$statuses): void {
+            $preview = ApplicationPreview::query()->lockForUpdate()->findOrFail($this->preview->id);
+            $storedStatuses = $preview->domain_dns_statuses ?? [];
+
+            foreach ($statuses as $key => $status) {
+                $storedStatus = $storedStatuses[$key] ?? null;
+                if (! is_array($storedStatus)) {
+                    continue;
+                }
+
+                $localCheckId = $status['check_id'] ?? null;
+                $storedCheckId = $storedStatus['check_id'] ?? null;
+
+                if (($storedCheckId !== null && $localCheckId !== $storedCheckId)
+                    || ($status['status'] === 'checking' && ($storedStatus['status'] ?? null) !== 'checking')) {
+                    $statuses[$key] = $storedStatus;
+                }
+            }
+
+            $preview->domain_dns_statuses = $statuses ?: null;
+            $preview->save();
+        });
+
+        $this->preview->domain_dns_statuses = $statuses ?: null;
+    }
+
+    private function validatedDomain(array $parts, string $errorKey): ?string
+    {
+        $domain = DomainUrlParts::compose(...$parts);
+        $validator = validator(['domain' => $domain], ['domain' => ValidationPatterns::applicationDomainRules()]);
+        if ($validator->fails()) {
+            $this->addError($errorKey, $validator->errors()->first('domain'));
+
+            return null;
+        }
+
+        return ValidationPatterns::normalizeApplicationDomains($domain);
+    }
+
+    private function makeRow(string $url, ?string $service, array $statuses = []): array
+    {
+        $status = $statuses[$this->statusKey($url, $service)] ?? [];
+        $port = $this->effectiveDomainInternalPort($url);
+
+        return [
+            'url' => $url,
+            'service' => $service,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
+            'dns_status' => $status['status'] ?? 'pending',
+            'dns_message' => $status['message'] ?? 'DNS has not been checked yet.',
+            'check_id' => $status['check_id'] ?? null,
+        ];
+    }
+
+    /**
+     * @param  array{scheme: string, host: string, port: string, path: string}  $parts
+     */
+    private function portFromParts(array $parts): ?int
+    {
+        $port = trim((string) ($parts['port'] ?? ''));
+        if ($port === '' || ! ctype_digit($port) || (int) $port <= 0) {
+            return null;
+        }
+
+        return (int) $port;
+    }
+
+    private function currentRowPort(string $url): ?int
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $override = ($this->preview->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($override) && (int) $override > 0) {
+            return (int) $override;
+        }
+
+        $legacy = DomainUrlParts::split($url)['port'] ?? '';
+
+        return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
+    }
+
+    private function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    {
+        if ($this->forceUseUnknownPort || $port === null) {
+            return false;
+        }
+        if ($currentPort !== null && $port === $currentPort) {
+            return false;
+        }
+
+        return $this->preview->application->portRequiresConfirmation($port);
+    }
+
+    private function openPortWarning(?int $port, string $action): void
+    {
+        $this->unrecognizedPort = $port;
+        $this->pendingPortAction = $action;
+        $this->showPortWarningModal = true;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    private function effectiveDomainInternalPort(string $url): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $this->preview->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+        $hasMapEntry = array_key_exists($canonical, $overrides);
+
+        if ($hasMapEntry) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($this->preview->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
+        $exposed = $this->preview->application->ports_exposes_array;
+        $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
+            ? (int) $exposed[0]
+            : null;
+
+        return [
+            'internal_port' => $defaultPort,
+            'has_port_override' => false,
+        ];
+    }
+
+    private function statusKey(string $url, ?string $service): string
+    {
+        return hash('sha256', $url.'|'.($service ?? ''));
+    }
+
+    private function splitDomains(?string $domains): array
+    {
+        return str($domains)->explode(',')->map(fn ($domain) => trim((string) $domain))->filter()->values()->all();
+    }
+
+    private function generateComposeDomains(string $service): array
+    {
+        $applicationDomains = json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: [];
+        $domainString = getComposeServiceDomainString($applicationDomains, $service);
+
+        if (empty($domainString)) {
+            $domainString = generateUrl(
+                server: $this->preview->application->destination->server,
+                random: str($service)->slug().'-'.$this->preview->application->uuid,
+            );
+        }
+
+        return collect($this->splitDomains($domainString))->map(function (string $domain): string {
+            $generated = $this->preview->generatedPreviewDomain($domain);
+            if (filled($generated['port'])) {
+                $overrides = $this->preview->domain_port_overrides ?? [];
+                $overrides[$generated['url']] = $generated['port'];
+                $this->preview->domain_port_overrides = $overrides;
+            }
+
+            return $generated['url'];
+        })->all();
+    }
+
+    private function composeServices(bool $failOnError = false): array
+    {
+        try {
+            $parsedCompose = $this->preview->application->parse(pull_request_id: $this->preview->pull_request_id);
+            $services = data_get($parsedCompose, 'services', []);
+            if (! is_iterable($services)) {
+                return [];
+            }
+
+            $previewSuffix = '-pr-'.$this->preview->pull_request_id;
+            $serviceNames = [];
+            foreach ($services as $serviceName => $service) {
+                if (isDatabaseImage(data_get($service, 'image'))) {
+                    continue;
+                }
+
+                $serviceName = (string) $serviceName;
+                if (str_ends_with($serviceName, $previewSuffix)) {
+                    $serviceName = substr($serviceName, 0, -strlen($previewSuffix));
+                }
+                $serviceNames[] = $serviceName;
+            }
+
+            return array_values(array_unique($serviceNames));
+        } catch (\Throwable $exception) {
+            if ($failOnError) {
+                throw $exception;
+            }
+
+            return [];
+        }
+    }
+}
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index e07a985b40..14d9bcdb8d 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -7,7 +7,6 @@ use App\Events\ServiceStatusChanged;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
-use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
@@ -16,6 +15,8 @@ class Previews extends Component
 {
     use AuthorizesRequests;
 
+    protected $listeners = ['previewDomainsChanged' => 'refreshPreviewDomains'];
+
     public Application $application;
 
     public string $deployment_uuid;
@@ -26,16 +27,6 @@ class Previews extends Component
 
     public int $rate_limit_remaining;
 
-    public $domainConflicts = [];
-
-    public $showDomainConflictModal = false;
-
-    public $forceSaveDomains = false;
-
-    public $pendingPreviewId = null;
-
-    public array $previewFqdns = [];
-
     public array $previewDockerTags = [];
 
     public ?int $manualPullRequestId = null;
@@ -43,7 +34,6 @@ class Previews extends Component
     public ?string $manualDockerTag = null;
 
     protected $rules = [
-        'previewFqdns.*' => 'string|nullable',
         'previewDockerTags.*' => 'string|nullable',
         'manualPullRequestId' => 'integer|min:1|nullable',
         'manualDockerTag' => 'string|nullable',
@@ -53,31 +43,23 @@ class Previews extends Component
     {
         $this->pull_requests = collect();
         $this->parameters = get_route_parameters();
-        $this->syncData(false);
+        $this->syncDockerTags();
     }
 
-    private function syncData(bool $toModel = false): void
+    private function syncDockerTags(): void
     {
-        if ($toModel) {
-            foreach ($this->previewFqdns as $key => $fqdn) {
-                $preview = $this->application->previews->get($key);
-                if ($preview) {
-                    $preview->fqdn = $fqdn;
-                    if ($this->application->build_pack === 'dockerimage') {
-                        $preview->docker_registry_image_tag = $this->previewDockerTags[$key] ?? null;
-                    }
-                }
-            }
-        } else {
-            $this->previewFqdns = [];
-            $this->previewDockerTags = [];
-            foreach ($this->application->previews as $key => $preview) {
-                $this->previewFqdns[$key] = $preview->fqdn;
-                $this->previewDockerTags[$key] = $preview->docker_registry_image_tag;
-            }
+        $this->previewDockerTags = [];
+        foreach ($this->application->previews as $key => $preview) {
+            $this->previewDockerTags[$key] = $preview->docker_registry_image_tag;
         }
     }
 
+    public function refreshPreviewDomains(): void
+    {
+        $this->application->refresh();
+        $this->syncDockerTags();
+    }
+
     public function load_prs()
     {
         try {
@@ -92,103 +74,28 @@ class Previews extends Component
         }
     }
 
-    public function confirmDomainUsage()
-    {
-        $this->forceSaveDomains = true;
-        $this->showDomainConflictModal = false;
-        if ($this->pendingPreviewId) {
-            $this->save_preview($this->pendingPreviewId);
-            $this->pendingPreviewId = null;
-        }
-    }
-
     public function save_preview($preview_id)
     {
         try {
             $this->authorize('update', $this->application);
-            $success = true;
             $preview = $this->application->previews->find($preview_id);
 
             if (! $preview) {
                 throw new \Exception('Preview not found');
             }
 
-            // Find the key for this preview in the collection
             $previewKey = $this->application->previews->search(function ($item) use ($preview_id) {
                 return $item->id == $preview_id;
             });
 
-            if ($previewKey !== false && isset($this->previewFqdns[$previewKey])) {
-                $this->validate([
-                    "previewFqdns.{$previewKey}" => ValidationPatterns::applicationDomainRules(),
-                ]);
-
-                $fqdn = $this->previewFqdns[$previewKey];
-
-                if (! empty($fqdn)) {
-                    $fqdn = ValidationPatterns::normalizeApplicationDomains($fqdn);
-                    $this->previewFqdns[$previewKey] = $fqdn;
-
-                    if (! validateDNSEntry($fqdn, $this->application->destination->server)) {
-                        $server = $this->application->destination->server;
-                        $target = serverDnsTargetIp($server) ?? $server->ip;
-                        $guidance = dnsMismatchGuidanceMessage($target, $target);
-                        $this->dispatch('error', 'Validating DNS failed.', "{$guidance}<br><br>Check this <a target='_blank' class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/dns-configuration'>documentation</a> for further help.");
-                        $success = false;
-                    }
-
-                    // Check for domain conflicts if not forcing save
-                    if (! $this->forceSaveDomains) {
-                        $result = checkDomainUsage(resource: $this->application, domain: $fqdn);
-                        if ($result['hasConflicts']) {
-                            $this->domainConflicts = $result['conflicts'];
-                            $this->showDomainConflictModal = true;
-                            $this->pendingPreviewId = $preview_id;
-
-                            return;
-                        }
-                    } else {
-                        // Reset the force flag after using it
-                        $this->forceSaveDomains = false;
-                    }
-                }
+            if ($previewKey === false) {
+                throw new \Exception('Preview not found');
             }
 
-            if ($success) {
-                $this->syncData(true);
-                $preview->save();
-                $this->dispatch('success', 'Preview saved.<br><br>Do not forget to redeploy the preview to apply the changes.');
-            }
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function generate_preview($preview_id)
-    {
-        try {
-            $this->authorize('update', $this->application);
-
-            $preview = $this->application->previews->find($preview_id);
-            if (! $preview) {
-                $this->dispatch('error', 'Preview not found.');
-
-                return;
-            }
-            if ($this->application->build_pack === 'dockercompose') {
-                $preview->generate_preview_fqdn_compose();
-                $this->application->refresh();
-                $this->syncData(false);
-                $this->dispatch('success', 'Domain generated.');
-
-                return;
-            }
-
-            $preview->generate_preview_fqdn();
-            $this->application->refresh();
-            $this->syncData(false);
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain generated.');
+            $this->validateOnly("previewDockerTags.{$previewKey}");
+            $preview->docker_registry_image_tag = $this->previewDockerTags[$previewKey] ?? null;
+            $preview->save();
+            $this->dispatch('success', 'Preview saved.<br><br>Do not forget to redeploy the preview to apply the changes.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -211,7 +118,7 @@ class Previews extends Component
                 }
                 $found->generate_preview_fqdn_compose();
                 $this->application->refresh();
-                $this->syncData(false);
+                $this->syncDockerTags();
             } else {
                 $this->setDeploymentUuid();
                 $found = ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', $pull_request_id)->first();
@@ -227,9 +134,9 @@ class Previews extends Component
                     $found->docker_registry_image_tag = $docker_registry_image_tag;
                     $found->save();
                 }
-                $found->generate_preview_fqdn();
+                $found->generate_preview_fqdn(generateWithoutApplicationDomain: true);
                 $this->application->refresh();
-                $this->syncData(false);
+                $this->syncDockerTags();
                 $this->dispatch('update_links');
                 $this->dispatch('success', 'Preview added.');
             }
@@ -377,6 +284,12 @@ class Previews extends Component
             ApplicationPreview::where('application_id', $this->application->id)
                 ->where('pull_request_id', $pull_request_id)
                 ->update(['status' => 'exited']);
+            auditLog('ui.application.preview_stopped', [
+                'team_id' => $this->application->team()?->id,
+                'application_uuid' => $this->application->uuid,
+                'application_name' => $this->application->name,
+                'pull_request_id' => $pull_request_id,
+            ]);
             ServiceStatusChanged::dispatch($this->application->environment->project->team->id);
 
             GetContainersStatus::run($server);
diff --git a/app/Livewire/Project/Application/PreviewsCompose.php b/app/Livewire/Project/Application/PreviewsCompose.php
deleted file mode 100644
index 0fdcf46153..0000000000
--- a/app/Livewire/Project/Application/PreviewsCompose.php
+++ /dev/null
@@ -1,165 +0,0 @@
-<?php
-
-namespace App\Livewire\Project\Application;
-
-use App\Models\ApplicationPreview;
-use App\Support\ValidationPatterns;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Component;
-use Spatie\Url\Url;
-
-class PreviewsCompose extends Component
-{
-    use AuthorizesRequests;
-
-    public $service;
-
-    public $serviceName;
-
-    public ApplicationPreview $preview;
-
-    public ?string $domain = null;
-
-    public function mount()
-    {
-        $this->domain = data_get($this->service, 'domain');
-    }
-
-    public function render()
-    {
-        return view('livewire.project.application.previews-compose');
-    }
-
-    public function save()
-    {
-        try {
-            $this->authorize('update', $this->preview->application);
-            $this->validate([
-                'domain' => ValidationPatterns::applicationDomainRules(),
-            ]);
-
-            $this->domain = ValidationPatterns::normalizeApplicationDomains($this->domain);
-            $this->persistPreviewDomain($this->domain);
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain saved.');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function generate()
-    {
-        try {
-            $this->authorize('update', $this->preview->application);
-
-            $applicationDomains = json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: [];
-            $domain_string = getComposeServiceDomainString($applicationDomains, (string) $this->serviceName);
-
-            // If no domain is set in the main application, generate a default domain
-            if (empty($domain_string)) {
-                $server = $this->preview->application->destination->server;
-                $template = $this->preview->application->preview_url_template;
-                $random = new_public_id();
-
-                // Generate a unique domain like main app services do
-                $generated_fqdn = generateUrl(server: $server, random: $random);
-
-                $preview_fqdn = str_replace('{{random}}', $random, $template);
-                $preview_fqdn = str_replace('{{domain}}', str($generated_fqdn)->after('://'), $preview_fqdn);
-                $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
-                $preview_fqdn = str($generated_fqdn)->before('://').'://'.$preview_fqdn;
-            } else {
-                foreach (ValidationPatterns::validateApplicationDomains($domain_string) as $error) {
-                    throw new \InvalidArgumentException($error);
-                }
-
-                // Use the existing domain from the main application
-                // Handle multiple domains separated by commas
-                $domain_list = ValidationPatterns::applicationDomainList($domain_string);
-                $preview_fqdns = [];
-                $template = $this->preview->application->preview_url_template;
-                $random = new_public_id();
-
-                foreach ($domain_list as $single_domain) {
-                    $single_domain = trim($single_domain);
-                    if (empty($single_domain)) {
-                        continue;
-                    }
-
-                    $url = Url::fromString($single_domain);
-                    $host = $url->getHost();
-                    $schema = $url->getScheme();
-                    $portInt = $url->getPort();
-                    $port = $portInt !== null ? ':'.$portInt : '';
-
-                    $preview_fqdn = str_replace('{{random}}', $random, $template);
-                    $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                    $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
-                    $preview_fqdns[] = "$schema://$preview_fqdn{$port}";
-                }
-
-                $preview_fqdn = implode(',', $preview_fqdns);
-            }
-
-            $this->domain = $preview_fqdn;
-            $this->persistPreviewDomain($this->domain);
-
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain generated.');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    private function persistPreviewDomain(?string $domain): void
-    {
-        $docker_compose_domains = json_decode(data_get($this->preview, 'docker_compose_domains') ?: '[]', true) ?: [];
-        $serviceNames = $this->previewServiceNames($docker_compose_domains);
-        $storageKey = findComposeServiceName((string) $this->serviceName, $serviceNames)
-            ?? (string) $this->serviceName;
-
-        $docker_compose_domains = putComposeServiceDomain(
-            $docker_compose_domains,
-            $storageKey,
-            $domain,
-            $serviceNames,
-        );
-        $docker_compose_domains = rekeyComposeDomainsToServiceNames($docker_compose_domains, $serviceNames);
-
-        $this->serviceName = $storageKey;
-        $this->preview->docker_compose_domains = json_encode($docker_compose_domains);
-        $this->preview->save();
-    }
-
-    /**
-     * @param  array<string, mixed>  $previewDomains
-     * @return list<string>
-     */
-    private function previewServiceNames(array $previewDomains): array
-    {
-        $parsedServices = $this->preview->application->parse(pull_request_id: $this->preview->pull_request_id);
-        $fromCompose = collect(data_get($parsedServices, 'services', []))
-            ->keys()
-            ->map(function ($serviceName) {
-                return str((string) $serviceName)
-                    ->replaceLast('-pr-'.$this->preview->pull_request_id, '')
-                    ->toString();
-            })
-            ->all();
-
-        $domainKeys = collect(array_keys($previewDomains))
-            ->merge(array_keys(json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: []))
-            ->map(fn ($name) => (string) $name);
-        $unmapped = $domainKeys
-            ->reject(fn (string $key) => findComposeServiceName($key, $fromCompose) !== null)
-            ->all();
-
-        return collect($fromCompose)
-            ->merge(preferredComposeServiceNamesFromDomainKeys(
-                $fromCompose === [] ? $domainKeys->all() : $unmapped
-            ))
-            ->unique()
-            ->values()
-            ->all();
-    }
-}
diff --git a/app/Livewire/Project/Application/Source.php b/app/Livewire/Project/Application/Source.php
index 29f798d595..60a7955738 100644
--- a/app/Livewire/Project/Application/Source.php
+++ b/app/Livewire/Project/Application/Source.php
@@ -65,7 +65,7 @@ class Source extends Component
         $this->gitCommitSha = trim($this->gitCommitSha);
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/Swarm.php b/app/Livewire/Project/Application/Swarm.php
index 661578fb3d..ac867e69aa 100644
--- a/app/Livewire/Project/Application/Swarm.php
+++ b/app/Livewire/Project/Application/Swarm.php
@@ -31,7 +31,7 @@ class Swarm extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/CloneMe.php b/app/Livewire/Project/CloneMe.php
index fff2b7fbf5..ad032779b3 100644
--- a/app/Livewire/Project/CloneMe.php
+++ b/app/Livewire/Project/CloneMe.php
@@ -102,6 +102,14 @@ class CloneMe extends Component
             if (! $selectedDestination) {
                 throw new \Exception('Destination not found.');
             }
+            auditLog('ui.project.clone_started', [
+                'team_id' => $this->project->team_id,
+                'project_uuid' => $this->project->uuid,
+                'project_name' => $this->project->name,
+                'clone_type' => $type,
+                'new_name' => $this->newName,
+                'destination_uuid' => $selectedDestination->uuid,
+            ]);
             if ($type === 'project') {
                 $foundProject = Project::where('name', $this->newName)->first();
                 if ($foundProject) {
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 2c04f5ba9b..1d223b6967 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -128,7 +128,7 @@ class BackupEdit extends Component
         $this->status = $database->status;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->backup->enabled = $this->backupEnabled;
@@ -207,19 +207,27 @@ class BackupEdit extends Component
                 }
             }
 
+            $database = $this->backup->database;
+            $backupUuid = $this->backup->uuid;
             $this->backup->delete();
+            auditLog('ui.database.backup_schedule_deleted', [
+                'team_id' => $database->team()?->id,
+                'database_uuid' => $database->uuid,
+                'database_name' => $database->name,
+                'backup_uuid' => $backupUuid,
+            ]);
 
-            if ($this->backup->database->getMorphClass() === ServiceDatabase::class) {
-                $serviceDatabase = $this->backup->database;
+            if ($database->getMorphClass() === ServiceDatabase::class) {
+                $serviceDatabase = $database;
 
-                return redirect()->route('project.service.database.backups', [
+                return redirectRoute($this, 'project.service.database.backups', [
                     'project_uuid' => $this->parameters['project_uuid'],
                     'environment_uuid' => $this->parameters['environment_uuid'],
                     'service_uuid' => $serviceDatabase->service->uuid,
                     'stack_service_uuid' => $serviceDatabase->uuid,
                 ]);
             } else {
-                return redirect()->route('project.database.backup.index', [
+                return redirectRoute($this, 'project.database.backup.index', [
                     'project_uuid' => $this->parameters['project_uuid'],
                     'environment_uuid' => $this->parameters['environment_uuid'],
                     'database_uuid' => $this->parameters['database_uuid'],
@@ -238,9 +246,14 @@ class BackupEdit extends Component
             $this->authorize('manageBackups', $this->backup->database);
 
             DatabaseBackupJob::dispatch($this->backup);
-            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
-
             $database = $this->backup->database;
+            auditLog('ui.database.backup_started', [
+                'team_id' => $database->team()?->id,
+                'database_uuid' => $database->uuid,
+                'database_name' => $database->name,
+                'backup_uuid' => $this->backup->uuid,
+            ]);
+            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
 
             if ($database instanceof ServiceDatabase) {
                 return redirect()->route('project.service.database.backup.executions', [
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 73877a945e..2786a45c3d 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -6,7 +6,6 @@ use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class BackupExecutions extends Component
@@ -37,12 +36,12 @@ class BackupExecutions extends Component
 
     public $delete_backup_sftp = false;
 
-    public function getListeners()
+    public function getListeners(): array
     {
-        $userId = Auth::id();
+        $teamId = currentTeam()->id;
 
         return [
-            "echo-private:team.{$userId},BackupCreated" => 'refreshBackupExecutions',
+            "echo-private:team.{$teamId},BackupCreated" => 'refreshBackupExecutions',
         ];
     }
 
diff --git a/app/Livewire/Project/Database/BackupNow.php b/app/Livewire/Project/Database/BackupNow.php
index e4ed2a366c..e45c797d1e 100644
--- a/app/Livewire/Project/Database/BackupNow.php
+++ b/app/Livewire/Project/Database/BackupNow.php
@@ -18,6 +18,13 @@ class BackupNow extends Component
             $this->authorize('manageBackups', $this->backup->database);
 
             DatabaseBackupJob::dispatch($this->backup);
+            $database = $this->backup->database;
+            auditLog('ui.database.backup_started', [
+                'team_id' => $database->team()?->id,
+                'database_uuid' => $database->uuid,
+                'database_name' => $database->name,
+                'backup_uuid' => $this->backup->uuid,
+            ]);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index ad5e45b3fe..1d8354a4fb 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -121,7 +121,7 @@ class General extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -199,6 +199,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 2f5b844845..a8bde2f007 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -115,7 +115,7 @@ class General extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -191,6 +191,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Heading.php b/app/Livewire/Project/Database/Heading.php
index 943f227021..993200b578 100644
--- a/app/Livewire/Project/Database/Heading.php
+++ b/app/Livewire/Project/Database/Heading.php
@@ -35,6 +35,12 @@ class Heading extends Component
 
     public function activityFinished()
     {
+        if (auth()->user()->cannot('update', $this->database)) {
+            $this->dispatch('refresh');
+
+            return;
+        }
+
         try {
             // Only set started_at if database is actually running
             if ($this->database->isRunning()) {
@@ -83,6 +89,7 @@ class Heading extends Component
 
             $this->dispatch('info', 'Gracefully stopping database.');
             StopDatabase::dispatch($this->database, false, $this->docker_cleanup);
+            $this->auditDatabaseAction('ui.database.stopped');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
         }
@@ -94,6 +101,7 @@ class Heading extends Component
             $this->authorize('manage', $this->database);
 
             $activity = RestartDatabase::run($this->database);
+            $this->auditDatabaseAction('ui.database.restarted');
             $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
             $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
         } catch (\Throwable $e) {
@@ -107,6 +115,7 @@ class Heading extends Component
             $this->authorize('manage', $this->database);
 
             $activity = StartDatabase::run($this->database);
+            $this->auditDatabaseAction('ui.database.started');
             $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
             $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
         } catch (\Throwable $e) {
@@ -122,4 +131,13 @@ class Heading extends Component
             ],
         ]);
     }
+
+    private function auditDatabaseAction(string $event): void
+    {
+        auditLog($event, [
+            'team_id' => $this->database->team()?->id,
+            'database_uuid' => $this->database->uuid,
+            'database_name' => $this->database->name,
+        ]);
+    }
 }
diff --git a/app/Livewire/Project/Database/Health.php b/app/Livewire/Project/Database/Health.php
index 8943e6316e..07373bdba2 100644
--- a/app/Livewire/Project/Database/Health.php
+++ b/app/Livewire/Project/Database/Health.php
@@ -34,7 +34,7 @@ class Health extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Database/ImportForm.php b/app/Livewire/Project/Database/ImportForm.php
index ccd3435106..87c9328eb3 100644
--- a/app/Livewire/Project/Database/ImportForm.php
+++ b/app/Livewire/Project/Database/ImportForm.php
@@ -510,6 +510,12 @@ EOD;
                 // Dispatch activity to the monitor and open slide-over
                 $this->dispatch('activityMonitor', $activity->id);
                 $this->dispatch('databaserestore');
+                auditLog('ui.database.import_started', [
+                    'team_id' => $this->resource->team()?->id,
+                    'database_uuid' => $this->resource->uuid,
+                    'database_name' => $this->resource->name,
+                    'source' => 'file',
+                ]);
             }
         } catch (\Throwable $e) {
             handleError($e, $this);
@@ -768,6 +774,13 @@ EOD;
             // Dispatch activity to the monitor and open slide-over
             $this->dispatch('activityMonitor', $activity->id);
             $this->dispatch('databaserestore');
+            auditLog('ui.database.restore_started', [
+                'team_id' => $this->resource->team()?->id,
+                'database_uuid' => $this->resource->uuid,
+                'database_name' => $this->resource->name,
+                'source' => 's3',
+                'storage_id' => $this->s3StorageId,
+            ]);
             $this->dispatch('info', 'Restoring database from S3. Progress will be shown in the activity monitor...');
         } catch (\Throwable $e) {
             $this->importRunning = false;
@@ -796,6 +809,8 @@ EOD;
      *
      * Hardened against bypasses:
      *  - decompresses gzip backups before scanning,
+     *  - converts custom-format (PGDMP) archives to SQL with pg_restore
+     *    before scanning, and rejects archives that cannot be inspected,
      *  - strips `--` line comments and flattens newlines so multi-line and
      *    comment-separated payloads (e.g. `FROM/**​/PROGRAM`) are caught,
      *  - matches a literal `\!` shell escape and `\o|`/`\g|` pipe redirects.
@@ -817,8 +832,30 @@ EOD;
         $escapedSqlPattern = escapeshellarg($sqlPattern);
         $escapedPsqlPattern = escapeshellarg($psqlPattern);
         $contents = "{ gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}; }";
+        $scan = static fn (string $source): string => "{$source} | sed 's/--.*//' | grep -Eiq {$escapedPsqlPattern} || {$source} | sed 's/--.*//' | tr '\\n\\r\\t' '   ' | grep -Eiq {$escapedSqlPattern}";
+        $customScan = $scan('pg_restore -f - "$inspect" 2>/dev/null');
+        $sqlScan = $scan($contents);
+        $blockedProgram = 'echo \'Blocked PostgreSQL restore: COPY ... PROGRAM and psql shell commands are not allowed.\'; exit 1';
+        $blockedInspect = 'echo \'Blocked PostgreSQL restore: unable to inspect custom archive.\'; exit 1';
 
-        return "header=\$({$contents} | head -c 5); if [ \"\$header\" = 'PGDMP' ]; then exit 0; fi; if {$contents} | sed 's/--.*//' | grep -Eiq {$escapedPsqlPattern} || {$contents} | sed 's/--.*//' | tr '\n\r\t' '   ' | grep -Eiq {$escapedSqlPattern}; then echo 'Blocked PostgreSQL restore: COPY ... PROGRAM and psql shell commands are not allowed.'; exit 1; fi";
+        return <<<SH
+header=\$({$contents} | head -c 5)
+if [ "\$header" = 'PGDMP' ]; then
+  inspect=\$(mktemp)
+  trap 'rm -f "\$inspect"' EXIT
+  if ! {$contents} > "\$inspect"; then
+    {$blockedInspect}
+  fi
+  if ! pg_restore -l "\$inspect" >/dev/null 2>&1; then
+    {$blockedInspect}
+  fi
+  if {$customScan}; then
+    {$blockedProgram}
+  fi
+elif {$sqlScan}; then
+  {$blockedProgram}
+fi
+SH;
     }
 
     private function addRestoreSafetyCheckCommand(array &$commands, string $tmpPath): void
@@ -883,7 +920,7 @@ EOD;
             case 'postgresql':
                 $restoreCommand = $this->postgresqlRestoreCommand;
                 if ($this->dumpAll) {
-                    $restoreCommand .= " && (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | psql -U \${POSTGRES_USER} -d \${POSTGRES_DB:-\${POSTGRES_USER:-postgres}}";
+                    $restoreCommand .= " && if [ \"\$({ gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}; } | head -c 5)\" = 'PGDMP' ]; then pg_restore -U \${POSTGRES_USER} -d \${POSTGRES_DB:-\${POSTGRES_USER:-postgres}} {$escapedTmpPath}; else (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | psql -U \${POSTGRES_USER} -d \${POSTGRES_DB:-\${POSTGRES_USER:-postgres}}; fi";
                 } else {
                     $restoreCommand .= " {$escapedTmpPath}";
                 }
diff --git a/app/Livewire/Project/Database/InitScript.php b/app/Livewire/Project/Database/InitScript.php
index 7074c235d5..eba1c4d8f7 100644
--- a/app/Livewire/Project/Database/InitScript.php
+++ b/app/Livewire/Project/Database/InitScript.php
@@ -22,6 +22,9 @@ class InitScript extends Component
     #[Locked]
     public int $index;
 
+    #[Locked]
+    public string $originalFilename;
+
     #[Validate(['nullable', 'string'])]
     public ?string $filename = null;
 
@@ -33,6 +36,7 @@ class InitScript extends Component
         try {
             $this->index = data_get($this->script, 'index');
             $this->filename = data_get($this->script, 'filename');
+            $this->originalFilename = (string) data_get($this->script, 'filename');
             $this->content = data_get($this->script, 'content');
         } catch (Exception $e) {
             return handleError($e, $this);
@@ -47,7 +51,7 @@ class InitScript extends Component
             $this->script['index'] = $this->index;
             $this->script['content'] = $this->content;
             $this->script['filename'] = $this->filename;
-            $this->dispatch('save_init_script', $this->script);
+            $this->dispatch('save_init_script', $this->script, $this->originalFilename);
         } catch (Exception $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index b2d9bce91b..0398362bbb 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -118,7 +118,7 @@ class General extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -196,6 +196,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index 61280a34b5..4d2dd9d8c2 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -136,7 +136,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -244,6 +244,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index f68ba82c7d..d3545564ee 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -128,7 +128,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -237,6 +237,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index 1adfe2ea79..ce7fc01ecd 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -136,7 +136,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -244,6 +244,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 051fb515d9..3d0406956f 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -149,7 +149,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -240,6 +240,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
@@ -247,16 +248,16 @@ class General extends Component
         }
     }
 
-    public function save_init_script($script)
+    public function save_init_script($script, string $originalFilename)
     {
         $this->authorize('update', $this->database);
 
         $initScripts = collect($this->initScripts ?? []);
 
         $existingScript = $initScripts->firstWhere('filename', $script['filename']);
-        $oldScript = $initScripts->firstWhere('index', $script['index']);
+        $oldScript = $initScripts->firstWhere('filename', $originalFilename);
 
-        if ($existingScript && $existingScript['index'] !== $script['index']) {
+        if ($existingScript && $script['filename'] !== $originalFilename) {
             $this->dispatch('error', 'A script with this filename already exists.');
 
             return;
@@ -285,11 +286,10 @@ class General extends Component
             }
         }
 
-        $index = $initScripts->search(function ($item) use ($script) {
-            return $item['index'] === $script['index'];
-        });
+        $index = $initScripts->search(fn ($item) => $item['filename'] === $originalFilename);
 
         if ($index !== false) {
+            $script['index'] = $oldScript['index'];
             $initScripts[$index] = $script;
         } else {
             $initScripts->push($script);
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index d431b15064..7c6313c8da 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -127,7 +127,7 @@ class General extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -235,6 +235,7 @@ class General extends Component
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Edit.php b/app/Livewire/Project/Edit.php
index 91b0444f51..0d42c71e94 100644
--- a/app/Livewire/Project/Edit.php
+++ b/app/Livewire/Project/Edit.php
@@ -77,7 +77,7 @@ class Edit extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/EnvironmentEdit.php b/app/Livewire/Project/EnvironmentEdit.php
index 9b9a3670db..35db3167d3 100644
--- a/app/Livewire/Project/EnvironmentEdit.php
+++ b/app/Livewire/Project/EnvironmentEdit.php
@@ -48,7 +48,7 @@ class EnvironmentEdit extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Index.php b/app/Livewire/Project/Index.php
index 2b472a1a20..f43b7542e6 100644
--- a/app/Livewire/Project/Index.php
+++ b/app/Livewire/Project/Index.php
@@ -53,10 +53,7 @@ class Index extends Component
                     'uuid' => $project->uuid,
                     'name' => $project->name,
                     'description' => $project->description,
-                    'iconUrl' => $project->icon_path ? route('project.icon', [
-                        'project_uuid' => $project->uuid,
-                        'v' => $project->updated_at->timestamp,
-                    ]) : null,
+                    'iconUrl' => $project->icon_path ? project_icon_url($project) : null,
                     'href' => $project->navigateTo(),
                     'environmentCount' => $project->environments->count(),
                     'resourceCount' => $resourceCount,
diff --git a/app/Livewire/Project/New/Select.php b/app/Livewire/Project/New/Select.php
index 4cffff8001..ba03041e2b 100644
--- a/app/Livewire/Project/New/Select.php
+++ b/app/Livewire/Project/New/Select.php
@@ -111,38 +111,14 @@ class Select extends Component
         $templateLastUpdatedMap = $this->serviceTemplateLastUpdatedMap($services);
 
         $services = collect($services)->map(function ($service, $key) use ($templateLastUpdatedMap) {
-            $default_logo = 'svgs/default.webp';
-            $logo = data_get($service, 'logo');
-
-            if (is_string($logo) && str_starts_with($logo, 'svg/')) {
-                $normalizedLogo = 'svgs/'.str($logo)->after('svg/');
-                if (file_exists(public_path($normalizedLogo))) {
-                    $logo = $normalizedLogo;
-                }
-            }
-
-            $hasLogo = is_string($logo)
-                && basename($logo) !== basename($default_logo)
-                && file_exists(public_path($logo));
-
-            if (! $hasLogo) {
-                $logo = $default_logo;
-            }
-
-            $local_logo_path = public_path($logo);
             $serviceKey = (string) $key;
 
             return [
                 'id' => $serviceKey,
                 'name' => str($serviceKey)->headline(),
                 'docsSlug' => str($serviceKey)->lower()->value(),
-                'has_logo' => $hasLogo,
-                'logo' => asset($logo),
-                'logo_github_url' => file_exists($local_logo_path)
-                    ? 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo
-                    : asset($default_logo),
                 'templateLastUpdated' => $templateLastUpdatedMap[$serviceKey] ?? null,
-            ] + (array) $service;
+            ] + service_logo_urls(data_get($service, 'logo')) + (array) $service;
         })->all();
 
         // Extract unique categories from services
diff --git a/app/Livewire/Project/Resource/Index.php b/app/Livewire/Project/Resource/Index.php
index 93633246a8..7c375d0e03 100644
--- a/app/Livewire/Project/Resource/Index.php
+++ b/app/Livewire/Project/Resource/Index.php
@@ -187,6 +187,11 @@ class Index extends Component
             'fqdn' => $item->fqdn ?? null,
             'description' => $item->description ?? null,
             'status' => $item->status ?? '',
+            'restartLimitReached' => method_exists($item, 'stoppedAfterRestartLimit') && $item->stoppedAfterRestartLimit(),
+            'restartCount' => method_exists($item, 'stoppedAfterRestartLimit') && $item->stoppedAfterRestartLimit()
+                ? max($item->restart_count ?? 0, $item->max_restart_count ?? 0)
+                : ($item->restart_count ?? 0),
+            'maxRestartCount' => $item->max_restart_count ?? 0,
             'server_status' => $item->server_status ?? null,
             'hrefLink' => $item->hrefLink ?? '',
             'destination' => [
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
new file mode 100644
index 0000000000..87f24fb1da
--- /dev/null
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -0,0 +1,124 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+
+class BackupExecutions extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public bool $executionModalOpen = false;
+
+    public ?array $selectedExecution = null;
+
+    public function getListeners(): array
+    {
+        $teamId = currentTeam()->id;
+
+        return [
+            'modalClosed' => 'closeExecutionModal',
+            "echo-private:team.{$teamId},BackupCreated" => '$refresh',
+        ];
+    }
+
+    public function mount(Service $service): void
+    {
+        abort_unless($service->environment?->project?->team_id === currentTeam()->id, 404);
+        $this->service = $service;
+        $this->authorize('view', $this->service);
+    }
+
+    public function openExecution(string $executionUuid): void
+    {
+        $this->selectedExecution = $this->executions()->firstWhere('uuid', $executionUuid);
+        abort_unless($this->selectedExecution, 404);
+        $this->executionModalOpen = true;
+    }
+
+    public function closeExecutionModal(): void
+    {
+        $this->executionModalOpen = false;
+        $this->selectedExecution = null;
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.backup-executions', [
+            'executions' => $this->executions(),
+        ]);
+    }
+
+    private function executions(): Collection
+    {
+        $databaseScheduleIds = ScheduledDatabaseBackup::query()
+            ->where('database_type', (new ServiceDatabase)->getMorphClass())
+            ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
+            ->pluck('id');
+
+        $databaseExecutions = ScheduledDatabaseBackupExecution::query()
+            ->with('scheduledDatabaseBackup.database')
+            ->whereIn('scheduled_database_backup_id', $databaseScheduleIds)
+            ->latest()
+            ->limit(100)
+            ->get()
+            ->map(fn (ScheduledDatabaseBackupExecution $execution): array => [
+                'id' => 'database:'.$execution->id,
+                'uuid' => $execution->uuid,
+                'target' => $execution->scheduledDatabaseBackup->database->human_name ?: $execution->scheduledDatabaseBackup->database->name,
+                'type' => 'Database',
+                'schedule' => $execution->scheduledDatabaseBackup->frequency,
+                'status' => $execution->status,
+                'started_at' => $execution->created_at,
+                'size' => $execution->size,
+                'message' => $execution->message,
+                'filename' => $execution->filename,
+                'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                    ? route('download.backup', $execution->id)
+                    : null,
+            ]);
+
+        $volumeSchedules = ScheduledVolumeBackup::query()
+            ->with('backupable.resource')
+            ->forService($this->service)
+            ->get()
+            ->keyBy('id');
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->whereIn('scheduled_volume_backup_id', $volumeSchedules->keys())
+            ->latest()
+            ->limit(100)
+            ->get()
+            ->map(function (ScheduledVolumeBackupExecution $execution) use ($volumeSchedules): array {
+                $schedule = $volumeSchedules->get($execution->scheduled_volume_backup_id);
+
+                return [
+                    'id' => 'storage:'.$execution->id,
+                    'uuid' => $execution->uuid,
+                    'target' => $schedule->targetName(),
+                    'type' => $schedule->targetType(),
+                    'schedule' => $schedule->frequency,
+                    'status' => $execution->status,
+                    'started_at' => $execution->created_at,
+                    'size' => $execution->size,
+                    'message' => $execution->message,
+                    'filename' => $execution->filename,
+                    'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                        ? route('download.volume-backup', $execution->id)
+                        : null,
+                ];
+            });
+
+        return $databaseExecutions->concat($volumeExecutions)->sortByDesc('started_at')->values();
+    }
+}
diff --git a/app/Livewire/Project/Service/Configuration.php b/app/Livewire/Project/Service/Configuration.php
index caa19042b8..f3ec3ba4df 100644
--- a/app/Livewire/Project/Service/Configuration.php
+++ b/app/Livewire/Project/Service/Configuration.php
@@ -26,10 +26,17 @@ class Configuration extends Component
 
     public array $parameters;
 
-    protected $listeners = [
-        'refreshServices' => 'refreshServices',
-        'refresh' => 'refreshServices',
-    ];
+    public function getListeners(): array
+    {
+        $teamId = auth()->user()->currentTeam()->id;
+
+        return [
+            'refreshServices' => 'refreshServices',
+            'refresh' => 'refreshServices',
+            'configurationChanged' => 'refreshServices',
+            "echo-private:team.{$teamId},ApplicationConfigurationChanged" => 'refreshServices',
+        ];
+    }
 
     public function render()
     {
diff --git a/app/Livewire/Project/Service/DatabaseBackups.php b/app/Livewire/Project/Service/DatabaseBackups.php
index 90907abc6e..8535584dd8 100644
--- a/app/Livewire/Project/Service/DatabaseBackups.php
+++ b/app/Livewire/Project/Service/DatabaseBackups.php
@@ -22,8 +22,6 @@ class DatabaseBackups extends Component
 
     public array $query;
 
-    public bool $isImportSupported = false;
-
     public ?ScheduledDatabaseBackup $backup = null;
 
     public string $section = 'index';
@@ -32,7 +30,7 @@ class DatabaseBackups extends Component
 
     protected $listeners = ['refreshScheduledBackups' => '$refresh'];
 
-    public function mount()
+    public function mount(): mixed
     {
         try {
             $this->parameters = array_filter(
@@ -67,10 +65,13 @@ class DatabaseBackups extends Component
                 return redirect()->route('project.service.index', $this->parameters);
             }
 
-            // Check if import is supported for this database type
-            $dbType = $this->serviceDatabase->databaseType();
-            $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
-            $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
+            if (! request()->route('backup_uuid')) {
+                return redirect()->route('project.service.volume-backups.index', [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'service_uuid' => $this->parameters['service_uuid'],
+                ]);
+            }
 
             if (request()->route('backup_uuid')) {
                 $this->backup = $this->serviceDatabase->scheduledBackups()
@@ -85,6 +86,14 @@ class DatabaseBackups extends Component
                     'project.service.database.backup.danger' => 'danger',
                     default => 'general',
                 };
+
+                $routeParameters = [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'service_uuid' => $this->parameters['service_uuid'],
+                ];
+
+                return redirect()->route('project.service.volume-backups.index', $routeParameters);
             }
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index 4690335d86..d5254e093a 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -2,11 +2,14 @@
 
 namespace App\Livewire\Project\Service;
 
+use App\Actions\Shared\CheckDomainDns;
+use App\Jobs\CheckDomainDnsJob;
 use App\Livewire\Concerns\InteractsWithCloudflareDomainConnect;
 use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -131,6 +134,39 @@ class Domains extends Component
         $this->loadDomainState();
     }
 
+    public function pollDnsChecks(): void
+    {
+        $this->authorize('view', $this->service);
+
+        $checkingRows = collect($this->domainRows)
+            ->where('dns_status', 'checking')
+            ->values();
+
+        $this->refreshDomains();
+
+        foreach ($checkingRows as $checkingRow) {
+            $row = collect($this->domainRows)->first(fn (array $row): bool => $row['url'] === $checkingRow['url']
+                && (int) $row['service_application_id'] === (int) $checkingRow['service_application_id']);
+
+            if (! is_array($row) || $row['dns_status'] === 'checking') {
+                continue;
+            }
+
+            $this->dispatchDnsCheckNotification($row['url'], $row['dns_status']);
+        }
+    }
+
+    protected function dispatchDnsCheckNotification(string $url, string $status): void
+    {
+        $host = parse_url($url, PHP_URL_HOST) ?: $url;
+
+        match ($status) {
+            'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
+            'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+            default => $this->dispatch('info', "DNS check skipped for {$host}."),
+        };
+    }
+
     public function toggleNoindexDomain(int $serviceApplicationId, string $domain, string|bool $indexing): void
     {
         $application = $this->service->applications()->findOrFail($serviceApplicationId);
@@ -271,38 +307,67 @@ class Domains extends Component
     {
         $entry = $stored[$url] ?? null;
         $displayName = $app->human_name ?: $app->name;
+        $port = $this->effectiveDomainInternalPort($url, $app);
 
-        if (is_array($entry) && filled(data_get($entry, 'status'))) {
-            return [
-                'service_application_id' => $app->id,
-                'service_name' => $displayName,
-                'service_image' => $app->image,
-                'url' => $url,
-                'dns_status' => (string) data_get($entry, 'status', 'pending'),
-                'dns_message' => (string) data_get($entry, 'message', 'Not checked yet.'),
-                'expected_ip' => data_get($entry, 'expected_ip') ?: $this->serverIp,
-                'checked_at' => data_get($entry, 'checked_at'),
-                'is_suggested' => false,
-                'suggested_for' => null,
-                'suggestion_label' => null,
-                'needs_force_add' => false,
-            ];
-        }
-
-        return [
+        $row = [
             'service_application_id' => $app->id,
             'service_name' => $displayName,
             'service_image' => $app->image,
             'url' => $url,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => 'pending',
             'dns_message' => 'Not checked yet.',
             'expected_ip' => $this->serverIp,
             'checked_at' => null,
+            'check_id' => null,
             'is_suggested' => false,
             'suggested_for' => null,
             'suggestion_label' => null,
             'needs_force_add' => false,
         ];
+
+        if (is_array($entry) && filled(data_get($entry, 'status'))) {
+            $row['dns_status'] = (string) data_get($entry, 'status', 'pending');
+            $row['dns_message'] = (string) data_get($entry, 'message', 'Not checked yet.');
+            $row['expected_ip'] = data_get($entry, 'expected_ip') ?: $this->serverIp;
+            $row['checked_at'] = data_get($entry, 'checked_at');
+            $row['check_id'] = data_get($entry, 'check_id');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    protected function effectiveDomainInternalPort(string $url, ServiceApplication $app): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $app->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+
+        if (array_key_exists($canonical, $overrides)) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null && $legacyPort > 0) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        $requiredPort = $app->getRequiredPort();
+
+        return [
+            'internal_port' => ($requiredPort !== null && $requiredPort > 0) ? $requiredPort : null,
+            'has_port_override' => false,
+        ];
     }
 
     /**
@@ -404,6 +469,8 @@ class Domains extends Component
             $server = $this->service->server;
             $skipDns = ! $this->dnsValidationEnabled || ! $server;
 
+            $indexesToCheck = [];
+
             foreach ($this->domainRows as $index => $row) {
                 if ($skipDns) {
                     $this->domainRows[$index]['dns_status'] = 'skipped';
@@ -415,7 +482,11 @@ class Domains extends Component
                     continue;
                 }
 
-                $this->applyDnsStatus($index, $row['url'], $server);
+                $indexesToCheck[] = $index;
+            }
+
+            if ($server && $indexesToCheck !== []) {
+                $this->applyDnsStatuses($indexesToCheck, $server);
             }
 
             $this->persistAllDomainDnsStatuses();
@@ -443,33 +514,37 @@ class Domains extends Component
             return;
         }
 
-        $this->applyDnsStatus($index, $this->domainRows[$index]['url'], $server);
+        $this->applyDnsStatus($index, $server);
         $this->persistAllDomainDnsStatuses();
     }
 
-    protected function applyDnsStatus(int $index, string $url, Server $server): void
+    protected function applyDnsStatus(int $index, Server $server): void
     {
-        $target = $this->dnsTargetLabel();
+        $this->applyDnsStatuses([$index], $server);
+    }
 
-        try {
-            $isValid = validateDNSEntry($url, $server);
-            if ($isValid) {
-                $this->domainRows[$index]['dns_status'] = 'ok';
-                $this->domainRows[$index]['dns_message'] = $target
-                    ? "DNS points to {$target} (or Cloudflare)."
-                    : 'DNS looks correct.';
-            } else {
-                $this->domainRows[$index]['dns_status'] = 'failed';
-                $this->domainRows[$index]['dns_message'] = dnsMismatchGuidanceMessage($target, $this->serverIp);
-            }
-        } catch (\Throwable) {
-            $this->domainRows[$index]['dns_status'] = 'failed';
-            $this->domainRows[$index]['dns_message'] = 'Could not validate DNS for this domain.';
+    /**
+     * @param  array<int, int>  $indexes
+     */
+    protected function applyDnsStatuses(array $indexes, Server $server): void
+    {
+        $entries = [];
+
+        foreach ($indexes as $index) {
+            $entries[(string) $index] = $this->domainRows[$index]['url'];
         }
 
-        $this->domainRows[$index]['expected_ip'] = $this->serverIp;
-        $this->domainRows[$index]['checked_at'] = now()->toIso8601String();
-        $this->decorateSuggestedDomainAfterDnsCheck($index);
+        $results = CheckDomainDns::run($entries, $server, $this->serverIp);
+
+        foreach ($results as $index => $result) {
+            $index = (int) $index;
+            $this->domainRows[$index]['dns_status'] = $result['status'];
+            $this->domainRows[$index]['dns_message'] = $result['message'];
+            $this->domainRows[$index]['expected_ip'] = $result['expected_ip'];
+            $this->domainRows[$index]['checked_at'] = $result['checked_at'];
+            $this->domainRows[$index]['check_id'] = null;
+            $this->decorateSuggestedDomainAfterDnsCheck($index);
+        }
     }
 
     /**
@@ -516,6 +591,7 @@ class Domains extends Component
                 'message' => (string) ($row['dns_message'] ?? ''),
                 'expected_ip' => $row['expected_ip'] ?? $this->serverIp,
                 'checked_at' => $row['checked_at'] ?? now()->toIso8601String(),
+                'check_id' => $row['check_id'] ?? null,
             ];
         }
 
@@ -528,8 +604,30 @@ class Domains extends Component
                 ->all();
             $statuses = array_intersect_key($statuses, array_flip($currentUrls));
 
+            DB::transaction(function () use ($app, &$statuses): void {
+                $application = ServiceApplication::query()->lockForUpdate()->findOrFail($app->id);
+                $storedStatuses = $application->domain_dns_statuses ?? [];
+
+                foreach ($statuses as $key => $status) {
+                    $localCheckId = $status['check_id'] ?? null;
+                    $storedCheckId = $storedStatuses[$key]['check_id'] ?? null;
+
+                    if ($storedCheckId !== null && $localCheckId !== $storedCheckId) {
+                        $statuses[$key] = $storedStatuses[$key];
+
+                        continue;
+                    }
+
+                    if ($status['status'] === 'checking' && isset($storedStatuses[$key]) && $storedStatuses[$key]['status'] !== 'checking') {
+                        $statuses[$key] = $storedStatuses[$key];
+                    }
+                }
+
+                $application->domain_dns_statuses = $statuses === [] ? null : $statuses;
+                $application->save();
+            });
+
             $app->domain_dns_statuses = $statuses === [] ? null : $statuses;
-            $app->save();
         }
 
         $this->service->load('applications');
@@ -920,24 +1018,17 @@ class Domains extends Component
                     ->all()
                 : [];
             $current = collect($this->splitDomains($app->fqdn));
+            $currentCanonicalDomains = $current->map(
+                fn (string $url): string => DomainPortOverrides::withoutPort($url)
+            );
             foreach ($newUrls as $url) {
-                if ($current->contains($url)) {
+                if ($currentCanonicalDomains->contains(DomainPortOverrides::withoutPort($url))) {
                     $this->addError('newDomain', "Domain {$url} is already configured for this service.");
 
                     return;
                 }
             }
 
-            if (! $this->forceSaveDns && $this->shouldValidateDns()) {
-                $dnsFailure = $this->findDnsFailureMessage($newUrls);
-                if ($dnsFailure !== null) {
-                    $this->addDomainDnsFailed = true;
-                    $this->addDomainDnsMessage = $dnsFailure;
-
-                    return;
-                }
-            }
-
             $merged = $current->merge($newUrls)->merge($pairedUrls)->unique()->values();
             $this->pendingAction = 'add';
 
@@ -955,14 +1046,93 @@ class Domains extends Component
             $this->forceRemovePort = false;
             $this->pendingAction = null;
             $this->dispatch('close-modal');
-            $this->dispatch('success', 'Domain added.');
             $this->refreshDomains();
-            $this->checkUrlsDns(array_values(array_unique(array_merge($newUrls, $pairedUrls))), (int) $app->id);
+            $urlsToCheck = array_values(array_unique(array_merge($newUrls, $pairedUrls)));
+            $serviceApplicationId = (int) $app->id;
+            $dnsChecks = collect($urlsToCheck)->map(fn (string $url) => [
+                'url' => $url,
+                'check_id' => new_public_id(),
+            ]);
+
+            foreach ($dnsChecks as $dnsCheck) {
+                $this->markUrlsAsChecking([$dnsCheck['url']], $serviceApplicationId, $dnsCheck['check_id']);
+            }
+            $this->persistAllDomainDnsStatuses();
+
+            $failedDnsChecks = 0;
+            foreach ($dnsChecks as $dnsCheck) {
+                try {
+                    CheckDomainDnsJob::dispatch(
+                        $app,
+                        $dnsCheck['url'],
+                        $dnsCheck['url'],
+                        $this->service->server,
+                        $this->serverIp,
+                        $dnsCheck['check_id'],
+                    );
+                } catch (\Throwable) {
+                    $failedDnsChecks++;
+                    $this->markUrlsDnsCheckUnavailable([$dnsCheck['url']], $serviceApplicationId, $dnsCheck['check_id']);
+                }
+            }
+
+            if ($failedDnsChecks > 0) {
+                $this->persistAllDomainDnsStatuses();
+                $this->dispatch('error', 'Some DNS checks could not be started. Try again from the Domains page.');
+            }
+
+            $this->dispatch('success', $failedDnsChecks === $dnsChecks->count()
+                ? 'Domain added.'
+                : 'Domain added. DNS check started.');
         } catch (\Throwable $e) {
             handleError($e, $this);
         }
     }
 
+    /**
+     * @param  array<int, string>  $urls
+     */
+    protected function markUrlsAsChecking(array $urls, int $serviceApplicationId, ?string $checkId = null): void
+    {
+        $indexesToCheck = [];
+
+        foreach ($this->domainRows as $index => $row) {
+            if (! in_array($row['url'], $urls, true)) {
+                continue;
+            }
+
+            if ((int) ($row['service_application_id'] ?? 0) !== $serviceApplicationId) {
+                continue;
+            }
+
+            $this->domainRows[$index]['dns_status'] = 'checking';
+            $this->domainRows[$index]['dns_message'] = 'Checking DNS...';
+            $this->domainRows[$index]['check_id'] = $checkId;
+        }
+    }
+
+    /**
+     * @param  array<int, string>  $urls
+     */
+    protected function markUrlsDnsCheckUnavailable(array $urls, int $serviceApplicationId, ?string $checkId = null): void
+    {
+        $this->markUrlsAsChecking($urls, $serviceApplicationId, $checkId);
+
+        foreach ($this->domainRows as $index => $row) {
+            if (! in_array($row['url'], $urls, true)) {
+                continue;
+            }
+
+            if ((int) ($row['service_application_id'] ?? 0) !== $serviceApplicationId) {
+                continue;
+            }
+
+            $this->domainRows[$index]['dns_status'] = 'skipped';
+            $this->domainRows[$index]['dns_message'] = 'DNS check could not be started.';
+            $this->domainRows[$index]['checked_at'] = now()->toIso8601String();
+        }
+    }
+
     public function startEdit(int $index): void
     {
         if (! isset($this->domainRows[$index]) || ($this->domainRows[$index]['is_suggested'] ?? false)) {
@@ -972,6 +1142,12 @@ class Domains extends Component
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $app = $this->findServiceApp((int) $this->domainRows[$index]['service_application_id']);
+        $canonical = DomainPortOverrides::withoutPort($this->editingDomain);
+        $savedPort = ($app?->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = (int) $this->domainRows[$index]['service_application_id'];
         $this->editDomainDnsFailed = false;
@@ -1005,7 +1181,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->editingDomainPartsChanged) {
+            if ($this->editingDomainPartsChanged || filled($this->editingDomainParts['host'] ?? null)) {
                 $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
             }
             $this->validateOnly('editingDomain');
@@ -1027,7 +1203,17 @@ class Domains extends Component
             $current = collect($this->splitDomains($app->fqdn));
             $wasNoindexed = $app->isDomainNoindexed($oldUrl);
 
-            if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
+            if (blank(DomainUrlParts::split($newUrl)['port'] ?? null)) {
+                $portOverrides = $app->domain_port_overrides ?? [];
+                unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+                unset($portOverrides[DomainPortOverrides::withoutPort($newUrl)]);
+                $app->domain_port_overrides = $portOverrides ?: null;
+            }
+
+            $otherCanonicalDomains = $current
+                ->reject(fn (string $url): bool => $url === $oldUrl)
+                ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url));
+            if ($otherCanonicalDomains->contains(DomainPortOverrides::withoutPort($newUrl))) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured for this service.");
 
                 return;
@@ -1104,6 +1290,28 @@ class Domains extends Component
         }
     }
 
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => ! ($row['is_suggested'] ?? false)
+                && hash_equals($domainKey, $this->domainRowKey($row))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    /**
+     * @param  array{url: string, service_application_id: int|string}  $row
+     */
+    private function domainRowKey(array $row): string
+    {
+        return hash('sha256', $row['url'].'|'.$row['service_application_id']);
+    }
+
     public function addSuggestedDomain(int $index): void
     {
         try {
@@ -1237,8 +1445,9 @@ class Domains extends Component
         if (! $this->forceRemovePort) {
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null && $domainString) {
+                $previousFqdn = $app->getOriginal('fqdn');
                 foreach ($this->splitDomains($domainString) as $fqdn) {
-                    if (ServiceApplication::extractPortFromUrl($fqdn) === null) {
+                    if ($app->portRequiresConfirmation($fqdn, $requiredPort, is_string($previousFqdn) ? $previousFqdn : null)) {
                         $this->requiredPort = $requiredPort;
                         $this->showPortWarningModal = true;
                         $app->refresh();
@@ -1286,6 +1495,7 @@ class Domains extends Component
         $urlSet = array_fill_keys($urls, true);
         $server = $this->service->server;
         $skipDns = ! $this->dnsValidationEnabled || ! $server;
+        $indexesToCheck = [];
 
         foreach ($this->domainRows as $index => $row) {
             $url = $row['url'] ?? null;
@@ -1309,7 +1519,11 @@ class Domains extends Component
                 continue;
             }
 
-            $this->applyDnsStatus($index, $url, $server);
+            $indexesToCheck[] = $index;
+        }
+
+        if ($server && $indexesToCheck !== []) {
+            $this->applyDnsStatuses($indexesToCheck, $server);
         }
 
         $this->persistAllDomainDnsStatuses();
@@ -1330,15 +1544,11 @@ class Domains extends Component
             return null;
         }
 
-        $target = $this->dnsTargetLabel() ?? $server->ip;
+        $results = CheckDomainDns::run(array_combine($urls, $urls), $server, $this->serverIp);
 
-        foreach ($urls as $url) {
-            try {
-                if (! validateDNSEntry($url, $server)) {
-                    return dnsMismatchGuidanceMessage($target, $this->serverIp);
-                }
-            } catch (\Throwable) {
-                return 'Could not validate DNS for this domain.';
+        foreach ($results as $result) {
+            if ($result['status'] === 'failed') {
+                return $result['message'];
             }
         }
 
diff --git a/app/Livewire/Project/Service/EditCompose.php b/app/Livewire/Project/Service/EditCompose.php
index 46a8ecdc89..2feafe41a2 100644
--- a/app/Livewire/Project/Service/EditCompose.php
+++ b/app/Livewire/Project/Service/EditCompose.php
@@ -78,7 +78,7 @@ class EditCompose extends Component
         try {
             $this->authorize('update', $this->service);
             $this->dispatch('saveCompose', $this->dockerComposeRaw);
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Service/EditDomain.php b/app/Livewire/Project/Service/EditDomain.php
index 96fe6a62c3..f099891534 100644
--- a/app/Livewire/Project/Service/EditDomain.php
+++ b/app/Livewire/Project/Service/EditDomain.php
@@ -46,18 +46,18 @@ class EditDomain extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
 
             // Sync to model
-            $this->application->fqdn = $this->fqdn;
+            $this->application->setEditableUrls($this->fqdn);
 
             $this->application->save();
         } else {
             // Sync from model
-            $this->fqdn = $this->application->fqdn;
+            $this->fqdn = $this->application->url;
         }
     }
 
@@ -84,6 +84,10 @@ class EditDomain extends Component
     public function submit()
     {
         try {
+            $persistedApplication = $this->application->fresh();
+            $previousEditableUrls = $persistedApplication->url;
+            $previousFqdn = $persistedApplication->fqdn;
+            $previousPortOverrides = $persistedApplication->domain_port_overrides;
             $this->authorize('update', $this->application);
             $this->validate();
 
@@ -93,7 +97,7 @@ class EditDomain extends Component
                 $this->dispatch('warning', __('warning.sslipdomain'));
             }
             // Sync to model for domain conflict check (without validation)
-            $this->application->fqdn = $this->fqdn;
+            $this->application->setEditableUrls($this->fqdn);
             // Check for domain conflicts if not forcing save
             if (! $this->forceSaveDomains) {
                 $result = checkDomainUsage(resource: $this->application);
@@ -113,29 +117,21 @@ class EditDomain extends Component
                 $requiredPort = $this->application->getRequiredPort();
 
                 if ($requiredPort !== null) {
-                    // Check if all FQDNs have a port
-                    $fqdns = str($this->fqdn)->trim()->explode(',');
-                    $missingPort = false;
-
-                    foreach ($fqdns as $fqdn) {
-                        $fqdn = trim($fqdn);
-                        if (empty($fqdn)) {
+                    foreach (str($this->fqdn)->trim()->explode(',') as $fqdn) {
+                        $fqdn = trim((string) $fqdn);
+                        if ($fqdn === '') {
                             continue;
                         }
 
-                        $port = ServiceApplication::extractPortFromUrl($fqdn);
-                        if ($port === null) {
-                            $missingPort = true;
-                            break;
+                        if ($this->application->portRequiresConfirmation($fqdn, $requiredPort, $previousEditableUrls)) {
+                            $this->requiredPort = $requiredPort;
+                            $this->showPortWarningModal = true;
+                            $this->application->fqdn = $previousFqdn;
+                            $this->application->domain_port_overrides = $previousPortOverrides;
+
+                            return;
                         }
                     }
-
-                    if ($missingPort) {
-                        $this->requiredPort = $requiredPort;
-                        $this->showPortWarningModal = true;
-
-                        return;
-                    }
                 }
             } else {
                 // Reset the force flag after using it
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 84a0daec8a..d6ab2ac151 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -120,7 +120,7 @@ class FileStorage extends Component
             : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             if ($this->fileStorage->is_too_large) {
@@ -160,7 +160,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -179,7 +179,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -207,7 +207,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -242,7 +242,7 @@ class FileStorage extends Component
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
 
         return true;
diff --git a/app/Livewire/Project/Service/Heading.php b/app/Livewire/Project/Service/Heading.php
index 34bb46ff19..d692a71546 100644
--- a/app/Livewire/Project/Service/Heading.php
+++ b/app/Livewire/Project/Service/Heading.php
@@ -5,8 +5,11 @@ namespace App\Livewire\Project\Service;
 use App\Actions\Docker\GetContainersStatus;
 use App\Actions\Service\StartService;
 use App\Actions\Service\StopService;
+use App\Actions\Service\StopServiceApplication;
 use App\Enums\ProcessStatus;
 use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
@@ -113,6 +116,7 @@ class Heading extends Component
         try {
             $this->authorizeService('deploy');
             $activity = StartService::run($this->service, pullLatestImages: true);
+            $this->auditServiceAction('ui.service.started');
             $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -146,6 +150,7 @@ class Heading extends Component
         try {
             $this->authorizeService('stop');
             StopService::dispatch($this->service, false, $this->docker_cleanup);
+            $this->auditServiceAction('ui.service.stopped');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -162,6 +167,7 @@ class Heading extends Component
                 return;
             }
             $activity = StartService::run($this->service, stopBeforeStart: true);
+            $this->auditServiceAction('ui.service.restarted');
             $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -169,6 +175,29 @@ class Heading extends Component
         }
     }
 
+    public function removeSelectedResourceContainer(): void
+    {
+        $resource = $this->selectedResource();
+        if (! $resource) {
+            return;
+        }
+
+        $this->authorize('update', $resource);
+        StopServiceApplication::run($resource, true, true);
+        $this->dispatch('success', 'Container removed.');
+    }
+
+    private function selectedResource(): ServiceApplication|ServiceDatabase|null
+    {
+        $uuid = data_get($this->parameters, 'stack_service_uuid');
+        if (! $uuid) {
+            return null;
+        }
+
+        return $this->service->applications()->whereUuid($uuid)->first()
+            ?? $this->service->databases()->whereUuid($uuid)->first();
+    }
+
     public function pullAndRestartEvent()
     {
         try {
@@ -180,6 +209,7 @@ class Heading extends Component
                 return;
             }
             $activity = StartService::run($this->service, pullLatestImages: true, stopBeforeStart: true);
+            $this->auditServiceAction('ui.service.restarted');
             $this->js("window.dispatchEvent(new CustomEvent('startservice'))");
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
@@ -196,6 +226,15 @@ class Heading extends Component
         $this->authorize($ability, $this->service);
     }
 
+    private function auditServiceAction(string $event): void
+    {
+        auditLog($event, [
+            'team_id' => $this->service->team()?->id,
+            'service_uuid' => $this->service->uuid,
+            'service_name' => $this->service->name,
+        ]);
+    }
+
     public function render()
     {
         return view('livewire.project.service.heading', [
diff --git a/app/Livewire/Project/Service/ImportBackup.php b/app/Livewire/Project/Service/ImportBackup.php
new file mode 100644
index 0000000000..29e8d9f359
--- /dev/null
+++ b/app/Livewire/Project/Service/ImportBackup.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+
+class ImportBackup extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public Collection $databases;
+
+    public ?ServiceDatabase $selectedDatabase = null;
+
+    public string $selectedDatabaseUuid = '';
+
+    public array $parameters;
+
+    public function mount(): mixed
+    {
+        $this->parameters = get_route_parameters();
+        $project = currentTeam()->projects()->whereUuid($this->parameters['project_uuid'])->firstOrFail();
+        $environment = $project->environments()->whereUuid($this->parameters['environment_uuid'])->firstOrFail();
+        $this->service = $environment->services()->whereUuid($this->parameters['service_uuid'])->firstOrFail();
+        $this->authorize('update', $this->service);
+
+        $this->databases = $this->service->databases
+            ->filter(fn (ServiceDatabase $database): bool => $this->supportsImport($database))
+            ->values();
+
+        $databaseUuid = request()->route('stack_service_uuid');
+        if ($databaseUuid) {
+            $selectedDatabase = $this->databases->firstWhere('uuid', $databaseUuid);
+            abort_unless($selectedDatabase instanceof ServiceDatabase, 404);
+            $this->authorize('update', $selectedDatabase);
+            $this->selectedDatabase = $selectedDatabase;
+            $this->selectedDatabaseUuid = $selectedDatabase->uuid;
+
+            if (request()->routeIs('project.service.database.import')) {
+                return redirect()->route('project.service.import-backup.database', $this->parameters);
+            }
+        } elseif ($this->databases->count() === 1) {
+            return redirect()->route('project.service.import-backup.database', [
+                ...$this->parameters,
+                'stack_service_uuid' => $this->databases->first()->uuid,
+            ]);
+        }
+
+        return null;
+    }
+
+    public function updatedSelectedDatabaseUuid(): mixed
+    {
+        $database = $this->databases->firstWhere('uuid', $this->selectedDatabaseUuid);
+        abort_unless($database instanceof ServiceDatabase, 404);
+        $this->authorize('update', $database);
+
+        return redirect()->route('project.service.import-backup.database', [
+            ...$this->parameters,
+            'stack_service_uuid' => $database->uuid,
+        ]);
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.import-backup');
+    }
+
+    private function supportsImport(ServiceDatabase $database): bool
+    {
+        return str($database->databaseType())->contains(['mysql', 'mariadb', 'postgres', 'mongo']);
+    }
+}
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index d93ed7c026..7980e07056 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -59,8 +59,6 @@ class Index extends Component
 
     public bool $isLogDrainEnabled = false;
 
-    public bool $isImportSupported = false;
-
     // Application-specific properties
     public $docker_cleanup = true;
 
@@ -101,10 +99,27 @@ class Index extends Component
         'isStripprefixEnabled' => 'nullable|boolean',
     ];
 
-    public function mount()
+    public function mount(?ServiceApplication $serviceApplication = null)
     {
         try {
             $this->services = collect([]);
+            if ($serviceApplication) {
+                $this->service = $serviceApplication->service;
+                $this->authorize('view', $this->service);
+                $this->parameters = [
+                    'project_uuid' => $this->service->environment->project->uuid,
+                    'environment_uuid' => $this->service->environment->uuid,
+                    'service_uuid' => $this->service->uuid,
+                    'stack_service_uuid' => $serviceApplication->uuid,
+                ];
+                $this->query = request()->query();
+                $this->serviceApplication = $serviceApplication;
+                $this->resourceType = 'application';
+                $this->initializeApplicationProperties();
+                $this->s3s = currentTeam()->s3s;
+
+                return;
+            }
             $this->parameters = get_route_parameters();
             $this->query = request()->query();
             $this->currentRoute = request()->route()->getName();
@@ -153,10 +168,6 @@ class Index extends Component
         $this->refreshFileStorages();
         $this->syncDatabaseData(false);
 
-        // Check if import is supported for this database type
-        $dbType = $this->serviceDatabase->databaseType();
-        $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
-        $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
     }
 
     private function syncDatabaseData(bool $toModel = false): void
@@ -356,7 +367,7 @@ class Index extends Component
         if ($toModel) {
             $this->serviceApplication->human_name = $this->humanName;
             $this->serviceApplication->description = $this->description;
-            $this->serviceApplication->fqdn = $this->fqdn;
+            $this->serviceApplication->setEditableUrls($this->fqdn);
             $this->serviceApplication->image = $this->image;
             $this->serviceApplication->exclude_from_status = $this->excludeFromStatus;
             $this->serviceApplication->is_log_drain_enabled = $this->isLogDrainEnabled;
@@ -365,7 +376,7 @@ class Index extends Component
         } else {
             $this->humanName = $this->serviceApplication->human_name;
             $this->description = $this->serviceApplication->description;
-            $this->fqdn = $this->serviceApplication->fqdn;
+            $this->fqdn = $this->serviceApplication->url;
             $this->image = $this->serviceApplication->image;
             $this->excludeFromStatus = data_get($this->serviceApplication, 'exclude_from_status', false);
             $this->isLogDrainEnabled = data_get($this->serviceApplication, 'is_log_drain_enabled', false);
@@ -428,7 +439,7 @@ class Index extends Component
             $this->serviceApplication->delete();
             $this->dispatch('success', 'Application deleted.');
 
-            return redirect()->route('project.service.configuration', $this->parameters);
+            return redirectRoute($this, 'project.service.configuration', $this->parameters);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -462,7 +473,7 @@ class Index extends Component
                 $serviceApplication->delete();
             });
 
-            return redirect()->route('project.service.configuration', $redirectParams);
+            return redirectRoute($this, 'project.service.configuration', $redirectParams);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -491,6 +502,10 @@ class Index extends Component
     public function submitApplication()
     {
         try {
+            $persistedApplication = $this->serviceApplication->fresh();
+            $previousEditableUrls = $persistedApplication->url;
+            $previousFqdn = $persistedApplication->fqdn;
+            $previousPortOverrides = $persistedApplication->domain_port_overrides;
             $this->authorize('update', $this->serviceApplication);
             $this->validate([
                 'fqdn' => ValidationPatterns::applicationDomainRules(),
@@ -520,28 +535,21 @@ class Index extends Component
                 $requiredPort = $this->serviceApplication->getRequiredPort();
 
                 if ($requiredPort !== null) {
-                    $fqdns = str($this->fqdn)->trim()->explode(',');
-                    $missingPort = false;
-
-                    foreach ($fqdns as $fqdn) {
-                        $fqdn = trim($fqdn);
-                        if (empty($fqdn)) {
+                    foreach (str($this->fqdn)->trim()->explode(',') as $fqdn) {
+                        $fqdn = trim((string) $fqdn);
+                        if ($fqdn === '') {
                             continue;
                         }
 
-                        $port = ServiceApplication::extractPortFromUrl($fqdn);
-                        if ($port === null) {
-                            $missingPort = true;
-                            break;
+                        if ($this->serviceApplication->portRequiresConfirmation($fqdn, $requiredPort, $previousEditableUrls)) {
+                            $this->requiredPort = $requiredPort;
+                            $this->showPortWarningModal = true;
+                            $this->serviceApplication->fqdn = $previousFqdn;
+                            $this->serviceApplication->domain_port_overrides = $previousPortOverrides;
+
+                            return;
                         }
                     }
-
-                    if ($missingPort) {
-                        $this->requiredPort = $requiredPort;
-                        $this->showPortWarningModal = true;
-
-                        return;
-                    }
                 }
             } else {
                 $this->forceRemovePort = false;
diff --git a/app/Livewire/Project/Service/Status.php b/app/Livewire/Project/Service/Status.php
index 192d7ca804..27919f1ae7 100644
--- a/app/Livewire/Project/Service/Status.php
+++ b/app/Livewire/Project/Service/Status.php
@@ -10,6 +10,13 @@ class Status extends Component
 {
     public Service $service;
 
+    public ?string $selectedResourceUuid = null;
+
+    public function mount(): void
+    {
+        $this->selectedResourceUuid = request()->route('stack_service_uuid');
+    }
+
     public function getListeners(): array
     {
         $teamId = auth()->user()->currentTeam()->id;
@@ -27,6 +34,11 @@ class Status extends Component
 
     public function render(): View
     {
-        return view('livewire.project.service.status');
+        $selectedResource = $this->selectedResourceUuid
+            ? $this->service->applications->firstWhere('uuid', $this->selectedResourceUuid)
+                ?? $this->service->databases->firstWhere('uuid', $this->selectedResourceUuid)
+            : null;
+
+        return view('livewire.project.service.status', compact('selectedResource'));
     }
 }
diff --git a/app/Livewire/Project/Service/Storage.php b/app/Livewire/Project/Service/Storage.php
index 6880b5ab09..10079276f2 100644
--- a/app/Livewire/Project/Service/Storage.php
+++ b/app/Livewire/Project/Service/Storage.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Service;
 
+use App\Livewire\Project\Shared\Storages\All as StorageList;
 use App\Models\Application;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
@@ -51,7 +52,7 @@ class Storage extends Component
 
         return [
             "echo-private:team.{$teamId},FileStorageChanged" => 'refreshStoragesFromEvent',
-            'refreshStorages',
+            'storageCountsChanged' => 'refreshStorages',
             'addNewVolume',
         ];
     }
@@ -88,11 +89,17 @@ class Storage extends Component
 
     public function refreshStorages()
     {
+        $hadVolumes = $this->cachedVolumeCount > 0;
+
         // Avoid loading full volume models onto this parent (child All owns that snapshot).
         $this->resource->unsetRelation('persistentStorages');
         $this->loadVolumeCount();
         $this->loadFileStorageMetaCounts();
         $this->loadFileStorageForActiveTab();
+
+        if ($this->activeTab === 'volumes' && $hadVolumes && $this->cachedVolumeCount > 0) {
+            $this->dispatch('refreshVolumeList')->to(StorageList::class);
+        }
     }
 
     public function setActiveTab(string $tab): void
@@ -222,7 +229,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Volume added successfully');
             $this->dispatch('closeStorageModal', 'volume');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -257,7 +263,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'File mount added successfully');
             $this->dispatch('closeStorageModal', 'file');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -292,7 +297,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Host file mount added successfully');
             $this->dispatch('closeStorageModal', 'host-file');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -331,7 +335,6 @@ class Storage extends Component
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Directory mount added successfully');
             $this->dispatch('closeStorageModal', 'directory');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Create.php b/app/Livewire/Project/Service/VolumeBackup/Create.php
index adb1234e69..430e89a2c1 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Create.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Create.php
@@ -99,8 +99,8 @@ class Create extends Component
             $label = str($resource->name)->headline();
             $targets->push(...$resource->persistentStorages()->orderBy('name')->get()->map(fn (LocalPersistentVolume $volume): array => [
                 'key' => 'volume:'.$volume->id,
-                'type' => 'Volume · '.$label,
-                'name' => $volume->name,
+                'type' => $label,
+                'name' => str($volume->name)->after($this->service->uuid.'_')->value(),
             ]));
             $targets->push(...$resource->fileStorages()
                 ->where('is_directory', true)
@@ -109,8 +109,8 @@ class Create extends Component
                 ->get()
                 ->map(fn (LocalFileVolume $directory): array => [
                     'key' => 'directory:'.$directory->id,
-                    'type' => 'Directory · '.$label,
-                    'name' => $directory->fs_path,
+                    'type' => $label,
+                    'name' => $directory->fs_path.' (directory)',
                 ]));
         }
 
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index 49da9e21f4..e856d1373a 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -2,11 +2,14 @@
 
 namespace App\Livewire\Project\Service\VolumeBackup;
 
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledVolumeBackup;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -20,14 +23,70 @@ class Index extends Component
 
     public string $search = '';
 
-    protected $listeners = ['refreshVolumeBackups' => '$refresh'];
+    public bool $scheduleModalOpen = false;
 
-    public function mount(): void
+    public ?ScheduledDatabaseBackup $selectedDatabaseBackup = null;
+
+    public ?ScheduledVolumeBackup $selectedVolumeBackup = null;
+
+    public ?Collection $s3s = null;
+
+    public function getListeners(): array
     {
-        $this->service = $this->findService();
+        $teamId = currentTeam()->id;
+
+        return [
+            'refreshVolumeBackups' => '$refresh',
+            'modalClosed' => 'closeScheduleModal',
+            "echo-private:team.{$teamId},BackupCreated" => '$refresh',
+        ];
+    }
+
+    public function mount(?Service $service = null): void
+    {
+        $this->service = $service ?? $this->findService();
         $this->authorize('view', $this->service);
         $this->parameters = get_route_parameters();
         $this->search = request()->string('search')->toString();
+
+    }
+
+    public function openSchedule(string $backupUuid): void
+    {
+        $this->loadSelectedSchedule($backupUuid);
+        $this->s3s = currentTeam()->s3s;
+        $this->scheduleModalOpen = true;
+    }
+
+    public function closeScheduleModal(): void
+    {
+        $this->scheduleModalOpen = false;
+        $this->selectedDatabaseBackup = null;
+        $this->selectedVolumeBackup = null;
+    }
+
+    public function backupNow(string $type, string $backupUuid): void
+    {
+        try {
+            if ($type === 'database') {
+                $this->loadSelectedSchedule($backupUuid);
+                abort_unless($this->selectedDatabaseBackup, 404);
+                $this->authorize('manageBackups', $this->selectedDatabaseBackup->database);
+                DatabaseBackupJob::dispatch($this->selectedDatabaseBackup);
+            } else {
+                abort_unless($type === 'storage', 404);
+                $this->loadSelectedSchedule($backupUuid);
+                abort_unless($this->selectedVolumeBackup, 404);
+                $this->authorize('update', $this->selectedVolumeBackup->targetResource());
+                VolumeBackupJob::dispatch($this->selectedVolumeBackup);
+            }
+
+            $this->selectedDatabaseBackup = null;
+            $this->selectedVolumeBackup = null;
+            $this->dispatch('success', 'Backup queued.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function render(): View
@@ -68,4 +127,24 @@ class Index extends Component
             ->where('uuid', request()->route('service_uuid'))
             ->firstOrFail();
     }
+
+    private function loadSelectedSchedule(string $backupUuid): void
+    {
+        $this->selectedDatabaseBackup = ScheduledDatabaseBackup::query()
+            ->with('database')
+            ->whereUuid($backupUuid)
+            ->where('database_type', (new ServiceDatabase)->getMorphClass())
+            ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
+            ->first();
+
+        if ($this->selectedDatabaseBackup) {
+            return;
+        }
+
+        $this->selectedVolumeBackup = ScheduledVolumeBackup::query()
+            ->with('backupable.resource')
+            ->whereUuid($backupUuid)
+            ->forService($this->service)
+            ->firstOrFail();
+    }
 }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Show.php b/app/Livewire/Project/Service/VolumeBackup/Show.php
index eec60497f7..10abeb3bf4 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Show.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Show.php
@@ -20,7 +20,7 @@ class Show extends Component
 
     public string $section = 'general';
 
-    public function mount(): void
+    public function mount(): mixed
     {
         $project = currentTeam()->projects()->where('uuid', request()->route('project_uuid'))->firstOrFail();
         $environment = $project->environments()->where('uuid', request()->route('environment_uuid'))->firstOrFail();
@@ -43,6 +43,10 @@ class Show extends Component
             'project.service.volume-backups.danger' => 'danger',
             default => 'general',
         };
+
+        $routeParameters = collect($this->parameters)->except('backup_uuid')->all();
+
+        return redirect()->route('project.service.volume-backups.index', $routeParameters);
     }
 
     public function render(): View
diff --git a/app/Livewire/Project/Shared/Danger.php b/app/Livewire/Project/Shared/Danger.php
index 7f0d3b173e..d2420a029f 100644
--- a/app/Livewire/Project/Shared/Danger.php
+++ b/app/Livewire/Project/Shared/Danger.php
@@ -106,14 +106,13 @@ class Danger extends Component
 
         try {
             $this->authorize('delete', $this->resource);
-            $this->resource->delete();
             DeleteResourceJob::dispatch(
                 $this->resource,
                 $this->delete_volumes,
                 $this->delete_connected_networks,
                 $this->delete_configurations,
                 $this->docker_cleanup
-            );
+            )->afterResponse();
 
             return redirectRoute($this, 'project.resource.index', [
                 'project_uuid' => $this->projectUuid,
diff --git a/app/Livewire/Project/Shared/Destination.php b/app/Livewire/Project/Shared/Destination.php
index 94fb4b4eb3..9262b9847e 100644
--- a/app/Livewire/Project/Shared/Destination.php
+++ b/app/Livewire/Project/Shared/Destination.php
@@ -64,6 +64,13 @@ class Destination extends Component
             $this->authorize('deploy', $this->resource);
             $server = Server::ownedByCurrentTeam()->findOrFail($serverId);
             StopApplicationOneServer::run($this->resource, $server);
+            auditLog('ui.application.destination_stopped', [
+                'team_id' => $this->resource->team()?->id,
+                'application_uuid' => $this->resource->uuid,
+                'application_name' => $this->resource->name,
+                'server_uuid' => $server->uuid,
+                'server_name' => $server->name,
+            ]);
             $this->refreshServers();
         } catch (\Exception $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Add.php b/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
index 1dcb7c7810..15b4410a5f 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Add.php
@@ -9,14 +9,27 @@ use App\Models\Server;
 use App\Models\Service;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
+use App\Traits\HasSecretManagerAutocomplete;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
 
 class Add extends Component
 {
-    use AuthorizesRequests, EnvironmentVariableAnalyzer;
+    use AuthorizesRequests, EnvironmentVariableAnalyzer, HasSecretManagerAutocomplete;
+
+    protected function secretManagerResource(): ?Model
+    {
+        if ($this->shared || ! $this->resource) {
+            return null;
+        }
+
+        return $this->resource;
+    }
+
+    public $resource;
 
     public $parameters;
 
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index db80cff801..fea181395c 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared\EnvironmentVariable;
 
+use App\Events\ApplicationConfigurationChanged;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
@@ -12,7 +13,9 @@ use App\Models\SharedEnvironmentVariable;
 use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
 use App\Traits\EnvironmentVariableProtection;
+use App\Traits\HasSecretManagerAutocomplete;
 use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Database\Eloquent\Model;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
@@ -21,7 +24,12 @@ class Show extends Component
 {
     public bool $showEnvironmentType = true;
 
-    use AuthorizesRequests, EnvironmentVariableAnalyzer, EnvironmentVariableProtection;
+    use AuthorizesRequests, EnvironmentVariableAnalyzer, EnvironmentVariableProtection, HasSecretManagerAutocomplete;
+
+    protected function secretManagerResource(): ?Model
+    {
+        return $this->isSharedVariable ? null : $this->env->resourceable;
+    }
 
     public $parameters;
 
@@ -144,6 +152,8 @@ class Show extends Component
      */
     public function loadValues(): void
     {
+        $this->authorize('update', $this->env);
+
         if ($this->valuesLoaded) {
             return;
         }
@@ -177,7 +187,8 @@ class Show extends Component
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
+
     {
         if ($toModel) {
             $this->key = ValidationPatterns::normalizeEnvironmentVariableKey($this->key);
@@ -314,6 +325,10 @@ class Show extends Component
             $this->dispatch('success', 'Environment variable updated.');
             $this->dispatch('envsUpdated');
             $this->dispatch('configurationChanged');
+
+            if ($this->is_required && $this->resource instanceof Service) {
+                event(new ApplicationConfigurationChanged($this->resource->team()->id));
+            }
         } catch (\Exception $e) {
             return handleError($e);
         }
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index 67a040ef77..e1e5413719 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -17,12 +17,15 @@ use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Process;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class GetLogs extends Component
 {
+    use AuthorizesRequests;
+
     public const MAX_LOG_LINES = 50000;
 
     public const MAX_DISPLAY_SIZE_BYTES = 5 * 1024 * 1024;
@@ -82,6 +85,10 @@ class GetLogs extends Component
     public function instantSave()
     {
         if (! is_null($this->resource)) {
+            if (auth()->user()->cannot('update', $this->resource)) {
+                return;
+            }
+
             if ($this->resource->getMorphClass() === Application::class) {
                 $this->resource->settings->is_include_timestamps = $this->showTimeStamps;
                 $this->resource->settings->save();
diff --git a/app/Livewire/Project/Shared/HealthChecks.php b/app/Livewire/Project/Shared/HealthChecks.php
index 6a128a1426..70633fe030 100644
--- a/app/Livewire/Project/Shared/HealthChecks.php
+++ b/app/Livewire/Project/Shared/HealthChecks.php
@@ -86,7 +86,7 @@ class HealthChecks extends Component
         }
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Shared/ResourceOperations.php b/app/Livewire/Project/Shared/ResourceOperations.php
index dd00be25cc..61b4b2d2ed 100644
--- a/app/Livewire/Project/Shared/ResourceOperations.php
+++ b/app/Livewire/Project/Shared/ResourceOperations.php
@@ -86,6 +86,14 @@ class ResourceOperations extends Component
             if (! $server->canHostResources()) {
                 return $this->addError('destination_id', 'The selected server cannot host resources.');
             }
+            auditLog('ui.resource.clone_started', [
+                'team_id' => $this->resource->team()?->id,
+                'resource_uuid' => $this->resource->uuid,
+                'resource_name' => $this->resource->name,
+                'resource_type' => class_basename($this->resource),
+                'destination_uuid' => $new_destination->uuid,
+                'environment_id' => $new_environment->id,
+            ]);
 
             if ($this->resource->getMorphClass() === Application::class) {
                 $new_resource = clone_application($this->resource, $new_destination, [
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index 61bc6b0fbc..f170a0a6f0 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -102,7 +102,7 @@ class Add extends Component
         }
     }
 
-    public function saveScheduledTask()
+    private function saveScheduledTask(): mixed
     {
         try {
             $task = new ScheduledTask;
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 11df001531..c121f1b93b 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -87,7 +87,7 @@ class Show extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -169,9 +169,9 @@ class Show extends Component
             $this->task->delete();
 
             if ($this->type === 'application') {
-                return redirect()->route('project.application.scheduled-tasks.show', $this->parameters);
+                return redirectRoute($this, 'project.application.scheduled-tasks.show', $this->parameters);
             } else {
-                return redirect()->route('project.service.scheduled-tasks.show', $this->parameters);
+                return redirectRoute($this, 'project.service.scheduled-tasks.show', $this->parameters);
             }
         } catch (\Exception $e) {
             return handleError($e);
@@ -184,6 +184,13 @@ class Show extends Component
             $this->authorize('update', $this->resource);
             $this->authorize('update', $this->task);
             ScheduledTaskJob::dispatch($this->task);
+            auditLog('ui.scheduled_task.executed', [
+                'team_id' => $this->resource->team()?->id,
+                'resource_uuid' => $this->resource->uuid,
+                'resource_name' => $this->resource->name,
+                'scheduled_task_uuid' => $this->task->uuid,
+                'scheduled_task_name' => $this->task->name,
+            ]);
             $this->dispatch('success', 'Scheduled task executed.');
         } catch (\Exception $e) {
             return handleError($e);
diff --git a/app/Livewire/Project/Shared/SecretManagerLinks.php b/app/Livewire/Project/Shared/SecretManagerLinks.php
new file mode 100644
index 0000000000..c0641b56c5
--- /dev/null
+++ b/app/Livewire/Project/Shared/SecretManagerLinks.php
@@ -0,0 +1,290 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Models\IntegrationToken;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+/**
+ * Manages a resource's single secret manager source and lets the user
+ * browse remote key names, add {{vault.KEY}} reference variables, and import
+ * all missing keys. Secret values never enter the component state or the DB.
+ */
+class SecretManagerLinks extends Component
+{
+    use AuthorizesRequests;
+
+    public $resource;
+
+    public $link;
+
+    public $availableTokens;
+
+    public string $integration_token_uuid = '';
+
+    public array $settings = [];
+
+    /** @var list<string> Remote key names only — values are never stored. */
+    public array $keys = [];
+
+    public bool $keysLoaded = false;
+
+    public string $search = '';
+
+    public function mount(): void
+    {
+        $this->loadData();
+    }
+
+    private function loadData(): void
+    {
+        $this->link = $this->resource->secretManagerLink()->with('integrationToken')->first();
+        $this->availableTokens = IntegrationToken::ownedByCurrentTeam()
+            ->whereIn('provider', IntegrationToken::SECRET_MANAGER_PROVIDERS)
+            ->get()
+            ->filter(fn (IntegrationToken $token) => in_array('secrets', $token->capabilities ?? [], true))
+            ->values();
+
+        if ($this->link) {
+            $this->integration_token_uuid = $this->link->integrationToken->uuid;
+            $this->settings = $this->link->settings ?? [];
+        }
+    }
+
+    public function getSelectedTokenProperty(): ?IntegrationToken
+    {
+        if (blank($this->integration_token_uuid)) {
+            return null;
+        }
+
+        return $this->availableTokens->firstWhere('uuid', $this->integration_token_uuid);
+    }
+
+    protected function rules(): array
+    {
+        $rules = [
+            'integration_token_uuid' => ['required', 'string'],
+        ];
+
+        $rules += match ($this->selectedToken?->provider) {
+            'doppler' => $this->selectedToken->dopplerTokenType() === 'service_account'
+                ? [
+                    'settings.project' => ['required', 'string'],
+                    'settings.config' => ['required', 'string'],
+                ]
+                : [],
+            'infisical' => [
+                'settings.project_id' => ['required', 'string'],
+                'settings.environment' => ['required', 'string'],
+                'settings.secret_path' => ['nullable', 'string'],
+            ],
+            'vault' => [
+                'settings.mount' => ['required', 'string'],
+                'settings.path' => ['required', 'string'],
+            ],
+            default => [],
+        };
+
+        return $rules;
+    }
+
+    /**
+     * Auto-save when a token is selected in the dropdown. Existing {{vault.*}}
+     * references are intentionally NOT re-checked — missing keys surface at
+     * the next deployment.
+     */
+    public function updatedIntegrationTokenUuid(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $token = $this->selectedToken;
+
+            if (! $token) {
+                return;
+            }
+
+            if ($this->link?->integrationToken?->provider !== $token->provider
+                || $this->link?->integrationToken?->dopplerTokenType() !== $token->dopplerTokenType()) {
+                $this->settings = [];
+            }
+
+            $settings = array_filter($this->settings, fn ($value) => filled($value));
+
+            $this->resource->secretManagerLink()->updateOrCreate([], [
+                'integration_token_id' => $token->id,
+                'settings' => $settings ?: null,
+            ]);
+            $this->auditSecretManagerAction('source_updated', [
+                'integration_token_uuid' => $token->uuid,
+                'provider' => $token->provider,
+            ]);
+
+            $this->resetKeys();
+            $this->loadData();
+            $this->dispatch('success', 'Secret manager source saved. References resolve at the next deployment.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    /**
+     * Auto-save of the provider-specific settings fields (called on blur).
+     */
+    public function saveSettings(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->link) {
+            return;
+        }
+
+        $validated = $this->validate();
+
+        try {
+
+            $settings = array_filter(data_get($validated, 'settings', []), fn ($value) => filled($value));
+
+            $this->link->update(['settings' => $settings ?: null]);
+            $this->auditSecretManagerAction('settings_updated');
+            $this->resetKeys();
+            $this->loadData();
+            $this->dispatch('success', 'Secret manager settings saved.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function removeSource(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+            $token = $this->link?->integrationToken;
+            $this->resource->secretManagerLink()->delete();
+            $this->auditSecretManagerAction('source_removed', [
+                'integration_token_uuid' => $token?->uuid,
+                'provider' => $token?->provider,
+            ]);
+            $this->link = null;
+            $this->integration_token_uuid = '';
+            $this->settings = [];
+            $this->resetKeys();
+            $this->loadData();
+            $this->dispatch('success', 'Secret manager source removed. Existing {{vault.*}} references will fail the next deployment until they are removed too.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function loadKeys(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            if (! $this->link) {
+                return;
+            }
+
+            // Values are fetched into memory, reduced to key names, and discarded.
+            $keys = array_keys($this->link->fetchSecrets());
+            sort($keys);
+            $this->keys = $keys;
+            $this->keysLoaded = true;
+            $this->auditSecretManagerAction('keys_viewed', ['key_count' => count($keys)]);
+        } catch (\Throwable $e) {
+            $this->dispatch('error', 'Could not fetch keys: '.$e->getMessage());
+        }
+    }
+
+    public function addReference(string $key): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            if (! in_array($key, $this->keys, true)) {
+                return;
+            }
+
+            if ($this->resource->environment_variables()->where('key', $key)->exists()) {
+                $this->dispatch('error', "A variable with the key {$key} already exists.");
+
+                return;
+            }
+
+            $this->resource->environment_variables()->create([
+                'key' => $key,
+                'value' => '{{vault.'.$key.'}}',
+            ]);
+            $this->auditSecretManagerAction('reference_created', ['secret_key' => $key]);
+
+            $this->dispatch('refreshEnvs');
+            $this->dispatch('success', "Added {$key} as {{vault.{$key}}}.");
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function importAll(): void
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            if (! $this->link) {
+                return;
+            }
+
+            $imported = $this->link->importMissingReferences();
+            $this->auditSecretManagerAction('references_imported', [
+                'key_count' => count($imported),
+                'secret_keys' => $imported,
+            ]);
+
+            $this->dispatch('refreshEnvs');
+            $this->dispatch('success', $imported === []
+                ? 'All remote keys already exist as variables.'
+                : 'Imported '.count($imported).' keys as {{vault.KEY}} references.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    private function resetKeys(): void
+    {
+        $this->keys = [];
+        $this->keysLoaded = false;
+        $this->search = '';
+    }
+
+    /** @param array<string, mixed> $context */
+    private function auditSecretManagerAction(string $action, array $context = []): void
+    {
+        $resourceType = str(class_basename($this->resource))->snake()->value();
+
+        auditLog("ui.{$resourceType}.secret_manager.{$action}", array_merge([
+            'team_id' => $this->resource->team()?->id,
+            "{$resourceType}_uuid" => $this->resource->uuid,
+            "{$resourceType}_name" => $this->resource->name,
+        ], $context));
+    }
+
+    public function getFilteredKeysProperty(): array
+    {
+        if (blank($this->search)) {
+            return $this->keys;
+        }
+
+        return array_values(array_filter(
+            $this->keys,
+            fn (string $key) => stripos($key, $this->search) !== false,
+        ));
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.shared.secret-manager-links', [
+            'selectedToken' => $this->selectedToken,
+            'filteredKeys' => $this->filteredKeys,
+        ]);
+    }
+}
diff --git a/app/Livewire/Project/Shared/Storages/All.php b/app/Livewire/Project/Shared/Storages/All.php
index efe54a6a7d..3dadfb46f4 100644
--- a/app/Livewire/Project/Shared/Storages/All.php
+++ b/app/Livewire/Project/Shared/Storages/All.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared\Storages;
 
+use App\Livewire\Project\Service\Storage as StorageComponent;
 use App\Models\Application;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
@@ -44,7 +45,7 @@ class All extends Component
 
     public bool $deleteDockerVolume = false;
 
-    protected $listeners = ['refreshStorages' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
+    protected $listeners = ['refreshVolumeList' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
 
     public function mount(): void
     {
@@ -182,7 +183,7 @@ class All extends Component
 
         $storage->delete();
         $this->refreshList();
-        $this->dispatch('refreshStorages');
+        $this->dispatch('storageCountsChanged')->to(StorageComponent::class);
         $this->dispatch('configurationChanged');
 
         return true;
diff --git a/app/Livewire/Project/Shared/Storages/Show.php b/app/Livewire/Project/Shared/Storages/Show.php
deleted file mode 100644
index 7e1e2dec1d..0000000000
--- a/app/Livewire/Project/Shared/Storages/Show.php
+++ /dev/null
@@ -1,200 +0,0 @@
-<?php
-
-namespace App\Livewire\Project\Shared\Storages;
-
-use App\Models\Application;
-use App\Models\LocalPersistentVolume;
-use App\Models\ScheduledVolumeBackup;
-use App\Support\ValidationPatterns;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Attributes\On;
-use Livewire\Component;
-
-class Show extends Component
-{
-    use AuthorizesRequests;
-
-    public LocalPersistentVolume $storage;
-
-    public $resource;
-
-    public bool $isReadOnly = false;
-
-    public bool $isFirst = true;
-
-    public bool $isService = false;
-
-    public ?string $startedAt = null;
-
-    public bool $supportsPreviewSuffix = false;
-
-    // Explicit properties
-    public string $name;
-
-    public string $mountPath;
-
-    public ?string $hostPath = null;
-
-    public bool $isPreviewSuffixEnabled = true;
-
-    public bool $hasEnabledBackup = false;
-
-    public ?string $backupUrl = null;
-
-    /**
-     * When true, parent already batched badge/url data — skip per-row queries on mount.
-     */
-    public bool $backupMetaHydrated = false;
-
-    /** When true, the Backup Configure Livewire modal is mounted (lazy). */
-    public bool $showBackupModal = false;
-
-    protected $validationAttributes = [
-        'name' => 'name',
-        'mountPath' => 'mount',
-        'hostPath' => 'host',
-    ];
-
-    protected function rules(): array
-    {
-        return [
-            'name' => ValidationPatterns::volumeNameRules(),
-            'mountPath' => ['required', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
-            'hostPath' => ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
-            'isPreviewSuffixEnabled' => 'required|boolean',
-        ];
-    }
-
-    protected function messages(): array
-    {
-        return array_merge(
-            ValidationPatterns::volumeNameMessages(),
-            [
-                'mountPath.regex' => 'Mount path must start with / and only contain safe path characters.',
-                'hostPath.regex' => 'Host path must start with / and only contain safe path characters.',
-            ]
-        );
-    }
-
-    /**
-     * Sync data between component properties and model
-     *
-     * @param  bool  $toModel  If true, sync FROM properties TO model. If false, sync FROM model TO properties.
-     */
-    private function syncData(bool $toModel = false): void
-    {
-        if ($toModel) {
-            // Sync TO model (before save)
-            $this->storage->name = $this->name;
-            $this->storage->mount_path = $this->mountPath;
-            $this->storage->host_path = $this->hostPath;
-            $this->storage->is_preview_suffix_enabled = $this->isPreviewSuffixEnabled;
-        } else {
-            // Sync FROM model (on load/refresh)
-            $this->name = $this->storage->name;
-            $this->mountPath = $this->storage->mount_path;
-            $this->hostPath = $this->storage->host_path;
-            $this->isPreviewSuffixEnabled = $this->storage->is_preview_suffix_enabled ?? true;
-        }
-    }
-
-    public function mount(): void
-    {
-        $this->syncData(false);
-        $this->isReadOnly = $this->storage->shouldBeReadOnlyInUI();
-        // PR deployment volume suffixes only apply to git-based applications.
-        $this->supportsPreviewSuffix = $this->resource instanceof Application
-            && $this->resource->git_based()
-            && filled($this->resource->git_repository)
-            && ! $this->isService;
-        // Parent All batches badge/url; isolated embeds still hydrate themselves.
-        if (! $this->backupMetaHydrated) {
-            $this->refreshBackupStatus();
-        }
-    }
-
-    #[On('refreshVolumeBackups')]
-    public function refreshBackupStatus(): void
-    {
-        $backup = $this->storage->scheduledBackups()->first();
-
-        $this->hasEnabledBackup = $backup?->enabled ?? false;
-        $this->backupUrl = null;
-
-        if (! $this->hasEnabledBackup || ! $this->resource instanceof Application) {
-            return;
-        }
-
-        $this->resource->loadMissing('environment.project');
-
-        $parameters = [
-            'project_uuid' => $this->resource->project()->uuid,
-            'environment_uuid' => $this->resource->environment->uuid,
-            'application_uuid' => $this->resource->uuid,
-        ];
-        $hasOtherBackups = ScheduledVolumeBackup::query()
-            ->forApplication($this->resource)
-            ->where('id', '!=', $backup->id)
-            ->exists();
-
-        $this->backupUrl = $hasOtherBackups
-            ? route('project.application.backup.index', [...$parameters, 'search' => $this->storage->name])
-            : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
-    }
-
-    public function openBackupModal(): void
-    {
-        $this->authorize('update', $this->resource);
-        $this->showBackupModal = true;
-    }
-
-    #[On('modalClosed')]
-    public function onModalClosed(): void
-    {
-        // Drop the nested Create component from the DOM after close to free snapshot weight.
-        if ($this->showBackupModal) {
-            $this->showBackupModal = false;
-        }
-    }
-
-    public function instantSave(): void
-    {
-        $this->authorize('update', $this->resource);
-        $this->validate();
-
-        $this->syncData(true);
-        $this->storage->save();
-        $this->dispatch('success', 'Storage updated successfully');
-    }
-
-    public function submit()
-    {
-        $this->authorize('update', $this->resource);
-
-        $this->validate();
-        $this->syncData(true);
-        $this->storage->save();
-        $this->dispatch('success', 'Storage updated successfully');
-    }
-
-    public function delete($password, $selectedActions = [])
-    {
-        $this->authorize('update', $this->resource);
-
-        if (! verifyPasswordConfirmation($password, $this)) {
-            return 'The provided password is incorrect.';
-        }
-
-        if ($this->storage->scheduledBackups()->exists()) {
-            $this->dispatch('error', 'Delete this volume backup schedule and its archives before deleting the volume.');
-
-            return false;
-        }
-
-        $this->storage->delete();
-        $this->dispatch('refreshStorages');
-        $this->dispatch('configurationChanged');
-
-        return true;
-    }
-}
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index a10eb5ad03..ef7b36ff72 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -204,6 +204,12 @@ class VolumeBackups extends Component
         }
 
         VolumeBackupJob::dispatch($this->backup);
+        auditLog('ui.volume_backup.started', [
+            'team_id' => $this->resource->team()?->id,
+            'resource_uuid' => $this->resource->uuid,
+            'resource_name' => $this->resource->name,
+            'backup_uuid' => $this->backup->uuid,
+        ]);
         $this->dispatch('success', 'Storage backup queued.');
 
         return redirect()->route($this->routeName('executions'), $this->routeParameters());
diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index 5a978ac84f..a1cc4db19f 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -140,6 +140,12 @@ class ApiTokens extends Component
             ]);
             $expiresAt = $this->expiresInDays ? now()->addDays($this->expiresInDays) : null;
             $token = auth()->user()->createToken($this->description, array_values($this->permissions), $expiresAt);
+            auditLog('ui.api_token.created', [
+                'team_id' => currentTeam()->id,
+                'api_token_name' => $this->description,
+                'abilities' => array_values($this->permissions),
+                'expires_at' => $expiresAt?->toIso8601String(),
+            ]);
             $this->getTokens();
             // Do NOT strip the numeric prefix (e.g. "69|...") — Sanctum uses it to index and look up tokens.
             session()->flash('token', $token->plainTextToken);
@@ -156,7 +162,12 @@ class ApiTokens extends Component
                 ->where('id', $id)
                 ->firstOrFail();
             $this->authorize('delete', $token);
+            $tokenName = $token->name;
             $token->delete();
+            auditLog('ui.api_token.revoked', [
+                'team_id' => currentTeam()->id,
+                'api_token_name' => $tokenName,
+            ]);
             $this->getTokens();
         } catch (\Exception $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Security/CloudInitScripts.php b/app/Livewire/Security/CloudInitScripts.php
index b6d448e903..0d26d1d669 100644
--- a/app/Livewire/Security/CloudInitScripts.php
+++ b/app/Livewire/Security/CloudInitScripts.php
@@ -28,6 +28,8 @@ class CloudInitScripts extends Component
 
     public function loadScripts()
     {
+        $this->authorize('viewAny', CloudInitScript::class);
+
         CloudInitScript::ownedByCurrentTeam()
             ->whereNull('uuid')
             ->get()
diff --git a/app/Livewire/Security/CloudProviderTokenForm.php b/app/Livewire/Security/CloudProviderTokenForm.php
index ba2655b434..2c31d22035 100644
--- a/app/Livewire/Security/CloudProviderTokenForm.php
+++ b/app/Livewire/Security/CloudProviderTokenForm.php
@@ -94,6 +94,7 @@ class CloudProviderTokenForm extends Component
 
     public function addToken()
     {
+        $this->authorize('create', CloudProviderToken::class);
         $this->validate();
 
         try {
diff --git a/app/Livewire/Security/IntegrationTokenEditor.php b/app/Livewire/Security/IntegrationTokenEditor.php
index 453a7e8ae8..2a33591822 100644
--- a/app/Livewire/Security/IntegrationTokenEditor.php
+++ b/app/Livewire/Security/IntegrationTokenEditor.php
@@ -3,7 +3,7 @@
 namespace App\Livewire\Security;
 
 use App\Models\IntegrationToken;
-use App\Services\CloudflareTokenValidator;
+use App\Services\IntegrationTokenValidator;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -19,6 +19,8 @@ class IntegrationTokenEditor extends Component
 
     public array $capabilities = [];
 
+    public array $metadata = [];
+
     public function mount(string $integration_token_uuid): void
     {
         $this->integrationToken = IntegrationToken::ownedByCurrentTeam()
@@ -29,16 +31,31 @@ class IntegrationTokenEditor extends Component
 
         $this->name = $this->integrationToken->name;
         $this->capabilities = $this->integrationToken->capabilities;
+        $this->metadata = $this->integrationToken->metadata ?? [];
     }
 
     protected function rules(): array
     {
-        return [
+        $allowedCapability = $this->integrationToken->provider === 'cloudflare' ? 'dns' : 'secrets';
+
+        $rules = [
             'name' => ['required', 'string', 'max:255'],
             'newToken' => ['nullable', 'string'],
             'capabilities' => ['required', 'array', 'min:1'],
-            'capabilities.*' => ['required', 'in:dns'],
+            'capabilities.*' => ['required', 'in:'.$allowedCapability],
         ];
+
+        if ($this->integrationToken->provider === 'infisical') {
+            $rules['metadata.base_url'] = ['required', 'url'];
+            $rules['metadata.client_id'] = ['required', 'string'];
+        }
+
+        if ($this->integrationToken->provider === 'vault') {
+            $rules['metadata.base_url'] = ['required', 'url'];
+            $rules['metadata.namespace'] = ['nullable', 'string'];
+        }
+
+        return $rules;
     }
 
     protected function messages(): array
@@ -49,18 +66,21 @@ class IntegrationTokenEditor extends Component
         ];
     }
 
-    public function save(CloudflareTokenValidator $validator): void
+    public function save(IntegrationTokenValidator $validator): void
     {
         $this->authorize('update', $this->integrationToken);
         $validated = $this->validate();
+        $provider = $this->integrationToken->provider;
         $token = filled($validated['newToken']) ? $validated['newToken'] : $this->integrationToken->token;
+        $metadata = array_filter(data_get($validated, 'metadata', []), fn ($value) => filled($value));
         $capabilitiesChanged = collect($validated['capabilities'])->sort()->values()->all()
             !== collect($this->integrationToken->capabilities)->sort()->values()->all();
+        $metadataChanged = $metadata != ($this->integrationToken->metadata ?? []);
 
         try {
-            if ((filled($validated['newToken']) || $capabilitiesChanged)
-                && ! $validator->validate($token, $validated['capabilities'])) {
-                $this->dispatch('error', 'The token could not access the selected Cloudflare capabilities. Check its permissions and zone resources.');
+            if ((filled($validated['newToken']) || $capabilitiesChanged || $metadataChanged)
+                && ! $validator->validate($provider, $token, $validated['capabilities'], $metadata)) {
+                $this->dispatch('error', $validator->errorMessage($provider));
 
                 return;
             }
@@ -68,6 +88,7 @@ class IntegrationTokenEditor extends Component
             $updates = [
                 'name' => $validated['name'],
                 'capabilities' => $validated['capabilities'],
+                'metadata' => $metadata ?: null,
             ];
 
             if (filled($validated['newToken'])) {
@@ -100,8 +121,25 @@ class IntegrationTokenEditor extends Component
     public function delete(string $password = ''): void
     {
         $this->authorize('delete', $this->integrationToken);
+
+        if ($this->integrationToken->secretManagerLinks()->exists()) {
+            $this->dispatch('error', 'This token is used by one or more resources as a secret manager source. Remove those links first.');
+
+            return;
+        }
+
+        $uuid = $this->integrationToken->uuid;
+        $name = $this->integrationToken->name;
+        $provider = $this->integrationToken->provider;
         $this->integrationToken->delete();
 
+        auditLog('ui.integration_token.deleted', [
+            'team_id' => currentTeam()->id,
+            'integration_token_uuid' => $uuid,
+            'integration_token_name' => $name,
+            'provider' => $provider,
+        ]);
+
         $this->dispatch('integration-token-deleted', uuid: $this->integrationToken->uuid);
         $this->dispatch('close-modal');
         $this->dispatch('success', 'Integration token deleted successfully.');
diff --git a/app/Livewire/Security/IntegrationTokenForm.php b/app/Livewire/Security/IntegrationTokenForm.php
index 7a7637bf5e..26ecce1e14 100644
--- a/app/Livewire/Security/IntegrationTokenForm.php
+++ b/app/Livewire/Security/IntegrationTokenForm.php
@@ -3,7 +3,7 @@
 namespace App\Livewire\Security;
 
 use App\Models\IntegrationToken;
-use App\Services\CloudflareTokenValidator;
+use App\Services\IntegrationTokenValidator;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -21,20 +21,53 @@ class IntegrationTokenForm extends Component
 
     public array $capabilities = ['dns'];
 
+    public array $metadata = [];
+
     public function mount(): void
     {
         $this->authorize('create', IntegrationToken::class);
     }
 
+    public function updatedProvider(): void
+    {
+        if ($this->provider === 'cloudflare') {
+            $this->capabilities = ['dns'];
+            $this->metadata = [];
+        } else {
+            $this->capabilities = ['secrets'];
+            $this->metadata = $this->provider === 'infisical'
+                ? ['base_url' => 'https://app.infisical.com']
+                : [];
+        }
+    }
+
     protected function rules(): array
     {
-        return [
-            'provider' => ['required', 'in:cloudflare'],
+        $allowedCapability = $this->provider === 'cloudflare' ? 'dns' : 'secrets';
+
+        $rules = [
+            'provider' => ['required', 'in:'.implode(',', array_keys(IntegrationToken::PROVIDER_NAMES))],
             'name' => ['required', 'string', 'max:255'],
             'token' => ['required', 'string'],
             'capabilities' => ['required', 'array', 'min:1'],
-            'capabilities.*' => ['required', 'in:dns'],
+            'capabilities.*' => ['required', 'in:'.$allowedCapability],
         ];
+
+        if ($this->provider === 'infisical') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.client_id'] = ['required', 'string'];
+        }
+
+        if ($this->provider === 'doppler') {
+            $rules['token'][] = 'regex:/^dp\.(st|sa)\./';
+        }
+
+        if ($this->provider === 'vault') {
+            $rules['metadata.base_url'] = ['required', 'url:http,https'];
+            $rules['metadata.namespace'] = ['nullable', 'string'];
+        }
+
+        return $rules;
     }
 
     protected function messages(): array
@@ -42,25 +75,38 @@ class IntegrationTokenForm extends Component
         return [
             'capabilities.required' => 'Select at least one capability.',
             'capabilities.min' => 'Select at least one capability.',
+            'token.regex' => 'Use a Doppler service token (dp.st.*) or service account token (dp.sa.*).',
         ];
     }
 
-    public function addToken(CloudflareTokenValidator $validator): void
+    public function addToken(IntegrationTokenValidator $validator): void
     {
         $validated = $this->validate();
+        $metadata = array_filter(data_get($validated, 'metadata', []), fn ($value) => filled($value));
 
         try {
-            if (! $validator->validate($validated['token'], $validated['capabilities'])) {
-                $this->dispatch('error', 'The token could not access the selected Cloudflare capabilities. Check its permissions and zone resources.');
+            if (! $validator->validate($validated['provider'], $validated['token'], $validated['capabilities'], $metadata)) {
+                $this->dispatch('error', $validator->errorMessage($validated['provider']));
 
                 return;
             }
 
-            IntegrationToken::query()->create([
-                ...$validated,
+            $integrationToken = IntegrationToken::query()->create([
+                'provider' => $validated['provider'],
+                'name' => $validated['name'],
+                'token' => $validated['token'],
+                'capabilities' => $validated['capabilities'],
+                'metadata' => $metadata ?: null,
                 'team_id' => currentTeam()->id,
             ]);
 
+            auditLog('ui.integration_token.created', [
+                'team_id' => currentTeam()->id,
+                'integration_token_uuid' => $integrationToken->uuid,
+                'integration_token_name' => $integrationToken->name,
+                'provider' => $integrationToken->provider,
+            ]);
+
             $this->reset(['name', 'token']);
             $this->dispatch('integrationTokenAdded')->to(IntegrationTokens::class);
 
diff --git a/app/Livewire/Security/IntegrationTokens.php b/app/Livewire/Security/IntegrationTokens.php
index 39db135b38..71805fb841 100644
--- a/app/Livewire/Security/IntegrationTokens.php
+++ b/app/Livewire/Security/IntegrationTokens.php
@@ -29,7 +29,23 @@ class IntegrationTokens extends Component
     {
         $token = IntegrationToken::ownedByCurrentTeam()->findOrFail($tokenId);
         $this->authorize('delete', $token);
+
+        if ($token->secretManagerLinks()->exists()) {
+            $this->dispatch('error', 'This token is used by one or more resources as a secret manager source. Remove those links first.');
+
+            return;
+        }
+
+        $tokenUuid = $token->uuid;
+        $tokenName = $token->name;
+        $provider = $token->provider;
         $token->delete();
+        auditLog('ui.integration_token.deleted', [
+            'team_id' => currentTeam()->id,
+            'integration_token_uuid' => $tokenUuid,
+            'integration_token_name' => $tokenName,
+            'provider' => $provider,
+        ]);
         $this->loadTokens();
         $this->dispatch('success', 'Integration token deleted successfully.');
     }
diff --git a/app/Livewire/Security/PrivateKey/Index.php b/app/Livewire/Security/PrivateKey/Index.php
index 8b170e6ae0..9a7ff4e979 100644
--- a/app/Livewire/Security/PrivateKey/Index.php
+++ b/app/Livewire/Security/PrivateKey/Index.php
@@ -10,13 +10,38 @@ class Index extends Component
 {
     use AuthorizesRequests;
 
+    public ?string $selectedPrivateKeyUuid = null;
+
     public function getListeners(): array
     {
         return [
             'securityResourceChanged' => '$refresh',
+            'privateKeyCreated' => 'refreshResources',
+            'privateKeyDeleted' => 'refreshResources',
+            'privateKeyUpdated' => 'refreshResources',
+            'modalClosed' => 'closeEditor',
         ];
     }
 
+    public function openEditor(string $privateKeyUuid): void
+    {
+        $privateKey = PrivateKey::ownedByCurrentTeam()->whereUuid($privateKeyUuid)->firstOrFail();
+        $this->authorize('view', $privateKey);
+
+        $this->selectedPrivateKeyUuid = $privateKey->uuid;
+    }
+
+    public function closeEditor(): void
+    {
+        $this->selectedPrivateKeyUuid = null;
+    }
+
+    public function refreshResources(): void
+    {
+        $this->closeEditor();
+        $this->dispatch('close-modal');
+    }
+
     public function generatePrivateKey(string $type)
     {
         try {
diff --git a/app/Livewire/Security/PrivateKey/Show.php b/app/Livewire/Security/PrivateKey/Show.php
index 7fa2300031..1b8f26ff28 100644
--- a/app/Livewire/Security/PrivateKey/Show.php
+++ b/app/Livewire/Security/PrivateKey/Show.php
@@ -76,7 +76,9 @@ class Show extends Component
             // Sync FROM model (on load/refresh)
             $this->name = $this->private_key->name;
             $this->description = $this->private_key->description;
-            $this->privateKeyValue = $this->private_key->private_key;
+            $this->privateKeyValue = auth()->user()->can('update', $this->private_key)
+                ? $this->private_key->private_key
+                : '';
             $this->isGitRelated = $this->private_key->is_git_related;
         }
     }
@@ -92,6 +94,7 @@ class Show extends Component
 
             $this->syncData(false);
             $this->isInUse = $this->private_key->isInUse();
+            $this->public_key = $this->private_key->getPublicKey();
         } catch (AuthorizationException $e) {
             abort(403, 'You do not have permission to view this private key.');
         } catch (\Throwable) {
@@ -99,14 +102,6 @@ class Show extends Component
         }
     }
 
-    public function loadPublicKey()
-    {
-        $this->public_key = $this->private_key->getPublicKey();
-        if ($this->public_key === 'Error loading private key') {
-            $this->dispatch('error', 'Failed to load public key. The private key may be invalid.');
-        }
-    }
-
     public function delete()
     {
         try {
@@ -123,8 +118,7 @@ class Show extends Component
             currentTeam()->privateKeys = PrivateKey::where('team_id', currentTeam()->id)->get();
 
             if ($this->modalMode) {
-                $this->dispatch('securityResourceChanged');
-                $this->dispatch('close-modal');
+                $this->dispatch('privateKeyDeleted');
 
                 return null;
             }
@@ -150,10 +144,12 @@ class Show extends Component
             ]);
             refresh_server_connection($this->private_key);
             $this->dispatch('success', 'Private key updated.');
-            $this->dispatch('securityResourceChanged');
             if ($this->modalMode) {
-                $this->dispatch('close-modal');
+                $this->dispatch('privateKeyUpdated');
+
+                return null;
             }
+            $this->dispatch('securityResourceChanged');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Server/Advanced.php b/app/Livewire/Server/Advanced.php
index a94881b12b..895ce34e79 100644
--- a/app/Livewire/Server/Advanced.php
+++ b/app/Livewire/Server/Advanced.php
@@ -42,10 +42,9 @@ class Advanced extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->concurrent_builds = $this->concurrentBuilds;
             $this->server->settings->dynamic_timeout = $this->dynamicTimeout;
@@ -67,6 +66,7 @@ class Advanced extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
@@ -81,6 +81,7 @@ class Advanced extends Component
                 $this->serverDiskUsageCheckFrequency = $this->server->settings->getOriginal('server_disk_usage_check_frequency');
                 throw new \Exception('Invalid Cron / Human expression for Disk Usage Check Frequency.');
             }
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/DockerCleanup.php b/app/Livewire/Server/DockerCleanup.php
index 12d111d219..d0a8d8ca9d 100644
--- a/app/Livewire/Server/DockerCleanup.php
+++ b/app/Livewire/Server/DockerCleanup.php
@@ -97,10 +97,9 @@ class DockerCleanup extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->force_docker_cleanup = $this->forceDockerCleanup;
             $this->server->settings->docker_cleanup_frequency = $this->dockerCleanupFrequency;
@@ -122,6 +121,7 @@ class DockerCleanup extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
@@ -134,6 +134,13 @@ class DockerCleanup extends Component
         try {
             $this->authorize('update', $this->server);
             DockerCleanupJob::dispatch($this->server, true, $this->deleteUnusedVolumes, $this->deleteUnusedNetworks);
+            auditLog('ui.server.docker_cleanup_started', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'delete_unused_volumes' => $this->deleteUnusedVolumes,
+                'delete_unused_networks' => $this->deleteUnusedNetworks,
+            ]);
             $this->dispatch('success', 'Manual cleanup job started. Depending on the amount of data, this might take a while.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -147,6 +154,7 @@ class DockerCleanup extends Component
                 $this->dockerCleanupFrequency = $this->server->settings->getOriginal('docker_cleanup_frequency');
                 throw new \Exception('Invalid Cron / Human expression for Docker Cleanup Frequency.');
             }
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/LogDrains.php b/app/Livewire/Server/LogDrains.php
index ae53488bd5..9319c856c0 100644
--- a/app/Livewire/Server/LogDrains.php
+++ b/app/Livewire/Server/LogDrains.php
@@ -52,7 +52,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncDataNewRelic(bool $toModel = false)
+    private function syncDataNewRelic(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_newrelic_enabled = $this->isLogDrainNewRelicEnabled;
@@ -65,7 +65,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncDataAxiom(bool $toModel = false)
+    private function syncDataAxiom(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_axiom_enabled = $this->isLogDrainAxiomEnabled;
@@ -78,7 +78,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncDataCustom(bool $toModel = false)
+    private function syncDataCustom(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_custom_enabled = $this->isLogDrainCustomEnabled;
@@ -91,7 +91,7 @@ class LogDrains extends Component
         }
     }
 
-    public function syncData(bool $toModel = false, ?string $type = null)
+    private function syncData(bool $toModel = false, ?string $type = null): void
     {
         if ($toModel) {
             $this->customValidation();
diff --git a/app/Livewire/Server/Navbar.php b/app/Livewire/Server/Navbar.php
index d9f70ea253..242b0971ec 100644
--- a/app/Livewire/Server/Navbar.php
+++ b/app/Livewire/Server/Navbar.php
@@ -101,6 +101,11 @@ class Navbar extends Component
 
             // Always use background job for all servers
             RestartProxyJob::dispatch($this->server);
+            auditLog('ui.proxy.restarted', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+            ]);
 
         } catch (\Throwable $e) {
             $this->restartInitiated = false;
@@ -125,6 +130,11 @@ class Navbar extends Component
         try {
             $this->authorize('manageProxy', $this->server);
             $activity = StartProxy::run($this->server, force: true);
+            auditLog('ui.proxy.started', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+            ]);
             $this->dispatch('activityMonitor', $activity->id);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -136,6 +146,12 @@ class Navbar extends Component
         try {
             $this->authorize('manageProxy', $this->server);
             StopProxy::dispatch($this->server, $forceStop);
+            auditLog('ui.proxy.stopped', [
+                'team_id' => $this->server->team_id,
+                'server_uuid' => $this->server->uuid,
+                'server_name' => $this->server->name,
+                'force' => $forceStop,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 811a01eb19..68cb52a926 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -57,6 +57,7 @@ class Proxy extends Component
         $this->redirectUrl = data_get($this->server, 'proxy.redirect_url');
         $this->syncData(false);
         $this->loadProxyConfiguration();
+        $this->clearAppliedTraefikBranchWarning();
     }
 
     private function syncData(bool $toModel = false): void
@@ -276,6 +277,8 @@ class Proxy extends Component
                 return null;
             }
 
+            $configuredBranch = $this->getConfiguredTraefikBranch();
+
             // Check if we have outdated info stored for this server (faster than computing)
             $outdatedInfo = $this->server->traefik_outdated_info;
             $storedCurrentVersion = ltrim((string) data_get($outdatedInfo, 'current'), 'v');
@@ -283,9 +286,15 @@ class Proxy extends Component
             if ($storedCurrentVersion === $detectedCurrentVersion && data_get($outdatedInfo, 'type') === 'minor_upgrade') {
                 // Use the upgrade_target field if available (e.g., "v3.6")
                 if (isset($outdatedInfo['upgrade_target'])) {
-                    return str_starts_with($outdatedInfo['upgrade_target'], 'v')
+                    $upgradeTarget = str_starts_with($outdatedInfo['upgrade_target'], 'v')
                         ? $outdatedInfo['upgrade_target']
                         : "v{$outdatedInfo['upgrade_target']}";
+
+                    if ($configuredBranch && version_compare($configuredBranch, ltrim($upgradeTarget, 'v'), '>=')) {
+                        return null;
+                    }
+
+                    return $upgradeTarget;
                 }
             }
 
@@ -315,9 +324,53 @@ class Proxy extends Component
                 }
             }
 
-            return $newestBranch ? "v{$newestBranch}" : null;
+            if (! $newestBranch || ($configuredBranch && version_compare($configuredBranch, $newestBranch, '>='))) {
+                return null;
+            }
+
+            return "v{$newestBranch}";
         } catch (\Throwable $e) {
             return null;
         }
     }
+
+    private function getConfiguredTraefikBranch(): ?string
+    {
+        if ($this->server->proxy->get('status') !== 'running' || $this->server->hasPendingProxyConfiguration()) {
+            return null;
+        }
+
+        if (! is_string($this->proxySettings)) {
+            return null;
+        }
+
+        if (! preg_match('/^\s*image:\s*[\'\"]?traefik:v?(\d+\.\d+)(?:\.\d+)?[\'\"]?\s*$/mi', $this->proxySettings, $matches)) {
+            return null;
+        }
+
+        return $matches[1];
+    }
+
+    private function clearAppliedTraefikBranchWarning(): void
+    {
+        $outdatedInfo = $this->server->traefik_outdated_info;
+
+        if (data_get($outdatedInfo, 'type') !== 'minor_upgrade') {
+            return;
+        }
+
+        $configuredBranch = $this->getConfiguredTraefikBranch();
+        $upgradeTarget = ltrim((string) data_get($outdatedInfo, 'upgrade_target'), 'v');
+
+        if (! $configuredBranch || ! $upgradeTarget || version_compare($configuredBranch, $upgradeTarget, '<')) {
+            return;
+        }
+
+        Server::query()
+            ->whereKey($this->server->id)
+            ->where('traefik_outdated_info->type', data_get($outdatedInfo, 'type'))
+            ->where('traefik_outdated_info->current', data_get($outdatedInfo, 'current'))
+            ->where('traefik_outdated_info->upgrade_target', data_get($outdatedInfo, 'upgrade_target'))
+            ->update(['traefik_outdated_info' => null]);
+    }
 }
diff --git a/app/Livewire/Server/Security/TerminalAccess.php b/app/Livewire/Server/Security/TerminalAccess.php
index b4b99a3e7c..999482dcff 100644
--- a/app/Livewire/Server/Security/TerminalAccess.php
+++ b/app/Livewire/Server/Security/TerminalAccess.php
@@ -62,10 +62,9 @@ class TerminalAccess extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             // No other fields to sync for terminal access
         } else {
diff --git a/app/Livewire/Server/Sentinel.php b/app/Livewire/Server/Sentinel.php
index e189254837..d467380ba3 100644
--- a/app/Livewire/Server/Sentinel.php
+++ b/app/Livewire/Server/Sentinel.php
@@ -77,10 +77,9 @@ class Sentinel extends Component
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->is_metrics_enabled = $this->isMetricsEnabled;
             $this->server->settings->sentinel_token = $this->sentinelToken;
@@ -204,6 +203,7 @@ class Sentinel extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');
         } catch (\Throwable $e) {
@@ -214,6 +214,7 @@ class Sentinel extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->restartSentinel();
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index 017beb3719..38bbe24e7c 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -230,12 +230,10 @@ class Show extends Component
             ->toArray();
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-
-            $this->authorize('update', $this->server);
             $foundServer = Server::where('ip', $this->ip)
                 ->where('id', '!=', $this->server->id)
                 ->first();
@@ -363,6 +361,7 @@ class Show extends Component
     public function checkLocalhostConnection()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
             if ($uptime) {
@@ -479,6 +478,7 @@ class Show extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -694,6 +694,7 @@ class Show extends Component
     public function submit()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/Swarm.php b/app/Livewire/Server/Swarm.php
index e3e441ea0e..af785a8c20 100644
--- a/app/Livewire/Server/Swarm.php
+++ b/app/Livewire/Server/Swarm.php
@@ -29,10 +29,9 @@ class Swarm extends Component
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->server->settings->is_swarm_manager = $this->isSwarmManager;
             $this->server->settings->is_swarm_worker = $this->isSwarmWorker;
             $this->server->settings->save();
@@ -45,6 +44,7 @@ class Swarm extends Component
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/TransferImport.php b/app/Livewire/Server/TransferImport.php
index db8999c268..9fe37c10ca 100644
--- a/app/Livewire/Server/TransferImport.php
+++ b/app/Livewire/Server/TransferImport.php
@@ -123,6 +123,15 @@ class TransferImport extends Component
             $this->lastWarnings = array_values((array) data_get($result, 'warnings', []));
             $this->importedServerUuid = $dryRun ? null : data_get($result, 'server_uuid');
 
+            if (! $dryRun) {
+                auditLog('ui.server.imported', [
+                    'team_id' => $teamId,
+                    'server_uuid' => $this->importedServerUuid,
+                    'claimed' => (bool) data_get($result, 'claimed'),
+                    'adopt_mode' => $this->adoptMode,
+                ]);
+            }
+
             if ($dryRun) {
                 $this->dispatch('success', 'Dry run completed — nothing was written.');
             } elseif (data_get($result, 'claimed')) {
diff --git a/app/Livewire/Server/ValidateAndInstall.php b/app/Livewire/Server/ValidateAndInstall.php
index c39f868baf..db62bff2db 100644
--- a/app/Livewire/Server/ValidateAndInstall.php
+++ b/app/Livewire/Server/ValidateAndInstall.php
@@ -53,6 +53,8 @@ class ValidateAndInstall extends Component
 
     public function init(int $data = 0)
     {
+        $this->authorize('update', $this->server);
+
         if (! $this->server->canBeValidated()) {
             $this->error = 'This server was transferred to another Coolify instance and cannot be revalidated here.';
             $this->server->update([
@@ -160,6 +162,8 @@ class ValidateAndInstall extends Component
 
     public function validateOS()
     {
+        $this->authorize('update', $this->server);
+
         $this->supported_os_type = $this->server->validateOS();
         if (! $this->supported_os_type) {
             $this->error = 'Server OS type is not supported. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://docs.docker.com/engine/install/#server">documentation</a>.';
@@ -174,6 +178,8 @@ class ValidateAndInstall extends Component
 
     public function validatePrerequisites()
     {
+        $this->authorize('update', $this->server);
+
         $validationResult = $this->server->validatePrerequisites();
         $this->prerequisites_installed = $validationResult['success'];
         if (! $validationResult['success']) {
@@ -212,6 +218,8 @@ class ValidateAndInstall extends Component
 
     public function validateDockerEngine()
     {
+        $this->authorize('update', $this->server);
+
         $this->docker_installed = $this->server->validateDockerEngine();
         $this->docker_compose_installed = $this->server->validateDockerCompose();
         if (! $this->docker_installed || ! $this->docker_compose_installed) {
@@ -248,6 +256,8 @@ class ValidateAndInstall extends Component
 
     public function validateDockerVersion()
     {
+        $this->authorize('update', $this->server);
+
         if ($this->server->isSwarm()) {
             $swarmInstalled = $this->server->validateDockerSwarm();
             if ($swarmInstalled) {
diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index 40705617f1..829fbda800 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -212,7 +212,7 @@ class Index extends Component
                 return;
             }
 
-            $imageRef = escapeshellarg("ghcr.io/coollabsio/coolify-helper:{$version}");
+            $imageRef = escapeshellarg(coolifyHelperImage().":{$version}");
             $buildCommand = "docker build -t {$imageRef} -f docker/coolify-helper/Dockerfile .";
 
             $activity = remote_process(
diff --git a/app/Livewire/SettingsEmail.php b/app/Livewire/SettingsEmail.php
index 1426f61f02..975ce9a241 100644
--- a/app/Livewire/SettingsEmail.php
+++ b/app/Livewire/SettingsEmail.php
@@ -74,7 +74,7 @@ class SettingsEmail extends Component
         $this->testEmailAddress = auth()->user()->email;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 2570c3a1b5..2dadd73661 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -122,13 +122,6 @@ class Change extends Component
         }
     }
 
-    public function boot()
-    {
-        if ($this->github_app) {
-            $this->github_app->makeVisible(['client_secret', 'webhook_secret']);
-        }
-    }
-
     /**
      * Sync data between component properties and model
      *
@@ -170,8 +163,9 @@ class Change extends Component
             $this->appId = $this->github_app->app_id;
             $this->installationId = $this->github_app->installation_id;
             $this->clientId = $this->github_app->client_id;
-            $this->clientSecret = $this->github_app->client_secret;
-            $this->webhookSecret = $this->github_app->webhook_secret;
+            $canUpdate = auth()->user()->can('update', $this->github_app);
+            $this->clientSecret = $canUpdate ? $this->github_app->client_secret : null;
+            $this->webhookSecret = $canUpdate ? $this->github_app->webhook_secret : null;
             $this->isSystemWide = $this->github_app->is_system_wide;
             $this->privateKeyId = $this->github_app->private_key_id;
             $this->contents = $this->github_app->contents;
@@ -231,7 +225,7 @@ class Change extends Component
             syncGithubAppName($this->github_app);
 
             GithubAppPermissionJob::dispatchSync($this->github_app);
-            $this->github_app->refresh()->makeVisible('client_secret')->makeVisible('webhook_secret');
+            $this->github_app->refresh();
             $this->syncData(false);
             $this->isConnected = $this->github_app->isConnected();
             $this->name = str($this->github_app->name)->kebab();
@@ -305,7 +299,7 @@ class Change extends Component
         try {
             $github_app_uuid = request()->github_app_uuid;
             $this->github_app = GithubApp::ownedByCurrentTeam()->whereUuid($github_app_uuid)->firstOrFail();
-            $this->github_app->makeVisible(['client_secret', 'webhook_secret']);
+            $this->authorize('view', $this->github_app);
             $this->privateKeys = PrivateKey::ownedByCurrentTeamCached();
 
             $this->applications = $this->github_app->applications;
@@ -420,7 +414,6 @@ class Change extends Component
         try {
             $this->authorize('update', $this->github_app);
 
-            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
             $this->organization = normalizeGithubOrganization($this->organization);
             $this->apiUrl = filled($this->apiUrl)
                 ? $this->apiUrl
@@ -442,7 +435,6 @@ class Change extends Component
     {
         $this->authorize('update', $this->github_app);
 
-        $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
         $this->github_app->app_id = 1234567890;
         $this->github_app->installation_id = 1234567890;
         $this->github_app->save();
@@ -457,8 +449,6 @@ class Change extends Component
         try {
             $this->authorize('update', $this->github_app);
 
-            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
-
             $this->syncData(true);
             $this->github_app->save();
             $this->isConnected = $this->github_app->isConnected();
@@ -475,7 +465,6 @@ class Change extends Component
 
             if ($this->github_app->applications->isNotEmpty()) {
                 $this->dispatch('error', 'This source is being used by an application. Please delete all applications first.');
-                $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
 
                 return;
             }
@@ -484,7 +473,7 @@ class Change extends Component
             // @can and canGate checks against a deleted model (null team_id TypeError).
             $this->github_app = null;
 
-            return redirect()->route('source.all');
+            return redirectRoute($this, 'source.all');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Source/Gitlab/Change.php b/app/Livewire/Source/Gitlab/Change.php
index dd0284582b..29374105b2 100644
--- a/app/Livewire/Source/Gitlab/Change.php
+++ b/app/Livewire/Source/Gitlab/Change.php
@@ -338,7 +338,7 @@ class Change extends Component
             // @can and canGate checks against a deleted model (null team_id TypeError).
             $this->gitlab_app = null;
 
-            return redirect()->route('source.all');
+            return redirectRoute($this, 'source.all');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Storage/Show.php b/app/Livewire/Storage/Show.php
index 89782d686c..17abd19e51 100644
--- a/app/Livewire/Storage/Show.php
+++ b/app/Livewire/Storage/Show.php
@@ -43,7 +43,7 @@ class Show extends Component
 
             $this->storage->delete();
 
-            return redirect()->route('storage.index');
+            return redirectRoute($this, 'storage.index');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Team/AuditLog.php b/app/Livewire/Team/AuditLog.php
new file mode 100644
index 0000000000..53cb203eff
--- /dev/null
+++ b/app/Livewire/Team/AuditLog.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Livewire\Team;
+
+use App\Models\AuditEvent;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Str;
+use Livewire\Component;
+use Livewire\WithPagination;
+
+class AuditLog extends Component
+{
+    use WithPagination;
+
+    public string $search = '';
+
+    public string $action = 'all';
+
+    public string $source = 'all';
+
+    public int $perPage = 25;
+
+    public function boot(): void
+    {
+        abort_unless(auth()->user()->isAdminOfTeam(currentTeam()->id), 403);
+    }
+
+    public function updatedSearch(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedAction(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedSource(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(10, min(100, $this->perPage));
+        $this->resetPage();
+    }
+
+    public function render(): View
+    {
+        $search = trim($this->search);
+        $teamId = currentTeam()->id;
+        $canViewInstanceEvents = $teamId === 0 && isInstanceAdmin();
+        $visibleEvents = AuditEvent::query()->visibleToTeam($teamId, $canViewInstanceEvents);
+        $actionOptions = [
+            ['value' => 'all', 'label' => 'All actions'],
+            ...$visibleEvents->clone()
+                ->select('action')
+                ->distinct()
+                ->orderBy('action')
+                ->pluck('action')
+                ->map(fn (string $action): array => ['value' => $action, 'label' => Str::headline($action)])
+                ->all(),
+        ];
+        $events = AuditEvent::query()
+            ->visibleToTeam($teamId, $canViewInstanceEvents)
+            ->filtered($search, $this->action, $this->source)
+            ->latestFirst()
+            ->paginate($this->perPage);
+
+        return view('livewire.team.audit-log', ['actionOptions' => $actionOptions, 'events' => $events]);
+    }
+}
diff --git a/app/Livewire/Team/Invitations.php b/app/Livewire/Team/Invitations.php
index 8ecafc417c..b66c49ac9e 100644
--- a/app/Livewire/Team/Invitations.php
+++ b/app/Livewire/Team/Invitations.php
@@ -22,6 +22,8 @@ class Invitations extends Component
             $this->authorize('manageInvitations', currentTeam());
 
             $invitation = TeamInvitation::ownedByCurrentTeam()->findOrFail($invitation_id);
+            $invitationEmail = $invitation->email;
+            $invitationUuid = $invitation->uuid;
             DB::transaction(function () use ($invitation): void {
                 $user = User::whereEmail($invitation->email)->first();
                 if (filled($user)) {
@@ -30,6 +32,11 @@ class Invitations extends Component
 
                 $invitation->delete();
             });
+            auditLog('ui.team_invitation.revoked', [
+                'team_id' => currentTeam()->id,
+                'invitation_uuid' => $invitationUuid,
+                'invitation_email' => $invitationEmail,
+            ]);
             $this->refreshInvitations();
             $this->dispatch('success', 'Invitation revoked.');
         } catch (\Exception) {
diff --git a/app/Livewire/Team/InviteLink.php b/app/Livewire/Team/InviteLink.php
index a93bf8dd92..d6ea836075 100644
--- a/app/Livewire/Team/InviteLink.php
+++ b/app/Livewire/Team/InviteLink.php
@@ -103,6 +103,13 @@ class InviteLink extends Component
                 'link' => $link,
                 'via' => $sendEmail ? 'email' : 'link',
             ]);
+            auditLog('ui.team_invitation.created', [
+                'team_id' => currentTeam()->id,
+                'invitation_uuid' => $invitation->uuid,
+                'invitation_email' => $invitation->email,
+                'role' => $invitation->role,
+                'via' => $invitation->via,
+            ]);
             if ($sendEmail) {
                 $mail = new MailMessage;
                 $mail->view('emails.invitation-link', [
diff --git a/app/Livewire/Team/Member.php b/app/Livewire/Team/Member.php
index 38c932c39d..d99fd2eb1b 100644
--- a/app/Livewire/Team/Member.php
+++ b/app/Livewire/Team/Member.php
@@ -30,6 +30,7 @@ class Member extends Component
                 $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::ADMIN->value]);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            $this->auditRoleUpdate($teamId, Role::ADMIN);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -50,6 +51,7 @@ class Member extends Component
                 $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::OWNER->value]);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            $this->auditRoleUpdate($teamId, Role::OWNER);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -70,6 +72,7 @@ class Member extends Component
                 $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::MEMBER->value]);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            $this->auditRoleUpdate($teamId, Role::MEMBER);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -90,6 +93,12 @@ class Member extends Component
                 $this->member->teams()->detach($teamId);
                 RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             });
+            auditLog('ui.team_member.removed', [
+                'team_id' => $teamId,
+                'member_id' => $this->member->id,
+                'member_name' => $this->member->name,
+                'member_email' => $this->member->email,
+            ]);
             // Clear cache for the removed user - both old and new key formats
             Cache::forget("team:{$this->member->id}");
             Cache::forget("user:{$this->member->id}:team:{$teamId}");
@@ -103,4 +112,15 @@ class Member extends Component
     {
         return $this->member->teams()->where('teams.id', currentTeam()->id)->first()?->pivot?->role;
     }
+
+    private function auditRoleUpdate(int $teamId, Role $role): void
+    {
+        auditLog('ui.team_member.role_updated', [
+            'team_id' => $teamId,
+            'member_id' => $this->member->id,
+            'member_name' => $this->member->name,
+            'member_email' => $this->member->email,
+            'role' => $role->value,
+        ]);
+    }
 }
diff --git a/app/Livewire/Terminal/Index.php b/app/Livewire/Terminal/Index.php
index 6bb4c5e908..116db1eed1 100644
--- a/app/Livewire/Terminal/Index.php
+++ b/app/Livewire/Terminal/Index.php
@@ -47,7 +47,7 @@ class Index extends Component
                     return [
                         'name' => data_get($container, 'Names'),
                         'connection_name' => data_get($container, 'Names'),
-                        'uuid' => data_get($container, 'Names'),
+                        'uuid' => $server->uuid.':'.data_get($container, 'Names'),
                         'status' => data_get_str($container, 'State')->lower(),
                         'server' => $server,
                         'server_uuid' => $server->uuid,
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 0868bdf9cd..e7c2c1d90e 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -7,11 +7,16 @@ use App\Services\ConfigurationGenerator;
 use App\Services\DeploymentConfiguration\ApplicationConfigurationSnapshot;
 use App\Services\DeploymentConfiguration\ConfigurationDiff;
 use App\Services\DeploymentConfiguration\ConfigurationDiffer;
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
+use App\Traits\Auditable;
+
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasConfiguration;
 use App\Traits\HasMetrics;
 use App\Traits\HasNoindexDomains;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Database\Factories\ApplicationFactory;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -121,10 +126,8 @@ use Symfony\Component\Yaml\Yaml;
 
 class Application extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasConfiguration, HasMetrics, HasNoindexDomains, HasSafeStringAttribute, SoftDeletes;
-
     /** @use HasFactory<ApplicationFactory> */
-    use HasFactory;
+    use Auditable, ClearsGlobalSearchCache, HasConfiguration, HasFactory, HasMetrics, HasNoindexDomains, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     public const MAX_DOCKER_COMPOSE_SIZE_BYTES = 5 * 1024 * 1024;
 
@@ -135,6 +138,7 @@ class Application extends BaseModel
         'description',
         'fqdn',
         'noindex_domains',
+        'domain_port_overrides',
         'git_repository',
         'git_branch',
         'git_commit_sha',
@@ -213,6 +217,8 @@ class Application extends BaseModel
         'last_online_at',
         'restart_count',
         'max_restart_count',
+        'restart_limit_reached',
+        'container_present',
         'last_restart_at',
         'last_restart_type',
         'uuid',
@@ -244,6 +250,7 @@ class Application extends BaseModel
         'docker_compose_raw',
         'custom_labels',
         'domain_dns_statuses',
+        'domain_port_overrides',
     ];
 
     protected function casts(): array
@@ -256,8 +263,11 @@ class Application extends BaseModel
             'manual_webhook_secret_gitea' => 'encrypted',
             'noindex_domains' => 'array',
             'domain_dns_statuses' => 'array',
+            'domain_port_overrides' => 'array',
             'restart_count' => 'integer',
             'max_restart_count' => 'integer',
+            'restart_limit_reached' => 'boolean',
+            'container_present' => 'boolean',
             'last_restart_at' => 'datetime',
         ];
     }
@@ -282,6 +292,9 @@ class Application extends BaseModel
                 if ($application->fqdn === '') {
                     $application->fqdn = null;
                 }
+                $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
+                $application->fqdn = $normalized['fqdn'];
+                $application->domain_port_overrides = $normalized['overrides'];
                 $payload['fqdn'] = $application->fqdn;
                 $application->syncNoindexDomains();
             }
@@ -382,6 +395,7 @@ class Application extends BaseModel
             $application->persistentStorages()->delete();
             $application->environment_variables()->delete();
             $application->environment_variables_preview()->delete();
+            $application->secretManagerLink()->delete();
             foreach ($application->scheduled_tasks as $task) {
                 $task->delete();
             }
@@ -605,10 +619,8 @@ class Application extends BaseModel
     public function stoppedAfterRestartLimit(): bool
     {
         return str($this->status)->startsWith('exited')
-            && ($this->restart_count ?? 0) > 0
-            && ($this->max_restart_count ?? 0) > 0
-            && $this->restart_count >= $this->max_restart_count
-            && $this->last_restart_type === 'crash';
+            && $this->container_present === true
+            && $this->restart_limit_reached === true;
     }
 
     public function taskLink($task_uuid)
@@ -739,24 +751,20 @@ class Application extends BaseModel
 
             return "{$this->source->html_url}/{$this->git_repository}/commit/{$link}";
         }
-        if (str($this->git_repository)->contains('bitbucket')) {
-            $git_repository = str_replace('.git', '', $this->git_repository);
-            $url = Url::fromString($git_repository);
-            $url = $url->withUserInfo('');
-            $url = $url->withPath($url->getPath().'/commits/'.$link);
 
-            return $url->__toString();
-        }
+        $git_repository = $this->git_repository;
         if (strpos($this->git_repository, 'git@') === 0) {
-            $git_repository = str_replace(['git@', ':', '.git'], ['', '/', ''], $this->git_repository);
-            if (data_get($this, 'source.html_url')) {
-                return "{$this->source->html_url}/{$git_repository}/commit/{$link}";
-            }
-
-            return "{$git_repository}/commit/{$link}";
+            $git_repository = preg_replace('/^git@([^:]+):/', 'https://$1/', $git_repository);
+        } elseif (str($this->git_repository)->startsWith('ssh://')) {
+            $git_repository = 'https://'.parse_url($git_repository, PHP_URL_HOST).parse_url($git_repository, PHP_URL_PATH);
         }
 
-        return $this->git_repository;
+        $url = Url::fromString(Str::replaceEnd('.git', '', $git_repository));
+        $url = $url->withUserInfo('');
+        $commitPath = str($git_repository)->contains('bitbucket') ? 'commits' : 'commit';
+        $url = $url->withPath(Str::finish($url->getPath(), '/').$commitPath.'/'.$link);
+
+        return $url->__toString();
     }
 
     public function dockerfileLocation(): Attribute
@@ -976,6 +984,46 @@ class Application extends BaseModel
         return $this->settings->is_static ? [80] : $this->ports_exposes_array;
     }
 
+    /**
+     * Ports the container is expected to listen on: Ports Exposes plus ports already used by application domains.
+     *
+     * @return list<int>
+     */
+    public function availableInternalPorts(): array
+    {
+        $ports = collect($this->settings?->is_static ? [80] : $this->ports_exposes_array)
+            ->filter(fn (mixed $port): bool => is_numeric($port) && (int) $port > 0)
+            ->map(fn (mixed $port): int => (int) $port);
+
+        foreach ($this->domain_port_overrides ?? [] as $port) {
+            if (is_numeric($port) && (int) $port > 0) {
+                $ports->push((int) $port);
+            }
+        }
+
+        foreach (explode(',', (string) $this->fqdn) as $url) {
+            $url = trim($url);
+            if ($url === '') {
+                continue;
+            }
+            $legacyPort = DomainUrlParts::split($url)['port'] ?? '';
+            if ($legacyPort !== '' && is_numeric($legacyPort) && (int) $legacyPort > 0) {
+                $ports->push((int) $legacyPort);
+            }
+        }
+
+        return $ports->unique()->sort()->values()->all();
+    }
+
+    public function portRequiresConfirmation(?int $port): bool
+    {
+        if ($port === null || $port <= 0) {
+            return false;
+        }
+
+        return ! in_array($port, $this->availableInternalPorts(), true);
+    }
+
     public function detectPortFromEnvironment(?bool $isPreview = false): ?int
     {
         $envVars = $isPreview
diff --git a/app/Models/ApplicationDeploymentQueue.php b/app/Models/ApplicationDeploymentQueue.php
index ee190532c4..f16f7f8f96 100644
--- a/app/Models/ApplicationDeploymentQueue.php
+++ b/app/Models/ApplicationDeploymentQueue.php
@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Casts\EncryptedArrayCast;
+use App\Enums\ApplicationDeploymentStatus;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Carbon;
@@ -44,6 +45,44 @@ use OpenApi\Attributes as OA;
 )]
 class ApplicationDeploymentQueue extends Model
 {
+    protected static function booted(): void
+    {
+        static::created(function (ApplicationDeploymentQueue $deployment): void {
+            if (! auth()->check() || ! $deployment->rollback) {
+                return;
+            }
+
+            $application = $deployment->application;
+            $source = $deployment->is_api ? 'api' : 'ui';
+
+            auditLog("{$source}.application.rollback", [
+                'team_id' => $application?->team()?->id,
+                'application_uuid' => $application?->uuid,
+                'application_name' => $application?->name,
+                'deployment_uuid' => $deployment->deployment_uuid,
+                'commit' => $deployment->commit,
+            ]);
+        });
+
+        static::updated(function (ApplicationDeploymentQueue $deployment): void {
+            if (! auth()->check()
+                || ! $deployment->wasChanged('status')
+                || $deployment->status !== ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
+                return;
+            }
+
+            $application = $deployment->application;
+            $source = $deployment->is_api ? 'api' : 'ui';
+
+            auditLog("{$source}.deployment.cancelled", [
+                'team_id' => $application?->team()?->id,
+                'application_uuid' => $application?->uuid,
+                'application_name' => $application?->name,
+                'deployment_uuid' => $deployment->deployment_uuid,
+            ]);
+        });
+    }
+
     protected $fillable = [
         'application_id',
         'deployment_uuid',
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index 6998211eea..bffbdab621 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -2,13 +2,16 @@
 
 namespace App\Models;
 
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\SoftDeletes;
+use RuntimeException;
 use Spatie\Url\Url;
 
 class ApplicationPreview extends BaseModel
 {
-    use SoftDeletes;
+    use HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'uuid',
@@ -22,15 +25,23 @@ class ApplicationPreview extends BaseModel
         'docker_compose_domains',
         'docker_registry_image_tag',
         'last_online_at',
+        'domain_dns_statuses',
+        'domain_port_overrides',
+    ];
+
+    protected $hidden = [
+        'domain_port_overrides',
     ];
 
     protected $casts = [
         'pull_request_id' => 'integer',
+        'domain_dns_statuses' => 'array',
+        'domain_port_overrides' => 'array',
     ];
 
-    protected static function booted()
+    protected static function booted(): void
     {
-        static::forceDeleting(function ($preview) {
+        static::forceDeleting(function (ApplicationPreview $preview): void {
             $server = $preview->application->destination->server;
             $application = $preview->application;
 
@@ -57,10 +68,19 @@ class ApplicationPreview extends BaseModel
                 });
             } else {
                 // Regular application volume cleanup
-                $persistentStorages = $preview->persistentStorages()->get() ?? collect();
-                if ($persistentStorages->count() > 0) {
-                    foreach ($persistentStorages as $storage) {
-                        instant_remote_process(['docker volume rm -f '.escapeshellarg($storage->name)], $server, false);
+                $persistentStorages = $application->persistentStorages()
+                    ->get()
+                    ->filter(fn (LocalPersistentVolume $storage): bool => blank($storage->host_path)
+                        && $storage->is_preview_suffix_enabled);
+
+                foreach ($persistentStorages as $storage) {
+                    $volumeName = addPreviewDeploymentSuffix($storage->name, $preview->pull_request_id);
+                    try {
+                        instant_remote_process(['docker volume rm -f '.escapeshellarg($volumeName)], $server);
+                    } catch (RuntimeException $exception) {
+                        if (! preg_match('/\bvolume\b.*\bnot found\b/i', $exception->getMessage())) {
+                            throw $exception;
+                        }
                     }
                 }
             }
@@ -72,6 +92,14 @@ class ApplicationPreview extends BaseModel
             if ($preview->isDirty('status')) {
                 $preview->last_online_at = now();
             }
+            if ($preview->isDirty('fqdn')) {
+                if ($preview->fqdn === '') {
+                    $preview->fqdn = null;
+                }
+                $normalized = DomainPortOverrides::normalize($preview->fqdn, $preview->domain_port_overrides);
+                $preview->fqdn = $normalized['fqdn'];
+                $preview->domain_port_overrides = $normalized['overrides'];
+            }
         });
     }
 
@@ -90,39 +118,42 @@ class ApplicationPreview extends BaseModel
         return $this->belongsTo(Application::class);
     }
 
+    public function restartLimitMaximum(): int
+    {
+        return $this->application->max_restart_count ?? $this->max_restart_count ?? 0;
+    }
+
     public function persistentStorages()
     {
         return $this->morphMany(LocalPersistentVolume::class, 'resource');
     }
 
-    public function generate_preview_fqdn()
+    public function generate_preview_fqdn(bool $generateWithoutApplicationDomain = false)
     {
-        if ($this->application->fqdn) {
-            if (str($this->application->fqdn)->contains(',')) {
-                $url = Url::fromString(str($this->application->fqdn)->explode(',')[0]);
-            } else {
-                $url = Url::fromString($this->application->fqdn);
-            }
-            $template = $this->application->preview_url_template;
-            $host = $url->getHost();
-            $schema = $url->getScheme();
-            $portInt = $url->getPort();
-            $port = $portInt !== null ? ':'.$portInt : '';
-            $urlPath = $url->getPath();
-            $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-            $random = new_public_id();
-            $preview_fqdn = str_replace('{{random}}', $random, $template);
-            $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-            $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
-            $preview_fqdn = "$schema://$preview_fqdn{$port}{$path}";
-            $this->fqdn = $preview_fqdn;
+        $applicationFqdn = $this->application->fqdn;
+        if (! $applicationFqdn && $generateWithoutApplicationDomain) {
+            $applicationFqdn = generateUrl(
+                server: $this->application->destination->server,
+                random: $this->application->uuid,
+            );
+        }
+
+        if ($applicationFqdn) {
+            $sourceDomain = str($applicationFqdn)->contains(',')
+                ? str($applicationFqdn)->explode(',')[0]
+                : $applicationFqdn;
+            $generated = $this->generatedPreviewDomain((string) $sourceDomain);
+            $this->fqdn = $generated['url'];
+            $this->domain_port_overrides = filled($generated['port'])
+                ? [$generated['url'] => $generated['port']]
+                : null;
             $this->save();
         }
 
         return $this;
     }
 
-    public function generate_preview_fqdn_compose()
+    public function generate_preview_fqdn_compose(bool $generateWithoutApplicationDomain = false)
     {
         $applicationDomains = json_decode($this->application->docker_compose_domains ?: '[]', true) ?: [];
         $previewDomains = json_decode(data_get($this, 'docker_compose_domains') ?: '[]', true) ?: [];
@@ -161,11 +192,19 @@ class ApplicationPreview extends BaseModel
             ->all();
 
         $docker_compose_domains = [];
+        $previewPortOverrides = [];
         foreach ($serviceNames as $service_name) {
             $domain_string = getComposeServiceDomainString($applicationDomains, $service_name);
 
-            // If domain string is empty or null, don't auto-generate domain
-            // Only generate domains when main app already has domains set
+            if (empty($domain_string)) {
+                if ($generateWithoutApplicationDomain) {
+                    $domain_string = generateUrl(
+                        server: $this->application->destination->server,
+                        random: str($service_name)->slug().'-'.$this->application->uuid,
+                    );
+                }
+            }
+
             if (empty($domain_string)) {
                 $docker_compose_domains = putComposeServiceDomain(
                     $docker_compose_domains,
@@ -185,20 +224,11 @@ class ApplicationPreview extends BaseModel
                     continue;
                 }
 
-                $url = Url::fromString($domain);
-                $template = $this->application->preview_url_template;
-                $host = $url->getHost();
-                $schema = $url->getScheme();
-                $portInt = $url->getPort();
-                $port = $portInt !== null ? ':'.$portInt : '';
-                $urlPath = $url->getPath();
-                $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-                $random = new_public_id();
-                $preview_fqdn = str_replace('{{random}}', $random, $template);
-                $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
-                $preview_fqdn = "$schema://$preview_fqdn{$port}{$path}";
-                $preview_domains[] = $preview_fqdn;
+                $generated = $this->generatedPreviewDomain((string) $domain);
+                $preview_domains[] = $generated['url'];
+                if (filled($generated['port'])) {
+                    $previewPortOverrides[$generated['url']] = $generated['port'];
+                }
             }
 
             $docker_compose_domains = putComposeServiceDomain(
@@ -222,10 +252,36 @@ class ApplicationPreview extends BaseModel
             ->implode(',');
 
         $this->fqdn = ! empty($allDomains) ? $allDomains : null;
+        $this->domain_port_overrides = $previewPortOverrides ?: null;
 
         $this->save();
     }
 
+    /**
+     * @return array{url: string, port: ?int}
+     */
+    public function generatedPreviewDomain(string $sourceDomain): array
+    {
+        $url = Url::fromString($sourceDomain);
+        $template = $this->application->preview_url_template;
+        $host = $url->getHost();
+        $schema = $url->getScheme();
+        $urlPath = $url->getPath();
+        $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
+        $random = new_public_id();
+        $previewFqdn = str_replace('{{random}}', $random, $template);
+        $previewFqdn = str_replace('{{domain}}', $host, $previewFqdn);
+        $previewFqdn = str_replace('{{pr_id}}', (string) $this->pull_request_id, $previewFqdn);
+        $previewUrl = "{$schema}://{$previewFqdn}{$path}";
+        $sourceCanonical = DomainPortOverrides::withoutPort($sourceDomain);
+        $port = $url->getPort() ?? ($this->application->domain_port_overrides[$sourceCanonical] ?? null);
+
+        return [
+            'url' => $previewUrl,
+            'port' => $port !== null ? (int) $port : null,
+        ];
+    }
+
     /**
      * Original compose service names for this preview (PR suffix stripped), excluding database images.
      *
diff --git a/app/Models/AuditEvent.php b/app/Models/AuditEvent.php
new file mode 100644
index 0000000000..2383dee267
--- /dev/null
+++ b/app/Models/AuditEvent.php
@@ -0,0 +1,211 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
+use Throwable;
+
+class AuditEvent extends Model
+{
+    use HasFactory;
+
+    public const UPDATED_AT = null;
+
+    protected $fillable = [
+        'team_id',
+        'event',
+        'source',
+        'action',
+        'actor_type',
+        'actor_id',
+        'actor_name',
+        'actor_email',
+        'actor_token_id',
+        'actor_token_name',
+        'resource_type',
+        'resource_uuid',
+        'resource_name',
+        'description',
+        'metadata',
+        'ip_address',
+        'user_agent',
+        'created_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'metadata' => 'array',
+            'created_at' => 'datetime',
+        ];
+    }
+
+    public function scopeVisibleToTeam(Builder $query, int $teamId, bool $includeInstanceEvents = false): Builder
+    {
+        return $query->where(function (Builder $query) use ($includeInstanceEvents, $teamId): void {
+            $query->where('team_id', $teamId)
+                ->when($includeInstanceEvents, fn (Builder $query) => $query->orWhereNull('team_id'));
+        });
+    }
+
+    public function scopeFiltered(
+        Builder $query,
+        string $search = '',
+        string $action = 'all',
+        string $source = 'all',
+        bool $searchSensitiveFields = true,
+    ): Builder {
+        return $query
+            ->when($action !== 'all', fn (Builder $query) => $query->where('action', $action))
+            ->when($source !== 'all', fn (Builder $query) => $query->where('source', $source))
+            ->when($search !== '', function (Builder $query) use ($search, $searchSensitiveFields): void {
+                $query->where(function (Builder $query) use ($search, $searchSensitiveFields): void {
+                    $query->where('event', 'like', "%{$search}%")
+                        ->orWhere('description', 'like', "%{$search}%")
+                        ->orWhere('resource_name', 'like', "%{$search}%")
+                        ->orWhere('actor_name', 'like', "%{$search}%")
+                        ->when($searchSensitiveFields, fn (Builder $query) => $query->orWhere('actor_email', 'like', "%{$search}%"));
+                });
+            });
+    }
+
+    public function scopeLatestFirst(Builder $query): Builder
+    {
+        return $query->latest('created_at')->latest('id');
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    public static function record(string $event, array $context = []): void
+    {
+        try {
+            $attributes = self::attributesFor($event, $context);
+
+            DB::afterCommit(function () use ($attributes): void {
+                defer(function () use ($attributes): void {
+                    try {
+                        self::query()->create($attributes);
+                    } catch (Throwable $exception) {
+                        Log::warning('Audit event persistence failed', [
+                            'event' => $attributes['event'],
+                            'exception' => $exception::class,
+                        ]);
+                    }
+                })->always();
+            });
+        } catch (Throwable $exception) {
+            Log::warning('Audit event preparation failed', [
+                'event' => $event,
+                'exception' => $exception::class,
+            ]);
+        }
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     * @return array<string, mixed>
+     */
+    private static function attributesFor(string $event, array $context): array
+    {
+        $teamId = data_get(auth()->user()?->currentAccessToken(), 'team_id')
+            ?? data_get($context, 'team_id')
+            ?? currentTeam()?->id
+            ?? self::teamIdFromContext($context);
+
+        $parts = explode('.', $event);
+        $source = $parts[0] ?? 'system';
+        $resourceType = data_get($context, 'resource') ?? ($parts[1] ?? null);
+        $action = data_get($context, 'action') ?? (end($parts) ?: 'event');
+        $resourceUuid = self::firstContextValue($context, $resourceType ? "{$resourceType}_uuid" : null, '_uuid');
+        $resourceName = self::firstContextValue($context, $resourceType ? "{$resourceType}_name" : null, '_name');
+        $user = auth()->user();
+        $token = $user?->currentAccessToken();
+        $actorType = match (true) {
+            in_array($source, ['mcp', 'webhook', 'system', 'scheduler'], true) => $source,
+            $token !== null => 'api_token',
+            $user !== null => 'user',
+            default => 'system',
+        };
+
+        return [
+            'team_id' => $teamId,
+            'event' => $event,
+            'source' => $source,
+            'action' => $action,
+            'actor_type' => $actorType,
+            'actor_id' => $user?->id,
+            'actor_name' => $user?->name,
+            'actor_email' => $user?->email,
+            'actor_token_id' => $token?->id,
+            'actor_token_name' => $token?->name,
+            'resource_type' => $resourceType,
+            'resource_uuid' => $resourceUuid,
+            'resource_name' => $resourceName,
+            'description' => data_get($context, 'audit_description')
+                ?? trim(($resourceName ?? Str::headline((string) $resourceType)).' '.Str::headline($action)),
+            'metadata' => self::redact($context),
+            'ip_address' => app()->bound('request') ? request()->ip() : null,
+            'user_agent' => app()->bound('request') ? Str::limit((string) request()->userAgent(), 200, '') : null,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    private static function teamIdFromContext(array $context): ?int
+    {
+        $applicationUuid = data_get($context, 'application_uuid');
+        if (! is_string($applicationUuid) || $applicationUuid === '') {
+            return null;
+        }
+
+        return Application::query()
+            ->where('uuid', $applicationUuid)
+            ->first()?->team()?->id;
+    }
+
+    public static function pruneExpired(): int
+    {
+        return self::query()
+            ->where('created_at', '<', now()->subDays(90))
+            ->delete();
+    }
+
+    /**
+     * @param  array<string, mixed>  $context
+     */
+    private static function firstContextValue(array $context, ?string $preferredKey, string $suffix): mixed
+    {
+        if ($preferredKey !== null && filled(data_get($context, $preferredKey))) {
+            return data_get($context, $preferredKey);
+        }
+
+        $key = Arr::first(array_keys($context), fn (string $key): bool => str_ends_with($key, $suffix));
+
+        return $key ? data_get($context, $key) : null;
+    }
+
+    private static function redact(mixed $value, ?string $key = null): mixed
+    {
+        if ($key !== null && preg_match('/password|secret|token|private_key|signature|credential|invitation_email|api_key|access_key|authorization|cookie/i', $key)) {
+            return '[REDACTED]';
+        }
+
+        if (! is_array($value)) {
+            return $value;
+        }
+
+        return collect($value)
+            ->mapWithKeys(fn (mixed $item, string|int $itemKey): array => [
+                $itemKey => self::redact($item, (string) $itemKey),
+            ])
+            ->all();
+    }
+}
diff --git a/app/Models/DiscordNotificationSettings.php b/app/Models/DiscordNotificationSettings.php
index 135c921f61..48d5b5d293 100644
--- a/app/Models/DiscordNotificationSettings.php
+++ b/app/Models/DiscordNotificationSettings.php
@@ -20,6 +20,7 @@ class DiscordNotificationSettings extends Model
         'deployment_success_discord_notifications',
         'deployment_failure_discord_notifications',
         'status_change_discord_notifications',
+        'restart_limit_reached_discord_notifications',
         'backup_success_discord_notifications',
         'backup_failure_discord_notifications',
         'scheduled_task_success_discord_notifications',
@@ -45,6 +46,7 @@ class DiscordNotificationSettings extends Model
         'deployment_success_discord_notifications' => 'boolean',
         'deployment_failure_discord_notifications' => 'boolean',
         'status_change_discord_notifications' => 'boolean',
+        'restart_limit_reached_discord_notifications' => 'boolean',
         'backup_success_discord_notifications' => 'boolean',
         'backup_failure_discord_notifications' => 'boolean',
         'scheduled_task_success_discord_notifications' => 'boolean',
diff --git a/app/Models/EmailNotificationSettings.php b/app/Models/EmailNotificationSettings.php
index 814d053395..3b04b482af 100644
--- a/app/Models/EmailNotificationSettings.php
+++ b/app/Models/EmailNotificationSettings.php
@@ -31,6 +31,7 @@ class EmailNotificationSettings extends Model
         'deployment_success_email_notifications',
         'deployment_failure_email_notifications',
         'status_change_email_notifications',
+        'restart_limit_reached_email_notifications',
         'backup_success_email_notifications',
         'backup_failure_email_notifications',
         'scheduled_task_success_email_notifications',
@@ -73,6 +74,7 @@ class EmailNotificationSettings extends Model
         'deployment_success_email_notifications' => 'boolean',
         'deployment_failure_email_notifications' => 'boolean',
         'status_change_email_notifications' => 'boolean',
+        'restart_limit_reached_email_notifications' => 'boolean',
         'backup_success_email_notifications' => 'boolean',
         'backup_failure_email_notifications' => 'boolean',
         'scheduled_task_success_email_notifications' => 'boolean',
diff --git a/app/Models/Environment.php b/app/Models/Environment.php
index 1364d874a1..e98f13d21f 100644
--- a/app/Models/Environment.php
+++ b/app/Models/Environment.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -21,8 +22,8 @@ use OpenApi\Attributes as OA;
 )]
 class Environment extends BaseModel
 {
+    use Auditable, HasFactory;
     use ClearsGlobalSearchCache;
-    use HasFactory;
     use HasSafeStringAttribute;
 
     protected $fillable = [
diff --git a/app/Models/EnvironmentVariable.php b/app/Models/EnvironmentVariable.php
index 70c9013af2..e7dd8564bc 100644
--- a/app/Models/EnvironmentVariable.php
+++ b/app/Models/EnvironmentVariable.php
@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
 use App\Support\ValidationPatterns;
+use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use OpenApi\Attributes as OA;
@@ -34,6 +35,8 @@ use OpenApi\Attributes as OA;
 )]
 class EnvironmentVariable extends BaseModel
 {
+    use Auditable;
+
     public const BUILDPACK_CONTROL_VARIABLE_PREFIXES = ['NIXPACKS_', 'RAILPACK_'];
 
     protected $attributes = [
@@ -249,17 +252,21 @@ class EnvironmentVariable extends BaseModel
     protected function isShared(): Attribute
     {
         return Attribute::make(
-            get: function () {
-                $type = str($this->value)->after('{{')->before('.')->value;
-                if (str($this->value)->startsWith('{{'.$type) && str($this->value)->endsWith('}}')) {
-                    return true;
-                }
-
-                return false;
-            }
+            get: fn () => $this->isSharedReference(),
         );
     }
 
+    private function isSharedReference(): bool
+    {
+        if (blank($this->value)) {
+            return false;
+        }
+
+        $types = implode('|', SHARED_VARIABLE_TYPES);
+
+        return preg_match('/^{{\s*(?:'.$types.')\..*}}$/s', trim($this->value)) === 1;
+    }
+
     public function get_real_environment_variables_with_server(?string $environment_variable = null, $resource = null, $server = null)
     {
         return $this->get_real_environment_variables_internal($environment_variable, $resource, $server);
@@ -406,8 +413,6 @@ class EnvironmentVariable extends BaseModel
 
     protected function updateIsShared(): void
     {
-        $type = str($this->value)->after('{{')->before('.')->value;
-        $isShared = str($this->value)->startsWith('{{'.$type) && str($this->value)->endsWith('}}');
-        $this->is_shared = $isShared;
+        $this->is_shared = $this->isSharedReference();
     }
 }
diff --git a/app/Models/GithubApp.php b/app/Models/GithubApp.php
index 564fbcf6a4..96c7a2d39d 100644
--- a/app/Models/GithubApp.php
+++ b/app/Models/GithubApp.php
@@ -2,11 +2,14 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Support\Facades\DB;
 
 class GithubApp extends BaseModel
 {
+    use Auditable;
+
     public function delete(): ?bool
     {
         return DB::transaction(fn () => parent::delete());
diff --git a/app/Models/GitlabApp.php b/app/Models/GitlabApp.php
index c6c2b84095..727ec77cd1 100644
--- a/app/Models/GitlabApp.php
+++ b/app/Models/GitlabApp.php
@@ -2,12 +2,15 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use Illuminate\Contracts\Encryption\DecryptException;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Support\Facades\Crypt;
 
 class GitlabApp extends BaseModel
 {
+    use Auditable;
+
     protected $fillable = [
         'name',
         'organization',
diff --git a/app/Models/IntegrationToken.php b/app/Models/IntegrationToken.php
index 20541f6139..53b4dd6f4a 100644
--- a/app/Models/IntegrationToken.php
+++ b/app/Models/IntegrationToken.php
@@ -3,15 +3,26 @@
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class IntegrationToken extends BaseModel
 {
+    public const SECRET_MANAGER_PROVIDERS = ['doppler', 'infisical', 'vault'];
+
+    public const PROVIDER_NAMES = [
+        'cloudflare' => 'Cloudflare',
+        'doppler' => 'Doppler',
+        'infisical' => 'Infisical',
+        'vault' => 'HashiCorp Vault',
+    ];
+
     protected $fillable = [
         'team_id',
         'provider',
         'name',
         'token',
         'capabilities',
+        'metadata',
     ];
 
     protected $hidden = [
@@ -23,6 +34,7 @@ class IntegrationToken extends BaseModel
         return [
             'token' => 'encrypted',
             'capabilities' => 'array',
+            'metadata' => 'array',
         ];
     }
 
@@ -31,6 +43,34 @@ class IntegrationToken extends BaseModel
         return $this->belongsTo(Team::class);
     }
 
+    public function secretManagerLinks(): HasMany
+    {
+        return $this->hasMany(SecretManagerLink::class);
+    }
+
+    public function isSecretManager(): bool
+    {
+        return in_array($this->provider, self::SECRET_MANAGER_PROVIDERS, true);
+    }
+
+    public function providerName(): string
+    {
+        return self::PROVIDER_NAMES[$this->provider] ?? ucfirst($this->provider);
+    }
+
+    public function dopplerTokenType(): ?string
+    {
+        if ($this->provider !== 'doppler') {
+            return null;
+        }
+
+        return match (true) {
+            str_starts_with($this->token, 'dp.st.') => 'service',
+            str_starts_with($this->token, 'dp.sa.') => 'service_account',
+            default => null,
+        };
+    }
+
     public static function ownedByCurrentTeam()
     {
         return self::query()->where('team_id', currentTeam()->id);
diff --git a/app/Models/PrivateKey.php b/app/Models/PrivateKey.php
index 3f72642a57..43aa310cbc 100644
--- a/app/Models/PrivateKey.php
+++ b/app/Models/PrivateKey.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
 use DanHarrin\LivewireRateLimiting\WithRateLimiting;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -31,7 +32,7 @@ use phpseclib3\Crypt\PublicKeyLoader;
 )]
 class PrivateKey extends BaseModel
 {
-    use HasFactory, HasSafeStringAttribute, WithRateLimiting;
+    use Auditable, HasFactory, HasSafeStringAttribute, WithRateLimiting;
 
     protected $fillable = [
         'name',
diff --git a/app/Models/Project.php b/app/Models/Project.php
index 57dbf823ce..65c21c1e78 100644
--- a/app/Models/Project.php
+++ b/app/Models/Project.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -20,8 +21,8 @@ use OpenApi\Attributes as OA;
 )]
 class Project extends BaseModel
 {
+    use Auditable, HasFactory;
     use ClearsGlobalSearchCache;
-    use HasFactory;
     use HasSafeStringAttribute;
 
     protected $fillable = [
@@ -63,7 +64,9 @@ class Project extends BaseModel
             ]);
         });
         static::deleting(function ($project) {
-            $project->environments()->delete();
+            foreach ($project->environments()->get() as $environment) {
+                $environment->delete();
+            }
             $project->settings()->delete();
             $shared_variables = $project->environment_variables();
             foreach ($shared_variables as $shared_variable) {
diff --git a/app/Models/PushoverNotificationSettings.php b/app/Models/PushoverNotificationSettings.php
index dd0d81cc0e..2ab6693142 100644
--- a/app/Models/PushoverNotificationSettings.php
+++ b/app/Models/PushoverNotificationSettings.php
@@ -21,6 +21,7 @@ class PushoverNotificationSettings extends Model
         'deployment_success_pushover_notifications',
         'deployment_failure_pushover_notifications',
         'status_change_pushover_notifications',
+        'restart_limit_reached_pushover_notifications',
         'backup_success_pushover_notifications',
         'backup_failure_pushover_notifications',
         'scheduled_task_success_pushover_notifications',
@@ -47,6 +48,7 @@ class PushoverNotificationSettings extends Model
         'deployment_success_pushover_notifications' => 'boolean',
         'deployment_failure_pushover_notifications' => 'boolean',
         'status_change_pushover_notifications' => 'boolean',
+        'restart_limit_reached_pushover_notifications' => 'boolean',
         'backup_success_pushover_notifications' => 'boolean',
         'backup_failure_pushover_notifications' => 'boolean',
         'scheduled_task_success_pushover_notifications' => 'boolean',
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index e4b1e2fd68..3c0d9e7e95 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -4,6 +4,7 @@ namespace App\Models;
 
 use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
+use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -14,7 +15,7 @@ use Illuminate\Support\Facades\Validator;
 
 class S3Storage extends BaseModel
 {
-    use HasFactory, HasSafeStringAttribute;
+    use Auditable, HasFactory, HasSafeStringAttribute;
 
     private const CONNECTION_TIMEOUT_SECONDS = 15;
 
diff --git a/app/Models/SecretManagerLink.php b/app/Models/SecretManagerLink.php
new file mode 100644
index 0000000000..34e4e90d12
--- /dev/null
+++ b/app/Models/SecretManagerLink.php
@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Models;
+
+use App\Services\DopplerService;
+use App\Services\InfisicalService;
+use App\Services\VaultService;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+/**
+ * Links a resource (currently Application) to a remote secret manager source.
+ * Holds only the source coordinates — secret values are never persisted.
+ */
+class SecretManagerLink extends BaseModel
+{
+    protected $fillable = [
+        'resourceable_type',
+        'resourceable_id',
+        'integration_token_id',
+        'settings',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'settings' => 'array',
+        ];
+    }
+
+    public function resourceable(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    public function integrationToken(): BelongsTo
+    {
+        return $this->belongsTo(IntegrationToken::class);
+    }
+
+    /**
+     * Fetch the secrets from the remote manager. Values live only in memory.
+     *
+     * @return array<string, string>
+     */
+    public function fetchSecrets(): array
+    {
+        $token = $this->integrationToken;
+        $settings = $this->settings ?? [];
+        $metadata = $token->metadata ?? [];
+
+        return match ($token->provider) {
+            'doppler' => (new DopplerService($token->token))->fetchSecrets(
+                data_get($settings, 'project'),
+                data_get($settings, 'config'),
+            ),
+            'infisical' => (new InfisicalService(
+                data_get($metadata, 'base_url', 'https://app.infisical.com'),
+                (string) data_get($metadata, 'client_id'),
+                $token->token,
+            ))->fetchSecrets(
+                (string) data_get($settings, 'project_id'),
+                (string) data_get($settings, 'environment'),
+                (string) data_get($settings, 'secret_path', '/'),
+            ),
+            'vault' => (new VaultService(
+                (string) data_get($metadata, 'base_url'),
+                $token->token,
+                data_get($metadata, 'namespace'),
+            ))->fetchSecrets(
+                (string) data_get($settings, 'mount', 'secret'),
+                (string) data_get($settings, 'path'),
+            ),
+            default => throw new \RuntimeException("Unsupported secret manager provider [{$token->provider}]."),
+        };
+    }
+
+    /**
+     * Create one {{vault.KEY}} reference variable per remote key that has no
+     * variable with that key yet. Only key names touch the database.
+     *
+     * @return list<string> The keys that were imported
+     */
+    public function importMissingReferences(): array
+    {
+        $keys = array_keys($this->fetchSecrets());
+        sort($keys);
+
+        $existing = $this->resourceable->environment_variables()->pluck('key')->flip();
+        $imported = [];
+
+        foreach ($keys as $key) {
+            if (isset($existing[$key])) {
+                continue;
+            }
+
+            $this->resourceable->environment_variables()->create([
+                'key' => $key,
+                'value' => '{{vault.'.$key.'}}',
+            ]);
+            $imported[] = $key;
+        }
+
+        return $imported;
+    }
+
+    /** Short human-readable description of the remote source for the UI. */
+    public function sourceSummary(): string
+    {
+        $settings = $this->settings ?? [];
+
+        return match ($this->integrationToken->provider) {
+            'doppler' => trim(implode('/', array_filter([
+                data_get($settings, 'project'),
+                data_get($settings, 'config'),
+            ])), '/') ?: 'token scope',
+            'infisical' => data_get($settings, 'project_id').'/'.data_get($settings, 'environment').data_get($settings, 'secret_path', '/'),
+            'vault' => data_get($settings, 'mount', 'secret').'/'.data_get($settings, 'path'),
+            default => '',
+        };
+    }
+}
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 31f906ec16..912f79fb4b 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -21,6 +21,7 @@ use App\Services\DigitalOceanService;
 use App\Services\HetznerService;
 use App\Services\VultrService;
 use App\Support\ValidationPatterns;
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasMetrics;
 use App\Traits\HasSafeStringAttribute;
@@ -111,7 +112,7 @@ use Symfony\Component\Yaml\Yaml;
 
 class Server extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasFactory, HasMetrics, SchemalessAttributesTrait, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasFactory, HasMetrics, SchemalessAttributesTrait, SoftDeletes;
 
     /**
      * Sentinel IP for servers that do not have a real address yet
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 0da97b301a..11756f3c7e 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -4,8 +4,12 @@ namespace App\Models;
 
 use App\Enums\ProcessStatus;
 use App\Services\ContainerStatusAggregator;
+use App\Support\DomainPortOverrides;
+use App\Traits\Auditable;
+
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -43,7 +47,7 @@ use Symfony\Component\Yaml\Yaml;
 )]
 class Service extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasFactory, HasSafeStringAttribute, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasFactory, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     private static $parserVersion = '5';
 
@@ -92,11 +96,18 @@ class Service extends BaseModel
 
     public function isConfigurationChanged(bool $save = false)
     {
-        $domains = $this->applications()->get()->pluck('fqdn')->sort()->toArray();
+        $applications = $this->applications()->get();
+        $domains = $applications->pluck('fqdn')->sort()->toArray();
         $domains = implode(',', $domains);
-        $noindexDomains = $this->applications()->get()->pluck('noindex_domains')->flatten()->filter()->sort()->implode(',');
+        $noindexDomains = $applications->pluck('noindex_domains')->flatten()->filter()->sort()->implode(',');
+        $domainPortOverrides = $applications
+            ->mapWithKeys(fn (ServiceApplication $application): array => [
+                $application->id => DomainPortOverrides::sorted($application->domain_port_overrides),
+            ])
+            ->sortKeys()
+            ->all();
 
-        $applicationImages = $this->applications()->get()->pluck('image')->sort();
+        $applicationImages = $applications->pluck('image')->sort();
         $databaseImages = $this->databases()->get()->pluck('image')->sort();
         $images = $applicationImages->merge($databaseImages);
         $images = implode(',', $images->toArray());
@@ -105,7 +116,7 @@ class Service extends BaseModel
         $databaseStorages = $this->databases()->get()->pluck('persistentStorages')->flatten()->sortBy('id');
         $storages = $applicationStorages->merge($databaseStorages)->implode('updated_at');
 
-        $newConfigHash = $images.$domains.$images.$storages.$noindexDomains;
+        $newConfigHash = $images.$domains.$images.$storages.$noindexDomains.json_encode($domainPortOverrides);
         $newConfigHash .= json_encode($this->environment_variables()->get('value')->makeVisible('value')->sort());
         $newConfigHash = md5($newConfigHash);
         $oldConfigHash = data_get($this, 'config_hash');
@@ -1496,7 +1507,7 @@ class Service extends BaseModel
     {
         try {
             $services = get_service_templates();
-            $serviceName = str($this->name)->beforeLast('-')->value();
+            $serviceName = $this->service_type ?: str($this->name)->beforeLast('-')->value();
             $service = data_get($services, $serviceName, []);
             $port = data_get($service, 'port');
 
@@ -1631,7 +1642,7 @@ class Service extends BaseModel
             return 3;
         });
         foreach ($sorted as $env) {
-            $envs->push("{$env->key}={$env->real_value}");
+            $envs->push("{$env->key}={$this->resolveSecretManagerEnvironmentVariable($env)}");
         }
         if ($envs->count() === 0) {
             $commands[] = 'touch .env';
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index 9763fa894b..cf0faef5bd 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -2,7 +2,10 @@
 
 namespace App\Models;
 
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
 use App\Traits\HasNoindexDomains;
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
@@ -10,7 +13,9 @@ use Symfony\Component\Yaml\Yaml;
 
 class ServiceApplication extends BaseModel
 {
-    use HasFactory, HasNoindexDomains, SoftDeletes;
+    use HasFactory, HasNoindexDomains, HasRestartLimit, SoftDeletes;
+
+    protected $appends = ['url'];
 
     protected $fillable = [
         'service_id',
@@ -21,6 +26,7 @@ class ServiceApplication extends BaseModel
         'noindex_domains',
         'redirect',
         'domain_dns_statuses',
+        'domain_port_overrides',
         'ports',
         'exposes',
         'status',
@@ -43,6 +49,7 @@ class ServiceApplication extends BaseModel
      */
     protected $hidden = [
         'domain_dns_statuses',
+        'domain_port_overrides',
     ];
 
     protected $attributes = [
@@ -53,6 +60,7 @@ class ServiceApplication extends BaseModel
     {
         return [
             'domain_dns_statuses' => 'array',
+            'domain_port_overrides' => 'array',
             'noindex_domains' => 'array',
             'is_force_https_enabled' => 'boolean',
         ];
@@ -70,6 +78,7 @@ class ServiceApplication extends BaseModel
                 $service->last_online_at = now();
             }
             if ($service->isDirty('fqdn')) {
+                $service->normalizeDomainPortOverrides();
                 $service->syncNoindexDomains();
             }
         });
@@ -191,6 +200,45 @@ class ServiceApplication extends BaseModel
         );
     }
 
+    /**
+     * Return the public URLs with their persisted internal port overrides.
+     */
+    protected function url(): Attribute
+    {
+        return Attribute::make(
+            get: function (): ?string {
+                if (blank($this->fqdn)) {
+                    return null;
+                }
+
+                $overrides = $this->domain_port_overrides ?? [];
+
+                return collect(explode(',', $this->fqdn))
+                    ->map(function (string $url) use ($overrides): string {
+                        $url = trim($url);
+                        $canonical = DomainPortOverrides::withoutPort($url);
+                        $port = $overrides[$canonical] ?? null;
+
+                        if ($port === null) {
+                            return $canonical;
+                        }
+
+                        $parts = DomainUrlParts::split($canonical);
+
+                        return DomainUrlParts::compose($parts['scheme'], $parts['host'], (string) $port, $parts['path']);
+                    })
+                    ->implode(',');
+            },
+        );
+    }
+
+    public function setEditableUrls(?string $urls): void
+    {
+        $normalized = DomainPortOverrides::normalize($urls, null);
+        $this->fqdn = $normalized['fqdn'];
+        $this->domain_port_overrides = $normalized['overrides'];
+    }
+
     /**
      * Extract port number from a given FQDN URL.
      * Returns null if no port is specified.
@@ -212,6 +260,58 @@ class ServiceApplication extends BaseModel
         }
     }
 
+    /**
+     * True when saving this URL should confirm that it does not use the required template port.
+     */
+    public function portRequiresConfirmation(string $fqdn, ?int $requiredPort, ?string $previousFqdn = null): bool
+    {
+        if ($requiredPort === null) {
+            return false;
+        }
+
+        $fqdn = trim($fqdn);
+        if ($fqdn === '') {
+            return false;
+        }
+
+        $canonical = DomainPortOverrides::withoutPort($fqdn);
+        $explicit = self::extractPortFromUrl($fqdn);
+
+        if ($explicit === $requiredPort) {
+            return false;
+        }
+
+        if ($explicit === null) {
+            $previous = collect(explode(',', (string) $previousFqdn))
+                ->filter();
+            $previousUrl = $previous->first(
+                fn (string $url): bool => DomainPortOverrides::withoutPort(trim($url)) === $canonical
+            );
+
+            if (is_string($previousUrl) && self::extractPortFromUrl($previousUrl) !== null) {
+                return true;
+            }
+
+            return $previousUrl === null;
+        }
+
+        $existingOverride = $this->domain_port_overrides[$canonical] ?? null;
+
+        return (int) $existingOverride !== $explicit;
+    }
+
+    public static function withoutPort(string $url): string
+    {
+        return DomainPortOverrides::withoutPort($url);
+    }
+
+    protected function normalizeDomainPortOverrides(): void
+    {
+        $normalized = DomainPortOverrides::normalize($this->fqdn, $this->domain_port_overrides);
+        $this->fqdn = $normalized['fqdn'];
+        $this->domain_port_overrides = $normalized['overrides'];
+    }
+
     /**
      * Check if all FQDNs have a port specified.
      */
@@ -276,6 +376,7 @@ class ServiceApplication extends BaseModel
             // Extract SERVICE_URL and SERVICE_FQDN variables DIRECTLY DECLARED in this service's environment
             // (not variables that are merely referenced with ${VAR} syntax)
             $portFound = null;
+            $declaresHttpUrl = false;
             foreach ($environment as $key => $value) {
                 if (is_int($key) && is_string($value)) {
                     // List-style: "- SERVICE_URL_APP_3000" or "- SERVICE_URL_APP_3000=value"
@@ -284,6 +385,7 @@ class ServiceApplication extends BaseModel
 
                     // Only process direct declarations
                     if ($envVarName->startsWith('SERVICE_FQDN_') || $envVarName->startsWith('SERVICE_URL_')) {
+                        $declaresHttpUrl = true;
                         // Parse to check if it has a port suffix
                         $parsed = parseServiceEnvironmentVariable($envVarName->value());
                         if ($parsed['has_port'] && $parsed['port']) {
@@ -298,6 +400,7 @@ class ServiceApplication extends BaseModel
 
                     // Only process direct declarations
                     if ($envVarName->startsWith('SERVICE_FQDN_') || $envVarName->startsWith('SERVICE_URL_')) {
+                        $declaresHttpUrl = true;
                         // Parse to check if it has a port suffix
                         $parsed = parseServiceEnvironmentVariable($envVarName->value());
                         if ($parsed['has_port'] && $parsed['port']) {
@@ -314,8 +417,12 @@ class ServiceApplication extends BaseModel
                 return $portFound;
             }
 
-            // No port-specific variables found for this service, return null
-            // (DO NOT fall back to service-level port, as that applies to all services)
+            // HTTP-facing compose services that only declare SERVICE_URL/FQDN (no _PORT
+            // suffix), such as WordPress, inherit the one-click template `# port:`.
+            if ($declaresHttpUrl) {
+                return $this->service->getRequiredPort();
+            }
+
             return null;
         } catch (\Throwable $e) {
             return null;
diff --git a/app/Models/ServiceDatabase.php b/app/Models/ServiceDatabase.php
index 603d11a7f3..c932791a78 100644
--- a/app/Models/ServiceDatabase.php
+++ b/app/Models/ServiceDatabase.php
@@ -2,12 +2,13 @@
 
 namespace App\Models;
 
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ServiceDatabase extends BaseModel
 {
-    use HasFactory, SoftDeletes;
+    use HasFactory, HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/SharedEnvironmentVariable.php b/app/Models/SharedEnvironmentVariable.php
index c70bf9f08a..086cc33e50 100644
--- a/app/Models/SharedEnvironmentVariable.php
+++ b/app/Models/SharedEnvironmentVariable.php
@@ -3,11 +3,14 @@
 namespace App\Models;
 
 use App\Support\ValidationPatterns;
+use App\Traits\Auditable;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Model;
 
 class SharedEnvironmentVariable extends Model
 {
+    use Auditable;
+
     protected $fillable = [
         // Core identification
         'key',
diff --git a/app/Models/SlackNotificationSettings.php b/app/Models/SlackNotificationSettings.php
index 62603685e9..648869bafe 100644
--- a/app/Models/SlackNotificationSettings.php
+++ b/app/Models/SlackNotificationSettings.php
@@ -20,6 +20,7 @@ class SlackNotificationSettings extends Model
         'deployment_success_slack_notifications',
         'deployment_failure_slack_notifications',
         'status_change_slack_notifications',
+        'restart_limit_reached_slack_notifications',
         'backup_success_slack_notifications',
         'backup_failure_slack_notifications',
         'scheduled_task_success_slack_notifications',
@@ -44,6 +45,7 @@ class SlackNotificationSettings extends Model
         'deployment_success_slack_notifications' => 'boolean',
         'deployment_failure_slack_notifications' => 'boolean',
         'status_change_slack_notifications' => 'boolean',
+        'restart_limit_reached_slack_notifications' => 'boolean',
         'backup_success_slack_notifications' => 'boolean',
         'backup_failure_slack_notifications' => 'boolean',
         'scheduled_task_success_slack_notifications' => 'boolean',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index 7ca45cc3b7..a627d00aa6 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -2,17 +2,24 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneClickhouse extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    protected array $auditExclude = ['last_online_at'];
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneDocker.php b/app/Models/StandaloneDocker.php
index 604a245fc7..e7e0a8c108 100644
--- a/app/Models/StandaloneDocker.php
+++ b/app/Models/StandaloneDocker.php
@@ -43,14 +43,20 @@ class StandaloneDocker extends BaseModel
             }
 
             $server = $newStandaloneDocker->server;
-            $safeNetwork = escapeshellarg($newStandaloneDocker->network);
             instant_remote_process([
-                "docker network inspect {$safeNetwork} >/dev/null 2>&1 || docker network create --driver overlay --attachable {$safeNetwork} >/dev/null",
+                $newStandaloneDocker->networkCreateCommand(),
             ], $server, false);
             ConnectProxyToNetworksJob::dispatchSync($server);
         });
     }
 
+    public function networkCreateCommand(): string
+    {
+        $safeNetwork = escapeshellarg($this->network);
+
+        return "docker network inspect {$safeNetwork} >/dev/null 2>&1 || docker network create --attachable {$safeNetwork} >/dev/null";
+    }
+
     public function setNetworkAttribute(string $value): void
     {
         if (! ValidationPatterns::isValidDockerNetwork($value)) {
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 769d9f00c4..8371bd0493 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -2,17 +2,22 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneDragonfly extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 15a1fe2f82..bbe55a4f5a 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -2,17 +2,22 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneKeydb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index 378d36395d..d35509ce99 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -2,10 +2,13 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\MorphTo;
@@ -13,7 +16,9 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMariadb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index 1010ca5f37..faf54e0e71 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -2,17 +2,22 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMongodb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 90828bf012..5a1ecb8425 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -2,17 +2,22 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMysql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index e7db812858..e91539d55b 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -2,17 +2,22 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandalonePostgresql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 3262611903..674f7867fd 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -2,17 +2,24 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
+use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneRedis extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+
+    protected array $auditExclude = ['last_online_at'];
+
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/Tag.php b/app/Models/Tag.php
index d5cccabd8f..30844b2bb6 100644
--- a/app/Models/Tag.php
+++ b/app/Models/Tag.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Traits\Auditable;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Support\Facades\DB;
 use OpenApi\Attributes as OA;
@@ -18,7 +19,7 @@ use OpenApi\Attributes as OA;
 )]
 class Tag extends BaseModel
 {
-    use HasSafeStringAttribute;
+    use Auditable, HasSafeStringAttribute;
 
     protected $fillable = [
         'name',
diff --git a/app/Models/Team.php b/app/Models/Team.php
index b7664e94d3..6ec79f2046 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -8,6 +8,7 @@ use App\Notifications\Channels\SendsDiscord;
 use App\Notifications\Channels\SendsEmail;
 use App\Notifications\Channels\SendsPushover;
 use App\Notifications\Channels\SendsSlack;
+use App\Traits\Auditable;
 use App\Traits\HasNotificationSettings;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -39,7 +40,7 @@ use OpenApi\Attributes as OA;
 
 class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, SendsSlack
 {
-    use HasFactory, HasNotificationSettings, HasSafeStringAttribute, Notifiable;
+    use Auditable, HasFactory, HasNotificationSettings, HasSafeStringAttribute, Notifiable;
 
     protected $fillable = [
         'name',
@@ -86,8 +87,11 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
             }
 
             // Transfer instance-wide sources to root team so they remain available
-            GithubApp::where('team_id', $team->id)->where('is_system_wide', true)->update(['team_id' => 0]);
-            GitlabApp::where('team_id', $team->id)->where('is_system_wide', true)->update(['team_id' => 0]);
+            $systemWideSources = GithubApp::where('team_id', $team->id)->where('is_system_wide', true)->get()
+                ->concat(GitlabApp::where('team_id', $team->id)->where('is_system_wide', true)->get());
+            foreach ($systemWideSources as $source) {
+                $source->update(['team_id' => 0]);
+            }
 
             // Delete non-instance-wide sources owned by this team
             $teamSources = GithubApp::where('team_id', $team->id)->get()
@@ -275,13 +279,22 @@ class Team extends Model implements SendsDiscord, SendsEmail, SendsPushover, Sen
         return $this->hasMany(TeamInvitation::class);
     }
 
-    public function isEmpty()
+    /**
+     * @return array<string, int>
+     */
+    public function deletionBlockers(): array
     {
-        if ($this->projects()->count() === 0 && $this->servers()->count() === 0 && $this->privateKeys()->count() === 0 && $this->sources()->count() === 0) {
-            return true;
-        }
+        return array_filter([
+            'projects' => $this->projects()->count(),
+            'servers' => $this->servers()->count(),
+            'sources' => GithubApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count()
+                + GitlabApp::query()->where('team_id', $this->id)->where('is_system_wide', false)->count(),
+        ]);
+    }
 
-        return false;
+    public function isEmpty(): bool
+    {
+        return $this->deletionBlockers() === [];
     }
 
     public function projects()
diff --git a/app/Models/TelegramNotificationSettings.php b/app/Models/TelegramNotificationSettings.php
index 8c644f9bcf..3376e239d6 100644
--- a/app/Models/TelegramNotificationSettings.php
+++ b/app/Models/TelegramNotificationSettings.php
@@ -21,6 +21,7 @@ class TelegramNotificationSettings extends Model
         'deployment_success_telegram_notifications',
         'deployment_failure_telegram_notifications',
         'status_change_telegram_notifications',
+        'restart_limit_reached_telegram_notifications',
         'backup_success_telegram_notifications',
         'backup_failure_telegram_notifications',
         'scheduled_task_success_telegram_notifications',
@@ -36,6 +37,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id',
         'telegram_notifications_deployment_failure_thread_id',
         'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_restart_limit_reached_thread_id',
         'telegram_notifications_backup_success_thread_id',
         'telegram_notifications_backup_failure_thread_id',
         'telegram_notifications_scheduled_task_success_thread_id',
@@ -55,6 +57,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id',
         'telegram_notifications_deployment_failure_thread_id',
         'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_restart_limit_reached_thread_id',
         'telegram_notifications_backup_success_thread_id',
         'telegram_notifications_backup_failure_thread_id',
         'telegram_notifications_scheduled_task_success_thread_id',
@@ -76,6 +79,7 @@ class TelegramNotificationSettings extends Model
         'deployment_success_telegram_notifications' => 'boolean',
         'deployment_failure_telegram_notifications' => 'boolean',
         'status_change_telegram_notifications' => 'boolean',
+        'restart_limit_reached_telegram_notifications' => 'boolean',
         'backup_success_telegram_notifications' => 'boolean',
         'backup_failure_telegram_notifications' => 'boolean',
         'scheduled_task_success_telegram_notifications' => 'boolean',
@@ -90,6 +94,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id' => 'encrypted',
         'telegram_notifications_deployment_failure_thread_id' => 'encrypted',
         'telegram_notifications_status_change_thread_id' => 'encrypted',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'encrypted',
         'telegram_notifications_backup_success_thread_id' => 'encrypted',
         'telegram_notifications_backup_failure_thread_id' => 'encrypted',
         'telegram_notifications_scheduled_task_success_thread_id' => 'encrypted',
diff --git a/app/Models/WebhookNotificationSettings.php b/app/Models/WebhookNotificationSettings.php
index c6a81b50a8..7ffd20a8c3 100644
--- a/app/Models/WebhookNotificationSettings.php
+++ b/app/Models/WebhookNotificationSettings.php
@@ -20,6 +20,7 @@ class WebhookNotificationSettings extends Model
         'deployment_success_webhook_notifications',
         'deployment_failure_webhook_notifications',
         'status_change_webhook_notifications',
+        'restart_limit_reached_webhook_notifications',
         'backup_success_webhook_notifications',
         'backup_failure_webhook_notifications',
         'scheduled_task_success_webhook_notifications',
@@ -46,6 +47,7 @@ class WebhookNotificationSettings extends Model
             'deployment_success_webhook_notifications' => 'boolean',
             'deployment_failure_webhook_notifications' => 'boolean',
             'status_change_webhook_notifications' => 'boolean',
+            'restart_limit_reached_webhook_notifications' => 'boolean',
             'backup_success_webhook_notifications' => 'boolean',
             'backup_failure_webhook_notifications' => 'boolean',
             'scheduled_task_success_webhook_notifications' => 'boolean',
diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
index 635dfdbdce..687fd30867 100644
--- a/app/Notifications/Application/RestartLimitReached.php
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -2,7 +2,8 @@
 
 namespace App\Notifications\Application;
 
-use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\BaseModel;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
@@ -27,26 +28,40 @@ class RestartLimitReached extends CustomEmailNotification
 
     public int $max_restart_count;
 
-    public function __construct(public Application $resource)
+    public function __construct(public BaseModel $resource)
     {
         $this->onQueue('high');
         $this->afterCommit();
-        $this->resource_name = data_get($resource, 'name');
-        $this->project_uuid = data_get($resource, 'environment.project.uuid');
-        $this->environment_uuid = data_get($resource, 'environment.uuid');
-        $this->environment_name = data_get($resource, 'environment.name');
+        $environment = data_get($resource, 'environment')
+            ?? data_get($resource, 'application.environment')
+            ?? data_get($resource, 'service.environment');
+        $this->resource_name = $resource instanceof ApplicationPreview
+            ? data_get($resource, 'application.name').' PR #'.$resource->pull_request_id
+            : data_get($resource, 'name');
+        $this->project_uuid = data_get($environment, 'project.uuid');
+        $this->environment_uuid = data_get($environment, 'uuid');
+        $this->environment_name = data_get($environment, 'name');
         $this->fqdn = data_get($resource, 'fqdn', null);
         $this->restart_count = $resource->restart_count;
-        $this->max_restart_count = $resource->max_restart_count;
+        $this->max_restart_count = method_exists($resource, 'restartLimitMaximum')
+            ? $resource->restartLimitMaximum()
+            : $resource->max_restart_count;
         if (str($this->fqdn)->explode(',')->count() > 1) {
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
-        $this->resource_url = $this->resource->link() ?? base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/application/{$this->resource->uuid}";
+        $service = data_get($resource, 'service');
+        $this->resource_url = match (true) {
+            method_exists($this->resource, 'link') => $this->resource->link(),
+            $resource instanceof ApplicationPreview => $resource->application->link(),
+            is_object($service) && method_exists($service, 'link') => $service->link(),
+            default => null,
+        };
+        $this->resource_url ??= base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}";
     }
 
     public function via(object $notifiable): array
     {
-        return $notifiable->getEnabledChannels('status_change');
+        return $notifiable->getEnabledChannels('restart_limit_reached');
     }
 
     public function toMail(): MailMessage
@@ -68,7 +83,7 @@ class RestartLimitReached extends CustomEmailNotification
     {
         return new DiscordMessage(
             title: ':warning: Restart limit reached',
-            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Application in Coolify]({$this->resource_url})",
+            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Resource in Coolify]({$this->resource_url})",
             color: DiscordMessage::errorColor(),
             isCritical: true,
         );
@@ -82,7 +97,7 @@ class RestartLimitReached extends CustomEmailNotification
             'message' => $message,
             'buttons' => [
                 [
-                    'text' => 'Open Application in Coolify',
+                    'text' => 'Open Resource in Coolify',
                     'url' => $this->resource_url,
                 ],
             ],
@@ -99,7 +114,7 @@ class RestartLimitReached extends CustomEmailNotification
             message: $message,
             buttons: [
                 [
-                    'text' => 'Open Application in Coolify',
+                    'text' => 'Open Resource in Coolify',
                     'url' => $this->resource_url,
                 ],
             ],
@@ -110,10 +125,13 @@ class RestartLimitReached extends CustomEmailNotification
     {
         $title = 'Restart limit reached';
         $description = "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count})";
+        $environment = data_get($this->resource, 'environment')
+            ?? data_get($this->resource, 'application.environment')
+            ?? data_get($this->resource, 'service.environment');
 
-        $description .= "\n\n*Project:* ".data_get($this->resource, 'environment.project.name');
+        $description .= "\n\n*Project:* ".data_get($environment, 'project.name');
         $description .= "\n*Environment:* {$this->environment_name}";
-        $description .= "\n*Application URL:* {$this->resource_url}";
+        $description .= "\n*Resource URL:* {$this->resource_url}";
 
         return new SlackMessage(
             title: $title,
@@ -130,6 +148,8 @@ class RestartLimitReached extends CustomEmailNotification
             'event' => 'restart_limit_reached',
             'application_name' => $this->resource_name,
             'application_uuid' => $this->resource->uuid,
+            'resource_name' => $this->resource_name,
+            'resource_uuid' => $this->resource->uuid,
             'restart_count' => $this->restart_count,
             'max_restart_count' => $this->max_restart_count,
             'url' => $this->resource_url,
diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index c2fa3ff10d..4f311bf681 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -3,6 +3,21 @@
 namespace App\Notifications\Channels;
 
 use App\Jobs\SendMessageToTelegramJob;
+use App\Notifications\Application\DeploymentFailed;
+use App\Notifications\Application\DeploymentSuccess;
+use App\Notifications\Application\RestartLimitReached;
+use App\Notifications\Application\StatusChanged;
+use App\Notifications\Container\ContainerRestarted;
+use App\Notifications\Database\BackupFailed;
+use App\Notifications\Database\BackupSuccess;
+use App\Notifications\ScheduledTask\TaskFailed;
+use App\Notifications\ScheduledTask\TaskSuccess;
+use App\Notifications\Server\DockerCleanupFailed;
+use App\Notifications\Server\DockerCleanupSuccess;
+use App\Notifications\Server\HighDiskUsage;
+use App\Notifications\Server\Reachable;
+use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\Unreachable;
 
 class TelegramChannel
 {
@@ -17,24 +32,24 @@ class TelegramChannel
         $chatId = $settings->telegram_chat_id;
 
         $threadId = match (get_class($notification)) {
-            \App\Notifications\Application\DeploymentSuccess::class => $settings->telegram_notifications_deployment_success_thread_id,
-            \App\Notifications\Application\DeploymentFailed::class => $settings->telegram_notifications_deployment_failure_thread_id,
-            \App\Notifications\Application\StatusChanged::class,
-            \App\Notifications\Container\ContainerRestarted::class,
-            \App\Notifications\Container\ContainerStopped::class => $settings->telegram_notifications_status_change_thread_id,
+            DeploymentSuccess::class => $settings->telegram_notifications_deployment_success_thread_id,
+            DeploymentFailed::class => $settings->telegram_notifications_deployment_failure_thread_id,
+            StatusChanged::class,
+            ContainerRestarted::class => $settings->telegram_notifications_status_change_thread_id,
+            RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id,
 
-            \App\Notifications\Database\BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
-            \App\Notifications\Database\BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
+            BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
+            BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
 
-            \App\Notifications\ScheduledTask\TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
-            \App\Notifications\ScheduledTask\TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
+            TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
+            TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
 
-            \App\Notifications\Server\DockerCleanupSuccess::class => $settings->telegram_notifications_docker_cleanup_success_thread_id,
-            \App\Notifications\Server\DockerCleanupFailed::class => $settings->telegram_notifications_docker_cleanup_failure_thread_id,
-            \App\Notifications\Server\HighDiskUsage::class => $settings->telegram_notifications_server_disk_usage_thread_id,
-            \App\Notifications\Server\Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
-            \App\Notifications\Server\Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
-            \App\Notifications\Server\ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
+            DockerCleanupSuccess::class => $settings->telegram_notifications_docker_cleanup_success_thread_id,
+            DockerCleanupFailed::class => $settings->telegram_notifications_docker_cleanup_failure_thread_id,
+            HighDiskUsage::class => $settings->telegram_notifications_server_disk_usage_thread_id,
+            Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
+            Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
+            ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
 
             default => null,
         };
diff --git a/app/Notifications/Container/ContainerStopped.php b/app/Notifications/Container/ContainerStopped.php
deleted file mode 100644
index f518cd2fdd..0000000000
--- a/app/Notifications/Container/ContainerStopped.php
+++ /dev/null
@@ -1,123 +0,0 @@
-<?php
-
-namespace App\Notifications\Container;
-
-use App\Models\Server;
-use App\Notifications\CustomEmailNotification;
-use App\Notifications\Dto\DiscordMessage;
-use App\Notifications\Dto\PushoverMessage;
-use App\Notifications\Dto\SlackMessage;
-use Illuminate\Notifications\Messages\MailMessage;
-
-class ContainerStopped extends CustomEmailNotification
-{
-    public function __construct(public string $name, public Server $server, public ?string $url = null)
-    {
-        $this->onQueue('high');
-    }
-
-    public function via(object $notifiable): array
-    {
-        return $notifiable->getEnabledChannels('status_change');
-    }
-
-    public function toMail(): MailMessage
-    {
-        $mail = new MailMessage;
-        $mail->subject("Coolify: A resource  has been stopped unexpectedly on {$this->server->name}");
-        $mail->view('emails.container-stopped', [
-            'containerName' => $this->name,
-            'serverName' => $this->server->name,
-            'url' => $this->url,
-        ]);
-
-        return $mail;
-    }
-
-    public function toDiscord(): DiscordMessage
-    {
-        $message = new DiscordMessage(
-            title: ':cross_mark: Resource stopped',
-            description: "{$this->name} has been stopped unexpectedly on {$this->server->name}.",
-            color: DiscordMessage::errorColor(),
-        );
-
-        if ($this->url) {
-            $message->addField('Resource', '[Link]('.$this->url.')');
-        }
-
-        return $message;
-    }
-
-    public function toTelegram(): array
-    {
-        $message = "Coolify: A resource ($this->name) has been stopped unexpectedly on {$this->server->name}";
-        $payload = [
-            'message' => $message,
-        ];
-        if ($this->url) {
-            $payload['buttons'] = [
-                [
-                    [
-                        'text' => 'Open Application in Coolify',
-                        'url' => $this->url,
-                    ],
-                ],
-            ];
-        }
-
-        return $payload;
-    }
-
-    public function toPushover(): PushoverMessage
-    {
-        $buttons = [];
-        if ($this->url) {
-            $buttons[] = [
-                'text' => 'Open Application in Coolify',
-                'url' => $this->url,
-            ];
-        }
-
-        return new PushoverMessage(
-            title: 'Resource stopped',
-            level: 'error',
-            message: "A resource ({$this->name}) has been stopped unexpectedly on {$this->server->name}",
-            buttons: $buttons,
-        );
-    }
-
-    public function toSlack(): SlackMessage
-    {
-        $title = 'Resource stopped';
-        $description = "A resource ({$this->name}) has been stopped unexpectedly on {$this->server->name}";
-
-        if ($this->url) {
-            $description .= "\n*Resource URL:* {$this->url}";
-        }
-
-        return new SlackMessage(
-            title: $title,
-            description: $description,
-            color: SlackMessage::errorColor()
-        );
-    }
-
-    public function toWebhook(): array
-    {
-        $data = [
-            'success' => false,
-            'message' => 'Resource stopped unexpectedly',
-            'event' => 'container_stopped',
-            'container_name' => $this->name,
-            'server_name' => $this->server->name,
-            'server_uuid' => $this->server->uuid,
-        ];
-
-        if ($this->url) {
-            $data['url'] = $this->url;
-        }
-
-        return $data;
-    }
-}
diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
index dfa3bb3314..b5ca1922eb 100644
--- a/app/Providers/FortifyServiceProvider.php
+++ b/app/Providers/FortifyServiceProvider.php
@@ -9,10 +9,8 @@ use App\Actions\Fortify\UpdateUserProfileInformation;
 use App\Models\OauthSetting;
 use App\Models\TeamInvitation;
 use App\Models\User;
-use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 use Laravel\Fortify\Contracts\RegisterResponse;
 use Laravel\Fortify\Fortify;
@@ -122,45 +120,5 @@ class FortifyServiceProvider extends ServiceProvider
         Fortify::twoFactorChallengeView(function () {
             return view('auth.two-factor-challenge');
         });
-
-        RateLimiter::for('force-password-reset', function (Request $request) {
-            return Limit::perMinute(15)->by($request->user()->id);
-        });
-
-        RateLimiter::for('forgot-password', function (Request $request) {
-            // Use real client IP (not spoofable forwarded headers)
-            $realIp = $request->server('REMOTE_ADDR') ?? $request->ip();
-
-            $limits = [
-                Limit::perMinutes(10, 3)->by('forgot-password:ip:'.sha1($realIp)),
-            ];
-
-            $emailIdentity = normalize_email_identity($request->input('email'));
-            if ($emailIdentity !== null) {
-                $limits[] = Limit::perHour(3)->by('forgot-password:email-identity:'.sha1($emailIdentity));
-            }
-
-            return $limits;
-        });
-
-        RateLimiter::for('login', function (Request $request) {
-            $email = (string) $request->email;
-            // Use email + real client IP (not spoofable forwarded headers)
-            // server('REMOTE_ADDR') gives the actual connecting IP before proxy headers
-            $realIp = $request->server('REMOTE_ADDR') ?? $request->ip();
-
-            return Limit::perMinute(5)->by($email.'|'.$realIp);
-        });
-
-        RateLimiter::for('magic-link', function (Request $request) {
-            $realIp = $request->server('REMOTE_ADDR') ?? $request->ip();
-            $token = (string) $request->input('token');
-
-            return Limit::perMinute(5)->by(hash('sha256', $token.'|'.$realIp));
-        });
-
-        RateLimiter::for('two-factor', function (Request $request) {
-            return Limit::perMinute(5)->by($request->session()->get('login.id'));
-        });
     }
 }
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 4068572c81..79139c6b93 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -58,5 +58,34 @@ class RouteServiceProvider extends ServiceProvider
         RateLimiter::for('feedback', function (Request $request) {
             return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
         });
+
+        RateLimiter::for('login', function (Request $request) {
+            return Limit::perMinute(5)->by((string) $request->email.'|'.auth_rate_limit_ip($request));
+        });
+
+        RateLimiter::for('two-factor', function (Request $request) {
+            return Limit::perMinute(5)->by($request->session()->get('login.id'));
+        });
+
+        RateLimiter::for('forgot-password', function (Request $request) {
+            $limits = [
+                Limit::perMinutes(10, 3)->by('forgot-password:ip:'.sha1(auth_rate_limit_ip($request))),
+            ];
+
+            $emailIdentity = normalize_email_identity($request->input('email'));
+            if ($emailIdentity !== null) {
+                $limits[] = Limit::perHour(3)->by('forgot-password:email-identity:'.sha1($emailIdentity));
+            }
+
+            return $limits;
+        });
+
+        RateLimiter::for('magic-link', function (Request $request) {
+            return Limit::perMinute(5)->by(hash('sha256', (string) $request->input('token').'|'.auth_rate_limit_ip($request)));
+        });
+
+        RateLimiter::for('force-password-reset', function (Request $request) {
+            return Limit::perMinute(15)->by($request->user()->id);
+        });
     }
 }
diff --git a/app/Services/ContainerStatusAggregator.php b/app/Services/ContainerStatusAggregator.php
index 8859a99809..3a59ad58fa 100644
--- a/app/Services/ContainerStatusAggregator.php
+++ b/app/Services/ContainerStatusAggregator.php
@@ -18,14 +18,13 @@ use Illuminate\Support\Facades\Log;
  * State Priority (highest to lowest):
  * 1. Degraded (from sub-resources) → degraded:unhealthy
  * 2. Restarting → degraded:unhealthy (or restarting:unknown if preserveRestarting=true)
- * 3. Crash Loop (exited with restarts) → degraded:unhealthy
- * 4. Mixed (running + exited) → degraded:unhealthy
- * 5. Mixed (running + starting) → starting:unknown
- * 6. Running → running:healthy/unhealthy/unknown
- * 7. Dead/Removing → degraded:unhealthy
- * 8. Paused → paused:unknown
- * 9. Starting/Created → starting:unknown
- * 10. Exited → exited
+ * 3. Mixed (running + exited) → degraded:unhealthy
+ * 4. Mixed (running + starting) → starting:unknown
+ * 5. Running → running:healthy/unhealthy/unknown
+ * 6. Dead/Removing → degraded:unhealthy
+ * 7. Paused → paused:unknown
+ * 8. Starting/Created → starting:unknown
+ * 9. Exited → exited
  *
  * The $preserveRestarting parameter controls whether "restarting" containers should be
  * reported as "restarting:unknown" (true) or "degraded:unhealthy" (false, default).
@@ -228,23 +227,18 @@ class ContainerStatusAggregator
             return $preserveRestarting ? 'restarting:unknown' : 'degraded:unhealthy';
         }
 
-        // Priority 3: Crash loop detection (exited with restart count > 0)
-        if ($hasExited && $maxRestartCount > 0) {
-            return 'degraded:unhealthy';
-        }
-
-        // Priority 4: Mixed state (some running, some exited = degraded)
+        // Priority 3: Mixed state (some running, some exited = degraded)
         if ($hasRunning && $hasExited) {
             return 'degraded:unhealthy';
         }
 
-        // Priority 5: Mixed state (some running, some starting = still starting)
+        // Priority 4: Mixed state (some running, some starting = still starting)
         // If any component is still starting, the entire service stack is not fully ready
         if ($hasRunning && $hasStarting) {
             return 'starting:unknown';
         }
 
-        // Priority 6: Running containers (check health status)
+        // Priority 5: Running containers (check health status)
         if ($hasRunning) {
             if ($hasUnhealthy) {
                 return 'running:unhealthy';
@@ -255,22 +249,22 @@ class ContainerStatusAggregator
             }
         }
 
-        // Priority 7: Dead or removing containers
+        // Priority 6: Dead or removing containers
         if ($hasDead) {
             return 'degraded:unhealthy';
         }
 
-        // Priority 8: Paused containers
+        // Priority 7: Paused containers
         if ($hasPaused) {
             return 'paused:unknown';
         }
 
-        // Priority 9: Starting/created containers
+        // Priority 8: Starting/created containers
         if ($hasStarting) {
             return 'starting:unknown';
         }
 
-        // Priority 10: All containers exited (no restart count = truly stopped)
+        // Priority 9: All containers exited
         return 'exited';
     }
 }
diff --git a/app/Services/DatabaseStartCommandExecutor.php b/app/Services/DatabaseStartCommandExecutor.php
new file mode 100644
index 0000000000..dab3599101
--- /dev/null
+++ b/app/Services/DatabaseStartCommandExecutor.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\ProcessStatus;
+use App\Helpers\SshMultiplexingHelper;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Process;
+use Spatie\Activitylog\Models\Activity;
+
+class DatabaseStartCommandExecutor
+{
+    public function execute(array $commands, Model $database, Activity $activity): Activity
+    {
+        $server = $database->destination->server;
+        if ($server->isNonRoot()) {
+            $commands = parseCommandsByLineForSudo(collect($commands), $server)->all();
+        }
+
+        $secrets = method_exists($database, 'resolvedSecretManagerValuesForRedaction')
+            ? $database->resolvedSecretManagerValuesForRedaction()
+            : [];
+        $remoteCommand = SshMultiplexingHelper::generateSshCommand($server, implode("\n", $commands));
+
+        $activity->properties = $activity->properties->merge(['status' => ProcessStatus::IN_PROGRESS->value]);
+        $activity->save();
+
+        $process = Process::timeout(config('constants.ssh.command_timeout'))
+            ->idleTimeout(3600)
+            ->start($remoteCommand, function (string $type, string $output) use ($activity, $secrets): void {
+                $this->appendOutput($activity, $type, $this->redact($output, $secrets));
+            });
+
+        $result = $process->wait();
+        $status = $result->successful() ? ProcessStatus::FINISHED : ProcessStatus::ERROR;
+        $activity->properties = $activity->properties->merge([
+            'status' => $status->value,
+            'exitCode' => $result->exitCode(),
+        ]);
+        $activity->save();
+
+        if (! $result->successful()) {
+            throw new \RuntimeException($this->redact($result->errorOutput(), $secrets), $result->exitCode());
+        }
+
+        return $activity;
+    }
+
+    private function redact(string $value, array $secrets): string
+    {
+        foreach ($secrets as $secret) {
+            if (is_string($secret) && $secret !== '') {
+                $value = str_replace($secret, REDACTED, $value);
+            }
+        }
+
+        return sanitize_utf8_text(remove_iip($value));
+    }
+
+    private function appendOutput(Activity $activity, string $type, string $output): void
+    {
+        if ($output === '') {
+            return;
+        }
+
+        $entries = json_decode($activity->description ?: '[]', true, flags: JSON_THROW_ON_ERROR);
+        $entries[] = [
+            'type' => $type,
+            'output' => $output,
+            'timestamp' => hrtime(true),
+            'batch' => 1,
+            'order' => count($entries) + 1,
+        ];
+        $activity->description = json_encode($entries, flags: JSON_THROW_ON_ERROR | JSON_UNESCAPED_UNICODE);
+        $activity->save();
+    }
+}
diff --git a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
index 386bdd5bb9..e3ba77163d 100644
--- a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
+++ b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
@@ -7,6 +7,7 @@ use App\Models\EnvironmentVariable;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
 use App\Services\DeploymentConfiguration\Concerns\SummarizesDiffText;
+use App\Support\DomainPortOverrides;
 use Illuminate\Support\Arr;
 
 class ApplicationConfigurationSnapshot
@@ -194,6 +195,7 @@ class ApplicationConfigurationSnapshot
     {
         return [
             $this->item('fqdn', 'Domains', $this->application->fqdn, 'redeploy'),
+            $this->item('domain_port_overrides', 'Domain port overrides', DomainPortOverrides::sorted($this->application->domain_port_overrides), 'redeploy'),
             $this->item('noindex_domains', 'Search engine indexing', $this->application->noindexDomains()->all(), 'redeploy'),
             $this->item('docker_compose_domains', 'Service domains', $this->decodedComposeDomains(), 'redeploy', displayValue: $this->summarizeText($this->composeDomainsText()), displayFull: $this->composeDomainsText(), diffMode: 'lines'),
             $this->item('redirect', 'Redirect', $this->application->redirect, 'redeploy'),
diff --git a/app/Services/DopplerService.php b/app/Services/DopplerService.php
new file mode 100644
index 0000000000..2513a4f7d8
--- /dev/null
+++ b/app/Services/DopplerService.php
@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+
+class DopplerService
+{
+    private string $baseUrl = 'https://api.doppler.com';
+
+    public function __construct(private string $token) {}
+
+    public function validate(): bool
+    {
+        try {
+            return $this->client()->get($this->baseUrl.'/v3/me')->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Download all secrets for a config. Project and config are not needed for
+     * service tokens (the token itself is pinned to one config).
+     *
+     * @return array<string, string>
+     */
+    public function fetchSecrets(?string $project = null, ?string $config = null): array
+    {
+        $query = ['format' => 'json'];
+        if (filled($project)) {
+            $query['project'] = $project;
+        }
+        if (filled($config)) {
+            $query['config'] = $config;
+        }
+
+        $response = $this->client()->get($this->baseUrl.'/v3/configs/config/secrets/download', $query);
+
+        if (! $response->successful()) {
+            throw new \RuntimeException('Doppler API error: '.($response->json('messages.0') ?? 'HTTP '.$response->status()));
+        }
+
+        return collect($response->json())
+            ->map(fn ($value) => is_string($value) ? $value : json_encode($value))
+            ->all();
+    }
+
+    private function client(): PendingRequest
+    {
+        return Http::withToken($this->token)
+            ->acceptJson()
+            ->connectTimeout(5)
+            ->timeout(10);
+    }
+}
diff --git a/app/Services/InfisicalService.php b/app/Services/InfisicalService.php
new file mode 100644
index 0000000000..06f1e5d49f
--- /dev/null
+++ b/app/Services/InfisicalService.php
@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Services;
+
+use App\Rules\SafeExternalUrl;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Validator;
+
+class InfisicalService
+{
+    private string $baseUrl;
+
+    /** @var array<string, mixed> */
+    private array $httpClientOptions;
+
+    public function __construct(string $baseUrl, private string $clientId, private string $clientSecret)
+    {
+        $this->baseUrl = rtrim($baseUrl, '/');
+        Validator::make(['base_url' => $this->baseUrl], ['base_url' => new SafeExternalUrl])->validate();
+        $this->httpClientOptions = SafeExternalUrl::httpClientOptions($this->baseUrl);
+    }
+
+    public function validate(): bool
+    {
+        try {
+            $this->login();
+
+            return true;
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function fetchSecrets(string $projectId, string $environment, string $secretPath = '/'): array
+    {
+        $client = $this->client()->withToken($this->login());
+        $secretPath = $secretPath ?: '/';
+
+        $response = $client->get($this->baseUrl.'/api/v4/secrets', [
+            'projectId' => $projectId,
+            'environment' => $environment,
+            'secretPath' => $secretPath,
+        ]);
+
+        // Older self-hosted instances only expose the v3 endpoint.
+        if ($response->status() === 404) {
+            $response = $client->get($this->baseUrl.'/api/v3/secrets/raw', [
+                'workspaceId' => $projectId,
+                'environment' => $environment,
+                'secretPath' => $secretPath,
+            ]);
+        }
+
+        if (! $response->successful()) {
+            throw new \RuntimeException('Infisical API error: '.($response->json('message') ?? 'HTTP '.$response->status()));
+        }
+
+        return collect($response->json('secrets', []))
+            ->mapWithKeys(fn ($secret) => [(string) data_get($secret, 'secretKey') => (string) data_get($secret, 'secretValue', '')])
+            ->all();
+    }
+
+    private function login(): string
+    {
+        $response = $this->client()->post($this->baseUrl.'/api/v1/auth/universal-auth/login', [
+            'clientId' => $this->clientId,
+            'clientSecret' => $this->clientSecret,
+        ]);
+
+        $accessToken = $response->json('accessToken');
+        if (! $response->successful() || blank($accessToken)) {
+            throw new \RuntimeException('Infisical login failed: '.($response->json('message') ?? 'HTTP '.$response->status()));
+        }
+
+        return $accessToken;
+    }
+
+    private function client(): PendingRequest
+    {
+        return Http::acceptJson()
+            ->withOptions($this->httpClientOptions)
+            ->connectTimeout(5)
+            ->timeout(10);
+    }
+}
diff --git a/app/Services/IntegrationTokenValidator.php b/app/Services/IntegrationTokenValidator.php
new file mode 100644
index 0000000000..6033ce98f7
--- /dev/null
+++ b/app/Services/IntegrationTokenValidator.php
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Services;
+
+/**
+ * Validates an integration token against its provider API before it is saved.
+ */
+class IntegrationTokenValidator
+{
+    public function validate(string $provider, string $token, array $capabilities, array $metadata = []): bool
+    {
+        return match ($provider) {
+            'cloudflare' => app(CloudflareTokenValidator::class)->validate($token, $capabilities),
+            'doppler' => (new DopplerService($token))->validate(),
+            'infisical' => (new InfisicalService(
+                (string) data_get($metadata, 'base_url', 'https://app.infisical.com'),
+                (string) data_get($metadata, 'client_id'),
+                $token,
+            ))->validate(),
+            'vault' => (new VaultService(
+                (string) data_get($metadata, 'base_url'),
+                $token,
+                data_get($metadata, 'namespace'),
+            ))->validate(),
+            default => false,
+        };
+    }
+
+    public function errorMessage(string $provider): string
+    {
+        return match ($provider) {
+            'cloudflare' => 'The token could not access the selected Cloudflare capabilities. Check its permissions and zone resources.',
+            'doppler' => 'The Doppler token could not be verified. Check the token and its access.',
+            'infisical' => 'Infisical login failed. Check the base URL, the client ID, and the client secret.',
+            'vault' => 'The Vault token could not be verified. Check the base URL, the namespace, and the token.',
+            default => 'The token could not be verified.',
+        };
+    }
+}
diff --git a/app/Services/RestartCountTracker.php b/app/Services/RestartCountTracker.php
new file mode 100644
index 0000000000..e67deacb3c
--- /dev/null
+++ b/app/Services/RestartCountTracker.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Services;
+
+class RestartCountTracker
+{
+    /**
+     * @return array{restart_count: int, restart_count_changed: bool, restart_limit_reached: bool, new_generation: bool}
+     */
+    public function evaluate(
+        int $previousRestartCount,
+        int $observedRestartCount,
+        int $maxRestartCount,
+        bool $newGenerationConfirmed = false,
+    ): array {
+        $newGeneration = $newGenerationConfirmed
+            && $observedRestartCount < $previousRestartCount;
+        $restartCountIncreased = $observedRestartCount > $previousRestartCount;
+        $restartCountChanged = $newGeneration || $restartCountIncreased;
+
+        $restartLimitReached = $maxRestartCount > 0
+            && $observedRestartCount >= $maxRestartCount;
+
+        return [
+            'restart_count' => $restartCountChanged ? $observedRestartCount : $previousRestartCount,
+            'restart_count_changed' => $restartCountChanged,
+            'restart_limit_reached' => $restartLimitReached,
+            'new_generation' => $newGeneration,
+        ];
+    }
+}
diff --git a/app/Services/VaultService.php b/app/Services/VaultService.php
new file mode 100644
index 0000000000..e41652cd54
--- /dev/null
+++ b/app/Services/VaultService.php
@@ -0,0 +1,68 @@
+<?php
+
+namespace App\Services;
+
+use App\Rules\SafeExternalUrl;
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Validator;
+
+class VaultService
+{
+    private string $baseUrl;
+
+    /** @var array<string, mixed> */
+    private array $httpClientOptions;
+
+    public function __construct(string $baseUrl, private string $token, private ?string $namespace = null)
+    {
+        $this->baseUrl = rtrim($baseUrl, '/');
+        Validator::make(['base_url' => $this->baseUrl], ['base_url' => new SafeExternalUrl])->validate();
+        $this->httpClientOptions = SafeExternalUrl::httpClientOptions($this->baseUrl);
+    }
+
+    public function validate(): bool
+    {
+        try {
+            return $this->client()->get($this->baseUrl.'/v1/auth/token/lookup-self')->successful();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
+    /**
+     * Read a KV v2 secret. Non-string values are stored as JSON strings.
+     *
+     * @return array<string, string>
+     */
+    public function fetchSecrets(string $mount, string $path): array
+    {
+        $mount = trim($mount, '/');
+        $path = trim($path, '/');
+
+        $response = $this->client()->get($this->baseUrl."/v1/{$mount}/data/{$path}");
+
+        if (! $response->successful()) {
+            throw new \RuntimeException('Vault API error: '.($response->json('errors.0') ?? 'HTTP '.$response->status()));
+        }
+
+        return collect($response->json('data.data', []))
+            ->map(fn ($value) => is_string($value) ? $value : json_encode($value))
+            ->all();
+    }
+
+    private function client(): PendingRequest
+    {
+        $client = Http::withHeaders(['X-Vault-Token' => $this->token])
+            ->acceptJson()
+            ->withOptions($this->httpClientOptions)
+            ->connectTimeout(5)
+            ->timeout(10);
+
+        if (filled($this->namespace)) {
+            $client = $client->withHeaders(['X-Vault-Namespace' => $this->namespace]);
+        }
+
+        return $client;
+    }
+}
diff --git a/app/Support/DatabaseBackupFileValidator.php b/app/Support/DatabaseBackupFileValidator.php
index 2c1de948ba..84e629fe1a 100644
--- a/app/Support/DatabaseBackupFileValidator.php
+++ b/app/Support/DatabaseBackupFileValidator.php
@@ -90,8 +90,11 @@ class DatabaseBackupFileValidator
 
     public static function containsPostgresqlProgramExecution(string $sql): bool
     {
+        $requireStatementBoundary = true;
+
         if (str_starts_with($sql, 'PGDMP')) {
-            return false;
+            $sql = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]+/', "\n", $sql) ?? $sql;
+            $requireStatementBoundary = false;
         }
 
         $withoutComments = self::stripSqlComments($sql);
@@ -100,7 +103,9 @@ class DatabaseBackupFileValidator
             return true;
         }
 
-        return preg_match('/(?:^|;)\s*copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
+        $copyPrefix = $requireStatementBoundary ? '(?:^|;)\s*' : '\b';
+
+        return preg_match('/'.$copyPrefix.'copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
     }
 
     private static function extensionFor(string $name): ?string
diff --git a/app/Support/DomainPortOverrides.php b/app/Support/DomainPortOverrides.php
new file mode 100644
index 0000000000..320540ad68
--- /dev/null
+++ b/app/Support/DomainPortOverrides.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Support;
+
+class DomainPortOverrides
+{
+    /**
+     * @param  array<string, int|string>|null  $overrides
+     * @return array<string, int|string>
+     */
+    public static function sorted(?array $overrides): array
+    {
+        return collect($overrides ?? [])->sortKeys()->all();
+    }
+
+    public static function withoutPort(string $url): string
+    {
+        $parts = DomainUrlParts::split($url);
+
+        return DomainUrlParts::compose($parts['scheme'], $parts['host'], path: $parts['path']);
+    }
+
+    /**
+     * @param  array<string, int|string>|null  $existing
+     * @return array{fqdn: ?string, overrides: ?array<string, int>}
+     */
+    public static function normalize(?string $fqdn, ?array $existing): array
+    {
+        if (blank($fqdn)) {
+            return ['fqdn' => null, 'overrides' => null];
+        }
+
+        $existingOverrides = $existing ?? [];
+        $normalizedDomains = collect(explode(',', $fqdn))
+            ->map(fn (string $domain): string => trim($domain))
+            ->filter()
+            ->map(function (string $domain) use ($existingOverrides): array {
+                $portlessDomain = self::withoutPort($domain);
+                $parts = DomainUrlParts::split($domain);
+                $port = $parts['port'] !== ''
+                    ? (int) $parts['port']
+                    : ($existingOverrides[$portlessDomain] ?? null);
+
+                return ['domain' => $portlessDomain, 'port' => $port];
+            })
+            ->keyBy('domain')
+            ->values();
+
+        $effectiveOverrides = $normalizedDomains
+            ->filter(fn (array $domain): bool => filled($domain['port']))
+            ->mapWithKeys(fn (array $domain): array => [$domain['domain'] => (int) $domain['port']]);
+
+        $normalizedDomains = $normalizedDomains->map(function (array $domain) use ($effectiveOverrides): array {
+            if (filled($domain['port'])) {
+                return $domain;
+            }
+
+            $counterpart = self::wwwCounterpart($domain['domain']);
+            $domain['port'] = $counterpart === null ? null : $effectiveOverrides->get($counterpart);
+
+            return $domain;
+        });
+
+        $normalizedFqdn = $normalizedDomains->pluck('domain')->implode(',');
+        $overrides = $normalizedDomains
+            ->filter(fn (array $domain): bool => filled($domain['port']))
+            ->mapWithKeys(fn (array $domain): array => [$domain['domain'] => (int) $domain['port']])
+            ->all();
+
+        return [
+            'fqdn' => $normalizedFqdn === '' ? null : $normalizedFqdn,
+            'overrides' => $overrides ?: null,
+        ];
+    }
+
+    private static function wwwCounterpart(string $url): ?string
+    {
+        $parts = DomainUrlParts::split($url);
+        $host = $parts['host'];
+
+        if ($host === '') {
+            return null;
+        }
+
+        $counterpartHost = str_starts_with(strtolower($host), 'www.')
+            ? substr($host, 4)
+            : 'www.'.$host;
+
+        return DomainUrlParts::compose($parts['scheme'], $counterpartHost, path: $parts['path']);
+    }
+}
diff --git a/app/Support/RemoteSecretReferences.php b/app/Support/RemoteSecretReferences.php
new file mode 100644
index 0000000000..530c29a28c
--- /dev/null
+++ b/app/Support/RemoteSecretReferences.php
@@ -0,0 +1,64 @@
+<?php
+
+namespace App\Support;
+
+/**
+ * Parses {{vault.KEY}} style references to remote secret manager values.
+ * The namespace is provider-neutral and resolves against the resource's
+ * configured secret source. It is intentionally
+ * intentionally NOT "secret" so references stay visually distinct from the
+ * shared variable syntax ({{team.KEY}}, {{project.KEY}}, ...). References are
+ * only resolved inside the deployment job — never in the UI or in realValue —
+ * so secret values stay out of the database and the interface.
+ */
+class RemoteSecretReferences
+{
+    public const PATTERN = '/{{\s*vault\.([A-Za-z0-9_]+)\s*}}/';
+
+    public static function containsReference(?string $value): bool
+    {
+        return filled($value) && preg_match(self::PATTERN, $value) === 1;
+    }
+
+    /**
+     * @return list<string> Referenced secret key names (unique, in order of appearance)
+     */
+    public static function referencedKeys(?string $value): array
+    {
+        if (blank($value)) {
+            return [];
+        }
+
+        preg_match_all(self::PATTERN, $value, $matches);
+
+        return array_values(array_unique($matches[1]));
+    }
+
+    /**
+     * Replace every reference with its value from the secrets map.
+     * Keys missing from the map are left as-is — collect them first with
+     * missingKeys() and fail before calling substitute().
+     *
+     * @param  array<string, string>  $secrets
+     */
+    public static function substitute(string $value, array $secrets): string
+    {
+        return preg_replace_callback(
+            self::PATTERN,
+            fn (array $matches) => array_key_exists($matches[1], $secrets) ? $secrets[$matches[1]] : $matches[0],
+            $value,
+        );
+    }
+
+    /**
+     * @param  array<string, string>  $secrets
+     * @return list<string>
+     */
+    public static function missingKeys(?string $value, array $secrets): array
+    {
+        return array_values(array_filter(
+            self::referencedKeys($value),
+            fn (string $key) => ! array_key_exists($key, $secrets),
+        ));
+    }
+}
diff --git a/app/Support/ServiceComposeUrl.php b/app/Support/ServiceComposeUrl.php
index cdeb75e58d..5d3ded154a 100644
--- a/app/Support/ServiceComposeUrl.php
+++ b/app/Support/ServiceComposeUrl.php
@@ -25,15 +25,7 @@ class ServiceComposeUrl
             ->map(fn ($url) => trim((string) $url))
             ->filter();
 
-        foreach ($urls as $url) {
-            if (! filter_var($url, FILTER_VALIDATE_URL)) {
-                $errors[] = "Invalid URL: {$url}";
-            }
-            $scheme = parse_url($url, PHP_URL_SCHEME) ?? '';
-            if (! in_array(strtolower($scheme), ['http', 'https'], true)) {
-                $errors[] = "Invalid URL scheme: {$scheme} for URL: {$url}. Only http and https are supported.";
-            }
-        }
+        $errors = ValidationPatterns::validateApplicationDomains($urls->implode(','));
 
         $duplicates = $urls->duplicates()->unique()->values();
         if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 41b27f9ff9..4656406fc4 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -108,6 +108,11 @@ class ValidationPatterns
      */
     public const ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_.]*\z/u';
 
+    /**
+     * Pattern for environment variable keys written to shell-sourced files.
+     */
+    public const SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_]*\z/u';
+
     /**
      * Characters that are valid in some URL positions but unsafe for values
      * that are later reused in shell assignment contexts.
@@ -192,6 +197,43 @@ class ValidationPatterns
         return preg_match(self::ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) === 1;
     }
 
+    /**
+     * Make an environment variable key safe to show in deployment logs.
+     *
+     * Control characters are escaped and long values are truncated so an
+     * unexpected key cannot corrupt or overflow the deployment log output.
+     */
+    public static function displayShellEnvironmentVariableKey(string $value, int $maxLength = 80): string
+    {
+        $printable = str($value)
+            ->replace(["\0", "\r", "\n", "\t"], ['\\0', '\\r', '\\n', '\\t'])
+            ->value();
+
+        $printable = preg_replace_callback(
+            '/[\x00-\x1F\x7F]/',
+            fn (array $matches): string => sprintf('\\x%02X', ord($matches[0])),
+            $printable,
+        );
+
+        if ($printable === '') {
+            return '(empty)';
+        }
+
+        return str($printable)->limit($maxLength)->value();
+    }
+
+    /**
+     * Validate an environment variable key before writing it to a shell-sourced file.
+     */
+    public static function validatedShellEnvironmentVariableKey(string $value): string
+    {
+        if (preg_match(self::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) !== 1) {
+            throw new \InvalidArgumentException('Invalid environment variable name '.self::displayShellEnvironmentVariableKey($value).'. Names must start with a letter or underscore and contain only letters, numbers, and underscores.');
+        }
+
+        return $value;
+    }
+
     /**
      * Check if a string is a valid S3 bucket name.
      */
@@ -570,8 +612,23 @@ class ValidationPatterns
                 continue;
             }
 
-            if (blank(parse_url($url, PHP_URL_HOST))) {
+            $host = parse_url($url, PHP_URL_HOST);
+            if (blank($host)) {
                 $errors[] = "Invalid URL: {$url}";
+
+                continue;
+            }
+
+            $port = parse_url($url, PHP_URL_PORT);
+            if ($port !== null && ($port < 1 || $port > 65535)) {
+                $errors[] = "Invalid port for URL: {$url}. The port must be between 1 and 65535.";
+
+                continue;
+            }
+
+            $unwrappedHost = trim((string) $host, '[]');
+            if (! str_contains($unwrappedHost, '.') && filter_var($unwrappedHost, FILTER_VALIDATE_IP) === false) {
+                $errors[] = "Invalid URL: {$url}. The hostname must be a fully qualified domain name.";
             }
         }
 
diff --git a/app/Traits/Auditable.php b/app/Traits/Auditable.php
new file mode 100644
index 0000000000..878d46c1e4
--- /dev/null
+++ b/app/Traits/Auditable.php
@@ -0,0 +1,102 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\PersonalAccessToken;
+use App\Models\Team;
+use Closure;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+
+trait Auditable
+{
+    private bool $auditLoggingEnabled = true;
+
+    public static function bootAuditable(): void
+    {
+        static::created(fn (Model $model) => $model->recordAuditMutation('created'));
+        static::updated(fn (Model $model) => $model->recordAuditMutation('updated'));
+        static::deleted(fn (Model $model) => $model->recordAuditMutation('deleted'));
+    }
+
+    private function recordAuditMutation(string $action): void
+    {
+        if (! $this->auditLoggingEnabled || ! auth()->check()) {
+            return;
+        }
+
+        $teamId = $this->auditTeamId();
+        if ($teamId === null) {
+            return;
+        }
+
+        $changedFields = $action === 'updated'
+            ? collect(array_keys($this->getChanges()))
+                ->reject(fn (string $field): bool => in_array($field, [
+                    'updated_at',
+                    'order',
+                    'status',
+                    ...($this->auditExclude ?? []),
+                ], true))
+                ->values()
+                ->all()
+            : [];
+
+        if ($action === 'updated' && $changedFields === []) {
+            return;
+        }
+
+        $resourceType = Str::snake(class_basename($this));
+        $source = auth()->user()?->currentAccessToken() instanceof PersonalAccessToken ? 'api' : 'ui';
+
+        auditLog("{$source}.{$resourceType}.{$action}", [
+            'team_id' => $teamId,
+            "{$resourceType}_uuid" => $this->getAttribute('uuid'),
+            "{$resourceType}_name" => $this->getAttribute('name') ?? $this->getAttribute('key'),
+            'changed_fields' => $changedFields,
+        ]);
+    }
+
+    public function withoutAuditLogging(Closure $callback): mixed
+    {
+        $wasAuditLoggingEnabled = $this->auditLoggingEnabled;
+        $this->auditLoggingEnabled = false;
+
+        try {
+            return $callback();
+        } finally {
+            $this->auditLoggingEnabled = $wasAuditLoggingEnabled;
+        }
+    }
+
+    private function auditTeamId(): ?int
+    {
+        if ($this instanceof Team) {
+            return (int) $this->getKey();
+        }
+
+        if ($this->getAttribute('team_id') !== null) {
+            return (int) $this->getAttribute('team_id');
+        }
+
+        if ($this->getAttribute('project_id') !== null) {
+            return $this->project?->team_id;
+        }
+
+        if ($this->getAttribute('environment_id') !== null) {
+            return $this->environment?->project?->team_id;
+        }
+
+        if ($this->getAttribute('server_id') !== null) {
+            return $this->server?->team_id;
+        }
+
+        if ($this->getAttribute('resourceable_id') !== null) {
+            return $this->resourceable?->team()?->id
+                ?? $this->resourceable?->team_id
+                ?? $this->resourceable?->environment?->project?->team_id;
+        }
+
+        return null;
+    }
+}
diff --git a/app/Traits/ExecuteRemoteCommand.php b/app/Traits/ExecuteRemoteCommand.php
index a2c3d06da9..b8ff5df14b 100644
--- a/app/Traits/ExecuteRemoteCommand.php
+++ b/app/Traits/ExecuteRemoteCommand.php
@@ -46,6 +46,13 @@ trait ExecuteRemoteCommand
             );
         }
 
+        if (isset($this->remote_secrets_cache)) {
+            $lockedVars = $lockedVars->merge(array_values(array_filter(
+                $this->remote_secrets_cache,
+                static fn (mixed $value): bool => is_string($value) && $value !== ''
+            )));
+        }
+
         foreach ($lockedVars as $key => $value) {
             $escapedValue = preg_quote($value, '/');
             $text = preg_replace(
diff --git a/app/Traits/ExecutesDatabaseStartCommands.php b/app/Traits/ExecutesDatabaseStartCommands.php
new file mode 100644
index 0000000000..d267a8b1b2
--- /dev/null
+++ b/app/Traits/ExecutesDatabaseStartCommands.php
@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Traits;
+
+use App\Services\DatabaseStartCommandExecutor;
+use Illuminate\Database\Eloquent\Model;
+use Spatie\Activitylog\Models\Activity;
+
+trait ExecutesDatabaseStartCommands
+{
+    private function executeDatabaseStartCommands(array $commands, Model $database, ?Activity $activity = null): Activity
+    {
+        if ($activity) {
+            return app(DatabaseStartCommandExecutor::class)->execute($commands, $database, $activity);
+        }
+
+        return remote_process($commands, $database->destination->server, callEventOnFinish: 'DatabaseStatusChanged');
+    }
+}
diff --git a/app/Traits/HasNoindexDomains.php b/app/Traits/HasNoindexDomains.php
index c3ba8a7d86..7afe0d4f25 100644
--- a/app/Traits/HasNoindexDomains.php
+++ b/app/Traits/HasNoindexDomains.php
@@ -2,6 +2,7 @@
 
 namespace App\Traits;
 
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Support\Collection;
 
@@ -19,7 +20,7 @@ trait HasNoindexDomains
     {
         return collect($this->noindex_domains ?? [])
             ->filter(fn ($domain) => is_string($domain) && filled($domain))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain))
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain))
             ->unique()
             ->values();
     }
@@ -27,7 +28,7 @@ trait HasNoindexDomains
     public function isDomainNoindexed(string $domain): bool
     {
         return $this->noindexDomains()->contains(
-            ValidationPatterns::normalizeApplicationDomainUrl($domain)
+            $this->normalizeNoindexDomain($domain)
         );
     }
 
@@ -35,7 +36,7 @@ trait HasNoindexDomains
     {
         $this->noindex_domains = collect($domains)
             ->filter(fn ($domain) => is_string($domain) && filled($domain))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain))
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain))
             ->intersect($this->currentDomains())
             ->unique()
             ->values()
@@ -58,6 +59,13 @@ trait HasNoindexDomains
     private function currentDomains(): Collection
     {
         return collect(ValidationPatterns::applicationDomainList($this->fqdn))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain));
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain));
+    }
+
+    private function normalizeNoindexDomain(string $domain): string
+    {
+        return DomainPortOverrides::withoutPort(
+            ValidationPatterns::normalizeApplicationDomainUrl($domain)
+        );
     }
 }
diff --git a/app/Traits/HasRestartLimit.php b/app/Traits/HasRestartLimit.php
new file mode 100644
index 0000000000..edb461cdcd
--- /dev/null
+++ b/app/Traits/HasRestartLimit.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Traits;
+
+use App\Services\RestartCountTracker;
+
+trait HasRestartLimit
+{
+    public function initializeHasRestartLimit(): void
+    {
+        $this->mergeFillable(['restart_count', 'max_restart_count', 'restart_limit_reached', 'last_restart_at', 'last_restart_type']);
+        $this->mergeCasts([
+            'restart_count' => 'integer',
+            'max_restart_count' => 'integer',
+            'restart_limit_reached' => 'boolean',
+            'last_restart_at' => 'datetime',
+            'last_restart_type' => 'string',
+        ]);
+    }
+
+    public function stoppedAfterRestartLimit(): bool
+    {
+        return str($this->status)->startsWith('exited') && $this->restart_limit_reached === true;
+    }
+
+    public function trackRestartCount(int $observedRestartCount): bool
+    {
+        $state = (new RestartCountTracker)->evaluate(
+            previousRestartCount: $this->restart_count ?? 0,
+            observedRestartCount: $observedRestartCount,
+            maxRestartCount: $this->restartLimitMaximum(),
+        );
+
+        if ($state['restart_count_changed']) {
+            $hasCrashRestarts = $state['restart_count'] > 0;
+            $this->update([
+                'restart_count' => $state['restart_count'],
+                'last_restart_at' => $hasCrashRestarts ? now() : null,
+                'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
+            ]);
+        }
+
+        if (! $state['restart_limit_reached']) {
+            return false;
+        }
+
+        $claimed = $this->newQuery()
+            ->whereKey($this->getKey())
+            ->where('restart_limit_reached', false)
+            ->update(['restart_limit_reached' => true]) === 1;
+
+        if ($claimed) {
+            $this->restart_limit_reached = true;
+        }
+
+        return $claimed;
+    }
+
+    public function resetRestartLimit(): void
+    {
+        $this->update([
+            'restart_count' => 0,
+            'restart_limit_reached' => false,
+            'last_restart_at' => null,
+            'last_restart_type' => null,
+        ]);
+    }
+
+    public function restartLimitMaximum(): int
+    {
+        return $this->max_restart_count ?? 0;
+    }
+}
diff --git a/app/Traits/HasSecretManager.php b/app/Traits/HasSecretManager.php
new file mode 100644
index 0000000000..8b3e50b7bd
--- /dev/null
+++ b/app/Traits/HasSecretManager.php
@@ -0,0 +1,107 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\EnvironmentVariable;
+use App\Models\SecretManagerLink;
+use App\Support\RemoteSecretReferences;
+use Illuminate\Database\Eloquent\Relations\MorphOne;
+use RuntimeException;
+
+trait HasSecretManager
+{
+    /** @var array<string, string>|null */
+    private ?array $resolvedSecretManagerValues = null;
+
+    public static function bootHasSecretManager(): void
+    {
+        static::deleting(fn ($resource) => $resource->secretManagerLink()->delete());
+    }
+
+    public function secretManagerLink(): MorphOne
+    {
+        return $this->morphOne(SecretManagerLink::class, 'resourceable');
+    }
+
+    public function resolveSecretManagerEnvironmentVariable(EnvironmentVariable $environmentVariable): ?string
+    {
+        $value = $this->resolveSecretManagerEnvironmentVariableValue($environmentVariable);
+
+        return $this->formatEnvironmentVariableValue($environmentVariable, $value);
+    }
+
+    public function formatEnvironmentVariableValue(EnvironmentVariable $environmentVariable, ?string $value): ?string
+    {
+        if ($value === null) {
+            return null;
+        }
+
+        if (json_validate($value) && (str_starts_with($value, '{') || str_starts_with($value, '['))) {
+            return $value;
+        }
+
+        return $environmentVariable->is_literal || $environmentVariable->is_multiline
+            ? "'{$value}'"
+            : escapeEnvVariables($value);
+    }
+
+    public function resolveSecretManagerEnvironmentVariableValue(EnvironmentVariable $environmentVariable): ?string
+    {
+        $value = $this->resolvedEnvironmentVariableValue($environmentVariable);
+
+        if ($value === null) {
+            return null;
+        }
+
+        if (RemoteSecretReferences::containsReference($value)) {
+            $secrets = $this->secretManagerValues();
+            $missing = RemoteSecretReferences::missingKeys($value, $secrets);
+
+            if ($missing !== []) {
+                throw new RuntimeException('Missing secret keys: '.implode(', ', $missing)." (referenced by {$environmentVariable->key}).");
+            }
+
+            $value = RemoteSecretReferences::substitute($value, $secrets);
+        }
+
+        return $value;
+    }
+
+    public function environmentVariableUsesSecretManager(EnvironmentVariable $environmentVariable): bool
+    {
+        return RemoteSecretReferences::containsReference(
+            $this->resolvedEnvironmentVariableValue($environmentVariable),
+        );
+    }
+
+    private function resolvedEnvironmentVariableValue(EnvironmentVariable $environmentVariable): ?string
+    {
+        return $environmentVariable->get_real_environment_variables_with_server(
+            $environmentVariable->value,
+            $this,
+            data_get($this, 'server'),
+        );
+    }
+
+    /** @return array<string, string> */
+    private function secretManagerValues(): array
+    {
+        if ($this->resolvedSecretManagerValues !== null) {
+            return $this->resolvedSecretManagerValues;
+        }
+
+        $link = $this->secretManagerLink()->with('integrationToken')->first();
+
+        if (! $link) {
+            throw new RuntimeException('Environment variables reference remote secrets, but no secret manager source is configured.');
+        }
+
+        return $this->resolvedSecretManagerValues = $link->fetchSecrets();
+    }
+
+    /** @return array<string, string> */
+    public function resolvedSecretManagerValuesForRedaction(): array
+    {
+        return $this->resolvedSecretManagerValues ?? [];
+    }
+}
diff --git a/app/Traits/HasSecretManagerAutocomplete.php b/app/Traits/HasSecretManagerAutocomplete.php
new file mode 100644
index 0000000000..1b46ca2dd5
--- /dev/null
+++ b/app/Traits/HasSecretManagerAutocomplete.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Traits;
+
+use App\Models\SecretManagerLink;
+
+/**
+ * Exposes the resource's secret manager source to the env-var-input
+ * autocomplete: a boolean for the "vault" scope, and a lazy key-name fetch
+ * (called from the frontend only when the user types a vault reference).
+ * Secret values never reach the component state — key names only.
+ */
+trait HasSecretManagerAutocomplete
+{
+    public function hasSecretManagerSource(): bool
+    {
+        return $this->secretManagerLinkForAutocomplete() !== null;
+    }
+
+    /**
+     * @return list<string>
+     */
+    public function fetchSecretManagerKeys(): array
+    {
+        $this->skipRender();
+
+        $link = $this->secretManagerLinkForAutocomplete();
+
+        if (! $link) {
+            return [];
+        }
+
+        try {
+            $this->authorize('view', $link->resourceable);
+            $keys = array_keys($link->fetchSecrets());
+            sort($keys);
+
+            return $keys;
+        } catch (\Throwable) {
+            throw new \RuntimeException('Unable to fetch secret manager keys.');
+        }
+    }
+
+    private function secretManagerLinkForAutocomplete(): ?SecretManagerLink
+    {
+        $resource = $this->secretManagerResource();
+
+        if (! $resource || ! method_exists($resource, 'secretManagerLink')) {
+            return null;
+        }
+
+        if (! $resource->relationLoaded('secretManagerLink')) {
+            $resource->load('secretManagerLink.integrationToken');
+        }
+
+        return $resource->secretManagerLink;
+    }
+}
diff --git a/app/View/Components/Forms/EnvVarInput.php b/app/View/Components/Forms/EnvVarInput.php
index a3e6646fec..9ff5d72dc5 100644
--- a/app/View/Components/Forms/EnvVarInput.php
+++ b/app/View/Components/Forms/EnvVarInput.php
@@ -35,6 +35,7 @@ class EnvVarInput extends Component
         public mixed $canResource = null,
         public bool $autoDisable = true,
         public array $availableVars = [],
+        public bool $hasVaultSource = false,
         public ?string $projectUuid = null,
         public ?string $environmentUuid = null,
         public ?string $serverUuid = null,
diff --git a/app/View/Components/Forms/Input.php b/app/View/Components/Forms/Input.php
index 7831c9f024..a1b01e2808 100644
--- a/app/View/Components/Forms/Input.php
+++ b/app/View/Components/Forms/Input.php
@@ -34,6 +34,8 @@ class Input extends Component
         public ?string $canGate = null,
         public mixed $canResource = null,
         public bool $autoDisable = true,
+        public bool $loading = false,
+        public string $loadingText = 'Loading...',
     ) {
         // Handle authorization-based disabling
         if ($this->canGate && $this->canResource && $this->autoDisable) {
diff --git a/bootstrap/helpers/applications.php b/bootstrap/helpers/applications.php
index 339a0bcf7b..2fb0bb3f53 100644
--- a/bootstrap/helpers/applications.php
+++ b/bootstrap/helpers/applications.php
@@ -84,6 +84,15 @@ function queue_application_deployment(Application $application, string $deployme
         'only_this_server' => $only_this_server,
     ]);
 
+    if (auth()->check() && ! $is_webhook && ! $is_api && ! $rollback) {
+        auditLog($restart_only ? 'ui.application.restarted' : 'ui.application.deployed', [
+            'application_uuid' => $application->uuid,
+            'application_name' => $application->name,
+            'deployment_uuid' => $deployment_uuid,
+            'force_rebuild' => $force_rebuild,
+        ]);
+    }
+
     if ($no_questions_asked) {
         $deployment->update([
             'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
diff --git a/bootstrap/helpers/audit.php b/bootstrap/helpers/audit.php
index 8477450c4b..1a1ad0a994 100644
--- a/bootstrap/helpers/audit.php
+++ b/bootstrap/helpers/audit.php
@@ -1,13 +1,10 @@
 <?php
 
-use Illuminate\Support\Facades\Log;
+use App\Models\AuditEvent;
 
 if (! function_exists('auditLog')) {
     /**
-     * Write a security-relevant audit entry to the dedicated `audit` log channel.
-     *
-     * Never include secrets (private keys, passwords, tokens, webhook secrets,
-     * signature header values, env-var values) in $context.
+     * Queue an audit event for persistence after the response.
      *
      * @param  string  $event  Dot-namespaced event name, e.g. `api.private_key.created`.
      * @param  array<string, mixed>  $context  Identifiers + outcome details.
@@ -16,39 +13,15 @@ if (! function_exists('auditLog')) {
     function auditLog(string $event, array $context = [], string $level = 'info'): void
     {
         try {
-            $request = app()->bound('request') ? request() : null;
-            $user = auth()->check() ? auth()->user() : null;
-            $token = $user?->currentAccessToken();
-
-            $base = [
-                'event' => $event,
-                'ip' => $request?->ip(),
-                'ua' => substr((string) $request?->userAgent(), 0, 200),
-                'user_id' => $user?->id,
-                'user_email' => $user?->email,
-                'team_id' => $token ? data_get($token, 'team_id') : null,
-                'token_id' => $token?->id ?? null,
-                'token_name' => $token?->name ?? null,
-                'method' => $request?->method(),
-                'path' => $request?->path(),
-            ];
-
-            $payload = array_merge($base, $context);
-
-            Log::channel('audit')->{$level}($event, $payload);
-        } catch (Throwable $e) {
-            // Audit logging must never break the request path.
-            try {
-                Log::warning('auditLog failed: '.$e->getMessage(), ['event' => $event]);
-            } catch (Throwable) {
-            }
+            AuditEvent::record($event, $context);
+        } catch (Throwable) {
         }
     }
 }
 
 if (! function_exists('auditLogWebhookFailure')) {
     /**
-     * Record a webhook signature/auth verification failure to the `audit` channel.
+     * Record a webhook signature/auth verification failure.
      */
     function auditLogWebhookFailure(string $provider, string $reason, array $context = []): void
     {
@@ -58,10 +31,7 @@ if (! function_exists('auditLogWebhookFailure')) {
             $event = "webhook.{$provider}.signature_failed";
 
             $base = [
-                'event' => $event,
                 'reason' => $reason,
-                'ip' => $request?->ip(),
-                'ua' => substr((string) $request?->userAgent(), 0, 200),
                 'method' => $request?->method(),
                 'path' => $request?->path(),
                 'event_header' => $request?->header('X-GitHub-Event')
@@ -70,12 +40,8 @@ if (! function_exists('auditLogWebhookFailure')) {
                     ?? $request?->header('X-Event-Key'),
             ];
 
-            Log::channel('audit')->warning($event, array_merge($base, $context));
-        } catch (Throwable $e) {
-            try {
-                Log::warning('auditLogWebhookFailure failed: '.$e->getMessage(), ['provider' => $provider]);
-            } catch (Throwable) {
-            }
+            auditLog($event, array_merge($base, $context), 'warning');
+        } catch (Throwable) {
         }
     }
 }
diff --git a/bootstrap/helpers/auth.php b/bootstrap/helpers/auth.php
new file mode 100644
index 0000000000..7580fc1e06
--- /dev/null
+++ b/bootstrap/helpers/auth.php
@@ -0,0 +1,14 @@
+<?php
+
+use Illuminate\Http\Request;
+
+function auth_rate_limit_ip(Request $request): string
+{
+    $cloudflareIp = $request->header('CF-Connecting-IP');
+
+    if (isCloud() && is_string($cloudflareIp) && filter_var($cloudflareIp, FILTER_VALIDATE_IP) !== false) {
+        return $cloudflareIp;
+    }
+
+    return (string) $request->ip();
+}
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index dd532bd758..1f8778cdfe 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -166,11 +166,13 @@ function format_docker_labels_to_json(string|array $rawOutput): Collection
             $outputArray = explode(',', $outputLine);
 
             return collect($outputArray)
-                ->map(function ($outputLine) {
-                    return explode('=', $outputLine);
-                })
                 ->mapWithKeys(function ($outputLine) {
-                    return [$outputLine[0] => $outputLine[1]];
+                    $label = explode('=', $outputLine, 2);
+                    if (count($label) !== 2) {
+                        return [];
+                    }
+
+                    return [$label[0] => $label[1]];
                 });
         })[0];
 }
@@ -267,7 +269,28 @@ function dockerStopCommand(int $timeout, string $containers, Server|string|null
 function dockerRemoveCommandWithTimeout(string $container, int $timeout = 60, int $killAfter = 10): string
 {
     $container = escapeShellValue($container);
-    $script = "if command -v timeout >/dev/null 2>&1; then timeout -k {$killAfter}s {$timeout}s docker rm -f {$container}; exit_code=\$?; else exit_code=124; fi; if [ \"\$exit_code\" -eq 124 ]; then echo '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__'; fi; exit \$exit_code";
+    $script = "if command -v timeout >/dev/null 2>&1; then output=\$(timeout -k {$killAfter}s {$timeout}s docker rm -f {$container} 2>&1); exit_code=\$?; else output=''; exit_code=124; fi; if [ \"\$exit_code\" -eq 124 ]; then echo '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__'; elif [ \"\$exit_code\" -ne 0 ] && printf '%s' \"\$output\" | grep -q 'No such container:'; then exit 0; elif [ \"\$exit_code\" -ne 0 ]; then printf '%s\\n' \"\$output\" >&2; else printf '%s\\n' \"\$output\"; fi; exit \$exit_code";
+
+    return 'bash -c '.escapeShellValue($script);
+}
+
+function dockerRemoveCommand(string $container): string
+{
+    $command = 'docker rm -f '.escapeShellValue($container);
+
+    return dockerCommandIgnoringError($command, 'No such container:');
+}
+
+function dockerNetworkRemoveCommand(string $network): string
+{
+    $command = 'docker network rm '.escapeShellValue($network);
+
+    return dockerCommandIgnoringError($command, 'network .* not found');
+}
+
+function dockerCommandIgnoringError(string $command, string $ignoredError): string
+{
+    $script = "output=\$({$command} 2>&1); exit_code=\$?; if [ \"\$exit_code\" -ne 0 ] && printf '%s' \"\$output\" | grep -Eq ".escapeShellValue($ignoredError)."; then exit 0; fi; if [ \"\$exit_code\" -ne 0 ]; then printf '%s\\n' \"\$output\" >&2; else printf '%s\\n' \"\$output\"; fi; exit \$exit_code";
 
     return 'bash -c '.escapeShellValue($script);
 }
@@ -507,7 +530,7 @@ function isNoindexDomain(string $domain, ?Collection $noindex_domains): bool
         ->contains(ValidationPatterns::normalizeApplicationDomainUrl($domain));
 }
 
-function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $is_traffic_analytics_enabled = false)
+function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $is_traffic_analytics_enabled = false, array $domainPortOverrides = [])
 {
     $labels = collect([]);
     if ($serviceLabels) {
@@ -531,7 +554,8 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if ($schema === 'https' && ! $is_force_https_enabled) {
             $siteAddress = "http://{$host}, https://{$host}";
         }
-        $port = $url->getPort();
+        $portlessDomain = ServiceApplication::withoutPort($domain);
+        $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
         $handle = 'handle_path';
         if (! $is_stripprefix_enabled) {
             $handle = 'handle';
@@ -589,7 +613,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
-function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true)
+function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
 {
     $labels = collect([]);
     $labels->push('traefik.enable=true');
@@ -644,7 +668,8 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
             $host = $url->getHost();
             $path = $url->getPath();
             $schema = $url->getScheme();
-            $port = $url->getPort();
+            $portlessDomain = ServiceApplication::withoutPort($domain);
+            $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
             if (is_null($port) && ! is_null($onlyPort)) {
                 $port = $onlyPort;
             }
@@ -887,6 +912,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            domainPortOverrides: $application->domain_port_overrides ?? [],
                         ));
                         break;
                     case ProxyTypes::CADDY->value:
@@ -904,6 +930,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
                             is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
+                            domainPortOverrides: $application->domain_port_overrides ?? [],
                         ));
                         break;
                 }
@@ -921,6 +948,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
                     escape_redirect_replacement_for_compose: false,
+                    domainPortOverrides: $application->domain_port_overrides ?? [],
                 ));
                 $labels = $labels->merge(fqdnLabelsForCaddy(
                     network: $application->destination->network,
@@ -936,6 +964,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
                     is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
+                    domainPortOverrides: $application->domain_port_overrides ?? [],
                 ));
             }
         }
@@ -963,6 +992,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
                         escape_redirect_replacement_for_compose: false,
+                        domainPortOverrides: $preview->domain_port_overrides ?? [],
                     ));
                     break;
                 case ProxyTypes::CADDY->value:
@@ -979,6 +1009,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
                         is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
+                        domainPortOverrides: $preview->domain_port_overrides ?? [],
                     ));
                     break;
             }
@@ -995,6 +1026,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
                 escape_redirect_replacement_for_compose: false,
+                domainPortOverrides: $preview->domain_port_overrides ?? [],
             ));
             $labels = $labels->merge(fqdnLabelsForCaddy(
                 network: $application->destination->network,
@@ -1009,6 +1041,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
                 is_traffic_analytics_enabled: $application->destination->server->isTrafficAnalyticsEnabled(),
+                domainPortOverrides: $preview->domain_port_overrides ?? [],
             ));
         }
     }
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index b47e570477..f65b626984 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1265,24 +1265,16 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         $fqdns = collect([]);
                     }
                 } else {
-                    $fqdns = $fqdns->map(function ($fqdn) use ($pullRequestId, $resource) {
-                        $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pullRequestId);
-                        $url = Url::fromString($fqdn);
-                        $template = $resource->preview_url_template;
-                        $host = $url->getHost();
-                        $schema = $url->getScheme();
-                        $portInt = $url->getPort();
-                        $port = $portInt !== null ? ':'.$portInt : '';
-                        $random = new_public_id();
-                        $preview_fqdn = str_replace('{{random}}', $random, $template);
-                        $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                        $preview_fqdn = str_replace('{{pr_id}}', $pullRequestId, $preview_fqdn);
-                        $preview_fqdn = "$schema://$preview_fqdn{$port}";
-                        $preview->fqdn = $preview_fqdn;
-                        $preview->save();
-
-                        return $preview_fqdn;
-                    });
+                    $generatedDomains = $fqdns->map(
+                        fn ($fqdn) => $preview->generatedPreviewDomain((string) $fqdn)
+                    );
+                    $fqdns = $generatedDomains->pluck('url');
+                    $preview->fqdn = $fqdns->implode(',');
+                    $preview->domain_port_overrides = $generatedDomains
+                        ->filter(fn (array $generated): bool => filled($generated['port']))
+                        ->mapWithKeys(fn (array $generated): array => [$generated['url'] => $generated['port']])
+                        ->all();
+                    $preview->save();
                 }
             }
         }
@@ -1359,6 +1351,14 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
+            $previewForPorts = $isPullRequest
+                ? ($resource->previews()->find($preview_id) ?? ApplicationPreview::where('application_id', $resource->id)->where('pull_request_id', $pullRequestId)->first())
+                : null;
+            $domainPortOverrides = $isPullRequest
+                ? ($previewForPorts?->domain_port_overrides ?? [])
+                : ($originalResource->domain_port_overrides ?? []);
+            $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
+            $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1374,8 +1374,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            domainPortOverrides: $domainPortOverrides,
                         ));
                         break;
                     case ProxyTypes::CADDY->value:
@@ -1389,9 +1391,11 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             predefinedPort: $predefinedPort,
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            domainPortOverrides: $domainPortOverrides,
                         ));
                         break;
                 }
@@ -1405,8 +1409,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    domainPortOverrides: $domainPortOverrides,
                 ));
                 $serviceLabels = $serviceLabels->merge(fqdnLabelsForCaddy(
                     network: $labelNetwork,
@@ -1418,9 +1424,11 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     predefinedPort: $predefinedPort,
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    domainPortOverrides: $domainPortOverrides,
                 ));
             }
         }
@@ -1849,11 +1857,7 @@ function serviceParser(Service $resource): Collection
                 // Only save fqdn to ServiceApplication, not ServiceDatabase
                 if ($isServiceApplication && is_null($savedService->fqdn)) {
                     // Save URL (with scheme) to database, not FQDN
-                    if ((int) $resource->compose_parsing_version >= 5 && version_compare(config('constants.coolify.version'), '4.0.0-beta.420.7', '>=')) {
-                        $savedService->fqdn = $urlWithPort;
-                    } else {
-                        $savedService->fqdn = $urlWithPort;
-                    }
+                    $savedService->fqdn = $url;
                     $savedService->save();
                 }
 
@@ -2636,6 +2640,9 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
+            $onlyPort = $originalResource instanceof ServiceApplication
+                ? ($originalResource->getRequiredPort() ?? $predefinedPort)
+                : $predefinedPort;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -2651,6 +2658,8 @@ function serviceParser(Service $resource): Collection
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
+                            domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
                         ));
@@ -2666,7 +2675,9 @@ function serviceParser(Service $resource): Collection
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             predefinedPort: $predefinedPort,
+                            domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
                         ));
@@ -2682,6 +2693,8 @@ function serviceParser(Service $resource): Collection
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
+                    domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
                 ));
@@ -2695,7 +2708,9 @@ function serviceParser(Service $resource): Collection
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     predefinedPort: $predefinedPort,
+                    domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
                 ));
diff --git a/bootstrap/helpers/proxy.php b/bootstrap/helpers/proxy.php
index 9d1a2aa198..c5c0c391d0 100644
--- a/bootstrap/helpers/proxy.php
+++ b/bootstrap/helpers/proxy.php
@@ -146,7 +146,7 @@ function connectProxyToNetworks(Server $server)
     }
 
     return collect([
-        'for network in $(docker inspect $(docker ps --filter label=coolify.managed=true --format "{{.ID}}") --format=\'{{range $network, $_ := .NetworkSettings.Networks}}{{println $network}}{{end}}\' 2>/dev/null | sort -u); do',
+        'for network in $(docker inspect $(docker ps -a --filter label=coolify.managed=true --format "{{.ID}}") --format=\'{{range $network, $_ := .NetworkSettings.Networks}}{{println $network}}{{end}}\' 2>/dev/null | sort -u); do',
         '    if [ -z "$network" ] || [ "$network" = "bridge" ] || [ "$network" = "host" ] || [ "$network" = "none" ] || [ "$network" = "default" ]; then',
         '        continue',
         '    fi',
diff --git a/bootstrap/helpers/remoteProcess.php b/bootstrap/helpers/remoteProcess.php
index 982dda5511..241368d388 100644
--- a/bootstrap/helpers/remoteProcess.php
+++ b/bootstrap/helpers/remoteProcess.php
@@ -346,7 +346,7 @@ function remove_iip($text)
     $text = preg_replace('/Bearer\s+[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/i', 'Bearer '.REDACTED, $text);
 
     // GitHub tokens (ghp_ = personal, gho_ = OAuth, ghu_ = user-to-server, ghs_ = server-to-server, ghr_ = refresh)
-    $text = preg_replace('/\b(gh[pousr]_[A-Za-z0-9_]{36,})\b/', REDACTED, $text);
+    $text = preg_replace('/\bgh[pousr]_[A-Za-z0-9.\-_]{36,}(?![A-Za-z0-9.\-_])/', REDACTED, $text);
 
     // GitLab tokens (glpat- = personal access token, glcbt- = CI build token, glrt- = runner token)
     $text = preg_replace('/\b(gl(?:pat|cbt|rt)-[A-Za-z0-9\-_]{20,})\b/', REDACTED, $text);
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 07fdeb086f..96257a6323 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -1,5 +1,30 @@
 <?php
 
+function service_logo_urls(mixed $logo): array
+{
+    $defaultLogo = 'svgs/default.webp';
+
+    if (! is_string($logo) || $logo === '' || basename($logo) === basename($defaultLogo)) {
+        return [
+            'logo' => asset($defaultLogo),
+            'logo_cdn_url' => asset($defaultLogo),
+            'logo_default_url' => asset($defaultLogo),
+        ];
+    }
+
+    if (str_starts_with($logo, 'svg/')) {
+        $logo = 'svgs/'.str($logo)->after('svg/');
+    }
+
+    $logo = ltrim($logo, '/');
+
+    return [
+        'logo' => asset($logo),
+        'logo_cdn_url' => 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo,
+        'logo_default_url' => asset($defaultLogo),
+    ];
+}
+
 use App\Models\Application;
 use App\Models\Service;
 use App\Models\ServiceApplication;
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index e82bb9b6df..615fd97aaf 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -12,6 +12,8 @@ use App\Models\GitlabApp;
 use App\Models\InstanceSettings;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -815,6 +817,54 @@ function firstDomainFromList(?string $fqdns): string
 {
     return trim((string) str($fqdns ?? '')->explode(',')->first());
 }
+function profile_avatar_url(User $user): string
+{
+    if ($user->avatar_storage_type === 's3') {
+        $url = s3_image_url($user->avatar_s3_storage_id, $user->avatar_path, $user->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('profile.avatar', ['v' => $user->updated_at->timestamp]);
+}
+
+function project_icon_url(Project $project): string
+{
+    if ($project->icon_storage_type === 's3') {
+        $url = s3_image_url($project->icon_s3_storage_id, $project->icon_path, $project->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('project.icon', [
+        'project_uuid' => $project->uuid,
+        'v' => $project->updated_at->timestamp,
+    ]);
+}
+
+function s3_image_url(?int $storageId, ?string $path, int $version): ?string
+{
+    if (! $storageId || blank($path)) {
+        return null;
+    }
+
+    $storage = S3Storage::query()
+        ->whereKey($storageId)
+        ->whereTeamId(0)
+        ->where('is_usable', true)
+        ->first();
+
+    if (! $storage) {
+        return null;
+    }
+
+    $baseUrl = config('constants.coolify.avatar_cdn_url') ?: $storage->awsUrl();
+
+    return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
+}
+
 /**
  * If fqdn is set, return it, otherwise return public ip.
  */
@@ -3053,6 +3103,12 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $redirectDirection = in_array(data_get($savedService, 'redirect'), ['www', 'non-www', 'both'], true)
                             ? data_get($savedService, 'redirect')
                             : 'both';
+                        $domainPortOverrides = $savedService instanceof ServiceApplication
+                            ? ($savedService->domain_port_overrides ?? [])
+                            : [];
+                        $onlyPort = $savedService instanceof ServiceApplication
+                            ? ($savedService->getRequiredPort() ?? $predefinedPort)
+                            : $predefinedPort;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($resource->server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
@@ -3065,8 +3121,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
+                                        onlyPort: $onlyPort,
                                         noindex_domains: $noindexDomains,
-                                        redirect_direction: $redirectDirection
+                                        redirect_direction: $redirectDirection,
+                                        domainPortOverrides: $domainPortOverrides,
                                     ));
                                     break;
                                 case ProxyTypes::CADDY->value:
@@ -3080,8 +3138,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
+                                        onlyPort: $onlyPort,
+                                        predefinedPort: $predefinedPort,
                                         noindex_domains: $noindexDomains,
-                                        redirect_direction: $redirectDirection
+                                        redirect_direction: $redirectDirection,
+                                        domainPortOverrides: $domainPortOverrides,
                                     ));
                                     break;
                             }
@@ -3095,8 +3156,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
+                                onlyPort: $onlyPort,
                                 noindex_domains: $noindexDomains,
-                                redirect_direction: $redirectDirection
+                                redirect_direction: $redirectDirection,
+                                domainPortOverrides: $domainPortOverrides,
                             ));
                             $serviceLabels = $serviceLabels->merge(fqdnLabelsForCaddy(
                                 network: $resource->destination->network,
@@ -3108,8 +3171,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
+                                onlyPort: $onlyPort,
+                                predefinedPort: $predefinedPort,
                                 noindex_domains: $noindexDomains,
-                                redirect_direction: $redirectDirection
+                                redirect_direction: $redirectDirection,
+                                domainPortOverrides: $domainPortOverrides,
                             ));
                         }
                     }
@@ -3808,6 +3874,13 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $fqdns = str($fqdns)->explode(',');
                         if ($pull_request_id !== 0) {
                             $preview = $resource->previews()->find($preview_id);
+                            if (! $preview) {
+                                try {
+                                    $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pull_request_id);
+                                } catch (ModelNotFoundException) {
+                                    throw new RuntimeException('Preview not found.');
+                                }
+                            }
                             $docker_compose_domains = json_decode(data_get($preview, 'docker_compose_domains') ?: '[]', true) ?: [];
                             if (count($docker_compose_domains) > 0) {
                                 $found_fqdn = getComposeServiceDomainString($docker_compose_domains, (string) $serviceName);
@@ -3817,22 +3890,20 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     $fqdns = collect([]);
                                 }
                             } else {
-                                $fqdns = $fqdns->map(function ($fqdn) use ($pull_request_id, $resource) {
-                                    $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pull_request_id);
-                                    $url = Url::fromString($fqdn);
-                                    $template = $resource->preview_url_template;
-                                    $host = $url->getHost();
-                                    $schema = $url->getScheme();
-                                    $random = new_public_id();
-                                    $preview_fqdn = str_replace('{{random}}', $random, $template);
-                                    $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                                    $preview_fqdn = str_replace('{{pr_id}}', $pull_request_id, $preview_fqdn);
-                                    $preview_fqdn = "$schema://$preview_fqdn";
-                                    $preview->fqdn = $preview_fqdn;
-                                    $preview->save();
-
-                                    return $preview_fqdn;
-                                });
+                                $generatedDomains = $fqdns->map(
+                                    fn ($fqdn) => $preview->generatedPreviewDomain((string) $fqdn)
+                                );
+                                $fqdns = $generatedDomains->pluck('url');
+                                $preview->fqdn = $fqdns->implode(',');
+                                $generatedOverrides = $generatedDomains
+                                    ->filter(fn (array $generated): bool => filled($generated['port']))
+                                    ->mapWithKeys(fn (array $generated): array => [$generated['url'] => $generated['port']])
+                                    ->all();
+                                $preview->domain_port_overrides = array_replace(
+                                    $preview->domain_port_overrides ?? [],
+                                    $generatedOverrides,
+                                );
+                                $preview->save();
                             }
                         }
                         $noindexDomains = $pull_request_id !== 0 ? $fqdns : $resource->noindexDomains();
@@ -3841,6 +3912,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                             ? $composeRedirect
                             : 'both';
+                        $domainPortOverrides = $pull_request_id === 0
+                            ? ($resource->domain_port_overrides ?? [])
+                            : ($preview?->domain_port_overrides ?? []);
+                        $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
+                        $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
@@ -3854,8 +3930,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                            onlyPort: $onlyPort,
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
+                                            domainPortOverrides: $domainPortOverrides,
                                         )
                                     );
                                     break;
@@ -3870,8 +3948,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                            onlyPort: $onlyPort,
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
+                                            domainPortOverrides: $domainPortOverrides,
                                         )
                                     );
                                     break;
@@ -3887,8 +3967,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                    onlyPort: $onlyPort,
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
+                                    domainPortOverrides: $domainPortOverrides,
                                 )
                             );
                             $serviceLabels = $serviceLabels->merge(
@@ -3901,8 +3983,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                    onlyPort: $onlyPort,
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
+                                    domainPortOverrides: $domainPortOverrides,
                                 )
                             );
                         }
@@ -4152,11 +4236,12 @@ function coolifyHelperImage(): string
 
 function getHelperVersion(): string
 {
-    $settings = instanceSettings();
+    if (isDev()) {
+        $devHelperVersion = InstanceSettings::query()->whereKey(0)->value('dev_helper_version');
 
-    // In development mode, use the dev_helper_version if set, otherwise fallback to config
-    if (isDev() && ! empty($settings->dev_helper_version)) {
-        return $settings->dev_helper_version;
+        if (! empty($devHelperVersion)) {
+            return $devHelperVersion;
+        }
     }
 
     return config('constants.coolify.helper_version');
diff --git a/composer.json b/composer.json
index c0ffc6f07f..4778cc91dd 100644
--- a/composer.json
+++ b/composer.json
@@ -22,7 +22,7 @@
         "laravel/mcp": "^0.6.7",
         "laravel/nightwatch": "^1.28.6",
         "laravel/pail": "^1.2.7",
-        "laravel/prompts": "^0.3.22|^0.3.22|^0.3.22",
+        "laravel/prompts": "^0.3.22",
         "laravel/sanctum": "^4.3.3",
         "laravel/socialite": "^5.29.0",
         "laravel/tinker": "^2.11.1",
diff --git a/composer.lock b/composer.lock
index b77aef46f5..55be2166b6 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3644,16 +3644,16 @@
         },
         {
             "name": "livewire/livewire",
-            "version": "v3.8.3",
+            "version": "v3.8.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/livewire/livewire.git",
-                "reference": "ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2"
+                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/livewire/livewire/zipball/ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2",
-                "reference": "ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2",
+                "url": "https://api.github.com/repos/livewire/livewire/zipball/ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
+                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
                 "shasum": ""
             },
             "require": {
@@ -3708,7 +3708,7 @@
             "description": "A front-end framework for Laravel.",
             "support": {
                 "issues": "https://github.com/livewire/livewire/issues",
-                "source": "https://github.com/livewire/livewire/tree/v3.8.3"
+                "source": "https://github.com/livewire/livewire/tree/v3.8.7"
             },
             "funding": [
                 {
@@ -3716,7 +3716,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-07-31T00:08:18+00:00"
+            "time": "2026-08-31T15:40:46+00:00"
         },
         {
             "name": "log1x/laravel-webfonts",
diff --git a/config/constants.php b/config/constants.php
index a406dd0ea7..457a8a1ff8 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,9 +2,9 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.10',
-        'helper_version' => '1.0.15',
-        'realtime_version' => '1.0.17',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.15',
+        'helper_version' => '1.0.16',
+        'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
@@ -14,6 +14,7 @@ return [
         'realtime_image' => env('REALTIME_IMAGE', env('REGISTRY_URL', 'docker.io').'/coollabsio/coolify-realtime'),
         'is_windows_docker_desktop' => env('IS_WINDOWS_DOCKER_DESKTOP', false),
         'cdn_url' => env('CDN_URL', 'https://cdn.coollabs.io'),
+        'avatar_cdn_url' => env('AVATAR_CDN_URL'),
         'versions_url' => env('VERSIONS_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/versions.json'),
         'upgrade_script_url' => env('UPGRADE_SCRIPT_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/upgrade.sh'),
         'releases_url' => env('RELEASES_URL', 'https://cdn.coollabs.io/coolify/releases.json'),
diff --git a/config/logging.php b/config/logging.php
index 05cf8e13d3..89c9d38dde 100644
--- a/config/logging.php
+++ b/config/logging.php
@@ -133,13 +133,6 @@ return [
             'days' => 14,
         ],
 
-        'audit' => [
-            'driver' => 'daily',
-            'path' => storage_path('logs/audit.log'),
-            'level' => env('LOG_AUDIT_LEVEL', 'info'),
-            'days' => env('LOG_AUDIT_DAYS', 90),
-            'replace_placeholders' => true,
-        ],
     ],
 
 ];
diff --git a/database/factories/AuditEventFactory.php b/database/factories/AuditEventFactory.php
new file mode 100644
index 0000000000..01ddebbd2b
--- /dev/null
+++ b/database/factories/AuditEventFactory.php
@@ -0,0 +1,29 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\AuditEvent;
+use App\Models\Team;
+use Illuminate\Database\Eloquent\Factories\Factory;
+
+/**
+ * @extends Factory<AuditEvent>
+ */
+class AuditEventFactory extends Factory
+{
+    protected $model = AuditEvent::class;
+
+    public function definition(): array
+    {
+        return [
+            'team_id' => Team::factory(),
+            'event' => 'ui.application.updated',
+            'source' => 'ui',
+            'action' => 'updated',
+            'actor_type' => 'user',
+            'description' => 'Application updated',
+            'metadata' => [],
+            'created_at' => now(),
+        ];
+    }
+}
diff --git a/database/migrations/2026_08_20_000000_create_audit_events_table.php b/database/migrations/2026_08_20_000000_create_audit_events_table.php
new file mode 100644
index 0000000000..0ace21f229
--- /dev/null
+++ b/database/migrations/2026_08_20_000000_create_audit_events_table.php
@@ -0,0 +1,45 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('audit_events', function (Blueprint $table): void {
+            $table->id();
+            $table->unsignedBigInteger('team_id')->nullable();
+            $table->string('event');
+            $table->string('source', 32);
+            $table->string('action', 64);
+            $table->string('actor_type', 32);
+            $table->unsignedBigInteger('actor_id')->nullable();
+            $table->string('actor_name')->nullable();
+            $table->string('actor_email')->nullable();
+            $table->unsignedBigInteger('actor_token_id')->nullable();
+            $table->string('actor_token_name')->nullable();
+            $table->string('resource_type')->nullable();
+            $table->string('resource_uuid')->nullable();
+            $table->string('resource_name')->nullable();
+            $table->text('description');
+            $table->json('metadata')->nullable();
+            $table->string('ip_address', 45)->nullable();
+            $table->string('user_agent', 200)->nullable();
+            $table->timestamp('created_at')->useCurrent();
+
+            $table->index('created_at');
+            $table->index(['team_id', 'created_at', 'id']);
+            $table->index(['team_id', 'action', 'created_at', 'id']);
+            $table->index(['team_id', 'source', 'created_at', 'id']);
+            $table->index(['team_id', 'resource_type', 'resource_uuid', 'created_at']);
+            $table->index(['team_id', 'actor_id', 'created_at']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('audit_events');
+    }
+};
diff --git a/database/migrations/2026_08_23_000000_add_secret_manager_integrations.php b/database/migrations/2026_08_23_000000_add_secret_manager_integrations.php
new file mode 100644
index 0000000000..744697628f
--- /dev/null
+++ b/database/migrations/2026_08_23_000000_add_secret_manager_integrations.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('integration_tokens', function (Blueprint $table) {
+            $table->json('metadata')->nullable()->after('capabilities');
+        });
+
+        Schema::create('secret_manager_links', function (Blueprint $table) {
+            $table->id();
+            $table->string('uuid')->unique();
+            $table->string('resourceable_type');
+            $table->unsignedBigInteger('resourceable_id');
+            $table->foreignId('integration_token_id')->constrained()->cascadeOnDelete();
+            $table->json('settings')->nullable();
+            $table->timestamps();
+
+            $table->unique(['resourceable_type', 'resourceable_id']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('secret_manager_links');
+
+        Schema::table('integration_tokens', function (Blueprint $table) {
+            $table->dropColumn('metadata');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php b/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
new file mode 100644
index 0000000000..fd1865ed32
--- /dev/null
+++ b/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->json('domain_dns_statuses')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn('domain_dns_statuses');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php b/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
new file mode 100644
index 0000000000..fc59fb587b
--- /dev/null
+++ b/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->boolean('container_present')->nullable()->after('status');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('container_present');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php b/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
new file mode 100644
index 0000000000..80603ee978
--- /dev/null
+++ b/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached')->default(false)->after('max_restart_count');
+        });
+
+        DB::table('applications')
+            ->where('status', 'like', 'exited%')
+            ->where('restart_count', '>', 0)
+            ->where('max_restart_count', '>', 0)
+            ->whereColumn('restart_count', '>=', 'max_restart_count')
+            ->where('last_restart_type', 'crash')
+            ->update(['restart_limit_reached' => true]);
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php b/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
new file mode 100644
index 0000000000..adf119a6e0
--- /dev/null
+++ b/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php b/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
new file mode 100644
index 0000000000..0838ad4bd7
--- /dev/null
+++ b/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php b/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
new file mode 100644
index 0000000000..046b02960c
--- /dev/null
+++ b/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php b/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
new file mode 100644
index 0000000000..641da5b759
--- /dev/null
+++ b/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_postgresqls', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_postgresqls', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php b/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
new file mode 100644
index 0000000000..24329da9f3
--- /dev/null
+++ b/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_redis', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_redis', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php b/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
new file mode 100644
index 0000000000..08980a7cb8
--- /dev/null
+++ b/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mongodbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mongodbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php b/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
new file mode 100644
index 0000000000..729f852739
--- /dev/null
+++ b/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mysqls', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mysqls', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php b/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
new file mode 100644
index 0000000000..6bada23268
--- /dev/null
+++ b/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mariadbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mariadbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php b/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
new file mode 100644
index 0000000000..41a983924b
--- /dev/null
+++ b/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_keydbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_keydbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php b/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
new file mode 100644
index 0000000000..23d8ccf2c0
--- /dev/null
+++ b/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_dragonflies', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_dragonflies', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php b/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
new file mode 100644
index 0000000000..5ec8d4522c
--- /dev/null
+++ b/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_clickhouses', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_clickhouses', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php b/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
new file mode 100644
index 0000000000..e4db4b7e8c
--- /dev/null
+++ b/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('email_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_email_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('email_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_email_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php b/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
new file mode 100644
index 0000000000..b7803e6335
--- /dev/null
+++ b/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('discord_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_discord_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('discord_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_discord_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php b/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
new file mode 100644
index 0000000000..51880ceb81
--- /dev/null
+++ b/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('telegram_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_telegram_notifications')->default(true);
+            $table->text('telegram_notifications_restart_limit_reached_thread_id')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('telegram_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_telegram_notifications');
+            $table->dropColumn('telegram_notifications_restart_limit_reached_thread_id');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php b/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
new file mode 100644
index 0000000000..0b82b423f8
--- /dev/null
+++ b/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('slack_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_slack_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('slack_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_slack_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php b/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
new file mode 100644
index 0000000000..596af0b5cc
--- /dev/null
+++ b/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('pushover_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_pushover_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('pushover_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_pushover_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php b/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
new file mode 100644
index 0000000000..cc03cf0f52
--- /dev/null
+++ b/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('webhook_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_webhook_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('webhook_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_webhook_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php b/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
new file mode 100644
index 0000000000..c51551e792
--- /dev/null
+++ b/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php b/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
new file mode 100644
index 0000000000..f208c5865f
--- /dev/null
+++ b/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php b/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
new file mode 100644
index 0000000000..80fc8a0618
--- /dev/null
+++ b/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 0d7caceb95..ebf12379d5 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.17'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index 33709873f2..cc266e5562 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -97,7 +97,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.17'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/docker/coolify-helper/Dockerfile b/docker/coolify-helper/Dockerfile
index 567cfbeebe..94330bbcec 100644
--- a/docker/coolify-helper/Dockerfile
+++ b/docker/coolify-helper/Dockerfile
@@ -2,11 +2,11 @@
 # https://hub.docker.com/_/alpine
 ARG BASE_IMAGE=alpine:3.21
 # https://download.docker.com/linux/static/stable/
-ARG DOCKER_VERSION=28.0.0
+ARG DOCKER_VERSION=29.7.2
 # https://github.com/docker/compose/releases
-ARG DOCKER_COMPOSE_VERSION=2.38.2
+ARG DOCKER_COMPOSE_VERSION=5.5.0
 # https://github.com/docker/buildx/releases
-ARG DOCKER_BUILDX_VERSION=0.25.0
+ARG DOCKER_BUILDX_VERSION=0.36.1
 # https://github.com/buildpacks/pack/releases
 ARG PACK_VERSION=0.38.2
 # https://github.com/railwayapp/nixpacks/releases
diff --git a/docker/coolify-realtime/terminal-server.js b/docker/coolify-realtime/terminal-server.js
index 0d7b6dcdd9..b72574c8d0 100755
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@@ -10,6 +10,8 @@ import {
     extractTimeout,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
+    sanitizeSshArgs,
+    validateSshArgs,
 } from './terminal-utils.js';
 
 async function postToCoolify(path, headers) {
@@ -384,6 +386,16 @@ async function handleCommand(ws, command, userId) {
         return;
     }
 
+    if (!validateSshArgs(sshArgs, userSession.authorizedIPs)) {
+        logTerminal('warn', 'Rejecting terminal command because its SSH arguments are not allowed.', {
+            userId,
+            targetHost,
+        });
+        ws.send('Invalid SSH command: Unsupported SSH arguments');
+        return;
+    }
+    const sanitizedSshArgs = sanitizeSshArgs(sshArgs);
+
     const options = {
         name: 'xterm-color',
         cols: 80,
@@ -401,7 +413,7 @@ async function handleCommand(ws, command, userId) {
         commandTimeout,
         terminalSessionTimeout,
     });
-    const ptyProcess = pty.spawn('ssh', sshArgs.concat([hereDocContent]), options);
+    const ptyProcess = pty.spawn('ssh', sanitizedSshArgs.concat([hereDocContent]), options);
 
     userSession.ptyProcess = ptyProcess;
     userSession.isActive = true;
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index 8769d62d9d..c6865f1800 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -20,7 +20,7 @@ function normalizeShellArgument(argument) {
 }
 
 export function extractSshArgs(commandString) {
-    const sshCommandMatch = commandString.match(/ssh (.+?) 'bash -se'/);
+    const sshCommandMatch = commandString.match(/ssh (.+?) '[^']+' << /);
     if (!sshCommandMatch) return [];
 
     const argsString = sshCommandMatch[1];
@@ -131,3 +131,133 @@ export function isAuthorizedTargetHost(targetHost, authorizedHosts = []) {
         .map(host => normalizeHostForAuthorization(host))
         .includes(normalizedTargetHost);
 }
+
+const REQUIRED_SSH_OPTIONS = new Set([
+    'StrictHostKeyChecking',
+    'UserKnownHostsFile',
+    'PasswordAuthentication',
+    'ConnectTimeout',
+    'ServerAliveInterval',
+    'RequestTTY',
+    'LogLevel',
+]);
+
+function isAllowedSshOption(name, value) {
+    const fixedOptions = {
+        StrictHostKeyChecking: 'no',
+        UserKnownHostsFile: '/dev/null',
+        PasswordAuthentication: 'no',
+        LogLevel: 'ERROR',
+        ControlMaster: 'auto',
+        ProxyCommand: 'cloudflared access ssh --hostname %h',
+    };
+
+    if (Object.hasOwn(fixedOptions, name)) {
+        return value === fixedOptions[name];
+    }
+
+    if (name === 'RequestTTY') {
+        return value === 'yes' || value === 'no';
+    }
+
+    if (name === 'ConnectTimeout' || name === 'ServerAliveInterval' || name === 'ControlPersist') {
+        return /^\d+$/.test(value) && Number(value) > 0;
+    }
+
+    if (name === 'ControlPath') {
+        return /^\/var\/www\/html\/storage\/app\/ssh\/mux\/mux_[a-zA-Z0-9_-]+$/.test(value);
+    }
+
+    return false;
+}
+
+export function validateSshArgs(sshArgs, authorizedHosts = []) {
+    if (!Array.isArray(sshArgs) || sshArgs.length === 0) {
+        return false;
+    }
+
+    const seenOptions = new Set();
+    let hasIdentityFile = false;
+    let hasPort = false;
+    let targetHost = null;
+
+    for (let index = 0; index < sshArgs.length; index++) {
+        const argument = sshArgs[index];
+
+        if (typeof argument !== 'string' || /[\0\r\n]/.test(argument)) {
+            return false;
+        }
+
+        if (argument === '-i') {
+            const identityFile = sshArgs[++index];
+            if (hasIdentityFile || !/^\/var\/www\/html\/storage\/app\/ssh\/keys\/ssh_key@[a-zA-Z0-9_-]+$/.test(identityFile ?? '')) {
+                return false;
+            }
+            hasIdentityFile = true;
+            continue;
+        }
+
+        if (argument === '-p') {
+            const port = sshArgs[++index];
+            if (hasPort || !/^\d+$/.test(port ?? '') || Number(port) < 1 || Number(port) > 65535) {
+                return false;
+            }
+            hasPort = true;
+            continue;
+        }
+
+        if (argument === '-o') {
+            const option = sshArgs[++index];
+            const separator = option?.indexOf('=') ?? -1;
+            if (separator < 1) {
+                return false;
+            }
+
+            const name = option.slice(0, separator);
+            const value = option.slice(separator + 1);
+            if (seenOptions.has(name) || !isAllowedSshOption(name, value)) {
+                return false;
+            }
+            seenOptions.add(name);
+            continue;
+        }
+
+        if (/^[a-zA-Z0-9_][a-zA-Z0-9._-]*@[^@]+$/.test(argument) && targetHost === null) {
+            targetHost = extractTargetHost([argument]);
+            continue;
+        }
+
+        return false;
+    }
+
+    const hasRequiredOptions = [...REQUIRED_SSH_OPTIONS].every(option => seenOptions.has(option));
+    const hasCompleteMultiplexingOptions =
+        !['ControlMaster', 'ControlPath', 'ControlPersist'].some(option => seenOptions.has(option))
+        || ['ControlMaster', 'ControlPath', 'ControlPersist'].every(option => seenOptions.has(option));
+
+    return hasIdentityFile
+        && hasPort
+        && targetHost !== null
+        && hasRequiredOptions
+        && hasCompleteMultiplexingOptions
+        && isAuthorizedTargetHost(targetHost, authorizedHosts);
+}
+
+export function sanitizeSshArgs(sshArgs) {
+    const multiplexingOptions = new Set(['ControlMaster', 'ControlPath', 'ControlPersist']);
+    const sanitizedArgs = [];
+
+    for (let index = 0; index < sshArgs.length; index++) {
+        if (sshArgs[index] === '-o') {
+            const optionName = sshArgs[index + 1]?.split('=', 1)[0];
+            if (multiplexingOptions.has(optionName)) {
+                index++;
+                continue;
+            }
+        }
+
+        sanitizedArgs.push(sshArgs[index]);
+    }
+
+    return sanitizedArgs;
+}
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index bf863099b4..7af98be898 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -7,6 +7,8 @@ import {
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
+    sanitizeSshArgs,
+    validateSshArgs,
 } from './terminal-utils.js';
 
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
@@ -34,6 +36,14 @@ test('extractSshArgs preserves proxy command as a single normalized ssh option v
     assert.equal(sshArgs[4], 'root@example.com');
 });
 
+test('extractSshArgs supports the generated bash or sh fallback command', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o StrictHostKeyChecking=no 'root'@'10.0.0.5' 'if command -v bash >/dev/null 2>&1; then exec bash -se; else exec sh -se; fi' << \\\\$abc\necho hi\nabc"
+    );
+
+    assert.equal(extractTargetHost(sshArgs), '10.0.0.5');
+});
+
 test('isAuthorizedTargetHost matches normalized hosts against plain allowlist values', () => {
     assert.equal(isAuthorizedTargetHost("'10.0.0.5'", ['10.0.0.5']), true);
     assert.equal(isAuthorizedTargetHost('"host.docker.internal"', ['host.docker.internal']), true);
@@ -48,6 +58,79 @@ test('isAuthorizedTargetHost rejects hosts that are not in the allowlist', () =>
     assert.equal(isAuthorizedTargetHost("'10.0.0.9'", ['10.0.0.5']), false);
 });
 
+test('validateSshArgs accepts the SSH arguments generated by Coolify', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p '22' 'root'@'10.0.0.5' 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), true);
+});
+
+test('validateSshArgs rejects an injected ProxyCommand', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 300 ssh -o 'ProxyCommand=/bin/busybox id >/tmp/marker' root@10.0.0.5 'bash -se' << \\ENDSSH\nENDSSH"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), false);
+});
+
+test('validateSshArgs accepts only the fixed Cloudflare ProxyCommand', () => {
+    const validArgs = extractSshArgs(
+        "timeout 3600 ssh -o ProxyCommand='cloudflared access ssh --hostname %h' -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@example.com 'bash -se' << \\$abc\necho hi\nabc"
+    );
+    const maliciousArgs = [...validArgs];
+    maliciousArgs[1] = 'ProxyCommand=cloudflared access ssh --hostname %h; id';
+
+    assert.equal(validateSshArgs(validArgs, ['example.com']), true);
+    assert.equal(validateSshArgs(maliciousArgs, ['example.com']), false);
+});
+
+test('validateSshArgs rejects unknown SSH options and key paths', () => {
+    const baseArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(['-F', '/tmp/config', ...baseArgs], ['10.0.0.5']), false);
+    assert.equal(validateSshArgs(['-i', '/tmp/attacker-key', ...baseArgs.slice(2)], ['10.0.0.5']), false);
+});
+
+test('validateSshArgs rejects a destination that begins with an option prefix', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 -evil@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), false);
+});
+
+test('sanitizeSshArgs removes SSH multiplexing options before spawning SSH', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/mux_cm123 -o ControlPersist=3600 -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), true);
+    assert.deepEqual(sanitizeSshArgs(sshArgs), [
+        '-i',
+        '/var/www/html/storage/app/ssh/keys/ssh_key@cm123',
+        '-o',
+        'StrictHostKeyChecking=no',
+        '-o',
+        'UserKnownHostsFile=/dev/null',
+        '-o',
+        'PasswordAuthentication=no',
+        '-o',
+        'ConnectTimeout=10',
+        '-o',
+        'ServerAliveInterval=20',
+        '-o',
+        'RequestTTY=yes',
+        '-o',
+        'LogLevel=ERROR',
+        '-p',
+        '22',
+        'root@10.0.0.5',
+    ]);
+});
+
 
 test('getTerminalSessionTimeout always enforces the maximum terminal session lifetime', () => {
     assert.equal(getTerminalSessionTimeout(null), MAX_TERMINAL_SESSION_TIMEOUT_SECONDS);
diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml
index 0d7caceb95..ebf12379d5 100644
--- a/other/nightly/docker-compose.prod.yml
+++ b/other/nightly/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.17'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/other/nightly/docker-compose.windows.yml b/other/nightly/docker-compose.windows.yml
index 43f6f0d0e9..32524c4f43 100644
--- a/other/nightly/docker-compose.windows.yml
+++ b/other/nightly/docker-compose.windows.yml
@@ -96,7 +96,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.17'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 440ad36160..455918fdc0 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,16 +1,16 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.10"
+            "version": "4.3.15"
         },
         "nightly": {
             "version": "4.4-rc.1"
         },
         "helper": {
-            "version": "1.0.15"
+            "version": "1.0.16"
         },
         "realtime": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
             "version": "0.0.22"
diff --git a/public/svgs/executor.png b/public/svgs/executor.png
new file mode 100644
index 0000000000..a7cc57de9f
Binary files /dev/null and b/public/svgs/executor.png differ
diff --git a/resources/css/app.css b/resources/css/app.css
index 49e2998311..d62a33ce57 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1914,6 +1914,61 @@ html[data-theme="custom"] textarea:disabled {
     flex-shrink: 0;
 }
 
+.split-action {
+    display: inline-flex;
+}
+
+.split-action-main,
+.split-action-caret {
+    @apply button-highlighted;
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.375rem;
+    height: 2rem;
+    font-size: 13px;
+    font-weight: 500;
+    white-space: nowrap;
+    cursor: pointer;
+}
+
+.split-action-main {
+    flex: 1 1 auto;
+    min-width: 0;
+    padding: 0 0.625rem;
+    border-radius: 6px 0 0 6px;
+}
+
+.split-action-caret {
+    flex-shrink: 0;
+    width: 1.75rem;
+    border-left: 1px solid rgba(255, 255, 255, 0.25);
+    border-radius: 0 6px 6px 0;
+}
+
+.split-action > .split-action-main:only-of-type {
+    border-radius: 6px;
+}
+
+.split-action-main:disabled,
+.split-action-caret:disabled {
+    cursor: not-allowed;
+    opacity: 0.45;
+}
+
+.split-action-main:focus-visible,
+.split-action-caret:focus-visible {
+    outline: none;
+    position: relative;
+    z-index: 1;
+    box-shadow: 0 0 0 1px var(--color-accent);
+}
+
+.application-heading-actions .split-action-main,
+.application-heading-actions .split-action-caret {
+    height: 1.75rem;
+}
+
 /* Custom listbox (replaces native <select>) */
 .listbox-trigger {
     display: flex;
@@ -2196,6 +2251,14 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 /* Data table (layer-card body, full-bleed) */
+.data-table {
+    min-width: 0;
+    max-width: 100%;
+    overflow-x: auto;
+    overscroll-behavior-x: contain;
+    -webkit-overflow-scrolling: touch;
+}
+
 .data-table-header {
     display: grid;
     align-items: center;
@@ -2557,8 +2620,25 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .service-backup-table-grid {
-    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr);
-    min-width: 45rem;
+    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 7.5rem;
+    width: 100%;
+}
+
+.data-table-row.service-backup-table-grid {
+    background: var(--coollabs-base);
+    border-bottom: 1px solid var(--coollabs-fill);
+}
+
+.data-table-row.service-backup-table-grid:last-child {
+    border-bottom: 0;
+}
+
+.data-table-row.service-backup-table-grid:hover {
+    background: color-mix(in srgb, var(--coollabs-base) 98%, black);
+}
+
+.dark .data-table-row.service-backup-table-grid:hover {
+    background: color-mix(in srgb, var(--coollabs-base) 98%, white);
 }
 
 /* Persistent storage volumes: Name | Source | Destination | [PR suffix] | Backup | [Actions] */
diff --git a/resources/js/app.js b/resources/js/app.js
index 98231aa677..1e53439561 100644
--- a/resources/js/app.js
+++ b/resources/js/app.js
@@ -1,6 +1,11 @@
 import { initializeCopyButtonComponent } from './copy-button.js';
 import { initializeTerminalComponent } from './terminal.js';
 import './traffic-globe.js';
+import { registerLivewireRequestFailureHandler } from './livewire-request-failure.js';
+
+document.addEventListener('livewire:init', () => {
+    registerLivewireRequestFailureHandler(window.Livewire);
+});
 
 // Livewire 3.5.19+ re-applies `x-cloak` to morphed elements during wire:navigate
 // (via replaceHtmlAttributes). With `[x-cloak]{display:none}` on the app wrapper,
diff --git a/resources/js/livewire-request-failure.js b/resources/js/livewire-request-failure.js
new file mode 100644
index 0000000000..e1bd82583c
--- /dev/null
+++ b/resources/js/livewire-request-failure.js
@@ -0,0 +1,68 @@
+export const INFRASTRUCTURE_FAILURE_STATUSES = new Set([502, 503, 504, 520, 521, 522, 523, 524, 525, 526, 527, 530]);
+
+const USER_GESTURE_EVENTS = ['click', 'submit', 'keydown', 'input', 'change'];
+
+// A request sent within this window of a trusted user gesture is treated as
+// user-initiated. It must cover Alpine $nextTick deferrals and wire:model
+// debounces, while staying short enough to exclude most wire:poll requests.
+export const GESTURE_WINDOW_MS = 2_000;
+
+const WARN_COOLDOWN_MS = 10_000;
+const WARN_CONTENT_MAX_LENGTH = 2_000;
+
+export function createLivewireRequestFailureHandler({ now = Date.now } = {}) {
+    let lastWarnAt = Number.NEGATIVE_INFINITY;
+    let lastToastGestureAt = Number.NEGATIVE_INFINITY;
+
+    return ({ status, content, preventDefault, gestureAt = Number.NEGATIVE_INFINITY }) => {
+        if (!INFRASTRUCTURE_FAILURE_STATUSES.has(status)) {
+            return;
+        }
+
+        preventDefault();
+
+        const currentTime = now();
+        if (currentTime - lastWarnAt >= WARN_COOLDOWN_MS) {
+            lastWarnAt = currentTime;
+            console.warn('Livewire request failed', {
+                status,
+                content: typeof content === 'string' ? content.slice(0, WARN_CONTENT_MAX_LENGTH) : content,
+            });
+        }
+
+        // One toast per user gesture: a single click that fails several
+        // component requests toasts once, while a retry (a new gesture)
+        // always toasts again. Background requests carry no gesture.
+        if (gestureAt > lastToastGestureAt) {
+            lastToastGestureAt = gestureAt;
+            window.toast?.('Action could not be completed', {
+                type: 'danger',
+                description: 'Coolify did not receive a response. Please try again.',
+            });
+        }
+    };
+}
+
+export function registerLivewireRequestFailureHandler(Livewire, documentObject = document, { now = Date.now } = {}) {
+    let lastGestureAt = Number.NEGATIVE_INFINITY;
+
+    const markUserGesture = (event) => {
+        if (event.isTrusted) {
+            lastGestureAt = now();
+        }
+    };
+
+    USER_GESTURE_EVENTS.forEach((eventName) => {
+        documentObject.addEventListener(eventName, markUserGesture, true);
+    });
+
+    const handleFailure = createLivewireRequestFailureHandler({ now });
+
+    Livewire.hook('request', ({ fail }) => {
+        // Classify at send time: infrastructure failures (522/524) can arrive
+        // long after the gesture, so the failure timestamp is meaningless.
+        const gestureAt = now() - lastGestureAt <= GESTURE_WINDOW_MS ? lastGestureAt : Number.NEGATIVE_INFINITY;
+
+        fail((failure) => handleFailure({ ...failure, gestureAt }));
+    });
+}
diff --git a/resources/js/livewire-request-failure.test.js b/resources/js/livewire-request-failure.test.js
new file mode 100644
index 0000000000..64a5cebbce
--- /dev/null
+++ b/resources/js/livewire-request-failure.test.js
@@ -0,0 +1,146 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+    GESTURE_WINDOW_MS,
+    INFRASTRUCTURE_FAILURE_STATUSES,
+    createLivewireRequestFailureHandler,
+    registerLivewireRequestFailureHandler,
+} from './livewire-request-failure.js';
+
+function createHarness({ start = 100_000 } = {}) {
+    let currentTime = start;
+    let requestHook = null;
+    let toasts = 0;
+    let warnings = [];
+    const listeners = {};
+
+    global.window = { toast: () => toasts++ };
+    global.console = { warn: (...args) => warnings.push(args) };
+
+    registerLivewireRequestFailureHandler({
+        hook(name, callback) {
+            assert.equal(name, 'request');
+            requestHook = callback;
+        },
+    }, {
+        addEventListener(name, callback) {
+            listeners[name] = callback;
+        },
+    }, { now: () => currentTime });
+
+    return {
+        listeners,
+        advance: (ms) => currentTime += ms,
+        gesture: (event = { isTrusted: true }) => listeners.click(event),
+        fail(status) {
+            let prevented = false;
+            let failureCallback = null;
+            requestHook({ fail: (callback) => failureCallback = callback });
+            failureCallback({ status, content: '<html>proxy error</html>', preventDefault: () => prevented = true });
+            return prevented;
+        },
+        toasts: () => toasts,
+        warnings: () => warnings,
+    };
+}
+
+test('a failure after a trusted gesture suppresses the response and shows a toast', () => {
+    const harness = createHarness();
+
+    harness.gesture();
+    const prevented = harness.fail(504);
+
+    assert.equal(prevented, true);
+    assert.equal(harness.toasts(), 1);
+});
+
+test('background failures are suppressed and logged without a toast', () => {
+    const harness = createHarness();
+
+    const prevented = harness.fail(524);
+
+    assert.equal(prevented, true);
+    assert.equal(harness.toasts(), 0);
+    assert.equal(harness.warnings().length, 1);
+    assert.deepEqual(harness.warnings()[0], ['Livewire request failed', {
+        status: 524,
+        content: '<html>proxy error</html>',
+    }]);
+});
+
+test('one gesture toasts once, but a retry gesture toasts again', () => {
+    const harness = createHarness();
+
+    harness.gesture();
+    harness.fail(504);
+    harness.fail(504);
+    assert.equal(harness.toasts(), 1);
+
+    harness.advance(8_000);
+    harness.gesture();
+    harness.fail(504);
+    assert.equal(harness.toasts(), 2);
+});
+
+test('requests sent outside the gesture window count as background', () => {
+    const harness = createHarness();
+
+    harness.gesture();
+    harness.advance(GESTURE_WINDOW_MS + 1);
+    harness.fail(504);
+
+    assert.equal(harness.toasts(), 0);
+});
+
+test('untrusted synthetic events do not count as gestures', () => {
+    const harness = createHarness();
+
+    harness.gesture({ isTrusted: false });
+    harness.fail(504);
+
+    assert.equal(harness.toasts(), 0);
+});
+
+test('a missing window.toast does not throw', () => {
+    const harness = createHarness();
+    delete global.window.toast;
+
+    harness.gesture();
+    assert.doesNotThrow(() => harness.fail(504));
+});
+
+test('console warnings are throttled and truncated', () => {
+    const harness = createHarness();
+
+    harness.fail(502);
+    harness.fail(504);
+    assert.equal(harness.warnings().length, 1);
+
+    harness.advance(10_000);
+    harness.fail(504);
+    assert.equal(harness.warnings().length, 2);
+
+    const handler = createLivewireRequestFailureHandler({ now: () => 0 });
+    let logged = null;
+    global.console = { warn: (message, details) => logged = details };
+    handler({ status: 502, content: 'x'.repeat(5_000), preventDefault() {} });
+    assert.equal(logged.content.length, 2_000);
+});
+
+test('all supported infrastructure status codes are handled', () => {
+    const harness = createHarness();
+
+    for (const status of INFRASTRUCTURE_FAILURE_STATUSES) {
+        assert.equal(harness.fail(status), true, `expected ${status} to be handled`);
+    }
+});
+
+test('other failures keep Livewire default handling', () => {
+    const harness = createHarness();
+
+    harness.gesture();
+    for (const status of [401, 419, 422, 429, 500]) {
+        assert.equal(harness.fail(status), false, `expected ${status} to be untouched`);
+    }
+    assert.equal(harness.toasts(), 0);
+});
diff --git a/resources/views/components/application/configuration-sidebar.blade.php b/resources/views/components/application/configuration-sidebar.blade.php
index 7c92362ec5..77d273195f 100644
--- a/resources/views/components/application/configuration-sidebar.blade.php
+++ b/resources/views/components/application/configuration-sidebar.blade.php
@@ -267,7 +267,8 @@
                                 <span class="menu-item-label">{{ $menuItem['label'] }}</span>
                                 @if ($menuItem['badge'] ?? false)
                                     <span class="shrink-0">
-                                        <livewire:project.application.server-status-badge :application="$application" />
+                                        <livewire:project.application.server-status-badge :application="$application"
+                                            :key="'application-server-status-'.$application->uuid" />
                                     </span>
                                 @endif
                             </a>
diff --git a/resources/views/components/application/restart-limit-warning.blade.php b/resources/views/components/application/restart-limit-warning.blade.php
new file mode 100644
index 0000000000..3d08c803d5
--- /dev/null
+++ b/resources/views/components/application/restart-limit-warning.blade.php
@@ -0,0 +1,10 @@
+@props(['application'])
+
+@if ($application->stoppedAfterRestartLimit())
+    @php($restartLimit = method_exists($application, 'restartLimitMaximum') ? $application->restartLimitMaximum() : ($application->max_restart_count ?? 0))
+    @php($displayRestartCount = max($application->restart_count ?? 0, $restartLimit))
+    <x-status-badge
+        status="Restart limit reached"
+        type="warning"
+        title="Container has crashed and Coolify stopped it after {{ $displayRestartCount }} restart attempts." />
+@endif
diff --git a/resources/views/components/backup-sidebar.blade.php b/resources/views/components/backup-sidebar.blade.php
index 90c86ddb55..a2177b690d 100644
--- a/resources/views/components/backup-sidebar.blade.php
+++ b/resources/views/components/backup-sidebar.blade.php
@@ -15,7 +15,7 @@
             'danger' => 'project.application.backup.danger',
         ],
         'service' => [
-            'back' => 'project.service.database.backups',
+            'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.database.backup.show',
             's3' => 'project.service.database.backup.s3',
             'retention' => 'project.service.database.backup.retention',
@@ -48,9 +48,11 @@
         ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'shield-alert'],
     ];
     $backLabel = $context === 'database' ? 'Back to database' : 'Back to backups';
-    $backParameters = $context === 'database'
-        ? collect($parameters)->except('backup_uuid')->all()
-        : $parameters;
+    $backParameters = match ($context) {
+        'database' => collect($parameters)->except('backup_uuid')->all(),
+        'service' => collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all(),
+        default => $parameters,
+    };
 @endphp
 
 <aside class="application-settings-navigation min-w-0 xl:self-start">
diff --git a/resources/views/components/backup-tabs.blade.php b/resources/views/components/backup-tabs.blade.php
new file mode 100644
index 0000000000..4898a29ed5
--- /dev/null
+++ b/resources/views/components/backup-tabs.blade.php
@@ -0,0 +1,62 @@
+@props([
+    'context',
+    'parameters',
+    'section',
+])
+
+@php
+    $routes = match ($context) {
+        'service-schedule' => [
+            'general' => true,
+            's3' => true,
+            'retention' => true,
+            'danger' => true,
+        ],
+        'service' => [
+            'general' => 'project.service.database.backup.show',
+            's3' => 'project.service.database.backup.s3',
+            'retention' => 'project.service.database.backup.retention',
+            'executions' => 'project.service.database.backup.executions',
+            'danger' => 'project.service.database.backup.danger',
+        ],
+        'service-volume' => [
+            'general' => 'project.service.volume-backups.show',
+            's3' => 'project.service.volume-backups.s3',
+            'retention' => 'project.service.volume-backups.retention',
+            'executions' => 'project.service.volume-backups.executions',
+            'danger' => 'project.service.volume-backups.danger',
+        ],
+    };
+
+    $items = collect([
+        ['key' => 'general', 'label' => 'General'],
+        ['key' => 's3', 'label' => 'S3 storage'],
+        ['key' => 'retention', 'label' => 'Retention'],
+        ['key' => 'executions', 'label' => 'Executions'],
+        ['key' => 'danger', 'label' => 'Danger Zone'],
+    ])->filter(fn (array $item): bool => isset($routes[$item['key']]));
+@endphp
+
+<nav aria-label="Backup sections"
+    class="flex min-w-0 flex-wrap gap-1 border-b border-neutral-200 pb-2 dark:border-white/[0.08]">
+    @foreach ($items as $item)
+        @if ($context === 'service-schedule')
+            <button type="button" @click="activeSection = '{{ $item['key'] }}'"
+                :class="activeSection === '{{ $item['key'] }}'
+                    ? 'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25'
+                    : 'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg'"
+                class="inline-flex h-8 shrink-0 cursor-pointer items-center rounded-md px-3 text-[13px] font-medium transition-colors">
+                {{ $item['label'] }}
+            </button>
+        @else
+            <a @class([
+                'inline-flex h-8 shrink-0 items-center rounded-md px-3 text-[13px] font-medium transition-colors',
+                'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25' => $section === $item['key'],
+                'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg' => $section !== $item['key'],
+            ])
+                {{ wireNavigate() }} href="{{ route($routes[$item['key']], $parameters) }}">
+                {{ $item['label'] }}
+            </a>
+        @endif
+    @endforeach
+</nav>
diff --git a/resources/views/components/forms/env-var-input.blade.php b/resources/views/components/forms/env-var-input.blade.php
index 378a3947e3..41a29fbbdb 100644
--- a/resources/views/components/forms/env-var-input.blade.php
+++ b/resources/views/components/forms/env-var-input.blade.php
@@ -20,13 +20,32 @@
             cursorPosition: 0,
             currentScope: null,
             availableVars: @js($availableVars),
+            hasVaultSource: @js($hasVaultSource),
+            vaultKeysLoading: false,
             get availableScopes() {
                 // Only include scopes that have at least one variable
                 const allScopes = ['team', 'project', 'environment', 'server'];
-                return allScopes.filter(scope => {
+                const scopes = allScopes.filter(scope => {
                     const vars = this.availableVars[scope];
                     return vars && vars.length > 0;
                 });
+                // The vault scope is offered whenever a secret manager source is
+                // configured; its keys are fetched lazily on first use.
+                if (this.hasVaultSource) {
+                    scopes.push('vault');
+                }
+                return scopes;
+            },
+            loadVaultKeys() {
+                if (this.vaultKeysLoading) return;
+                this.vaultKeysLoading = true;
+                this.$wire.fetchSecretManagerKeys().then(keys => {
+                    this.availableVars['vault'] = keys || [];
+                    this.vaultKeysLoading = false;
+                    this.handleInput();
+                }).catch(() => {
+                    this.vaultKeysLoading = false;
+                });
             },
             scopeUrls: @js($scopeUrls),
 
@@ -84,6 +103,15 @@
                     }
 
                     this.currentScope = scope;
+
+                    // Vault keys are fetched from the secret manager on first use.
+                    if (scope === 'vault' && this.availableVars['vault'] === undefined) {
+                        this.loadVaultKeys();
+                        this.suggestions = [];
+                        this.showDropdown = true;
+                        return;
+                    }
+
                     const scopeVars = this.availableVars[scope] || [];
                     const filtered = scopeVars.filter(v =>
                         v.toLowerCase().includes((partial || '').toLowerCase())
@@ -214,6 +242,7 @@
                 wire:dirty.class="[box-shadow:inset_4px_0_0_#6b16ed,inset_0_0_0_2px_#e5e5e5] dark:[box-shadow:inset_4px_0_0_#fcd452,inset_0_0_0_2px_#242424]"
             @endif
             wire:loading.attr="disabled"
+            wire:target.except="fetchSecretManagerKeys"
             @disabled($disabled)
             @if ($type !== 'password')
                 type="{{ $type }}"
@@ -236,7 +265,14 @@
         <div x-show="showDropdown" x-cloak x-transition.origin.top
             class="listbox-panel top-full! z-[60]! mt-1! w-full! min-w-0! max-w-full!" role="listbox">
 
-            <template x-if="suggestions.length === 0 && currentScope">
+            <template x-if="suggestions.length === 0 && currentScope === 'vault'">
+                <div class="px-2 py-2 text-sm text-neutral-500 dark:text-fg-dim">
+                    <span x-show="vaultKeysLoading">Loading keys from the secret manager…</span>
+                    <span x-show="!vaultKeysLoading">No matching keys in the secret manager.</span>
+                </div>
+            </template>
+
+            <template x-if="suggestions.length === 0 && currentScope && currentScope !== 'vault'">
                 <div class="px-2 py-2 text-sm text-neutral-500 dark:text-fg-dim">
                     <div>No shared variables found in <span class="font-semibold" x-text="currentScope"></span> scope.</div>
                     <a :href="getScopeUrl(currentScope)"
diff --git a/resources/views/components/forms/input.blade.php b/resources/views/components/forms/input.blade.php
index 2f96331643..4a94d3e02e 100644
--- a/resources/views/components/forms/input.blade.php
+++ b/resources/views/components/forms/input.blade.php
@@ -22,7 +22,11 @@
             @endif
         </div>
     @endif
-    @if ($type === 'password')
+    @if ($loading)
+        <div class="{{ $defaultClass }} flex w-full items-center text-neutral-500 dark:text-fg-dim" aria-busy="true">
+            <x-loading :text="$loadingText" />
+        </div>
+    @elseif ($type === 'password')
         <div class="relative" x-data="{ type: 'password' }" @success.window="type = 'password'">
             <input autocomplete="{{ $autocomplete }}" value="{{ $value }}"
                 x-bind:type="type"
@@ -33,7 +37,7 @@
                 @readonly($readonly) @disabled($disabled) id="{{ $htmlId }}"
                 name="{{ $name }}" placeholder="{{ $attributes->get('placeholder') }}"
                 aria-placeholder="{{ $attributes->get('placeholder') }}"
-                @if ($autofocus) x-ref="autofocusInput" @endif>
+                @if ($autofocus) x-ref="autofocusInput" autofocus @endif>
             @if ($allowToPeak)
                 <button type="button" x-on:click="type = type === 'password' ? 'text' : 'password'"
                     class="password-toggle flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer text-neutral-500 hover:text-black dark:text-neutral-400 dark:hover:text-white"
@@ -56,7 +60,7 @@
             maxlength="{{ $attributes->get('maxlength') }}"
             @if ($htmlId !== 'null') id={{ $htmlId }} @endif name="{{ $name }}"
             placeholder="{{ $attributes->get('placeholder') }}"
-            @if ($autofocus) x-ref="autofocusInput" @endif>
+            @if ($autofocus) x-ref="autofocusInput" autofocus @endif>
     @endif
     @if (!$label && $helper)
         <x-helper :helper="$helper" />
diff --git a/resources/views/components/forms/monaco-editor.blade.php b/resources/views/components/forms/monaco-editor.blade.php
index b0d4adb14e..69466f7daa 100644
--- a/resources/views/components/forms/monaco-editor.blade.php
+++ b/resources/views/components/forms/monaco-editor.blade.php
@@ -3,8 +3,6 @@
         monacoVersion: '0.52.2',
         monacoContent: @entangle($id),
         monacoLanguage: '',
-        monacoPlaceholder: true,
-        monacoPlaceholderText: 'Start typing here',
         monacoLoader: true,
         monacoFontSize: '15px',
         monacoId: $id('monaco-editor'),
@@ -14,20 +12,7 @@
         monacoEditor(editor) {
             editor.onDidChangeModelContent((e) => {
                 this.monacoContent = editor.getValue();
-                this.updatePlaceholder(editor.getValue());
             });
-            editor.onDidBlurEditorWidget(() => {
-                this.updatePlaceholder(editor.getValue());
-            });
-            editor.onDidFocusEditorWidget(() => {
-                this.updatePlaceholder(editor.getValue());
-            });
-        },
-        updatePlaceholder(value) {
-            this.monacoPlaceholder = value === '';
-        },
-        monacoEditorFocus() {
-            document.getElementById(this.monacoId).dispatchEvent(new CustomEvent('monaco-editor-focused', { detail: { monacoId: this.monacoId } }));
         },
         monacoEditorAddLoaderScriptToHead() {
             // Use a global flag to prevent duplicate script loading
@@ -111,6 +96,7 @@
                         lineNumbersMinChars: 3,
                         automaticLayout: true,
                         language: '{{ $language }}',
+                        placeholder: 'Start typing here',
                         domReadOnly: '{{ $readonly ?? false }}',
                         contextmenu: '!{{ $readonly ?? false }}',
                         renderLineHighlight: 'none',
@@ -143,13 +129,8 @@
                     });
         
                     monacoEditor(editor);
-        
-                    document.getElementById(monacoId).editor = editor;
-                    document.getElementById(monacoId).addEventListener('monaco-editor-focused', (event) => {
-                        editor.focus();
-                    });
 
-                    updatePlaceholder(editor.getValue());
+                    document.getElementById(monacoId).editor = editor;
 
                     @if ($autofocus)
                     // Auto-focus the editor
@@ -172,10 +153,6 @@
         </div>
         <div class="relative z-10 w-full h-full">
             <div x-ref="monacoEditorElement" class="w-full text-md {{ $readonly ? 'opacity-65' : '' }}" style="height: var(--editor-height, calc(100vh - 20rem)); min-height: 150px;"></div>
-            <div x-ref="monacoPlaceholderElement" x-show="monacoPlaceholder" @click="monacoEditorFocus()"
-                :style="'font-size: ' + monacoFontSize"
-                class="w-full text-sm font-mono absolute z-50 text-gray-500 ml-14 -translate-x-0.5 mt-0.5 left-0 top-0"
-                x-text="monacoPlaceholderText"></div>
         </div>
     </div>
 </div>
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index b80e3d649b..588032e039 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -47,7 +47,7 @@
                 x-transition:enter-end="opacity-100" x-transition:leave="ease-in duration-100"
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
-            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-4 sm:items-center">
+            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-2 sm:items-center sm:p-4">
                 <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
                     x-transition:enter="ease-out duration-100"
                     x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
@@ -61,19 +61,22 @@
                         'lg:w-auto lg:min-w-2xl lg:max-w-4xl' => ! $isLarge,
                     ])
                     style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
-                    <header class="flex-nowrap!">
+                    <header class="flex-wrap! sm:flex-nowrap!">
                         <h3 class="min-w-0 flex-1 truncate">{{ $title }}</h3>
                         @isset($headerActions)
-                            <div class="flex shrink-0 items-center gap-2">
+                            <div class="order-3 w-full sm:order-none sm:w-auto flex shrink-0 items-center gap-2">
                                 {{ $headerActions }}
                             </div>
                         @endisset
                         <button type="button" @click="modalOpen=false"
-                            class="flex size-7 shrink-0 cursor-pointer items-center justify-center rounded-md text-neutral-500 outline-0 transition-colors hover:bg-neutral-100 hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                            class="order-2 sm:order-none flex size-7 shrink-0 cursor-pointer items-center justify-center rounded-md text-neutral-500 outline-0 transition-colors hover:bg-neutral-100 hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                             <x-reicon name="x" class="size-4" />
                         </button>
                     </header>
-                    <div class="application-settings-section-body min-h-0 flex-1 overflow-y-auto"
+                    <div @class([
+                        'application-settings-section-body min-h-0 flex-1 overflow-y-auto',
+                        'mt-2 sm:mt-0' => isset($headerActions),
+                    ])
                         style="-webkit-overflow-scrolling: touch;">
                         {{ $slot }}
                     </div>
diff --git a/resources/views/components/notification/event-grid.blade.php b/resources/views/components/notification/event-grid.blade.php
index 2ce6a4a7f7..55b452cf5e 100644
--- a/resources/views/components/notification/event-grid.blade.php
+++ b/resources/views/components/notification/event-grid.blade.php
@@ -9,10 +9,17 @@
         'Deployments' => [
             ['key' => 'deploymentSuccess', 'label' => 'Deployment success'],
             ['key' => 'deploymentFailure', 'label' => 'Deployment failure'],
+        ],
+        'Resources' => [
             [
                 'key' => 'statusChange',
-                'label' => 'Container status changes',
-                'helper' => 'Notify when a container stops or restarts.',
+                'label' => 'Resource status changes',
+                'helper' => 'Notify when a resource stops or Coolify automatically restarts it.',
+            ],
+            [
+                'key' => 'restartLimitReached',
+                'label' => 'Restart limit reached',
+                'helper' => 'Notify when a resource is stopped after reaching its restart limit.',
             ],
         ],
         'Backups' => [
diff --git a/resources/views/components/page-size-select.blade.php b/resources/views/components/page-size-select.blade.php
index 63bd02da96..5d0f7056be 100644
--- a/resources/views/components/page-size-select.blade.php
+++ b/resources/views/components/page-size-select.blade.php
@@ -3,8 +3,15 @@
     'livewire' => false,
     'options' => [10, 25, 50, 100],
     'storageKey' => null,
+    'canGate' => null,
+    'canResource' => null,
 ])
 
+@php
+    $disabled = $canGate && $canResource
+        && ! Illuminate\Support\Facades\Gate::allows($canGate, $canResource);
+@endphp
+
 <div class="mb-0! flex h-7 items-center gap-1.5 text-[11px] text-neutral-500 dark:text-fg-dim"
     x-data="{
         selectedPageSize: @js((int) $options[0]),
@@ -36,6 +43,7 @@
         <x-table.dropdown panel-class="min-w-24!">
             <x-slot:trigger>
                 <button type="button" aria-label="Items per page" aria-haspopup="listbox" :aria-expanded="open"
+                    @disabled($disabled)
                     class="inline-flex h-7! w-12! items-center justify-between border-0 px-1 text-[11px]! leading-none! tabular-nums text-neutral-500 transition-colors hover:text-black dark:text-fg-dim dark:hover:text-fg">
                     <span x-text="selectedPageSize"></span>
                     <x-reicon name="chevron-down" class="size-3 text-neutral-400 dark:text-fg-faint" />
@@ -43,6 +51,7 @@
             </x-slot:trigger>
             @foreach ($options as $option)
                 <button type="button" class="listbox-option" role="option"
+                    @disabled($disabled)
                     :aria-selected="selectedPageSize === {{ (int) $option }}"
                     x-on:click="applyPageSize({{ (int) $option }})">
                     <span>{{ $option }}</span>
@@ -50,6 +59,7 @@
                 </button>
             @endforeach
             <button type="button" class="listbox-option" role="option"
+                @disabled($disabled)
                 x-on:click="customizingPageSize = true; $nextTick(() => $refs.customPageSize.focus())">
                 Custom…
             </button>
@@ -58,6 +68,6 @@
     <input x-cloak x-show="customizingPageSize" x-ref="customPageSize" x-model.number="customPageSize"
         x-on:keydown.enter.prevent="applyPageSize(customPageSize)" x-on:keydown.escape.prevent="customizingPageSize = false"
         x-on:blur="if (customizingPageSize) applyPageSize(customPageSize)" type="number" min="1" max="100" inputmode="numeric"
-        aria-label="Custom items per page"
+        aria-label="Custom items per page" @disabled($disabled)
         class="mb-0! h-7! w-14! rounded-md! border-neutral-200! bg-transparent! px-1.5! py-0! text-[11px]! tabular-nums shadow-none! focus:border-neutral-300! focus:ring-0! dark:border-white/[0.08]! dark:text-fg-dim!" />
 </div>
diff --git a/resources/views/components/server/status-summary.blade.php b/resources/views/components/server/status-summary.blade.php
index 5e732fade8..8be64a7711 100644
--- a/resources/views/components/server/status-summary.blade.php
+++ b/resources/views/components/server/status-summary.blade.php
@@ -6,10 +6,16 @@
 
 @php
     $serverReady = $server->isFunctional();
-    $proxyUpdateAvailable = $server->proxySet()
-        && ($server->hasCurrentTraefikOutdatedInfo() || $server->hasPendingProxyConfiguration());
+    $proxyConfigurationPending = $server->proxySet() && $server->hasPendingProxyConfiguration();
+    $traefikUpdateAvailable = $server->proxySet() && $server->hasCurrentTraefikOutdatedInfo();
+    $proxyUpdateAvailable = $proxyConfigurationPending || $traefikUpdateAvailable;
     $proxyNeedsAttention = $server->proxySet()
         && (! in_array($proxyStatus, ['running'], true) || $proxyUpdateAvailable);
+    $proxyStatusLabel = match (true) {
+        $proxyConfigurationPending => 'Restart required',
+        $traefikUpdateAvailable => 'Update available',
+        default => str($proxyStatus ?: 'unknown')->headline(),
+    };
     $sentinelNeedsAttention = $showSentinelStatus && ! $server->isSentinelLive();
 
     [$summaryLabel, $summaryType] = match (true) {
@@ -66,7 +72,7 @@
                     'bg-error' => $proxyNeedsAttention && ! $proxyUpdateAvailable && ! in_array($proxyStatus, ['starting', 'restarting', 'stopping'], true),
                 ])></span>
                 <span class="flex-1">Proxy</span>
-                <span>{{ str($proxyStatus ?: 'unknown')->headline() }}</span>
+                <span>{{ $proxyStatusLabel }}</span>
             </a>
         @endif
         @if ($showSentinelStatus)
diff --git a/resources/views/components/service-database/sidebar.blade.php b/resources/views/components/service-database/sidebar.blade.php
index 610cbd9493..756cc6068a 100644
--- a/resources/views/components/service-database/sidebar.blade.php
+++ b/resources/views/components/service-database/sidebar.blade.php
@@ -1,11 +1,9 @@
 @props([
     'parameters',
     'serviceDatabase',
-    'isImportSupported' => false,
 ])
 
 @php
-    $serviceParameters = \Illuminate\Support\Arr::except($parameters, ['stack_service_uuid']);
     $items = [
         [
             'label' => 'General',
@@ -19,22 +17,6 @@
             'icon' => 'grid',
             'active' => request()->routeIs('project.service.index.advanced'),
         ],
-        [
-            'label' => 'Backups',
-            'route' => 'project.service.volume-backups.index',
-            'parameters' => $serviceParameters,
-            'icon' => 'storages',
-            'active' => request()->routeIs('project.service.database.backup*'),
-            'visible' => $serviceDatabase?->isBackupSolutionAvailable() || $serviceDatabase?->is_migrated,
-        ],
-        [
-            'label' => 'Import Backup',
-            'route' => 'project.service.database.import',
-            'icon' => 'upload',
-            'active' => request()->routeIs('project.service.database.import'),
-            'visible' => $isImportSupported,
-            'navigate' => false,
-        ],
     ];
 
     $items = array_values(array_filter($items, fn (array $item): bool => $item['visible'] ?? true));
diff --git a/resources/views/components/service/configuration-sidebar.blade.php b/resources/views/components/service/configuration-sidebar.blade.php
index 49dbff49ae..5e58b99b08 100644
--- a/resources/views/components/service/configuration-sidebar.blade.php
+++ b/resources/views/components/service/configuration-sidebar.blade.php
@@ -13,6 +13,7 @@
         ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
         ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
         ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
+        ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
         ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
         ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
@@ -27,13 +28,15 @@
                 || ($item['route'] === 'project.service.scheduled-tasks.show'
                     && str($currentRoute)->startsWith('project.service.scheduled-tasks'))
                 || ($item['route'] === 'project.service.volume-backups.index'
-                    && str($currentRoute)->startsWith('project.service.volume-backups')),
+                    && str($currentRoute)->startsWith('project.service.volume-backups'))
+                || ($item['route'] === 'project.service.import-backup'
+                    && str($currentRoute)->startsWith('project.service.import-backup')),
         ]);
 
     $menuGroups = [
         'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
         'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
-        'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
+        'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
         'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
     ];
 
diff --git a/resources/views/components/split-action.blade.php b/resources/views/components/split-action.blade.php
new file mode 100644
index 0000000000..c27525166c
--- /dev/null
+++ b/resources/views/components/split-action.blade.php
@@ -0,0 +1,19 @@
+<div {{ $attributes->class(['split-action relative']) }} x-data="{ open: false }"
+    x-effect="$dispatch('resource-actions-toggled', { open })" @click.outside="open = false"
+    @keydown.escape.window="open = false">
+    <button type="button" {{ $main->attributes->class(['split-action-main']) }}>
+        {{ $main }}
+    </button>
+    @if ($slot->hasActualContent())
+        <button type="button" class="split-action-caret" @click="open = !open" :aria-expanded="open"
+            aria-haspopup="menu" aria-label="More actions">
+            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
+                <x-reicon name="chevron-down" class="size-3" />
+            </span>
+        </button>
+        <div x-cloak x-show="open" x-transition.origin.top
+            class="listbox-panel right-0! xl:left-auto! xl:min-w-60! xl:max-w-96!" role="menu">
+            {{ $slot }}
+        </div>
+    @endif
+</div>
diff --git a/resources/views/components/status-summary.blade.php b/resources/views/components/status-summary.blade.php
index aee198a52b..88102f57ef 100644
--- a/resources/views/components/status-summary.blade.php
+++ b/resources/views/components/status-summary.blade.php
@@ -23,7 +23,7 @@
 
     $containerType = match (true) {
         str($containerStatus)->startsWith('running') => 'success',
-        str($containerStatus)->startsWith(['starting', 'restarting']) => 'warning',
+        str($containerStatus)->startsWith(['starting', 'restarting', 'degraded']) => 'warning',
         default => 'error',
     };
 
@@ -36,6 +36,7 @@
 
     [$summaryLabel, $summaryType] = match (true) {
         $containerType === 'error' => [$containerLabel, 'error'],
+        str($containerStatus)->startsWith('degraded') => ['Degraded', 'warning'],
         $healthType === 'error' => ['Degraded', 'error'],
         $containerType === 'warning' => [$containerLabel, 'warning'],
         $monitoringExcluded => ["{$containerLabel} (monitoring disabled)", 'warning'],
diff --git a/resources/views/components/status/index.blade.php b/resources/views/components/status/index.blade.php
index d774fa94ce..aafa106a7c 100644
--- a/resources/views/components/status/index.blade.php
+++ b/resources/views/components/status/index.blade.php
@@ -22,9 +22,7 @@
             title="Container has restarted {{ $resource->restart_count }} time{{ $resource->restart_count > 1 ? 's' : '' }}. Last restart: {{ $resource->last_restart_at?->diffForHumans() }}" />
     @endif
     @if ($stoppedAfterRestartLimit)
-        <x-status-badge status="Stopped after reaching restart limit ({{ $resource->restart_count }}/{{ $resource->max_restart_count }})."
-            type="warning"
-            title="Container has crashed and Coolify stopped it after {{ $resource->restart_count }} restart attempts." />
+        <x-application.restart-limit-warning :application="$resource" />
     @endif
     @if (!str($resource->status)->contains('exited') && $showRefreshButton)
         <x-status-badge as="button" wire:target="manualCheckStatus" wire:loading.attr="disabled"
diff --git a/resources/views/components/team/settings-layout.blade.php b/resources/views/components/team/settings-layout.blade.php
index e9a5fbd9b0..3b6db03c3a 100644
--- a/resources/views/components/team/settings-layout.blade.php
+++ b/resources/views/components/team/settings-layout.blade.php
@@ -12,6 +12,12 @@
             'active' => request()->routeIs('team.member.index'),
             'icon' => 'teams',
         ],
+        auth()->user()->isAdminOfTeam(currentTeam()->id) ? [
+            'label' => 'Audit log',
+            'route' => 'team.audit-log',
+            'active' => request()->routeIs('team.audit-log'),
+            'icon' => 'time-back',
+        ] : null,
         isInstanceAdmin() ? [
             'label' => 'Admin View',
             'route' => 'team.admin-view',
diff --git a/resources/views/components/top-user-menu.blade.php b/resources/views/components/top-user-menu.blade.php
index b176f4f219..7fdc312cbc 100644
--- a/resources/views/components/top-user-menu.blade.php
+++ b/resources/views/components/top-user-menu.blade.php
@@ -15,7 +15,7 @@
     pageWidth: localStorage.getItem('pageWidth') || 'full',
     themeColor: localStorage.getItem('themeColor') || '#6b16ed',
     themeColorFrame: null,
-    avatarUrl: @js($user?->avatar_path ? route('profile.avatar', ['v' => $user->updated_at->timestamp]) : null),
+    avatarUrl: @js($user?->avatar_path ? profile_avatar_url($user) : null),
     openPanel() {
         this.appearanceOpen = false;
         this.open = true;
diff --git a/resources/views/emails/container-stopped.blade.php b/resources/views/emails/container-stopped.blade.php
deleted file mode 100644
index cc1cec1da9..0000000000
--- a/resources/views/emails/container-stopped.blade.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<x-emails.layout>
-A resource ({{ $containerName }}) has been stopped unexpectedly on {{ $serverName }}.
-
-@if ($url)
-Please check what is going on [here]({{ $url }}).
-@endif
-</x-emails.layout>
diff --git a/resources/views/layouts/simple.blade.php b/resources/views/layouts/simple.blade.php
index 27248f4ece..e927e300c6 100644
--- a/resources/views/layouts/simple.blade.php
+++ b/resources/views/layouts/simple.blade.php
@@ -1,5 +1,8 @@
 @extends('layouts.base')
 @section('body')
+    {{-- Manual @livewireScripts disables Livewire's asset auto-injection, so the
+         styles (e.g. [wire\:loading] { display: none }) must be rendered manually too. --}}
+    @livewireStyles
     @livewireScripts
     <main class="h-full bg-gray-50 dark:bg-base">
         {{ $slot }}
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index ea6e6d1324..5d12e9f59c 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -68,7 +68,7 @@
                                 <div
                                     class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                                     @if ($project->icon_path)
-                                        <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                        <img src="{{ project_icon_url($project) }}"
                                             alt="{{ $project->name }} icon"
                                             class="h-full w-full rounded-lg object-cover">
                                     @else
diff --git a/resources/views/livewire/dev/livewire-request-failure-preview.blade.php b/resources/views/livewire/dev/livewire-request-failure-preview.blade.php
new file mode 100644
index 0000000000..f829b64016
--- /dev/null
+++ b/resources/views/livewire/dev/livewire-request-failure-preview.blade.php
@@ -0,0 +1,23 @@
+<div class="mx-auto flex min-h-screen w-full max-w-3xl flex-col gap-6 px-6 py-12">
+    <div class="flex flex-col gap-2">
+        <p class="text-xs font-semibold uppercase tracking-wider text-coollabs">Development tool</p>
+        <h1 class="text-2xl font-semibold text-neutral-950 dark:text-white">Livewire request failure preview</h1>
+        <p class="text-sm leading-6 text-neutral-600 dark:text-fg-dim">
+            Each button returns proxy-style HTML from a failed Livewire request. The page should remain visible and
+            Coolify should show a toast instead of Livewire's raw response modal.
+        </p>
+    </div>
+
+    <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+        @foreach ($statuses as $status)
+            <x-forms.button wire:click="fail({{ $status }})" class="justify-between">
+                <span>{{ in_array($status, [504, 522, 524], true) ? 'Gateway timeout' : 'Proxy unavailable' }}</span>
+                <span class="font-mono text-xs text-neutral-500 dark:text-fg-faint">{{ $status }}</span>
+            </x-forms.button>
+        @endforeach
+    </div>
+
+    <p class="text-xs text-neutral-500 dark:text-fg-faint">
+        This route is registered only when <code class="font-mono">APP_ENV</code> is local or testing.
+    </p>
+</div>
diff --git a/resources/views/livewire/global-search.blade.php b/resources/views/livewire/global-search.blade.php
index 43d6e6b55a..9e714b59f9 100644
--- a/resources/views/livewire/global-search.blade.php
+++ b/resources/views/livewire/global-search.blade.php
@@ -655,7 +655,9 @@
                                             class="search-result-item command-palette-item">
                                             <template x-if="item.logo">
                                                 <div class="command-palette-item-icon">
-                                                    <img :src="'/' + item.logo" :alt="item.name">
+                                                    <img :src="item.logo.startsWith('http') ? item.logo : '/' + item.logo"
+                                                        :alt="item.name"
+                                                        x-on:error="if (item.logo_cdn_url && !$el.dataset.cdnTried) { $el.dataset.cdnTried = 'true'; $el.src = item.logo_cdn_url; } else if (item.logo_default_url && !$el.dataset.defaultTried) { $el.dataset.defaultTried = 'true'; $el.src = item.logo_default_url; }">
                                                 </div>
                                             </template>
                                             <template x-if="!item.logo">
diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 2e5f6a02db..693c332d95 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -11,7 +11,7 @@
     reminderCollapseAfter: 10000,
     isDevelopment: {{ isDev() ? 'true' : 'false' }},
     init() {
-        this.popups.sponsorship = this.shouldShowMonthlyPopup('popupSponsorship');
+        this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup('popupSponsorship');
         this.popups.notification = this.shouldShowMonthlyPopup('popupNotification');
         this.popups.realtime = localStorage.getItem('popupRealtime');
 
@@ -86,7 +86,7 @@
         return isDifferentMonth;
         {{-- } --}}
     }
-}">
+}" x-on:show-sponsorship-reminder.window="popups.sponsorship = true; reminders.sponsorship.compact = false">
     @auth
         <span x-show="popups.realtime === true">
             @if (!isCloud())
@@ -140,11 +140,12 @@
             @endif
         </span>
     @endauth
-    @if (instanceSettings()->is_sponsorship_popup_enabled && !isCloud())
+    @if ((isDev() || instanceSettings()->is_sponsorship_popup_enabled) && ! isCloud())
         <span x-show="popups.sponsorship">
             <x-popup>
                 <x-slot:customActions>
                     <div class="relative mx-auto flex w-full flex-col overflow-hidden rounded-2xl border border-neutral-200 bg-white shadow-modal transition-all duration-300 dark:border-white/[0.1] dark:bg-surface"
+                        x-on:show-sponsorship-reminder.window="bannerVisible = true"
                         :class="reminders.sponsorship.compact ? 'max-w-sm gap-3 p-4' : 'max-w-2xl gap-5 p-5 sm:p-6'">
                         <button type="button" aria-label="Dismiss sponsorship reminder"
                             class="absolute top-3 right-3 flex size-7 items-center justify-center rounded-full text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg"
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index a41e72cb7a..fdc2ac672a 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -149,7 +149,11 @@
                         :events="[
                             ['property' => 'deploymentSuccessEmailNotifications', 'label' => 'Deployment success', 'enabled' => $deploymentSuccessEmailNotifications],
                             ['property' => 'deploymentFailureEmailNotifications', 'label' => 'Deployment failure', 'enabled' => $deploymentFailureEmailNotifications],
-                            ['property' => 'statusChangeEmailNotifications', 'label' => 'Container status changes', 'enabled' => $statusChangeEmailNotifications],
+                        ]" />
+                    <x-notification.event-multiselect :settings="$settings" id="resource-email-events" label="Resources"
+                        :events="[
+                            ['property' => 'statusChangeEmailNotifications', 'label' => 'Resource status changes', 'enabled' => $statusChangeEmailNotifications],
+                            ['property' => 'restartLimitReachedEmailNotifications', 'label' => 'Restart limit reached', 'enabled' => $restartLimitReachedEmailNotifications],
                         ]" />
                     <x-notification.event-multiselect :settings="$settings" id="backup-email-events" label="Backups"
                         :events="[
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index da5329a475..cc8c094b1e 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -91,7 +91,7 @@
                     <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
                         class="h-full w-full object-cover">
                     @if (auth()->user()->avatar_path)
-                        <img src="{{ route('profile.avatar', ['v' => auth()->user()->updated_at->timestamp]) }}"
+                        <img src="{{ profile_avatar_url(auth()->user()) }}"
                             x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
                     @else
                         <span x-show="!preview">
@@ -249,9 +249,10 @@
                                 </p>
                             </div>
                             <form action="/user/confirmed-two-factor-authentication" method="POST"
-                                class="flex items-end gap-2">
+                                class="flex items-end gap-2"
+                                x-init="$nextTick(() => $el.querySelector('input[name=code]')?.focus())">
                                 @csrf
-                                <x-forms.input type="text" inputmode="numeric" pattern="[0-9]*" id="code"
+                                <x-forms.input name="code" type="text" inputmode="numeric" pattern="[0-9]*" id="code"
                                     label="One-time code" required />
                                 <x-forms.button type="submit">Validate 2FA</x-forms.button>
                             </form>
diff --git a/resources/views/livewire/project/application/configuration.blade.php b/resources/views/livewire/project/application/configuration.blade.php
index 340a87179c..786e6b0fa9 100644
--- a/resources/views/livewire/project/application/configuration.blade.php
+++ b/resources/views/livewire/project/application/configuration.blade.php
@@ -20,6 +20,7 @@
                 <livewire:project.application.advanced :application="$application" />
             @elseif ($currentRoute === 'project.application.environment-variables')
                 <livewire:project.shared.environment-variable.all :resource="$application" />
+                <livewire:project.shared.secret-manager-links :resource="$application" />
             @elseif ($currentRoute === 'project.application.persistent-storage')
                 <livewire:project.service.storage :resource="$application" />
             @elseif ($currentRoute === 'project.application.source' && $application->git_based())
diff --git a/resources/views/livewire/project/application/deployment/index.blade.php b/resources/views/livewire/project/application/deployment/index.blade.php
index 88301d71c6..b2c2be9081 100644
--- a/resources/views/livewire/project/application/deployment/index.blade.php
+++ b/resources/views/livewire/project/application/deployment/index.blade.php
@@ -213,39 +213,43 @@
                             $commitMessage = $deployment->commitMessage()
                                 ? Str::before($deployment->commitMessage(), "\n")
                                 : null;
+                            $deploymentUrl = $current_url . '/' . data_get($deployment, 'deployment_uuid');
+                            $commitUrl = data_get($deployment, 'commit')
+                                ? $application->gitCommitLink(data_get($deployment, 'commit'))
+                                : null;
                         @endphp
-                        <a wire:key="deployment-{{ data_get($deployment, 'deployment_uuid') }}"
-                            href="{{ $current_url . '/' . data_get($deployment, 'deployment_uuid') }}"
-                            {{ wireNavigate() }}
+                        <div wire:key="deployment-{{ data_get($deployment, 'deployment_uuid') }}"
                             @class([
                                 'data-table-row deployment-table-grid border-b border-neutral-200 text-[13px] text-neutral-600 dark:border-white/[0.08] dark:text-fg-dim',
                                 'data-table-row-active' => $selectedDeploymentUuid === data_get($deployment, 'deployment_uuid'),
                             ])>
-                            <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
-                            <span>{{ $sourceLabel }}</span>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }}><x-status-badge :status="$statusLabel" :type="$statusType" /></a>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }}>{{ $sourceLabel }}</a>
                             <span class="min-w-0">
                                 @if (data_get($deployment, 'commit'))
                                     <span class="flex min-w-0 items-center gap-2">
-                                        <span class="shrink-0 font-mono text-xs text-neutral-950 dark:text-fg">
+                                        <a href="{{ $commitUrl }}" target="_blank" rel="noopener noreferrer"
+                                            class="shrink-0 font-mono text-xs text-neutral-950 underline decoration-neutral-400 underline-offset-2 dark:text-fg dark:decoration-neutral-600">
                                             {{ substr(data_get($deployment, 'commit'), 0, 7) }}
-                                        </span>
+                                        </a>
                                         @if ($commitMessage)
-                                            <span class="truncate text-neutral-500 dark:text-fg-faint"
-                                                title="{{ $commitMessage }}">{{ $commitMessage }}</span>
+                                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }}
+                                                class="truncate text-neutral-500 dark:text-fg-faint"
+                                                title="{{ $commitMessage }}">{{ $commitMessage }}</a>
                                         @endif
                                     </span>
                                 @else
                                     <span class="text-neutral-400 dark:text-fg-faint">-</span>
                                 @endif
                             </span>
-                            <span title="{{ formatDateInServerTimezone(data_get($deployment, 'created_at'), data_get($application, 'destination.server')) }}">
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }} title="{{ formatDateInServerTimezone(data_get($deployment, 'created_at'), data_get($application, 'destination.server')) }}">
                                 {{ \Carbon\Carbon::parse(data_get($deployment, 'created_at'))->diffForHumans() }}
-                            </span>
-                            <span class="tabular-nums">{{ $duration }}</span>
-                            <span class="truncate">
+                            </a>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }} class="tabular-nums">{{ $duration }}</a>
+                            <a href="{{ $deploymentUrl }}" {{ wireNavigate() }} class="truncate">
                                 {{ data_get($deployment, 'server_name') ?: data_get($application, 'destination.server.name', '-') }}
-                            </span>
-                        </a>
+                            </a>
+                        </div>
                         @endforeach
                     </div>
 
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index 4adbcf8ff1..b80085b9d5 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -2,6 +2,7 @@
     $configuredCount = collect($domainRows)->where('is_suggested', false)->count();
     $suggestedCount = collect($domainRows)->where('is_suggested', true)->count();
     $hasRows = count($domainRows) > 0;
+    $hasDnsChecksInProgress = collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking');
     $composeDomainGroups = collect($domainRows)
         ->groupBy(fn ($row) => $row['service'] ?? '__unknown')
         ->filter(fn ($rows) => $rows->contains(fn ($row) => ! ($row['is_suggested'] ?? false)));
@@ -36,6 +37,9 @@
     }"
     @open-edit-domain.window="openEditDomain()"
     @edit-domain-saved.window="closeEditDomain()">
+    @if ($hasDnsChecksInProgress)
+        <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
+    @endif
     <x-application.settings-section id="domains-section" title="Domains">
         @can('update', $application)
             <x-slot:actions>
@@ -362,4 +366,48 @@
 
     <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
         confirmAction="confirmDomainUsage" />
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+            class="relative z-40">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Unrecognized internal port" class="mb-4">
+                                Port <strong>{{ $unrecognizedPort }}</strong> is not listed in Ports Exposes
+                                and is not used by any application domain. The proxy will still route to it,
+                                but the container may not be listening there.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button" canGate="update" :canResource="$application"
+                                    @click="modalOpen = false; $wire.call('cancelUseUnknownPort')">
+                                    Cancel
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmUseUnknownPort" canGate="update"
+                                    :canResource="$application"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index b25f96b56f..a10e707412 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -122,8 +122,7 @@
                 @else
                     <div class="flex flex-col gap-5">
                         @if ($buildPack === 'dockercompose')
-                            <div class="flex flex-col gap-2"
-                                @can('update', $application) x-init="$wire.dispatch('loadCompose', true)" @endcan>
+                            <div class="flex flex-col gap-2">
                                 <div x-data="{
                                     baseDir: @entangle('baseDirectory'),
                                     composeLocation: @entangle('dockerComposeLocation'),
@@ -402,7 +401,15 @@
             @endif
 
             @if ($buildPack !== 'dockercompose')
-                <x-application.settings-section id="networking-section" title="Networking" helper="Ports the container exposes, host port mappings and internal network aliases.">
+                @php
+                    $applicationDomainsUrl = route('project.application.domains', [
+                        'project_uuid' => $application->environment->project->uuid,
+                        'environment_uuid' => $application->environment->uuid,
+                        'application_uuid' => $application->uuid,
+                    ]);
+                    $portsExposesDomainHint = "You can also set a different internal port for each domain on the <a class='underline dark:text-white' href='{$applicationDomainsUrl}'>Domains</a> page.";
+                @endphp
+                <x-application.settings-section id="networking-section" title="Networking" helper="Ports the container exposes, host port mappings and internal network aliases. You can also set an internal port per domain.">
                 @if ($this->detectedPortInfo)
                     @if ($this->detectedPortInfo['isEmpty'])
                         <div
@@ -464,20 +471,30 @@
                     </x-callout>
                 @endif
                 <div class="grid gap-4 lg:grid-cols-[14rem_16rem_minmax(0,1fr)]">
+                    <div class="min-w-0">
                     @if ($isStatic || $buildPack === 'static')
                         <x-forms.input id="portsExposes" label="Ports exposes" readonly
+                            :helper="$portsExposesDomainHint"
+                            canGate="update" :canResource="$application"
                             x-bind:disabled="!canUpdate" />
                     @else
                         @if ($application->settings->is_container_label_readonly_enabled === false)
                             <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports exposes" readonly
-                                helper="Readonly labels are disabled. You can set the ports manually in the labels section."
+                                :helper="'Readonly labels are disabled. You can set the ports manually in the labels section.<br><br>'.$portsExposesDomainHint"
+                                canGate="update" :canResource="$application"
                                 x-bind:disabled="!canUpdate" />
                         @else
                             <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports exposes"
-                                helper="A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly."
+                                :helper="'A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly.<br><br>'.$portsExposesDomainHint"
+                                canGate="update" :canResource="$application"
                                 x-bind:disabled="!canUpdate" />
                         @endif
                     @endif
+                    <p class="mt-1.5 text-xs text-neutral-500 dark:text-fg-dim">
+                        You can also set an internal port per domain on
+                        <a class="underline dark:text-white" href="{{ $applicationDomainsUrl }}" {{ wireNavigate() }}>Domains</a>.
+                    </p>
+                    </div>
                     @if (!$application->destination->server->isSwarm())
                         <x-forms.input placeholder="3000:3000" id="portsMappings" label="Port mappings"
                             helper="A comma separated list of ports you would like to map to the host system. Useful when you do not want to use domains.<br><br><span class='inline-block font-bold dark:text-warning'>Format:</span> host:container<br><br><span class='inline-block font-bold dark:text-warning'>Example:</span> 3000:3000,3002:3002<br><br>Rolling update is not supported if you have a port mapped to the host."
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 3892a623ca..06d07d9ffe 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -40,123 +40,79 @@
         <div class="w-full xl:hidden">
             @if (!($application->build_pack === 'dockercompose' && is_null($application->docker_compose_raw)))
                 @can('deploy', $application)
-                <div id="application-mobile-actions" class="relative mb-3"
-                    x-data="{ open: false }" @click.outside="open = false"
-                    @keydown.escape.window="open = false">
-                    <button type="button" class="button w-full justify-between" @click="open = !open"
-                        :aria-expanded="open" aria-haspopup="menu">
-                        <span class="inline-flex items-center gap-2">
-                            Actions
-                        </span>
-                        <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                            <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                        </span>
-                    </button>
-
-                    <div x-cloak x-show="open" x-transition.origin.top.left
-                        class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
-                        @if (!str($application->status)->startsWith('exited'))
+                    <x-split-action id="application-mobile-actions" class="mb-3 flex w-full">
+                        @if (str($application->status)->startsWith('exited'))
+                            <x-slot:main wire:click="deploy">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
+                            </x-slot:main>
                             @if (!$application->destination->server->isSwarm())
-                                @can('deploy', $application)
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        wire:click="deploy" @click="open = false" role="menuitem">
-                                        <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                        Deploy
-                                    </button>
-                                @else
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                        role="menuitem">
-                                        <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                        Deploy
-                                    </button>
-                                @endcan
+                                <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="deploy(true)"
+                                    @click="open = false" role="menuitem">
+                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
+                                </button>
                             @endif
-                            @if ($application->build_pack !== 'dockercompose')
-                                @if ($application->destination->server->isSwarm())
-                                    @can('deploy', $application)
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            wire:click="deploy" @click="open = false" role="menuitem">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Update Service
-                                        </button>
-                                    @else
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                            role="menuitem">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Update Service
-                                        </button>
-                                    @endcan
+                            @if ($application->container_present !== false)
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()" role="menuitem">
+                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                    Remove container
+                                </button>
+                            @endif
+                        @else
+                            @if ($application->destination->server->isSwarm())
+                                @if ($application->build_pack !== 'dockercompose')
+                                    <x-slot:main wire:click="deploy">
+                                        <x-reicon name="refresh" class="size-3.5" />
+                                        Update Service
+                                    </x-slot:main>
                                 @else
-                                    @can('deploy', $application)
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
-                                            role="menuitem">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                            Restart
-                                        </button>
-                                    @else
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                            role="menuitem">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                            Restart
-                                        </button>
-                                    @endcan
+                                    <x-slot:main @click="document.getElementById('application-mobile-stop-trigger')?.click()">
+                                        <x-reicon name="stop-circle" class="size-3.5" />
+                                        Stop
+                                    </x-slot:main>
+                                @endif
+                            @else
+                                <x-slot:main wire:click="deploy">
+                                    <x-reicon name="refresh" class="size-3.5" />
+                                    Redeploy
+                                </x-slot:main>
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    wire:click="{{ str($application->status)->startsWith('running') ? 'force_deploy_without_cache' : 'deploy(true)' }}"
+                                    @click="open = false" role="menuitem">
+                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                    {{ str($application->status)->startsWith('running') ? 'Redeploy (without cache)' : 'Deploy (without cache)' }}
+                                </button>
+                                @if ($application->build_pack !== 'dockercompose')
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
+                                        role="menuitem">
+                                        <x-reicon name="restart" class="size-3.5 opacity-70" />
+                                        Restart
+                                    </button>
                                 @endif
                             @endif
-                            @can('deploy', $application)
+                            @unless ($application->destination->server->isSwarm() && $application->build_pack === 'dockercompose')
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
                                     @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
                                     role="menuitem">
                                     <x-reicon name="stop-circle" class="size-3.5 text-error" />
                                     Stop
                                 </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 opacity-70" />
-                                    Stop
-                                </button>
-                            @endcan
-                        @else
-                            @can('deploy', $application)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    wire:click="deploy" @click="open = false" role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
-                                </button>
-                            @endcan
+                            @endunless
                         @endif
-                        @if (!$application->destination->server->isSwarm())
-                            @can('deploy', $application)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    wire:click="{{ $application->status === 'running' ? 'force_deploy_without_cache' : 'deploy(true)' }}"
-                                    @click="open = false" role="menuitem">
-                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Deploy (without cache)
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Deploy (without cache)
-                                </button>
-                            @endcan
-                        @endif
-                    </div>
-                </div>
+                    </x-split-action>
                 @endcan
             @endif
             <div class="hidden" aria-hidden="true">
-                <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
+                <x-modal-confirmation
+                    canGate="deploy" :canResource="$application"
+                    title="{{ str($application->status)->startsWith('exited') ? 'Confirm Container Removal?' : 'Confirm Application Stopping?' }}"
+                    buttonTitle="{{ str($application->status)->startsWith('exited') ? 'Remove container' : 'Stop' }}"
                     submitAction="stop" :checkboxes="$checkboxes" :actions="[
-                        'This application will be stopped.',
-                        'All non-persistent data of this application will be deleted.',
+                        str($application->status)->startsWith('exited') ? 'The exited application container will be removed.' : 'This application will be stopped.',
+                        str($application->status)->startsWith('exited') ? 'Anonymous volumes may become eligible for Docker cleanup.' : 'All non-persistent data of this application will be deleted.',
                     ]" :confirmWithText="false" :confirmWithPassword="false"
                     step1ButtonText="Continue" step2ButtonText="Confirm">
                     <x-slot:trigger>
@@ -188,100 +144,69 @@
                             <x-applications.links :application="$application" />
                         </div>
                         @can('deploy', $application)
-                        <div id="application-desktop-actions" class="relative" x-data="{ open: false }"
-                            x-effect="$dispatch('resource-actions-toggled', { open })"
-                            @click.outside="open = false" @keydown.escape.window="open = false">
-                            <button type="button" class="button button-highlighted" @click="open = !open" :aria-expanded="open"
-                                aria-haspopup="menu">
-                                Actions
-                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                            </button>
-
-                            <div x-cloak x-show="open" x-transition.origin.top.right
-                                class="listbox-panel top-full! right-0! left-auto! mt-1! w-60! min-w-0!" role="menu">
+                            <x-split-action id="application-desktop-actions">
                                 @if (str($application->status)->startsWith('exited'))
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @disabled(!auth()->user()->can('deploy', $application))
-                                        wire:click="deploy" @click="open = false" role="menuitem">
-                                        <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                        Deploy
-                                    </button>
+                                    <x-slot:main wire:click="deploy">
+                                        <x-reicon name="play-circle" class="size-3.5" />
+                                        {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
+                                    </x-slot:main>
                                     @if (!$application->destination->server->isSwarm())
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $application))
-                                            wire:click="deploy(true)" @click="open = false" role="menuitem">
+                                        <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="deploy(true)"
+                                            @click="open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Deploy (without cache)
+                                            {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
+                                        </button>
+                                    @endif
+                                    @if ($application->container_present !== false)
+                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                            @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()" role="menuitem">
+                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                            Remove container
                                         </button>
                                     @endif
                                 @else
-                                    @if (!$application->destination->server->isSwarm())
-                                        @can('deploy', $application)
-                                            <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                wire:click="deploy" @click="open = false" role="menuitem">
-                                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                Redeploy
-                                            </button>
+                                    @if ($application->destination->server->isSwarm())
+                                        @if ($application->build_pack !== 'dockercompose')
+                                            <x-slot:main wire:click="deploy">
+                                                <x-reicon name="refresh" class="size-3.5" />
+                                                Update Service
+                                            </x-slot:main>
                                         @else
-                                            <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                Redeploy
-                                            </button>
-                                        @endcan
+                                            <x-slot:main @click="document.getElementById('application-mobile-stop-trigger')?.click()">
+                                                <x-reicon name="stop-circle" class="size-3.5" />
+                                                Stop
+                                            </x-slot:main>
+                                        @endif
+                                    @else
+                                        <x-slot:main wire:click="deploy">
+                                            <x-reicon name="refresh" class="size-3.5" />
+                                            Redeploy
+                                        </x-slot:main>
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $application))
                                             wire:click="{{ str($application->status)->startsWith('running') ? 'force_deploy_without_cache' : 'deploy(true)' }}"
                                             @click="open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                             {{ str($application->status)->startsWith('running') ? 'Redeploy (without cache)' : 'Deploy (without cache)' }}
                                         </button>
-                                    @endif
-                                    @if ($application->build_pack !== 'dockercompose')
-                                        @if ($application->destination->server->isSwarm())
-                                            @can('deploy', $application)
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                    wire:click="deploy" @click="open = false" role="menuitem">
-                                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                    Update Service
-                                                </button>
-                                            @else
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                    Update Service
-                                                </button>
-                                            @endcan
-                                        @else
-                                            @can('deploy', $application)
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                    @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
-                                                    role="menuitem">
-                                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                                    Restart
-                                                </button>
-                                            @else
-                                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                                    Restart
-                                                </button>
-                                            @endcan
+                                        @if ($application->build_pack !== 'dockercompose')
+                                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                                @click="open = false; document.getElementById('application-mobile-restart-trigger')?.click()"
+                                                role="menuitem">
+                                                <x-reicon name="restart" class="size-3.5 opacity-70" />
+                                                Restart
+                                            </button>
                                         @endif
                                     @endif
-                                    @can('deploy', $application)
+                                    @unless ($application->destination->server->isSwarm() && $application->build_pack === 'dockercompose')
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
                                             @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
                                             role="menuitem">
                                             <x-reicon name="stop-circle" class="size-3.5 text-error" />
                                             Stop
                                         </button>
-                                    @else
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!" disabled>
-                                            <x-reicon name="stop-circle" class="size-3.5 opacity-70" />
-                                            Stop
-                                        </button>
-                                    @endcan
+                                    @endunless
                                 @endif
-                            </div>
-                        </div>
+                            </x-split-action>
                         @endcan
                     @endif
                 </div>
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index 10aa21200a..cf8970d814 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -10,6 +10,7 @@
         'ok' => 'DNS OK',
         'failed' => 'DNS mismatch',
         'skipped' => 'DNS skipped',
+        'checking' => 'Checking DNS...',
         'pending' => 'DNS pending',
         default => 'DNS unknown',
     };
@@ -36,9 +37,10 @@
         ->keys()
         ->first();
     $showDirection = ($showDirectionControl ?? true) && ! $isSuggested && $firstPairRowIndex === $index;
+    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
 @endphp
 
-<div wire:key="domain-row-{{ $index }}-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
+<div wire:key="domain-row-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
     class="env-table-item">
     <div @class([
         'data-table-row',
@@ -72,6 +74,17 @@
                         title="{{ $row['url'] }}">
                         {{ $row['url'] }}
                     </a>
+                    @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                        <span class="table-badge shrink-0"
+                            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
+                            Internal port {{ $row['internal_port'] }}
+                        </span>
+                    @else
+                        <span class="table-badge table-badge-danger shrink-0"
+                            title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
+                            No internal port
+                        </span>
+                    @endif
                 @endif
                 @if ($isSuggested && ! empty($row['suggestion_label']))
                     <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -184,7 +197,7 @@
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                         <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?" buttonTitle="Remove"
-                            isErrorButton submitAction="removeDomain({{ $index }})" :actions="[
+                            isErrorButton submitAction="removeDomainByKey({{ $domainKey }})" :actions="[
                                 'This domain will be removed from the application.',
                                 'Redeploy or restart may be required for proxy changes.',
                             ]" :confirmWithPassword="false" :confirmWithText="false" step2ButtonText="Remove domain">
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
new file mode 100644
index 0000000000..2a131e43cd
--- /dev/null
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -0,0 +1,207 @@
+<div class="flex flex-col gap-3" x-data="{ editOpen: false }"
+    @open-preview-domain-edit.window="editOpen = true"
+    @close-preview-domain-edit.window="editOpen = false">
+    @if (collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking'))
+        <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
+    @endif
+    <div class="flex flex-wrap items-center gap-2">
+        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+            {{ count($domainRows) }} domain{{ count($domainRows) === 1 ? '' : 's' }}
+        </p>
+        @can('update', $preview->application)
+            @if (count($domainRows) > 0)
+                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
+                    <x-reicon name="refresh" class="size-3.5" />
+                    Recheck DNS
+                </x-forms.button>
+            @endif
+            <x-modal-input title="Add domain" :closeOutside="false" :wireIgnore="false"
+                canGate="update" :canResource="$preview->application">
+                <x-slot:content>
+                    <button type="button" class="button button-highlighted">
+                        <x-reicon name="plus" class="size-3.5" />
+                        Add
+                    </button>
+                </x-slot:content>
+                <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
+                    @if ($isCompose && count($composeServices) > 0)
+                        <x-forms.listbox id="newDomainService" label="Service" required
+                            :options="collect($composeServices)->map(fn ($service) => ['value' => $service, 'label' => $service])->all()" />
+                    @endif
+                    <x-forms.domain-input id="newDomainParts" />
+
+                    <div class="flex flex-wrap items-center justify-between gap-2 pt-2">
+                        <x-forms.button type="button" wire:click="generateDomain">Generate domain</x-forms.button>
+                        <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                    </div>
+                </form>
+            </x-modal-input>
+        @endcan
+    </div>
+
+    @if (count($domainRows) === 0)
+        <div class="application-settings-section-body">
+            <x-empty size="sm" title="No domains configured"
+                description="Add a domain or generate one with the server wildcard domain." icon-name="globe" />
+        </div>
+    @else
+        <div class="application-settings-section-body is-flush overflow-visible">
+            <div class="data-table-header domains-table-grid-service">
+                <span>Domain</span>
+                <span>DNS check</span>
+                <span></span>
+                <span></span>
+            </div>
+            @foreach ($domainRows as $index => $row)
+                @php
+                    $dnsType = match ($row['dns_status']) {
+                        'ok' => 'success',
+                        'failed' => 'error',
+                        'skipped' => 'warning',
+                        default => 'neutral',
+                    };
+                    $dnsLabel = match ($row['dns_status']) {
+                        'ok' => 'DNS OK',
+                        'failed' => 'DNS mismatch',
+                        'skipped' => 'DNS skipped',
+                        default => 'DNS pending',
+                    };
+                    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+                @endphp
+                <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" class="env-table-item">
+                    <div class="data-table-row domains-table-grid-service">
+                        <div class="flex min-w-0 flex-col gap-1">
+                            <div class="flex min-w-0 flex-wrap items-center gap-2">
+                                <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
+                                <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
+                                    class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                    title="{{ $row['url'] }}">{{ $row['url'] }}</a>
+                                @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                                    <span class="table-badge shrink-0"
+                                        title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
+                                        Internal port {{ $row['internal_port'] }}
+                                    </span>
+                                @else
+                                    <span class="table-badge table-badge-danger shrink-0"
+                                        title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
+                                        No internal port
+                                    </span>
+                                @endif
+                                @if (filled($row['service']))
+                                    <span class="table-badge shrink-0">{{ $row['service'] }}</span>
+                                @endif
+                            </div>
+                        </div>
+                        <div class="flex min-w-0 items-center">
+                            <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
+                        </div>
+                        <div class="hidden"></div>
+                        <div class="flex items-center justify-end gap-1">
+                            @can('update', $preview->application)
+                                <button type="button" wire:click="checkDomainDns({{ $index }})"
+                                    wire:loading.attr="disabled"
+                                    wire:target="checkDomainDns({{ $index }}),checkAllDns"
+                                    class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
+                                    <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                    <x-loading-on-button wire:loading.delay
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                </button>
+                                <button type="button" wire:click="startEdit({{ $index }})"
+                                    class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
+                                    <x-reicon name="settings" class="size-3.5" />
+                                </button>
+                                <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
+                                    buttonTitle="Remove" isErrorButton
+                                    submitAction="removeDomainByKey({{ $domainKey }})"
+                                    :actions="[
+                                        'This domain will be removed from the preview deployment.',
+                                        'Redeploy the preview to apply proxy changes.',
+                                    ]"
+                                    :confirmWithPassword="false" :confirmWithText="false"
+                                    step2ButtonText="Remove domain">
+                                    <x-slot:trigger>
+                                        <button type="button"
+                                            class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
+                                            title="Remove domain" aria-label="Remove domain">
+                                            <x-reicon name="trash" class="size-3.5" />
+                                        </button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
+                            @endcan
+                        </div>
+                    </div>
+                </div>
+            @endforeach
+        </div>
+    @endif
+
+    <template x-teleport="body">
+        <div x-show="editOpen" x-cloak class="fixed inset-0 z-99 overflow-y-auto">
+            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="editOpen = false"></div>
+            <div class="relative flex min-h-full items-center justify-center p-4">
+                <div x-show="editOpen" x-trap.inert.noscroll="editOpen"
+                    class="application-settings-form application-settings-section relative w-full max-w-3xl">
+                    <header>
+                        <h3>Edit domain</h3>
+                        <button type="button" @click="editOpen = false" class="icon-button" aria-label="Close">
+                            <x-reicon name="x" class="size-4" />
+                        </button>
+                    </header>
+                    <div class="application-settings-section-body">
+                        <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                            <x-forms.domain-input id="editingDomainParts" />
+                            <div class="flex justify-end">
+                                <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                            </div>
+                        </form>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </template>
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+            class="relative z-40">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Unrecognized internal port" class="mb-4">
+                                Port <strong>{{ $unrecognizedPort }}</strong> is not listed in Ports Exposes
+                                and is not used by any application domain. The proxy will still route to it,
+                                but the container may not be listening there.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button" canGate="update" :canResource="$preview->application"
+                                    @click="modalOpen = false; $wire.call('cancelUseUnknownPort')">
+                                    Cancel
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmUseUnknownPort" canGate="update"
+                                    :canResource="$preview->application"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
+</div>
diff --git a/resources/views/livewire/project/application/previews-compose.blade.php b/resources/views/livewire/project/application/previews-compose.blade.php
deleted file mode 100644
index 85159682d8..0000000000
--- a/resources/views/livewire/project/application/previews-compose.blade.php
+++ /dev/null
@@ -1,6 +0,0 @@
-<form wire:submit="save"
-    class="grid gap-3 rounded-lg bg-neutral-50 p-3 ring-1 ring-neutral-200 md:grid-cols-[minmax(0,1fr)_auto] md:items-end dark:bg-white/[0.025] dark:ring-white/[0.07]">
-    <x-forms.input helper="One domain per preview." label="{{ Str::headline($serviceName) }} domain"
-        id="domain" wire:change="save" canGate="update" :canResource="$preview->application" />
-    <x-forms.button wire:click="generate">Generate domain</x-forms.button>
-</form>
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index ef42760b97..ac616b84a3 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -103,6 +103,7 @@
                                     Preview #{{ data_get($preview, 'pull_request_id') }}
                                 </h4>
                                 <x-status-summary :status="data_get($preview, 'status')" title="Preview status" />
+                                <x-application.restart-limit-warning :application="$preview" />
                             </div>
                         </div>
                     </div>
@@ -251,49 +252,19 @@
                 </div>
 
                 <div class="mt-4 border-t border-neutral-200 pt-4 dark:border-white/[0.07]">
-                    @if ($application->build_pack === 'dockercompose')
-                        @if (collect(json_decode($preview->docker_compose_domains))->count() === 0)
-                            <form wire:submit="save_preview('{{ $preview->id }}')"
-                                class="grid gap-3 md:grid-cols-[minmax(0,1fr)_auto] md:items-end">
-                                <x-forms.input label="Domain" helper="One domain per preview."
-                                    id="previewFqdns.{{ $previewName }}" canGate="update"
-                                    :canResource="$application"
-                                    wire:change="save_preview('{{ $preview->id }}')" />
-                                @can('update', $application)
-                                    <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">
-                                        Generate domain
-                                    </x-forms.button>
-                                @endcan
-                            </form>
-                        @else
-                            <div class="flex flex-col gap-3">
-                                @foreach (collect(json_decode($preview->docker_compose_domains)) as $serviceName => $service)
-                                    <livewire:project.application.previews-compose
-                                        wire:key="preview-{{ $preview->pull_request_id }}-{{ $serviceName }}"
-                                        :service="$service" :serviceName="$serviceName" :preview="$preview" />
-                                @endforeach
-                            </div>
-                        @endif
-                    @else
+                    <livewire:project.application.preview-domains
+                        wire:key="preview-domains-{{ $preview->id }}"
+                        :preview="$preview" />
+
+                    @if ($application->build_pack === 'dockerimage')
                         <form wire:submit="save_preview('{{ $preview->id }}')"
-                            class="grid gap-3 {{ $application->build_pack === 'dockerimage'
-                                ? 'md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto]'
-                                : 'md:grid-cols-[minmax(0,1fr)_auto]' }} md:items-end">
-                            <x-forms.input label="Domain" helper="One domain per preview."
-                                id="previewFqdns.{{ $previewName }}" canGate="update"
-                                :canResource="$application"
-                                wire:change="save_preview('{{ $preview->id }}')" />
-                            @if ($application->build_pack === 'dockerimage')
-                                <x-forms.input label="Docker tag" helper="Image tag used by this preview."
-                                    id="previewDockerTags.{{ $previewName }}" canGate="update"
+                            class="application-settings-section-body is-flush mt-3 overflow-visible">
+                            <div class="data-table-header grid-cols-1"><span>Docker tag</span></div>
+                            <div class="p-3">
+                                <x-forms.input id="previewDockerTags.{{ $previewName }}" canGate="update"
                                     :canResource="$application"
                                     wire:change="save_preview('{{ $preview->id }}')" />
-                            @endif
-                            @can('update', $application)
-                                <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">
-                                    Generate domain
-                                </x-forms.button>
-                            @endcan
+                            </div>
                         </form>
                     @endif
                 </div>
@@ -305,15 +276,4 @@
         @endforelse
     </x-application.settings-section>
 
-    <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
-        confirmAction="confirmDomainUsage">
-        The preview deployment domain is already used by another resource and may cause routing conflicts.
-        <x-slot:consequences>
-            <ul class="mt-2 ml-4 list-disc">
-                <li>The preview deployment may not be accessible.</li>
-                <li>SSL certificates may not work correctly.</li>
-                <li>Requests may be routed unpredictably.</li>
-            </ul>
-        </x-slot:consequences>
-    </x-domain-conflict-modal>
 </div>
diff --git a/resources/views/livewire/project/application/status.blade.php b/resources/views/livewire/project/application/status.blade.php
index 2aa68fd779..6d692d36b9 100644
--- a/resources/views/livewire/project/application/status.blade.php
+++ b/resources/views/livewire/project/application/status.blade.php
@@ -1,3 +1,4 @@
 <div wire:poll.10000ms="refreshStatus">
     <x-status-summary :status="$application->status" />
+    <x-application.restart-limit-warning :application="$application" />
 </div>
diff --git a/resources/views/livewire/project/database/configuration.blade.php b/resources/views/livewire/project/database/configuration.blade.php
index fb32c18ba4..5f7f4c5797 100644
--- a/resources/views/livewire/project/database/configuration.blade.php
+++ b/resources/views/livewire/project/database/configuration.blade.php
@@ -31,6 +31,7 @@
                     @endif
                 @elseif ($currentRoute === 'project.database.environment-variables')
                     <livewire:project.shared.environment-variable.all :resource="$database" />
+                    <livewire:project.shared.secret-manager-links :resource="$database" />
                 @elseif ($currentRoute === 'project.database.servers')
                     <livewire:project.shared.destination :resource="$database" />
                 @elseif ($currentRoute === 'project.database.persistent-storage')
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index bcdf1cf855..2d28510165 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -63,71 +63,36 @@
                 <h1 class="min-w-0 max-w-full truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $database->name }}
                 </h1>
-                <x-status-summary :status="$database->status" title="Database status" />
+                <div class="relative flex w-full min-w-0 items-center gap-2">
+                    <x-status-summary :status="$database->status" title="Database status" />
+                </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    <x-application.restart-limit-warning :application="$database" />
+                </div>
             </div>
         </div>
 
         <div class="w-full xl:hidden">
             @if ($database->destination->server->isFunctional())
                 @can('manage', $database)
-                <div id="database-mobile-actions" class="relative mb-3"
-                    x-data="{ open: false }" @click.outside="open = false"
-                    @keydown.escape.window="open = false">
-                    <button type="button" class="button w-full justify-between" @click="open = !open"
-                        :aria-expanded="open" aria-haspopup="menu">
-                        <span class="inline-flex items-center gap-2">
-                            Actions
-                        </span>
-                        <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                            <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                        </span>
-                    </button>
-
-                    <div x-cloak x-show="open" x-transition.origin.top.left
-                        class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
+                    <x-split-action id="database-mobile-actions" class="mb-3 flex w-full">
                         @if (! $databaseStatus->startsWith('exited'))
-                            @can('manage', $database)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('database-restart-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart
-                                </button>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('database-stop-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop" class="size-3.5 text-error" />
-                                    Stop
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart
-                                </button>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="stop" class="size-3.5 opacity-70" />
-                                    Stop
-                                </button>
-                            @endcan
+                            <x-slot:main @click="document.getElementById('database-restart-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart
+                            </x-slot:main>
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                @click="open = false; document.getElementById('database-stop-trigger')?.click()" role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop
+                            </button>
                         @else
-                            @can('manage', $database)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; $wire.dispatch('startEvent')" role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Start
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Start
-                                </button>
-                            @endcan
+                            <x-slot:main @click="$wire.dispatch('startEvent')">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                Start
+                            </x-slot:main>
                         @endif
-                    </div>
-                </div>
+                    </x-split-action>
                 @endcan
             @endif
 
@@ -140,25 +105,24 @@
                 <div class="resource-heading-actions flex shrink-0 items-center gap-0.5">
                     @if ($database->destination->server->isFunctional())
                         @can('manage', $database)
-                        <div id="database-desktop-actions" class="flex items-center gap-0.5">
-                            @if (! $databaseStatus->startsWith('exited'))
-                                <button type="button" class="button button-highlighted"
-                                    @disabled(!auth()->user()->can('manage', $database))
-                                    @click="document.getElementById('database-restart-trigger')?.click()">
-                                    Restart
-                                </button>
-                                <button type="button" class="button"
-                                    @disabled(!auth()->user()->can('manage', $database))
-                                    @click="document.getElementById('database-stop-trigger')?.click()">
-                                    Stop
-                                </button>
-                            @else
-                                <x-forms.button class="button-highlighted" canGate="manage" :canResource="$database"
-                                    @click="$wire.dispatch('startEvent')">
-                                    Start
-                                </x-forms.button>
-                            @endif
-                        </div>
+                            <x-split-action id="database-desktop-actions">
+                                @if (! $databaseStatus->startsWith('exited'))
+                                    <x-slot:main @click="document.getElementById('database-restart-trigger')?.click()">
+                                        <x-reicon name="restart" class="size-3.5" />
+                                        Restart
+                                    </x-slot:main>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @click="open = false; document.getElementById('database-stop-trigger')?.click()" role="menuitem">
+                                        <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                        Stop
+                                    </button>
+                                @else
+                                    <x-slot:main @click="$wire.dispatch('startEvent')">
+                                        <x-reicon name="play-circle" class="size-3.5" />
+                                        Start
+                                    </x-slot:main>
+                                @endif
+                            </x-split-action>
                         @endcan
                     @else
                         <x-status-badge status="Server unavailable" type="error" />
diff --git a/resources/views/livewire/project/database/import-form.blade.php b/resources/views/livewire/project/database/import-form.blade.php
index a8087bd8ed..dd57b121c2 100644
--- a/resources/views/livewire/project/database/import-form.blade.php
+++ b/resources/views/livewire/project/database/import-form.blade.php
@@ -57,6 +57,10 @@
                 <div class="space-y-4">
             @if ($resourceDbType === 'standalone-postgresql')
                 @if ($dumpAll)
+                            <x-callout type="warning" title="Full restore overwrites administrator passwords">
+                                The backup replaces PostgreSQL administrator role passwords, including the destination administrator password.
+                                <span class="mt-1 block">If the administrator password changes, update it in Coolify's database configuration after the restore.</span>
+                            </x-callout>
                             <x-forms.textarea rows="6" readonly label="Import command"
                                 wire:model="restoreCommandText" canGate="update"
                                 :canResource="$this->resource" />
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 738c46fea9..130669b01d 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -138,7 +138,7 @@
         <div class="divide-y divide-neutral-200 dark:divide-border-subtle">
             @forelse($initScripts ?? [] as $script)
                 <livewire:project.database.init-script :database="$database" :script="$script"
-                    :wire:key="$script['index']" />
+                    :wire:key="'init-script-'.md5($script['filename'])" />
             @empty
                 <x-empty title="No initialization scripts"
                     description="Add a SQL file to run during the first PostgreSQL initialization." />
diff --git a/resources/views/livewire/project/database/status.blade.php b/resources/views/livewire/project/database/status.blade.php
index 8f8a720676..cf2d32c7a4 100644
--- a/resources/views/livewire/project/database/status.blade.php
+++ b/resources/views/livewire/project/database/status.blade.php
@@ -1,3 +1,4 @@
 <div wire:poll.10000ms="refreshStatus">
     <x-status-summary :status="$database->status" title="Database status" />
+    <x-application.restart-limit-warning :application="$database" />
 </div>
diff --git a/resources/views/livewire/project/edit.blade.php b/resources/views/livewire/project/edit.blade.php
index 564da27647..f3d27997a0 100644
--- a/resources/views/livewire/project/edit.blade.php
+++ b/resources/views/livewire/project/edit.blade.php
@@ -65,7 +65,7 @@
                 <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                     <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
                     @if ($project->icon_path)
-                        <img x-show="!preview" src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                        <img x-show="!preview" src="{{ project_icon_url($project) }}"
                             alt="{{ $project->name }} icon" class="h-full w-full object-cover">
                     @else
                         <x-reicon x-show="!preview" name="projects" class="size-6" />
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index d8e0920ef1..aed3b96978 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -287,15 +287,8 @@
                                     <div class="flex min-w-0 items-start gap-3">
                                         <div
                                             class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
-                                            <template x-if="service.has_logo">
-                                                <img class="h-full w-full object-contain p-2" :src="service.logo"
-                                                    onerror="this.onerror=null; this.src=this.getAttribute('data-fallback');"
-                                                    :data-fallback="service.logo_github_url" />
-                                            </template>
-                                            <template x-if="!service.has_logo">
-                                                <x-reicon name="layers"
-                                                    class="size-6 text-neutral-400 dark:text-fg-faint" />
-                                            </template>
+                                            <img class="h-full w-full object-contain p-2" :src="service.logo"
+                                                x-on:error="if (!$el.dataset.cdnTried) { $el.dataset.cdnTried = 'true'; $el.src = service.logo_cdn_url; } else if (!$el.dataset.defaultTried) { $el.dataset.defaultTried = 'true'; $el.src = service.logo_default_url; }" />
                                         </div>
                                         <div class="min-w-0 flex-1">
                                             <h3 class="truncate text-[13px] font-semibold text-black dark:text-fg"
diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index 3ab0ac6330..09be827990 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -220,7 +220,7 @@
                             x-text="item.typeLabel"></div>
 
                         <div>
-                            <x-status-badge dynamic>
+                            <x-status-badge dynamic x-bind:title="statusTitle(item)">
                                 <span class="size-1.5 shrink-0 rounded-full"
                                     x-bind:class="statusDotClass(item)"></span>
                                 <span class="truncate" x-text="statusLabel(item)"></span>
@@ -299,7 +299,7 @@
                                     <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint"
                                         x-text="item.typeLabel"></p>
                                 </div>
-                                <x-status-badge dynamic>
+                                <x-status-badge dynamic x-bind:title="statusTitle(item)">
                                     <span class="size-1.5 shrink-0 rounded-full"
                                         x-bind:class="statusDotClass(item)"></span>
                                     <span class="truncate" x-text="statusLabel(item)"></span>
@@ -314,8 +314,6 @@
                                         class="relative z-10 max-w-full self-start truncate text-[11px] text-neutral-500 hover:underline dark:text-fg-dim"
                                         :title="displayDomain(item.fqdn)" x-text="displayDomain(item.fqdn)"></a>
                                 </template>
-                                <span x-show="!item.fqdn"
-                                    class="text-[11px] text-neutral-400 dark:text-fg-faint">-</span>
                             </div>
                         </article>
                     </template>
@@ -518,13 +516,32 @@
                 localStorage.setItem('environment-resource-view', mode);
             },
             statusState(item) {
+                if (item.restartLimitReached) {
+                    return 'restart-limit';
+                }
+
                 return String(item.status || 'unknown').split(':')[0].toLowerCase();
             },
             statusLabel(item) {
+                if (item.restartLimitReached) {
+                    return 'Restart limit reached';
+                }
+
                 const state = this.statusState(item);
                 return state.charAt(0).toUpperCase() + state.slice(1);
             },
+            statusTitle(item) {
+                if (item.restartLimitReached) {
+                    return `${item.restartCount}/${item.maxRestartCount} restarts. Container preserved.`;
+                }
+
+                return this.statusLabel(item);
+            },
             statusTone(item) {
+                if (item.restartLimitReached) {
+                    return 'warning';
+                }
+
                 const state = this.statusState(item);
                 if (state === 'running') {
                     return 'success';
@@ -539,6 +556,10 @@
                 return 'neutral';
             },
             statusDotClass(item) {
+                if (item.restartLimitReached) {
+                    return 'bg-warning';
+                }
+
                 return {
                     success: 'bg-emerald-500',
                     warning: 'bg-warning',
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
new file mode 100644
index 0000000000..b5c2057cfd
--- /dev/null
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -0,0 +1,64 @@
+<div>
+    @if ($selectedExecution)
+        <x-modal-input title="Backup execution" wireOpen="executionModalOpen" :wireIgnore="false" isLarge>
+            <x-slot:content><span></span></x-slot:content>
+            <div class="flex flex-col gap-5">
+                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Target</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['target'] }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Status</p><p class="mt-1 text-sm font-medium">{{ str($selectedExecution['status'])->headline() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Started</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['started_at']->diffForHumans() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Size</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['size'] ? formatBytes($selectedExecution['size']) : '-' }}</p></div>
+                </div>
+                @if ($selectedExecution['filename'])
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Backup path</p><code class="mt-1 block overflow-x-auto rounded-md bg-neutral-100 p-3 text-xs dark:bg-black/20">{{ $selectedExecution['filename'] }}</code></div>
+                @endif
+                @if ($selectedExecution['message'])
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Output</p><pre class="mt-1 max-h-80 overflow-auto rounded-md bg-neutral-100 p-3 font-mono text-xs whitespace-pre-wrap dark:bg-black/20">{{ $selectedExecution['message'] }}</pre></div>
+                @endif
+            </div>
+        </x-modal-input>
+    @endif
+
+    <x-application.settings-section title="Executions"
+        helper="Review backup runs across every database and storage target in this service." flush>
+        @if ($executions->isEmpty())
+            <x-empty size="sm" title="No backup executions"
+                description="Execution history appears here after a backup schedule runs." icon-name="browser-terminal" />
+        @else
+            <div class="data-table w-full overflow-x-auto">
+                <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
+                    <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
+                </div>
+                @foreach ($executions as $execution)
+                    @php
+                        $statusType = match ($execution['status']) {
+                            'success' => 'success',
+                            'failed' => 'error',
+                            'running' => 'warning',
+                            default => 'neutral',
+                        };
+                    @endphp
+                    <div wire:key="service-backup-execution-{{ $execution['id'] }}"
+                        wire:click="openExecution('{{ $execution['uuid'] }}')"
+                        wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
+                        class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
+                        <span class="truncate font-medium text-neutral-950 dark:text-fg" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                        <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
+                        <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
+                        <span>{{ $execution['started_at']->diffForHumans() }}</span>
+                        <span>{{ $execution['size'] ? formatBytes($execution['size']) : '-' }}</span>
+                        <span class="flex justify-end">
+                            @if ($execution['download_url'])
+                                <a href="{{ $execution['download_url'] }}" target="_blank" rel="noopener"
+                                    @click.stop class="icon-button shrink-0" title="Download backup"
+                                    aria-label="Download backup">
+                                    <x-reicon name="upload" class="size-3.5 rotate-180" />
+                                </a>
+                            @endif
+                        </span>
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </x-application.settings-section>
+</div>
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index beb6df6e27..e3d0e5e24d 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -18,6 +18,7 @@
             ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
             ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
             ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
+            ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
             ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
             ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
             ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
@@ -35,7 +36,7 @@
         $menuGroups = [
             'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
             'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
-            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
+            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
             'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
         ];
 
@@ -143,12 +144,12 @@
 
                         <div :class="viewMode === 'grid'
                             ? 'grid grid-cols-1 gap-3 sm:grid-cols-2'
-                            : 'overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
+                            : 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
                             @if ($applications->isNotEmpty() || $databases->isNotEmpty())
                                 <div x-cloak x-show="viewMode === 'table'"
-                                    class="grid grid-cols-[minmax(0,1fr)_auto] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_8rem_5rem] dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                    class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
                                     <div>Resource</div>
-                                    <div class="hidden sm:block">Image</div>
+                                    <div>Image</div>
                                     <div class="justify-self-start">Status</div>
                                     <div></div>
                                 </div>
@@ -179,6 +180,7 @@
                     <livewire:project.service.domains :service="$service" />
                 @elseif ($currentRoute === 'project.service.environment-variables')
                     <livewire:project.shared.environment-variable.all :resource="$service" />
+                    <livewire:project.shared.secret-manager-links :resource="$service" />
                 @elseif ($currentRoute === 'project.service.storages')
                     <div class="space-y-6">
                         <div
diff --git a/resources/views/livewire/project/service/database-backups.blade.php b/resources/views/livewire/project/service/database-backups.blade.php
index 9740b215a4..7db3174af6 100644
--- a/resources/views/livewire/project/service/database-backups.blade.php
+++ b/resources/views/livewire/project/service/database-backups.blade.php
@@ -8,24 +8,41 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            @if ($backup)
-                <x-backup-sidebar context="service" :parameters="$backupParameters" :section="$section" />
-            @else
-                <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase"
-                    :isImportSupported="$isImportSupported" />
-            @endif
+            <x-service.configuration-sidebar :service="$service"
+                current-route="project.service.volume-backups.index" />
 
             <div class="min-w-0">
                 @if ($backup)
-                    @if ($section === 'executions')
-                        <livewire:project.database.backup-executions :backup="$backup"
-                            :database="$serviceDatabase" />
-                    @else
-                        <livewire:project.database.backup-edit :backup="$backup"
-                            :available-s3-storages="$s3s" :status="data_get($serviceDatabase, 'status')"
-                            :section="$section"
-                            wire:key="service-database-backup-{{ $backup->uuid }}-{{ $section }}" />
-                    @endif
+                    <div class="flex min-w-0 flex-col gap-6">
+                        <div class="flex min-w-0 flex-col gap-4">
+                            <div>
+                                <a class="inline-flex items-center gap-1.5 text-xs text-neutral-500 hover:text-neutral-900 dark:text-fg-dim dark:hover:text-fg"
+                                    {{ wireNavigate() }}
+                                    href="{{ route('project.service.volume-backups.index', collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all()) }}">
+                                    <x-reicon name="arrow-right" class="size-3.5 rotate-180" />
+                                    Back to backups
+                                </a>
+                                <h1 class="mt-2 text-xl font-semibold text-neutral-950 dark:text-fg">
+                                    {{ $serviceDatabase->human_name ?: $serviceDatabase->name }} backup
+                                </h1>
+                                <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                                    {{ $backup->frequency }} schedule
+                                </p>
+                            </div>
+
+                            <x-backup-tabs context="service" :parameters="$backupParameters" :section="$section" />
+                        </div>
+
+                        @if ($section === 'executions')
+                            <livewire:project.database.backup-executions :backup="$backup"
+                                :database="$serviceDatabase" />
+                        @else
+                            <livewire:project.database.backup-edit :backup="$backup"
+                                :available-s3-storages="$s3s" :status="data_get($serviceDatabase, 'status')"
+                                :section="$section"
+                                wire:key="service-database-backup-{{ $backup->uuid }}-{{ $section }}" />
+                        @endif
+                    </div>
                 @else
                     <section class="application-settings-section">
                         <div class="application-settings-section-header">
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 05e5792fe2..a02d5ae758 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -2,6 +2,7 @@
     $configuredCount = collect($domainRows)->where('is_suggested', false)->count();
     $suggestedCount = collect($domainRows)->where('is_suggested', true)->count();
     $hasRows = count($domainRows) > 0;
+    $hasDnsChecksInProgress = collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking');
     $serviceAppCount = count($serviceApps);
     $domainGroups = collect($domainRows)
         ->groupBy('service_application_id')
@@ -37,6 +38,9 @@
     }"
     @open-edit-domain.window="openEditDomain()"
     @edit-domain-saved.window="closeEditDomain()">
+    @if ($hasDnsChecksInProgress)
+        <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
+    @endif
     <x-application.settings-section id="service-domains-section" title="Domains">
         @can('update', $service)
             <x-slot:actions>
@@ -279,4 +283,46 @@
 
     <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
         confirmAction="confirmDomainUsage" />
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelRemovePort')"
+            :class="{ 'z-40': modalOpen }" class="relative">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelRemovePort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Port requirement" class="mb-4">
+                                This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
+                                One or more of your domains use a different port, or none.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button"
+                                    @click="modalOpen = false; $wire.call('cancelRemovePort')">
+                                    Keep required port
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmRemovePort"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/livewire/project/service/edit-compose.blade.php b/resources/views/livewire/project/service/edit-compose.blade.php
index 78400cb76e..47b3e732f2 100644
--- a/resources/views/livewire/project/service/edit-compose.blade.php
+++ b/resources/views/livewire/project/service/edit-compose.blade.php
@@ -25,7 +25,7 @@
     </div>
 
     <div
-        class="flex flex-wrap items-center gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 dark:border-white/[0.08] dark:bg-white/[0.025]">
+        class="flex flex-col items-stretch gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 sm:flex-row sm:flex-wrap sm:items-center dark:border-white/[0.08] dark:bg-white/[0.025]">
         <x-forms.checkbox label="Escape special characters in labels"
             helper="By default, $ (and other characters) is escaped. A $ in a label is saved as $$. Turn this off to use environment variables inside labels."
             id="isContainerLabelEscapeEnabled" instantSave />
diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index 52474c8d98..91518194cd 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -44,7 +44,7 @@
                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header>
-                            <h3>Remove required port?</h3>
+                            <h3>Use a different port?</h3>
                             <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                 class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                                 <x-reicon name="x" class="size-4" />
@@ -53,7 +53,7 @@
                         <div class="application-settings-section-body">
                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                One or more of your domains are missing a port number.
+                                One or more of your domains use a different port, or none.
                             </x-callout>
 
                             <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
@@ -68,11 +68,11 @@
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                     class="w-auto">
-                                    Keep port
+                                    Keep required port
                                 </x-forms.button>
                                 <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
                                     isError>
-                                    Remove port anyway
+                                    Use this port anyway
                                 </x-forms.button>
                             </div>
                         </div>
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index b022eef10c..7604d7d0cc 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -74,85 +74,45 @@
         <div class="w-full xl:hidden">
             @if ($service->isDeployable)
                 @can('deploy', $service)
-                <div id="service-mobile-actions" class="relative mb-3"
-                    x-data="{ open: false }" @click.outside="open = false"
-                    @keydown.escape.window="open = false">
-                    <button type="button" class="button w-full justify-between" x-bind:disabled="deploying"
-                        @click="open = !open"
-                        :aria-expanded="open" aria-haspopup="menu">
-                        <span class="inline-flex items-center gap-2">
-                            <x-loading-on-button x-show="deploying" x-cloak />
-                            <span x-text="deploying ? 'Deploying…' : 'Actions'">Actions</span>
-                        </span>
-                        <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                            <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                        </span>
-                    </button>
-
-                    <div x-cloak x-show="open" x-transition.origin.top.left
-                        class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
-                        @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
-                            @can('deploy', $service)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('service-restart-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart current version
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                    Restart current version
-                                </button>
-                            @endcan
+                    <x-split-action id="service-mobile-actions" class="mb-3 flex w-full">
+                        @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <x-slot:main @click="document.getElementById('selected-resource-remove-trigger')?.click()">
+                                <x-reicon name="trash" class="size-3.5" />
+                                Remove container
+                            </x-slot:main>
+                        @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                            <x-slot:main x-bind:disabled="deploying"
+                                @click="document.getElementById('service-restart-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart
+                            </x-slot:main>
                             @if ($serviceStatus->contains('running'))
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @disabled(!auth()->user()->can('deploy', $service))
-                                    @click="$wire.dispatch('pullAndRestartEvent'); open = false"
-                                    role="menuitem">
+                                    @click="$wire.dispatch('pullAndRestartEvent'); open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Pull latest and restart
+                                    Restart (pull latest)
                                 </button>
-                            @else
+                            @endif
+                            @if ($serviceStatus->contains('degraded'))
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @disabled(!auth()->user()->can('deploy', $service))
-                                    @click="$wire.dispatch('forceDeployEvent'); open = false"
-                                    role="menuitem">
+                                    @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                     Force Restart
                                 </button>
                             @endif
-                            @can('stop', $service)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('service-stop-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    Stop
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 opacity-70" />
-                                    Stop
-                                </button>
-                            @endcan
-                        @else
-                            @can('deploy', $service)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; deploying = true; $wire.dispatch('startEvent')" role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
-                                </button>
-                            @endcan
                             <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                @disabled(!auth()->user()->can('deploy', $service))
+                                @disabled(!auth()->user()->can('stop', $service))
+                                @click="open = false; document.getElementById('service-stop-trigger')?.click()" role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop
+                            </button>
+                        @else
+                            <x-slot:main x-bind:disabled="deploying" @click="deploying = true; $wire.dispatch('startEvent')">
+                                <x-loading-on-button x-show="deploying" x-cloak />
+                                <x-reicon name="play-circle" class="size-3.5" x-show="!deploying" />
+                                <span x-text="deploying ? 'Deploying…' : 'Deploy'">Deploy</span>
+                            </x-slot:main>
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
                                 @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
                                 <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                 Force Deploy
@@ -164,8 +124,7 @@
                                 Force Cleanup Containers
                             </button>
                         @endif
-                    </div>
-                </div>
+                    </x-split-action>
                 @endcan
             @else
                 <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
@@ -186,70 +145,57 @@
                             <x-services.links :service="$service" />
                         </div>
                         @can('deploy', $service)
-                        <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
-                                x-effect="$dispatch('resource-actions-toggled', { open })"
-                                @click.outside="open = false" @keydown.escape.window="open = false">
-                                <button type="button" class="button button-highlighted" @click="open = !open" :aria-expanded="open">
-                                    Actions
-                                    <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                                </button>
-                                <div x-cloak x-show="open" x-transition.origin.top.right
-                                    class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="menu">
-                                    @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                            <x-split-action id="service-desktop-actions">
+                                @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <x-slot:main @click="document.getElementById('selected-resource-remove-trigger')?.click()">
+                                <x-reicon name="trash" class="size-3.5" />
+                                Remove container
+                            </x-slot:main>
+                        @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                                    <x-slot:main x-bind:disabled="deploying"
+                                        @click="document.getElementById('service-restart-trigger')?.click()">
+                                        <x-reicon name="restart" class="size-3.5" />
+                                        Restart
+                                    </x-slot:main>
+                                    @if ($serviceStatus->contains('running'))
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="open = false; document.getElementById('service-restart-trigger')?.click()">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                            Restart
+                                            @click="$wire.dispatch('pullAndRestartEvent'); open = false" role="menuitem">
+                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                            Restart (pull latest)
                                         </button>
-                                        @if ($serviceStatus->contains('running'))
-                                            <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                                @disabled(!auth()->user()->can('deploy', $service))
-                                                @click="$wire.dispatch('pullAndRestartEvent'); open = false">
-                                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                                Restart (pull latest)
-                                            </button>
-                                        @endif
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('stop', $service))
-                                            @click="open = false; document.getElementById('service-stop-trigger')?.click()">
-                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                            Stop
-                                        </button>
-                                    @elseif (! $serviceStatus->contains('running'))
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="deploying = true; $wire.dispatch('startEvent'); open = false">
-                                            <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                            Deploy
-                                        </button>
-                                    @endif
-                                    @if (! $serviceStatus->contains('running'))
-                                        <div class="my-1 border-t border-coolgray-200 dark:border-coolgray-300" role="separator"></div>
                                     @endif
                                     @if ($serviceStatus->contains('degraded'))
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="$wire.dispatch('forceDeployEvent'); open = false">
+                                            @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
                                             Force Restart
                                         </button>
-                                    @elseif (! $serviceStatus->contains('running'))
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('deploy', $service))
-                                            @click="$wire.dispatch('forceDeployEvent'); open = false">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Force Deploy
-                                        </button>
-                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                            @disabled(!auth()->user()->can('stop', $service))
-                                            @click="$wire.dispatch('cleanupEvent'); open = false">
-                                            <x-reicon name="trash" class="size-3.5 opacity-70" />
-                                            Force Cleanup Containers
-                                        </button>
                                     @endif
-                                </div>
-                        </div>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @disabled(!auth()->user()->can('stop', $service))
+                                        @click="open = false; document.getElementById('service-stop-trigger')?.click()" role="menuitem">
+                                        <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                        Stop
+                                    </button>
+                                @else
+                                    <x-slot:main x-bind:disabled="deploying" @click="deploying = true; $wire.dispatch('startEvent')">
+                                        <x-loading-on-button x-show="deploying" x-cloak />
+                                        <x-reicon name="play-circle" class="size-3.5" x-show="!deploying" />
+                                        <span x-text="deploying ? 'Deploying…' : 'Deploy'">Deploy</span>
+                                    </x-slot:main>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @click="$wire.dispatch('forceDeployEvent'); open = false" role="menuitem">
+                                        <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                        Force Deploy
+                                    </button>
+                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                        @disabled(!auth()->user()->can('stop', $service))
+                                        @click="$wire.dispatch('cleanupEvent'); open = false" role="menuitem">
+                                        <x-reicon name="trash" class="size-3.5 opacity-70" />
+                                        Force Cleanup Containers
+                                    </button>
+                                @endif
+                            </x-split-action>
                         @endcan
                     @else
                         <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
@@ -281,6 +227,17 @@
                     <button id="service-stop-trigger" type="button">Stop</button>
                 </x-slot:trigger>
             </x-modal-confirmation>
+            @if ($selectedResource)
+                <x-modal-confirmation title="Confirm Container Removal?" buttonTitle="Remove container"
+                    canGate="deploy" :canResource="$service" submitAction="removeSelectedResourceContainer"
+                    :actions="['The exited service resource container will be removed.', __('resource.non_persistent')]"
+                    :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue"
+                    step2ButtonText="Confirm">
+                    <x-slot:trigger>
+                        <button id="selected-resource-remove-trigger" type="button">Remove container</button>
+                    </x-slot:trigger>
+                </x-modal-confirmation>
+            @endif
         </div>
     @endif
 
diff --git a/resources/views/livewire/project/service/import-backup.blade.php b/resources/views/livewire/project/service/import-backup.blade.php
new file mode 100644
index 0000000000..802ca7d10a
--- /dev/null
+++ b/resources/views/livewire/project/service/import-backup.blade.php
@@ -0,0 +1,39 @@
+<div>
+    <x-slot:title>
+        {{ data_get_str($service, 'name')->limit(10) }} > Import Backup | Coolify
+    </x-slot>
+
+    <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="request()->query()"
+        wire:key="service-heading-import-backup" />
+
+    <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
+        <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            <x-service.configuration-sidebar :service="$service" current-route="project.service.import-backup" />
+
+            <div class="application-settings-form min-w-0 flex flex-col gap-6">
+                @if ($databases->isEmpty())
+                    <x-application.settings-section title="Import Backup"
+                        helper="Restore a backup into a database in this service.">
+                        <x-empty title="No compatible databases"
+                            description="This service does not contain a database that supports backup imports."
+                            icon-name="database" size="sm" />
+                    </x-application.settings-section>
+                @else
+                    <x-application.settings-section title="Import Backup"
+                        helper="Choose the database that should receive the backup.">
+                        <x-forms.listbox id="selectedDatabaseUuid" label="Database" live required canGate="update"
+                            :canResource="$service"
+                            :options="$databases->map(fn ($database) => [
+                                'value' => $database->uuid,
+                                'label' => $database->human_name ?: $database->name,
+                            ])->all()" />
+                    </x-application.settings-section>
+
+                    @if ($selectedDatabase)
+                        <livewire:project.database.import :key="'service-import-' . $selectedDatabase->uuid" />
+                    @endif
+                @endif
+            </div>
+        </div>
+    </section>
+</div>
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 8faf4cfdac..acd3f57f73 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -3,7 +3,7 @@
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
         @if ($resourceType === 'database')
-            <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" :isImportSupported="$isImportSupported" />
+            <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" />
         @else
             <aside class="application-settings-navigation min-w-0 xl:self-start">
                 <nav aria-label="Compose resource settings"
@@ -175,7 +175,7 @@
                                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                                         <header>
-                                            <h3>Remove required port?</h3>
+                                            <h3>Use a different port?</h3>
                                             <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                                 class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                                                 <x-reicon name="x" class="size-4" />
@@ -184,7 +184,7 @@
                                         <div class="application-settings-section-body">
                                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                                One or more of your domains are missing a port number.
+                                                One or more of your domains use a different port, or none.
                                             </x-callout>
 
                                             <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
@@ -199,11 +199,11 @@
                                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                                 <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                                     class="w-auto">
-                                                    Keep port
+                                                    Keep required port
                                                 </x-forms.button>
                                                 <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
                                                     isError>
-                                                    Remove port anyway
+                                                    Use this port anyway
                                                 </x-forms.button>
                                             </div>
                                         </div>
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index 81daa100fe..444d1bfd28 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -35,6 +35,7 @@
                 'ok' => 'DNS OK',
                 'failed' => 'DNS mismatch',
                 'skipped' => 'DNS skipped',
+                'checking' => 'Checking DNS...',
                 'pending' => 'DNS pending',
                 default => 'DNS unknown',
             };
@@ -60,9 +61,10 @@
                 ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
                 ->first(fn ($item) => $redirectPairKey($item['url']) === $pairKey)['url'] ?? null;
             $showDirection = ! $isSuggested && $firstPairRowUrl === $row['url'];
+            $domainKey = hash('sha256', $row['url'].'|'.($row['service_application_id'] ?? ''));
         @endphp
 
-        <div wire:key="svc-domain-{{ $row['service_application_id'] ?? 'x' }}-{{ $index }}-{{ md5(($isSuggested ? 's:' : '') . $row['url']) }}"
+        <div wire:key="svc-domain-{{ $row['service_application_id'] ?? 'x' }}-{{ md5(($isSuggested ? 's:' : '') . $row['url']) }}"
             class="env-table-item">
             <div @class([
                 'data-table-row',
@@ -96,6 +98,12 @@
                                 title="{{ $row['url'] }}">
                                 {{ $row['url'] }}
                             </a>
+                            @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                                <span class="table-badge shrink-0"
+                                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
+                                    Internal port {{ $row['internal_port'] }}
+                                </span>
+                            @endif
                         @endif
                         @if ($isSuggested && ! empty($row['suggestion_label']))
                             <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -207,7 +215,7 @@
                             </button>
                             <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
                                 buttonTitle="Remove" isErrorButton
-                                submitAction="removeDomain({{ $index }})" :actions="[
+                                submitAction="removeDomainByKey({{ $domainKey }})" :actions="[
                                     'This domain will be removed from the service application.',
                                     'Redeploy or restart may be required for proxy changes.',
                                 ]" :confirmWithPassword="false" :confirmWithText="false"
diff --git a/resources/views/livewire/project/service/resource-card.blade.php b/resources/views/livewire/project/service/resource-card.blade.php
index fe976180da..c9106b0fc1 100644
--- a/resources/views/livewire/project/service/resource-card.blade.php
+++ b/resources/views/livewire/project/service/resource-card.blade.php
@@ -1,4 +1,12 @@
-<div>
+<div x-data="{
+    settingsUrl: @js(route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid])),
+    openSettings(event) {
+        if (event.target.closest('a, button')) {
+            return;
+        }
+        Livewire.navigate(this.settingsUrl);
+    }
+}">
     @php
         [$statusType, $statusLabel] = match (true) {
             str($resource->status)->contains('running') => ['success', formatContainerStatus($resource->status)],
@@ -26,6 +34,7 @@
                     </div>
                 </div>
                 <x-status-badge :status="$statusLabel" :type="$statusType" />
+                <x-application.restart-limit-warning :application="$resource" />
             </div>
 
             @if ($resource->configuration_required)
@@ -76,7 +85,9 @@
     </div>
 
     <div x-cloak x-show="viewMode === 'table'"
-        class="grid min-h-14 grid-cols-[minmax(0,1fr)_auto] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_8rem_5rem] dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
+        x-on:click="openSettings($event)" x-on:keydown.enter="openSettings($event)"
+        role="link" tabindex="0" aria-label="Open {{ $resourceName }} settings"
+        class="grid min-h-14 min-w-[48rem] cursor-pointer grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-primary dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
         <div class="flex min-w-0 items-center gap-3">
             <div
                 class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-neutral-500 dark:bg-white/[0.06] dark:text-fg-dim">
@@ -86,14 +97,14 @@
                 <div class="truncate text-[13px] font-semibold text-black dark:text-fg">{{ $resourceName }}</div>
             </div>
         </div>
-        <div class="hidden truncate font-mono text-xs text-neutral-500 sm:block dark:text-fg-faint">
+        <div class="truncate font-mono text-xs text-neutral-500 dark:text-fg-faint">
             {{ $resource->image }}
         </div>
-        <div class="flex flex-wrap items-center justify-end gap-1 sm:contents">
-            <div class="justify-self-start">
-                <x-status-badge :status="$statusLabel" :type="$statusType" />
-            </div>
-            <div class="flex items-center justify-end gap-1">
+        <div class="flex flex-wrap items-center gap-1">
+            <x-status-badge :status="$statusLabel" :type="$statusType" />
+            <x-application.restart-limit-warning :application="$resource" />
+        </div>
+        <div class="flex items-center justify-end gap-1">
                 @if ($isDatabase && ($resource->isBackupSolutionAvailable() || $resource->is_migrated))
                     <a class="icon-button" title="Service backups" aria-label="Service backups" {{ wireNavigate() }}
                         href="{{ route('project.service.volume-backups.index', $parameters) }}">
@@ -109,10 +120,9 @@
                     @endcan
                 @endif
                 <a class="icon-button" title="Resource settings" aria-label="Resource settings" {{ wireNavigate() }}
-                    href="{{ route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid]) }}">
+            href="{{ route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid]) }}">
                     <x-reicon name="settings" class="size-4" />
                 </a>
-            </div>
         </div>
     </div>
 </div>
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 423ea0aaf8..d42c2a575d 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -14,7 +14,7 @@
                         <x-slot:headerActions>
                             <div x-data="{ preview: false, validating: false, saving: false }"
                                 @compose-validate-finished.window="validating = false"
-                                @compose-save-finished.window="saving = false" class="flex items-center gap-2">
+                                @compose-save-finished.window="saving = false" class="flex w-full items-center gap-2 overflow-x-auto sm:w-auto">
                                 <x-forms.button
                                     @click="preview = !preview; $dispatch('compose-preview-toggle')">
                                     <x-reicon name="eye" class="size-3.5" />
diff --git a/resources/views/livewire/project/service/status.blade.php b/resources/views/livewire/project/service/status.blade.php
index dd7a0bd8c9..2bdf531b0f 100644
--- a/resources/views/livewire/project/service/status.blade.php
+++ b/resources/views/livewire/project/service/status.blade.php
@@ -1,3 +1,8 @@
 <div wire:poll.10000ms="refreshStatus">
-    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+    @php($displayStatus = $selectedResource?->status ?? $service->status)
+    <x-status-summary :status="$displayStatus" :title="$selectedResource ? 'Resource status' : 'Service status'"
+        :container-name="$selectedResource ? 'Container' : 'Containers'" />
+    @if ($selectedResource)
+        <x-application.restart-limit-warning :application="$selectedResource" />
+    @endif
 </div>
diff --git a/resources/views/livewire/project/service/storage.blade.php b/resources/views/livewire/project/service/storage.blade.php
index 42ade3da6e..43608188d1 100644
--- a/resources/views/livewire/project/service/storage.blade.php
+++ b/resources/views/livewire/project/service/storage.blade.php
@@ -366,7 +366,7 @@
                 icon-name="storages" />
         @elseif ($activeTab === 'volumes')
             @if ($hasVolumes)
-                <livewire:project.shared.storages.all wire:key="volumes-{{ $resource->id }}-{{ $this->volumeCount }}"
+                <livewire:project.shared.storages.all wire:key="volumes-{{ $resource->id }}"
                     :resource="$resource" />
             @else
                 <x-empty size="sm" title="No volumes configured"
@@ -433,7 +433,7 @@
             @elseif ($activeTab === 'volumes')
                 @if ($hasVolumes)
                     <livewire:project.shared.storages.all
-                        wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"
+                        wire:key="svc-volumes-{{ $resource->id }}"
                         :resource="$resource" />
                 @else
                     <x-empty size="sm" title="No volumes configured"
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index 9fa11f1f8a..f69d3f0db2 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -56,6 +56,44 @@
     <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="request()->query()"
         wire:key="service-heading-volume-backup-index" />
 
+    @if ($selectedDatabaseBackup || $selectedVolumeBackup)
+        @php
+            $selectedSchedule = $selectedDatabaseBackup ?: $selectedVolumeBackup;
+        @endphp
+        <x-modal-input :title="'Edit backup schedule'" wireOpen="scheduleModalOpen" :wireIgnore="false" isLarge
+            canGate="update" :canResource="$service">
+            <x-slot:content><span></span></x-slot:content>
+
+            <div x-data="{ activeSection: 'general' }" class="flex min-w-0 flex-col gap-6">
+                <div>
+                    <h2 class="text-base font-semibold text-neutral-950 dark:text-fg">
+                        {{ $selectedDatabaseBackup
+                            ? ($selectedDatabaseBackup->database->human_name ?: $selectedDatabaseBackup->database->name)
+                            : $selectedVolumeBackup->targetName() }}
+                    </h2>
+                    <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">{{ $selectedSchedule->frequency }} schedule</p>
+                </div>
+
+                <x-backup-tabs context="service-schedule" :parameters="$parameters" section="general" />
+
+                @foreach (['general', 's3', 'retention', 'danger'] as $modalSection)
+                    <div x-show="activeSection === '{{ $modalSection }}'" x-cloak>
+                        @if ($selectedDatabaseBackup)
+                            <livewire:project.database.backup-edit :backup="$selectedDatabaseBackup"
+                                :available-s3-storages="$s3s" :status="data_get($selectedDatabaseBackup->database, 'status')"
+                                :section="$modalSection"
+                                wire:key="service-database-backup-modal-{{ $selectedDatabaseBackup->uuid }}-{{ $modalSection }}" />
+                        @else
+                            <livewire:project.shared.storages.volume-backups :storage="$selectedVolumeBackup->backupable"
+                                :resource="$service" :section="$modalSection"
+                                wire:key="service-volume-backup-modal-{{ $selectedVolumeBackup->uuid }}-{{ $modalSection }}" />
+                        @endif
+                    </div>
+                @endforeach
+            </div>
+        </x-modal-input>
+    @endif
+
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
             <x-service.configuration-sidebar :service="$service"
@@ -190,9 +228,11 @@
         </div>
 
         <div @class([
-            'application-settings-section-body w-full',
+            'application-settings-section-body relative w-full',
             'is-flush' => $backups->isNotEmpty() || $databaseBackups->isNotEmpty(),
         ])>
+            <x-table.loading target="openSchedule" text="Loading schedule..." />
+
             <div x-cloak x-show="backups.length > 0 && filteredBackups.length === 0">
                 <x-empty size="sm" title="No backups found"
                     description="No scheduled backups match your search." />
@@ -200,6 +240,7 @@
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
+                    <div class="min-w-[59rem]">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
@@ -207,6 +248,7 @@
                         <span>Status</span>
                         <span>S3</span>
                         <span>Last run</span>
+                        <span class="text-right">Actions</span>
                     </div>
 
                     @foreach ($databaseBackups as $databaseBackup)
@@ -227,16 +269,12 @@
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
                         @endphp
-                        <a wire:key="database-backup-{{ $databaseBackup->uuid }}"
+                        <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
                             x-bind:style="{ order: backupOrder(@js($databaseBackupId)) }"
-                            href="{{ route('project.service.database.backup.show', [
-                                ...$parameters,
-                                'stack_service_uuid' => $databaseBackup->database->uuid,
-                                'backup_uuid' => $databaseBackup->uuid,
-                            ]) }}"
-                            {{ wireNavigate() }}
-                            class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
+                            wire:click="openSchedule('{{ $databaseBackup->uuid }}')"
+                            wire:keydown.enter="openSchedule('{{ $databaseBackup->uuid }}')" role="button" tabindex="0"
+                            class="data-table-row backup-table-grid cursor-pointer text-left text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
                             <span class="min-w-0 truncate font-medium text-neutral-950 dark:text-fg">
                                 {{ $databaseBackup->database->human_name ?: $databaseBackup->database->name }}
                             </span>
@@ -248,7 +286,12 @@
                                     :type="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'success' : 'error') : 'neutral'" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
-                        </a>
+                            <span class="flex justify-end">
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="backupNow('database', '{{ $databaseBackup->uuid }}')"
+                                    wire:target="backupNow('database', '{{ $databaseBackup->uuid }}')">Back up now</x-forms.button>
+                            </span>
+                        </div>
                     @endforeach
 
                     @foreach ($backups as $backup)
@@ -268,12 +311,12 @@
                                 default => 'neutral',
                             };
                         @endphp
-                        <a wire:key="volume-backup-{{ $backup->uuid }}"
+                        <div wire:key="volume-backup-{{ $backup->uuid }}"
                             x-show="isVisible(@js('storage:'.$backup->id))"
                             x-bind:style="{ order: backupOrder(@js('storage:'.$backup->id)) }"
-                            href="{{ route('project.service.volume-backups.show', [...$parameters, 'backup_uuid' => $backup->uuid]) }}"
-                            {{ wireNavigate() }}
-                            class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
+                            wire:click="openSchedule('{{ $backup->uuid }}')"
+                            wire:keydown.enter="openSchedule('{{ $backup->uuid }}')" role="button" tabindex="0"
+                            class="data-table-row backup-table-grid cursor-pointer text-left text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
                             <span class="min-w-0 truncate font-medium text-neutral-950 dark:text-fg"
                                 title="{{ $backup->targetName() }}">
                                 {{ $backup->targetName() }}
@@ -288,8 +331,14 @@
                             <span>
                                 {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
                             </span>
-                        </a>
+                            <span class="flex justify-end">
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="backupNow('storage', '{{ $backup->uuid }}')"
+                                    wire:target="backupNow('storage', '{{ $backup->uuid }}')">Back up now</x-forms.button>
+                            </span>
+                        </div>
                     @endforeach
+                    </div>
                 </div>
             @else
                 <x-empty size="sm" title="No scheduled backups"
@@ -297,6 +346,8 @@
                     icon-name="storages" />
             @endif
         </div>
+        <livewire:project.service.backup-executions :service="$service"
+            wire:key="service-backup-executions-{{ $service->id }}" />
             </div>
         </div>
     </section>
diff --git a/resources/views/livewire/project/service/volume-backup/show.blade.php b/resources/views/livewire/project/service/volume-backup/show.blade.php
index e23a8a94cf..393822467f 100644
--- a/resources/views/livewire/project/service/volume-backup/show.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/show.blade.php
@@ -8,9 +8,29 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            <x-backup-sidebar context="service-volume" :parameters="$parameters" :section="$section" />
+            <x-service.configuration-sidebar :service="$service"
+                current-route="project.service.volume-backups.index" />
+
+            <div class="flex min-w-0 flex-col gap-6">
+                <div class="flex min-w-0 flex-col gap-4">
+                    <div>
+                        <a class="inline-flex items-center gap-1.5 text-xs text-neutral-500 hover:text-neutral-900 dark:text-fg-dim dark:hover:text-fg"
+                            {{ wireNavigate() }}
+                            href="{{ route('project.service.volume-backups.index', collect($parameters)->except('backup_uuid')->all()) }}">
+                            <x-reicon name="arrow-right" class="size-3.5 rotate-180" />
+                            Back to backups
+                        </a>
+                        <h1 class="mt-2 text-xl font-semibold text-neutral-950 dark:text-fg">
+                            {{ $backup->targetName() }} backup
+                        </h1>
+                        <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                            {{ $backup->frequency }} schedule
+                        </p>
+                    </div>
+
+                    <x-backup-tabs context="service-volume" :parameters="$parameters" :section="$section" />
+                </div>
 
-            <div class="min-w-0">
                 <livewire:project.shared.storages.volume-backups :storage="$backup->backupable"
                     :resource="$service" :section="$section"
                     wire:key="service-volume-backup-{{ $backup->uuid }}-{{ $section }}" />
diff --git a/resources/views/livewire/project/shared/destination.blade.php b/resources/views/livewire/project/shared/destination.blade.php
index a1f7923d3a..5aba6c9ece 100644
--- a/resources/views/livewire/project/shared/destination.blade.php
+++ b/resources/views/livewire/project/shared/destination.blade.php
@@ -35,6 +35,7 @@
                     <div class="flex flex-wrap items-center gap-2 sm:justify-end">
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
+                        <x-application.restart-limit-warning :application="$resource" />
                         <x-status-summary :status="$resource->status" />
                         @if ($hasAdditionalDestinations)
                             <x-forms.button canGate="deploy" :canResource="$resource"
@@ -217,6 +218,9 @@
                     <div class="flex flex-wrap items-center gap-2 sm:justify-end">
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
+                        @if (method_exists($resource, 'stoppedAfterRestartLimit'))
+                            <x-application.restart-limit-warning :application="$resource" />
+                        @endif
                         @if ($primaryStatus->startsWith('running'))
                             <x-status.running :status="$primaryStatus->value()" />
                         @elseif ($primaryStatus->startsWith(['starting', 'restarting']))
diff --git a/resources/views/livewire/project/shared/environment-variable/add.blade.php b/resources/views/livewire/project/shared/environment-variable/add.blade.php
index 0b13cccee4..1d10980bd5 100644
--- a/resources/views/livewire/project/shared/environment-variable/add.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/add.blade.php
@@ -14,7 +14,9 @@
         <template x-if="!isMultiline">
             <div wire:key="env-value-input">
                 <x-forms.env-var-input placeholder="production" id="value" label="Value" required
+                    canGate="manageEnvironment" :canResource="$resource"
                     :availableVars="$shared ? [] : $this->availableSharedVariables"
+                    :hasVaultSource="$this->hasSecretManagerSource()"
                     :projectUuid="data_get($parameters, 'project_uuid')"
                     :environmentUuid="data_get($parameters, 'environment_uuid')"
                     :serverUuid="data_get($parameters, 'server_uuid')" />
diff --git a/resources/views/livewire/project/shared/environment-variable/all.blade.php b/resources/views/livewire/project/shared/environment-variable/all.blade.php
index 87ecd69985..ae95ef6806 100644
--- a/resources/views/livewire/project/shared/environment-variable/all.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/all.blade.php
@@ -168,7 +168,7 @@
                                 Add
                             </button>
                         </x-slot:content>
-                        <livewire:project.shared.environment-variable.add />
+                        <livewire:project.shared.environment-variable.add :resource="$resource" />
                     </x-modal-input>
                 @endcan
         </x-table.toolbar>
diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index 9172b99e18..30ef3f6598 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -152,14 +152,14 @@
                                 </label>
                                 <div class="relative">
                                     @if (!$valuesLoaded)
-                                        <div class="input input-with-password-toggle flex w-full items-center text-neutral-500 dark:text-fg-dim"
-                                            aria-busy="true">
-                                            <x-loading text="Loading value..." />
-                                        </div>
+                                        <x-forms.input loading loadingText="Loading value..."
+                                            defaultClass="input input-with-password-toggle" />
                                     @else
                                         <x-forms.env-var-input id="value" type="password"
+                                            canGate="manageEnvironment" :canResource="$this->resource"
                                             :required="$is_redis_credential" :disabled="!$canEditValue"
                                             :availableVars="$isSharedVariable ? [] : $this->availableSharedVariables"
+                                            :hasVaultSource="$this->hasSecretManagerSource()"
                                             :projectUuid="data_get($parameters, 'project_uuid')"
                                             :environmentUuid="data_get($parameters, 'environment_uuid')"
                                             :serverUuid="data_get($parameters, 'server_uuid')" />
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index 57391233d4..dc64666e2f 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -513,19 +513,23 @@
                     @if ($outputs)
                         @php
                             $displayLines = collect(explode("\n", $outputs))->filter(fn($line) => trim($line) !== '');
+                            $lineOccurrences = [];
                         @endphp
                         <div id="logs" class="font-logs max-w-full cursor-default text-[11px] leading-relaxed sm:text-xs">
                             <div x-show="searchQuery.trim() && matchCount === 0"
                                 class="py-2 text-gray-500 dark:text-gray-400">
                                 No matches found.
                             </div>
-                            @foreach ($displayLines as $index => $line)
+                            @foreach ($displayLines as $line)
                                 @php
+                                    $lineFingerprint = md5($line);
+                                    $lineOccurrence = $lineOccurrences[$lineFingerprint] ?? 0;
+                                    $lineOccurrences[$lineFingerprint] = $lineOccurrence + 1;
+
                                     // Parse timestamp from log line (ISO 8601 format: 2025-12-04T11:48:39.136764033Z)
                                     $timestamp = '';
                                     $logContent = $line;
                                     if (preg_match('/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z?\s(.*)$/', $line, $matches)) {
-                                        $microseconds = isset($matches[2]) ? substr($matches[2], 0, 6) : '000000';
                                         $logContent = $matches[3];
 
                                         // Convert UTC Docker timestamp to server timezone for display
@@ -537,11 +541,9 @@
                                             // keep UTC
                                         }
                                         $timestamp = $carbonTs->format('Y-M-d H:i:s');
-                                        // Include microseconds in key for uniqueness
-                                        $lineKey = "{$timestamp}.{$microseconds}";
                                     }
                                 @endphp
-                                <div wire:key="{{ $lineKey ?? 'line-' . $index }}" data-log-line data-log-content="{{ $line }}" class="log-line logs-viewer-line">
+                                <div wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}" data-log-line data-log-content="{{ $line }}" class="log-line logs-viewer-line">
                                     @if ($timestamp && $showTimeStamps)
                                         <span class="logs-viewer-timestamp text-gray-500">{{ $timestamp }}</span>
                                     @endif
diff --git a/resources/views/livewire/project/shared/secret-manager-links.blade.php b/resources/views/livewire/project/shared/secret-manager-links.blade.php
new file mode 100644
index 0000000000..3fa283c9f8
--- /dev/null
+++ b/resources/views/livewire/project/shared/secret-manager-links.blade.php
@@ -0,0 +1,125 @@
+<div class="mt-8">
+    @php
+        $secretManagerDescription = 'Reference remote secrets in your environment variables with {{vault.KEY}}. Values are fetched at deployment time and are never stored in the Coolify database. Changing the source does not re-check existing references — missing keys fail the next deployment.';
+        $removeSourceWarning = 'Existing {{vault.*}} reference variables will fail the next deployment until they are removed too.';
+    @endphp
+    <x-application.settings-section title="Secret manager" :description="$secretManagerDescription">
+
+        @if (! $link && $availableTokens->isEmpty())
+            <x-empty title="No secret manager tokens"
+                description="Add a Doppler, Infisical, or HashiCorp Vault token under Keys & Tokens > Integration Tokens first."
+                icon-name="keys" size="sm" />
+        @else
+            @can('update', $resource)
+                <div class="application-settings-form flex w-full flex-col gap-4">
+                    <div class="flex items-end gap-2">
+                        <x-forms.listbox id="integration_token_uuid" label="Integration token" :live="true"
+                            placeholder="Select a secret manager token" :options="$availableTokens
+                                ->map(fn ($token) => [
+                                    'value' => $token->uuid,
+                                    'label' => $token->name.' ('.$token->providerName().')',
+                                ])
+                                ->all()" />
+                        @if ($link)
+                            <x-modal-confirmation title="Remove secret manager source?" isErrorButton
+                                buttonTitle="Remove" submitAction="removeSource"
+                                :actions="[$removeSourceWarning]"
+                                :confirmWithText="false" :confirmWithPassword="false"
+                                step1ButtonText="Remove source" />
+                        @endif
+                    </div>
+
+                    @if ($link)
+                        @if ($selectedToken?->provider === 'doppler')
+                            @if ($selectedToken->dopplerTokenType() === 'service_account')
+                                <div class="grid gap-4 lg:grid-cols-2">
+                                    <x-forms.input required id="settings.project" label="Project (required)"
+                                        wire:blur="saveSettings" />
+                                    <x-forms.input required id="settings.config" label="Config (required)" placeholder="prd"
+                                        wire:blur="saveSettings" />
+                                </div>
+                            @else
+                                <p class="text-[12px] text-neutral-500 dark:text-fg-dim">
+                                    Project and config are fixed by this service token.
+                                </p>
+                            @endif
+                        @elseif ($selectedToken?->provider === 'infisical')
+                            <div class="grid gap-4 lg:grid-cols-3">
+                                <x-forms.input required id="settings.project_id" label="Project ID"
+                                    wire:blur="saveSettings" />
+                                <x-forms.input required id="settings.environment" label="Environment slug"
+                                    placeholder="prod" wire:blur="saveSettings" />
+                                <x-forms.input id="settings.secret_path" label="Secret path" placeholder="/"
+                                    wire:blur="saveSettings" />
+                            </div>
+                        @elseif ($selectedToken?->provider === 'vault')
+                            <div class="grid gap-4 lg:grid-cols-2">
+                                <x-forms.input required id="settings.mount" label="KV v2 mount" placeholder="secret"
+                                    wire:blur="saveSettings" />
+                                <x-forms.input required id="settings.path" label="Secret path"
+                                    placeholder="my-app/production" wire:blur="saveSettings" />
+                            </div>
+                        @endif
+
+                        <div class="flex flex-col gap-3">
+                            <div class="flex items-center gap-2">
+                                <x-forms.button wire:click="loadKeys" wire:target="loadKeys">
+                                    {{ $keysLoaded ? 'Reload keys' : 'Browse keys' }}
+                                </x-forms.button>
+                                @if ($keysLoaded)
+                                    <x-forms.button wire:click="importAll" wire:target="importAll" isHighlighted>
+                                        Import all keys
+                                    </x-forms.button>
+                                @endif
+                            </div>
+
+                            @if ($keysLoaded)
+                                @if (count($keys) === 0)
+                                    <div class="text-[12px] text-neutral-500 dark:text-fg-dim">
+                                        No secrets found at this source.
+                                    </div>
+                                @else
+                                    <x-forms.input label="Search keys" placeholder="Filter key names"
+                                        wire:model.live.debounce.300ms="search" />
+                                    <div class="divide-y divide-neutral-200 rounded-lg border border-neutral-200 dark:divide-white/[0.07] dark:border-white/[0.08]">
+                                        @forelse ($filteredKeys as $key)
+                                            <div wire:key="secret-key-{{ $key }}"
+                                                class="flex items-center justify-between gap-3 px-3 py-2">
+                                                <div class="flex min-w-0 flex-col">
+                                                    <span class="font-mono text-[12px] text-black dark:text-fg">{{ $key }}</span>
+                                                    <span class="font-mono text-[11px] text-neutral-400 dark:text-fg-dim">{{ '{{vault.'.$key.'}'.'}' }}</span>
+                                                </div>
+                                                <x-forms.button wire:click="addReference({{ \Illuminate\Support\Js::from($key) }})"
+                                                    wire:target="addReference({{ \Illuminate\Support\Js::from($key) }})">
+                                                    Add as variable
+                                                </x-forms.button>
+                                            </div>
+                                        @empty
+                                            <div class="px-3 py-2 text-[12px] text-neutral-500 dark:text-fg-dim">
+                                                No keys match the search.
+                                            </div>
+                                        @endforelse
+                                    </div>
+                                    <p class="text-[11px] text-neutral-500 dark:text-fg-dim">
+                                        Key names only — values stay in the secret manager. "Add as variable" creates
+                                        <span class="font-mono">KEY={{ '{{vault.KEY}'.'}' }}</span>; you can also paste a reference
+                                        into any variable value, including inside a longer string.
+                                    </p>
+                                @endif
+                            @endif
+                        </div>
+                    @endif
+                </div>
+            @else
+                @if ($link)
+                    <div class="px-1 py-2 text-[13px] text-black dark:text-fg">
+                        {{ $link->integrationToken->providerName() }}
+                        <span class="text-neutral-500 dark:text-fg-dim">
+                            {{ $link->integrationToken->name }} &middot; {{ $link->sourceSummary() }}
+                        </span>
+                    </div>
+                @endif
+            @endcan
+        @endif
+    </x-application.settings-section>
+</div>
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index dbe21fd7b8..cfbc58972b 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -183,7 +183,7 @@
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
                                     <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" :options="[
+                                    <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" portal :options="[
                                         ['value' => true, 'label' => 'Add suffix'],
                                         ['value' => false, 'label' => 'Share volume'],
                                     ]" />
diff --git a/resources/views/livewire/project/shared/storages/show.blade.php b/resources/views/livewire/project/shared/storages/show.blade.php
deleted file mode 100644
index 3662568087..0000000000
--- a/resources/views/livewire/project/shared/storages/show.blade.php
+++ /dev/null
@@ -1,156 +0,0 @@
-@php
-    $showActionsColumn = $resource instanceof \App\Models\Application;
-    $gridClass = match (true) {
-        $supportsPreviewSuffix => 'volumes-table-grid-with-pr',
-        $showActionsColumn => 'volumes-table-grid',
-        default => 'volumes-table-grid-readonly',
-    };
-    $canUpdate = auth()->user()?->can('update', $resource) ?? false;
-    $inputsReadonly = $isReadOnly || ! $canUpdate;
-    $displayHostPath = filled($hostPath) ? $hostPath : '—';
-@endphp
-
-@if ($inputsReadonly)
-    {{-- Read-only: plain data-table row (service / compose / no permission) --}}
-    <div class="env-table-item" wire:key="storage-row-{{ $storage->id }}">
-        <div class="data-table-row {{ $gridClass }} text-[13px] text-neutral-700 dark:text-fg-dim">
-            <div class="volumes-cell-name min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Volume Name</span>
-                <div class="flex min-w-0 items-center gap-2">
-                    <span class="min-w-0 truncate text-[13px] font-medium text-neutral-950 dark:text-fg"
-                        title="{{ $name }}">{{ $name }}</span>
-                    @if ($hasEnabledBackup)
-                        @if ($backupUrl)
-                            <a href="{{ $backupUrl }}"
-                                class="table-badge table-badge-success shrink-0 underline-offset-2 hover:underline"
-                                title="Volume backup is enabled">
-                                Backup
-                            </a>
-                        @else
-                            <span class="table-badge table-badge-success shrink-0" title="Volume backup is enabled">
-                                Backup
-                            </span>
-                        @endif
-                    @endif
-                </div>
-            </div>
-
-            <div class="volumes-col-source min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                <span class="block min-w-0 truncate text-[13px]" title="{{ $hostPath }}">
-                    {{ $displayHostPath }}
-                </span>
-            </div>
-
-            <div class="volumes-cell-dest min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Destination Path</span>
-                <span class="block min-w-0 truncate text-[13px] text-neutral-950 dark:text-fg"
-                    title="{{ $mountPath }}">{{ $mountPath }}</span>
-            </div>
-
-            @if ($supportsPreviewSuffix)
-                <div class="volumes-col-pr min-w-0">
-                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                    <span>{{ $isPreviewSuffixEnabled ? 'Add suffix' : 'Share volume' }}</span>
-                </div>
-            @endif
-
-            @if ($showActionsColumn)
-                <div class="volumes-col-actions volumes-cell-actions flex flex-wrap items-center justify-end gap-1.5">
-                    @if ($canUpdate)
-                        @if ($showBackupModal)
-                            <x-modal-input buttonTitle="Backup" title="Configure Volume Backup" :wireIgnore="false"
-                                wireOpen="showBackupModal">
-                                <livewire:project.application.backup.create :application="$resource"
-                                    :selected-target-key="'volume:' . $storage->id"
-                                    wire:key="configure-readonly-volume-backup-{{ $storage->id }}" />
-                            </x-modal-input>
-                        @else
-                            <x-forms.button type="button" wire:click="openBackupModal" class="!px-2.5 !text-xs">
-                                Backup
-                            </x-forms.button>
-                        @endif
-                    @else
-                        <span class="text-neutral-400 dark:text-fg-faint">—</span>
-                    @endif
-                </div>
-            @endif
-        </div>
-    </div>
-@else
-    {{-- Editable volume row --}}
-    <form wire:submit="submit" class="env-table-item" wire:key="storage-row-{{ $storage->id }}">
-        <div class="data-table-row {{ $gridClass }}">
-            <div class="volumes-cell-name min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Volume Name</span>
-                <div class="flex min-w-0 items-center gap-2">
-                    <div class="min-w-0 flex-1">
-                        <x-forms.input id="name" required />
-                    </div>
-                    @if ($hasEnabledBackup)
-                        @if ($backupUrl)
-                            <a href="{{ $backupUrl }}"
-                                class="table-badge table-badge-success shrink-0 underline-offset-2 hover:underline"
-                                title="Volume backup is enabled">
-                                Backup
-                            </a>
-                        @else
-                            <span class="table-badge table-badge-success shrink-0" title="Volume backup is enabled">
-                                Backup
-                            </span>
-                        @endif
-                    @endif
-                </div>
-            </div>
-
-            <div class="volumes-col-source min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Source Path</span>
-                <x-forms.input id="hostPath" placeholder="Host path (optional)" />
-            </div>
-
-            <div class="volumes-cell-dest min-w-0">
-                <span class="volumes-mobile-label volumes-field-label">Destination Path</span>
-                <x-forms.input id="mountPath" required placeholder="/path/in/container" />
-            </div>
-
-            @if ($supportsPreviewSuffix)
-                <div class="volumes-col-pr min-w-0">
-                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
-                    <x-forms.listbox id="isPreviewSuffixEnabled" onChange="instantSave" :options="[
-                        ['value' => true, 'label' => 'Add suffix'],
-                        ['value' => false, 'label' => 'Share volume'],
-                    ]" />
-                </div>
-            @endif
-
-            <div class="volumes-col-actions volumes-cell-actions flex flex-wrap items-center justify-end gap-1.5">
-                <x-forms.button type="submit" class="!px-2.5 !text-xs">
-                    Update
-                </x-forms.button>
-
-                @if ($resource instanceof \App\Models\Application)
-                    @if ($showBackupModal)
-                        <x-modal-input buttonTitle="Backup" title="Configure Volume Backup" :wireIgnore="false"
-                            wireOpen="showBackupModal">
-                            <livewire:project.application.backup.create :application="$resource"
-                                :selected-target-key="'volume:' . $storage->id"
-                                wire:key="configure-volume-backup-{{ $storage->id }}" />
-                        </x-modal-input>
-                    @else
-                        <x-forms.button type="button" wire:click="openBackupModal" class="!px-2.5 !text-xs">
-                            Backup
-                        </x-forms.button>
-                    @endif
-                @endif
-
-                <x-modal-confirmation title="Confirm persistent storage deletion?" isErrorButton buttonTitle="Delete"
-                    submitAction="delete" :actions="[
-                        'The selected persistent storage/volume will be permanently deleted.',
-                        'If the persistent storage/volume is actvily used by a resource data will be lost.',
-                    ]" confirmationText="{{ $storage->name }}"
-                    confirmationLabel="Please confirm the execution of the actions by entering the Storage Name below"
-                    shortConfirmationLabel="Storage Name" />
-            </div>
-        </div>
-    </form>
-@endif
diff --git a/resources/views/livewire/security/integration-token-editor.blade.php b/resources/views/livewire/security/integration-token-editor.blade.php
index b7e53dbc7c..ea06cbbb9b 100644
--- a/resources/views/livewire/security/integration-token-editor.blade.php
+++ b/resources/views/livewire/security/integration-token-editor.blade.php
@@ -2,29 +2,52 @@
     <form class="application-settings-form flex w-full flex-col gap-4" wire:submit="save">
         <div class="grid gap-4 lg:grid-cols-2">
             <x-forms.input required id="name" label="Token name" />
-            <x-forms.input readonly label="Provider" value="Cloudflare" />
+            <x-forms.input readonly label="Provider" value="{{ $integrationToken->providerName() }}" />
             <div class="lg:col-span-2">
-                <x-forms.input type="password" id="newToken" label="New API token"
+                <x-forms.input type="password" id="newToken"
+                    label="{{ $integrationToken->provider === 'infisical' ? 'New client secret' : 'New API token' }}"
                     placeholder="Leave blank to keep the current token"
                     helper="Paste a replacement token to rotate this credential." />
             </div>
         </div>
 
-        <fieldset>
-            <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
-            <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
-                <x-forms.checkbox id="edit-dns-capability" label="DNS" domValue="dns" fullWidth
-                    wire:model.live="capabilities" />
-                <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
-                    Manage Cloudflare DNS records.
-                </p>
+        @if ($integrationToken->provider === 'infisical')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://app.infisical.com" />
+                <x-forms.input required id="metadata.client_id" label="Client ID" />
             </div>
-            @error('capabilities')
-                <span class="text-xs text-red-500">{{ $message }}</span>
-            @enderror
-        </fieldset>
+        @elseif ($integrationToken->provider === 'vault')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://vault.example.com:8200" />
+                <x-forms.input id="metadata.namespace" label="Namespace (optional)" />
+            </div>
+        @endif
 
-        @if (in_array('dns', $capabilities, true))
+        @if ($integrationToken->provider === 'cloudflare')
+            <fieldset>
+                <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
+                <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
+                    <x-forms.checkbox id="edit-dns-capability" label="DNS" domValue="dns" fullWidth
+                        wire:model.live="capabilities" />
+                    <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                        Manage Cloudflare DNS records.
+                    </p>
+                </div>
+                @error('capabilities')
+                    <span class="text-xs text-red-500">{{ $message }}</span>
+                @enderror
+            </fieldset>
+        @else
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Capability: Secrets (read-only)</div>
+                <p>Coolify reads secrets from this provider at deployment time. Secret values are never stored in
+                    the Coolify database.</p>
+            </div>
+        @endif
+
+        @if ($integrationToken->provider === 'cloudflare' && in_array('dns', $capabilities, true))
             <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
                 <div class="font-medium text-black dark:text-fg">Required Cloudflare permissions</div>
                 <ul class="list-inside list-disc">
diff --git a/resources/views/livewire/security/integration-token-form.blade.php b/resources/views/livewire/security/integration-token-form.blade.php
index d847fff7fb..83d4f17c60 100644
--- a/resources/views/livewire/security/integration-token-form.blade.php
+++ b/resources/views/livewire/security/integration-token-form.blade.php
@@ -1,30 +1,65 @@
 <div class="w-full">
     <form class="application-settings-form flex w-full flex-col gap-4" wire:submit="addToken">
-        <x-forms.listbox required id="provider" label="Provider" :options="[
+        <x-forms.listbox required id="provider" label="Provider" :live="true" :options="[
             ['value' => 'cloudflare', 'label' => 'Cloudflare'],
+            ['value' => 'doppler', 'label' => 'Doppler'],
+            ['value' => 'infisical', 'label' => 'Infisical'],
+            ['value' => 'vault', 'label' => 'HashiCorp Vault'],
         ]" />
 
-        <div class="grid gap-4 lg:grid-cols-2">
-            <x-forms.input required id="name" label="Token name" placeholder="Production DNS" />
-            <x-forms.input required type="password" id="token" label="API token"
-                placeholder="Paste the provider token" />
-        </div>
-
-        <fieldset>
-            <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
-            <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
-                <x-forms.checkbox id="dns-capability" label="DNS" domValue="dns" fullWidth
-                    wire:model.live="capabilities" />
-                <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
-                    Manage Cloudflare DNS records.
-                </p>
+        @if ($provider === 'infisical')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="name" label="Token name" placeholder="Production secrets" />
+                <x-forms.input required id="metadata.client_id" label="Client ID"
+                    placeholder="Machine identity client ID" />
+                <x-forms.input required type="password" id="token" label="Client secret"
+                    placeholder="Paste the machine identity client secret" />
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://app.infisical.com"
+                    helper="Use the URL of your self-hosted Infisical instance, or the Infisical cloud URL." />
             </div>
-            @error('capabilities')
-                <span class="text-xs text-red-500">{{ $message }}</span>
-            @enderror
-        </fieldset>
+        @else
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="name" label="Token name"
+                    placeholder="{{ $provider === 'cloudflare' ? 'Production DNS' : 'Production secrets' }}" />
+                <x-forms.input required type="password" id="token"
+                    label="{{ $provider === 'vault' ? 'Vault token' : 'API token' }}"
+                    placeholder="Paste the provider token" />
+            </div>
+        @endif
 
-        @if (in_array('dns', $capabilities, true))
+        @if ($provider === 'vault')
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input required id="metadata.base_url" label="Base URL"
+                    placeholder="https://vault.example.com:8200" />
+                <x-forms.input id="metadata.namespace" label="Namespace (optional)"
+                    placeholder="admin/team-a" helper="Only for Vault Enterprise / HCP Vault." />
+            </div>
+        @endif
+
+        @if ($provider === 'cloudflare')
+            <fieldset>
+                <legend class="text-sm font-medium text-black dark:text-fg">Capabilities</legend>
+                <div class="mt-3 rounded-lg border border-neutral-200 p-1 dark:border-white/[0.08]">
+                    <x-forms.checkbox id="dns-capability" label="DNS" domValue="dns" fullWidth
+                        wire:model.live="capabilities" />
+                    <p class="px-2.5 pb-2 text-[11px] text-neutral-500 dark:text-fg-dim">
+                        Manage Cloudflare DNS records.
+                    </p>
+                </div>
+                @error('capabilities')
+                    <span class="text-xs text-red-500">{{ $message }}</span>
+                @enderror
+            </fieldset>
+        @else
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Capability: Secrets (read-only)</div>
+                <p>Coolify reads secrets from this provider at deployment time and writes them into the generated
+                    <code>.env</code> file. Secret values are never stored in the Coolify database.</p>
+            </div>
+        @endif
+
+        @if ($provider === 'cloudflare' && in_array('dns', $capabilities, true))
             <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
                 <div class="font-medium text-black dark:text-fg">Required Cloudflare permissions</div>
                 <ul class="list-inside list-disc">
@@ -38,6 +73,24 @@
                     Create this token in Cloudflare
                 </a>
             </div>
+        @elseif ($provider === 'doppler')
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Recommended Doppler token</div>
+                <p>Use a read-only <span class="font-medium">Service Token</span> (dp.st.*). It is pinned to one
+                    project and config. Create it in Doppler under Project &gt; Config &gt; Access.</p>
+            </div>
+        @elseif ($provider === 'infisical')
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Infisical machine identity</div>
+                <p>Create a machine identity with Universal Auth and read access to your project. Paste the client
+                    ID above and the client secret in the secret field.</p>
+            </div>
+        @elseif ($provider === 'vault')
+            <div class="rounded-lg border border-neutral-200 bg-neutral-50 p-3 text-[11px] leading-5 text-neutral-600 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-dim">
+                <div class="font-medium text-black dark:text-fg">Vault token</div>
+                <p>Use a token with read access to your KV v2 secrets. Prefer a periodic or long-lived token —
+                    deployments fail when the token expires.</p>
+            </div>
         @endif
 
         <div class="flex justify-end border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
diff --git a/resources/views/livewire/security/integration-tokens.blade.php b/resources/views/livewire/security/integration-tokens.blade.php
index b4961551ae..4ac77ee503 100644
--- a/resources/views/livewire/security/integration-tokens.blade.php
+++ b/resources/views/livewire/security/integration-tokens.blade.php
@@ -6,7 +6,7 @@
     <x-security.settings-layout>
         <div class="application-settings-form">
             <x-application.settings-section title="Integration tokens"
-                description="Credentials used by third-party integrations such as DNS providers." flush>
+                description="Credentials used by third-party integrations such as DNS providers and secret managers." flush>
                 <x-slot:actions>
                     @can('create', App\Models\IntegrationToken::class)
                         <x-modal-input title="New Integration Token">
@@ -56,7 +56,7 @@
                                             </h3>
                                         </div>
                                         <div class="text-center text-[12px] text-neutral-500 dark:text-fg-dim">
-                                            {{ ucfirst($savedToken->provider) }}
+                                            {{ $savedToken->providerName() }}
                                         </div>
                                         <div class="flex flex-wrap gap-1">
                                             <template x-for="capability in tokenCapabilities" :key="capability">
diff --git a/resources/views/livewire/security/private-key/index.blade.php b/resources/views/livewire/security/private-key/index.blade.php
index 32f6ad655a..a5dda7ad9a 100644
--- a/resources/views/livewire/security/private-key/index.blade.php
+++ b/resources/views/livewire/security/private-key/index.blade.php
@@ -76,9 +76,8 @@
             </div>
             @foreach ($privateKeys as $key)
                 @can('view', $key)
-                    <x-modal-input title="Edit Private Key" isFullWidth :wireIgnore="false" :contentClicks="false"
+                    <div wire:key="private-key-{{ $key->id }}"
                         class="border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
-                        <x-slot:content>
                     <div
                         class="grid min-h-14 w-full grid-cols-[minmax(0,1fr)_7rem_1.75rem] items-center gap-3 px-4 py-2.5 text-left transition-colors hover:bg-neutral-50 sm:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)_7rem_1.75rem] dark:hover:bg-white/[0.025]"
                     >
@@ -104,14 +103,13 @@
                             @endif
                         </div>
                         <button type="button" class="icon-button" title="Edit private key"
-                            aria-label="Edit {{ $key->name }}" @click="modalOpen=true">
+                            aria-label="Edit {{ $key->name }}"
+                            @click="$dispatch('open-private-key-editor', { name: @js($key->name), description: @js($key->description ?? '') })"
+                            wire:click="openEditor('{{ $key->uuid }}')">
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                     </div>
-                        </x-slot:content>
-                        <livewire:security.private-key.show :private_key_uuid="$key->uuid" :modalMode="true"
-                            :key="'private-key-editor-'.$key->uuid" />
-                    </x-modal-input>
+                    </div>
                 @else
                     <div class="grid min-h-14 cursor-not-allowed grid-cols-[minmax(0,1fr)_7rem_1.75rem] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 opacity-65 last:border-b-0 sm:grid-cols-[minmax(0,1.2fr)_minmax(0,1fr)_7rem_1.75rem] dark:border-white/[0.07]"
                         title="You do not have permission to view this private key">
@@ -139,6 +137,39 @@
             @endforeach
         </div>
     @endif
+
+    <x-modal-input title="Edit Private Key" :wireIgnore="false" :contentClicks="false"
+        @open-private-key-editor.window="modalOpen=true; $nextTick(() => { $refs.loadingPrivateKeyName.value = $event.detail.name; $refs.loadingPrivateKeyDescription.value = $event.detail.description })">
+        <x-slot:content><span class="hidden" aria-hidden="true"></span></x-slot:content>
+        <div wire:loading.flex wire:target="openEditor" aria-label="Loading private key editor"
+            class="w-full flex-col gap-4">
+            <div class="grid gap-4 lg:grid-cols-2">
+                <x-forms.input label="Name" required x-ref="loadingPrivateKeyName" />
+                <x-forms.input label="Description" x-ref="loadingPrivateKeyDescription" />
+                <div class="lg:col-span-2">
+                    <x-forms.input label="Public key" loading
+                        helper="Copy this value to ~/.ssh/authorized_keys on the target server." />
+                </div>
+                <div class="lg:col-span-2">
+                    <div class="mb-1.5 flex items-center justify-between gap-3">
+                        <label class="text-[13px] font-medium">Private key <span class="text-helper">*</span></label>
+                        <span class="text-[11px] font-medium text-neutral-400 dark:text-fg-faint">Edit key</span>
+                    </div>
+                    <x-forms.input loading :allowToPeak="false" />
+                </div>
+            </div>
+            <div class="flex items-center justify-between gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                <x-forms.button disabled isError>Delete</x-forms.button>
+                <x-forms.button disabled isHighlighted>Save changes</x-forms.button>
+            </div>
+        </div>
+        @if ($selectedPrivateKeyUuid)
+            <div wire:loading.remove wire:target="openEditor">
+                <livewire:security.private-key.show :private_key_uuid="$selectedPrivateKeyUuid" :modalMode="true"
+                    :key="'private-key-editor-'.$selectedPrivateKeyUuid" />
+            </div>
+        @endif
+    </x-modal-input>
         </x-application.settings-section>
 
     </x-security.settings-layout>
diff --git a/resources/views/livewire/security/private-key/show.blade.php b/resources/views/livewire/security/private-key/show.blade.php
index 59cffc70fa..da9373f0f1 100644
--- a/resources/views/livewire/security/private-key/show.blade.php
+++ b/resources/views/livewire/security/private-key/show.blade.php
@@ -1,6 +1,8 @@
-<div x-init="$wire.loadPublicKey()">
+<div>
     @if ($modalMode)
-        <form wire:submit="changePrivateKey" class="flex flex-col gap-4" x-data="{ showPrivateKey: false }">
+        <div class="relative">
+        <form wire:submit="changePrivateKey" class="flex flex-col gap-4" x-data="{ showPrivateKey: false }"
+            wire:loading.class="pointer-events-none opacity-50" wire:target="delete">
             <div class="grid gap-4 lg:grid-cols-2">
                 <x-forms.input canGate="update" :canResource="$private_key" id="name" label="Name" required />
                 <x-forms.input canGate="update" :canResource="$private_key" id="description" label="Description" />
@@ -34,6 +36,11 @@
                 <x-forms.button type="submit" isHighlighted>Save changes</x-forms.button>
             </div>
         </form>
+        <div wire:loading.flex wire:target="delete"
+            class="absolute inset-0 z-10 items-center justify-center rounded-lg bg-white/50 dark:bg-black/40">
+            <x-loading text="Deleting private key..." />
+        </div>
+        </div>
     @else
     <x-slot:title>
         {{ $private_key->name }} | Private Keys | Coolify
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index e75f77b5b4..ac25ca2c1d 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -156,8 +156,17 @@
                     class="min-w-0 truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $server->name }}
                 </h1>
-                <x-server.status-summary :server="$server" :proxy-status="$proxyStatus"
-                    :show-sentinel-status="$showSentinelStatus" />
+                <div class="flex w-full min-w-0 items-center gap-2">
+                    <x-server.status-summary :server="$server" :proxy-status="$proxyStatus"
+                        :show-sentinel-status="$showSentinelStatus" />
+                    @if ($traefikDashboardAvailable)
+                        <a target="_blank" href="http://{{ $serverIp }}:8080" title="Open Traefik dashboard"
+                            class="inline-flex h-6 shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium leading-none text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white">
+                            <x-reicon name="external-link" class="size-3" />
+                            Traefik
+                        </a>
+                    @endif
+                </div>
             </div>
         </div>
 
@@ -165,66 +174,31 @@
         <div class="w-full xl:hidden">
             @if ($server->proxySet())
                 @can('manageProxy', $server)
-                    <div id="server-mobile-actions" class="relative mb-3"
-                        x-data="{ open: false }" @click.outside="open = false"
-                        @keydown.escape.window="open = false">
-                        <button type="button" class="button w-full justify-between" @click="open = !open"
-                            :aria-expanded="open" aria-haspopup="menu">
-                            <span class="inline-flex items-center gap-2">
-                                Actions
-                            </span>
-                            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
-                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                            </span>
-                        </button>
-
-                        <div x-cloak x-show="open" x-transition.origin.top.left
-                            class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
-                            @if ($proxyCanBeStopped)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()"
-                                    role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="restart" class="size-3.5 text-orange-500 dark:text-warning" />
-                                    </span>
-                                    Restart Proxy
-                                </button>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
-                                    role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                        <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    </span>
-                                    Stop Proxy
-                                </button>
-                                @if ($traefikDashboardAvailable)
-                                    <a class="listbox-option justify-start! gap-2.5!" target="_blank"
-                                        href="http://{{ $serverIp }}:8080" @click="open = false" role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                        <x-reicon name="external-link" class="size-3! opacity-70" />
-                                        </span>
-                                        Traefik Dashboard
-                                    </a>
-                                @endif
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; $wire.dispatch('checkProxyEvent')" role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="play-circle" class="size-3.5 text-warning" />
-                                    </span>
-                                    Start Proxy
-                                </button>
-                            @endif
+                    <x-split-action id="server-mobile-actions" class="mb-3 flex w-full">
+                        @if ($proxyCanBeStopped)
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
+                                @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                                <x-reicon name="restart" class="size-3.5" />
+                                Restart Proxy
+                            </x-slot:main>
                             <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                wire:click="checkProxyStatus" wire:loading.attr="disabled"
-                                @click="open = false" role="menuitem">
-                                <span class="flex size-4 shrink-0 items-center justify-center">
-                                    <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                </span>
-                                Refresh Proxy Status
+                                @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
+                                role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                Stop Proxy
                             </button>
-                        </div>
-                    </div>
+                        @else
+                            <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
+                                <x-reicon name="play-circle" class="size-3.5" />
+                                Start Proxy
+                            </x-slot:main>
+                        @endif
+                        <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
+                            wire:loading.attr="disabled" @click="open = false" role="menuitem">
+                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                            Refresh Proxy Status
+                        </button>
+                    </x-split-action>
 
                     {{-- Programmatic open only (clicked from the Actions menu). Keep fully
                          display:none so the modal shells never reserve a layout row. --}}
@@ -299,66 +273,40 @@
 
                 @if ($server->proxySet())
                     @can('manageProxy', $server)
-                        <div id="server-desktop-actions" class="resource-heading-actions relative shrink-0"
-                            x-data="{ open: false }" x-effect="$dispatch('resource-actions-toggled', { open })"
-                            @click.outside="open = false"
-                            @keydown.escape.window="open = false">
-                            <button type="button" class="button button-highlighted" @click="open = !open" :aria-expanded="open"
-                                aria-haspopup="menu" wire:loading.attr="disabled" wire:loading.class="is-loading"
-                                wire:target="checkProxy,startProxy">
-                                Actions
-                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
-                            </button>
-
-                            <div x-cloak x-show="open" x-transition.origin.top.right
-                                class="listbox-panel top-full! right-0! left-auto! mt-1! w-60! min-w-0!" role="menu">
-                                @if ($proxyCanBeStopped)
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()"
-                                        role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="restart" class="size-3.5 opacity-70" />
-                                        </span>
-                                        Restart Proxy
-                                    </button>
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
-                                        role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                        </span>
-                                        Stop Proxy
-                                    </button>
-                                @else
-                                    <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                        @click="open = false; $wire.dispatch('checkProxyEvent')" role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                        </span>
-                                        Start Proxy
-                                    </button>
-                                @endif
-                                <div class="my-1 border-t border-coolgray-200 dark:border-coolgray-300"
-                                    role="separator"></div>
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    wire:click="checkProxyStatus" wire:loading.attr="disabled"
-                                    @click="open = false" role="menuitem">
-                                    <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    </span>
-                                    Refresh Proxy Status
-                                </button>
-                                @if ($traefikDashboardAvailable)
-                                    <a class="listbox-option justify-start! gap-2.5!" target="_blank"
-                                        href="http://{{ $serverIp }}:8080" @click="open = false" role="menuitem">
-                                        <span class="flex size-4 shrink-0 items-center justify-center">
-                                            <x-reicon name="external-link" class="size-3! opacity-70" />
-                                        </span>
-                                        Traefik Dashboard
-                                    </a>
-                                @endif
+                        @if ($traefikDashboardAvailable)
+                            <div class="resource-heading-menus shrink-0">
+                                <a class="app-tab shrink-0 gap-1" target="_blank" title="Open Traefik dashboard"
+                                    href="http://{{ $serverIp }}:8080">
+                                    <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+                                    Traefik Dashboard
+                                </a>
                             </div>
-                        </div>
+                        @endif
+                        <x-split-action id="server-desktop-actions" class="resource-heading-actions shrink-0">
+                            @if ($proxyCanBeStopped)
+                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy"
+                                    @click="document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                                    <x-reicon name="restart" class="size-3.5" />
+                                    Restart Proxy
+                                </x-slot:main>
+                                <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                    @click="open = false; document.getElementById('server-mobile-stop-proxy-trigger')?.click()"
+                                    role="menuitem">
+                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                    Stop Proxy
+                                </button>
+                            @else
+                                <x-slot:main wire:loading.attr="disabled" wire:target="checkProxy,startProxy" @click="$wire.dispatch('checkProxyEvent')">
+                                    <x-reicon name="play-circle" class="size-3.5" />
+                                    Start Proxy
+                                </x-slot:main>
+                            @endif
+                            <button type="button" class="listbox-option justify-start! gap-2.5!" wire:click="checkProxyStatus"
+                                wire:loading.attr="disabled" @click="open = false" role="menuitem">
+                                <x-reicon name="refresh" class="size-3.5 opacity-70" />
+                                Refresh Proxy Status
+                            </button>
+                        </x-split-action>
                     @endcan
                 @endif
             </div>
diff --git a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
index 6e2016370d..2ffc8ae779 100644
--- a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
+++ b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
@@ -60,7 +60,7 @@
                                         <livewire:server.proxy.dynamic-configuration-navbar
                                             :server_id="$server->id" :server="$server" :fileName="$fileName"
                                             :value="$value ?? ''" :newFile="false"
-                                            wire:key="{{ $fileName }}-{{ $loop->index }}" />
+                                            wire:key="proxy-navbar-{{ $fileName }}" />
                                     @endif
                                 </x-slot:actions>
                                 <x-forms.textarea disabled wire:model="contents.{{ $fileName }}"
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 491535dd62..9fb2ca2fcc 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -61,10 +61,14 @@
                                     {{ str($resource->type())->headline() }}
                                 </div>
                                 <div>
-                                    <x-status-badge :status="str($resourceStatus)->headline()"
-                                        :type="str($resourceStatus)->contains('running')
-                                            ? 'success'
-                                            : (str($resourceStatus)->contains(['failed', 'exited']) ? 'error' : 'neutral')" />
+                                    @if (method_exists($resource, 'stoppedAfterRestartLimit') && $resource->stoppedAfterRestartLimit())
+                                        <x-application.restart-limit-warning :application="$resource" />
+                                    @else
+                                        <x-status-badge :status="str($resourceStatus)->headline()"
+                                            :type="str($resourceStatus)->contains('running')
+                                                ? 'success'
+                                                : (str($resourceStatus)->contains(['failed', 'exited']) ? 'error' : 'neutral')" />
+                                    @endif
                                 </div>
                             </div>
                         @endforeach
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index d05ac5ac98..6840529dc8 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -134,11 +134,18 @@
                             ['value' => false, 'label' => 'Enabled'],
                             ['value' => true, 'label' => 'Disabled'],
                         ]" />
-                    <x-forms.listbox id="is_sponsorship_popup_enabled" label="Sponsorship reminders"
-                        helper="Show the monthly project sponsorship reminder." onChange="instantSave" :options="[
-                            ['value' => true, 'label' => 'Enabled'],
-                            ['value' => false, 'label' => 'Disabled'],
-                        ]" />
+                    <div class="flex flex-col gap-2">
+                        <x-forms.listbox id="is_sponsorship_popup_enabled" label="Sponsorship reminders"
+                            helper="Show the monthly project sponsorship reminder." onChange="instantSave" :options="[
+                                ['value' => true, 'label' => 'Enabled'],
+                                ['value' => false, 'label' => 'Disabled'],
+                            ]" />
+                        @if (isDev())
+                            <x-forms.button type="button" @click="$dispatch('show-sponsorship-reminder')">
+                                Show sponsorship reminder
+                            </x-forms.button>
+                        @endif
+                    </div>
                 </div>
             </x-application.settings-section>
 
diff --git a/resources/views/livewire/settings/scheduled-jobs.blade.php b/resources/views/livewire/settings/scheduled-jobs.blade.php
index 11d0e5fdd2..4cbd4a8cd0 100644
--- a/resources/views/livewire/settings/scheduled-jobs.blade.php
+++ b/resources/views/livewire/settings/scheduled-jobs.blade.php
@@ -216,7 +216,7 @@
                                 <span>Skipped</span>
                             </div>
                             @foreach ($managerRuns as $run)
-                                <div wire:key="run-{{ $loop->index }}"
+                                <div wire:key="run-{{ md5(serialize($run)) }}"
                                     x-show="{{ $loop->index }} >= (page - 1) * perPage && {{ $loop->index }} < page * perPage"
                                     class="data-table-row scheduler-runs-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
                                     <div class="font-mono text-[11px] text-neutral-500 dark:text-fg-dim">
@@ -272,7 +272,7 @@
                                     default => ucfirst(str_replace('_', ' ', $skip['reason'])),
                                 };
                             @endphp
-                            <div wire:key="skip-{{ $loop->index }}"
+                            <div wire:key="skip-{{ md5(serialize($skip)) }}"
                                 class="data-table-row skipped-jobs-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
                                 <div class="font-mono text-[11px] text-neutral-500 dark:text-fg-dim">
                                     {{ $skip['timestamp'] }}
diff --git a/resources/views/livewire/shared-variables/project/index.blade.php b/resources/views/livewire/shared-variables/project/index.blade.php
index eb394ae83e..63e4f45731 100644
--- a/resources/views/livewire/shared-variables/project/index.blade.php
+++ b/resources/views/livewire/shared-variables/project/index.blade.php
@@ -24,7 +24,7 @@
                             <div class="flex items-start gap-3">
                                 <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                                     @if ($project->icon_path)
-                                        <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                        <img src="{{ project_icon_url($project) }}"
                                             alt="{{ $project->name }} icon"
                                             class="h-full w-full rounded-lg object-cover">
                                     @else
@@ -49,7 +49,7 @@
                             href="{{ route('shared-variables.project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
                             class="flex min-h-14 items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                             @if ($project->icon_path)
-                                <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                <img src="{{ project_icon_url($project) }}"
                                     alt="{{ $project->name }} icon" class="size-4 shrink-0 rounded object-cover">
                             @else
                                 <x-reicon name="projects" class="size-4 shrink-0 text-neutral-500 dark:text-fg-dim" />
diff --git a/resources/views/livewire/team/audit-log.blade.php b/resources/views/livewire/team/audit-log.blade.php
new file mode 100644
index 0000000000..b81de272c5
--- /dev/null
+++ b/resources/views/livewire/team/audit-log.blade.php
@@ -0,0 +1,105 @@
+<div>
+    <x-slot:title>
+        Team Audit Log | Coolify
+    </x-slot>
+
+    <x-team.settings-layout>
+        <div class="application-settings-form">
+            <x-application.settings-section title="Audit log"
+                description="Activity from the last 90 days for the current team." flush>
+                <div
+                    class="flex flex-col gap-2 border-b border-neutral-200 p-3 sm:flex-row sm:items-center dark:border-white/[0.08]">
+                    <div class="relative min-w-0 flex-1 sm:max-w-sm">
+                        <x-reicon name="search"
+                            class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                        <input wire:model.live.debounce.300ms="search" type="search"
+                            placeholder="Search activity" aria-label="Search activity"
+                            class="h-8! w-full rounded-lg! border-neutral-200! bg-white! py-0! pr-8! pl-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint">
+                    </div>
+                    <div class="grid grid-cols-2 gap-2 sm:flex">
+                        <div class="sm:w-36">
+                            <x-forms.listbox id="action" live canGate="viewAdmin" :canResource="currentTeam()"
+                                :options="$actionOptions" />
+                        </div>
+                        <div class="sm:w-36">
+                            <x-forms.listbox id="source" live canGate="viewAdmin" :canResource="currentTeam()" :options="[
+                                ['value' => 'all', 'label' => 'All sources'],
+                                ['value' => 'ui', 'label' => 'Web UI'],
+                                ['value' => 'api', 'label' => 'API'],
+                                ['value' => 'mcp', 'label' => 'MCP'],
+                                ['value' => 'webhook', 'label' => 'Webhook'],
+                            ]" />
+                        </div>
+                    </div>
+                </div>
+
+                @if ($events->isNotEmpty())
+                    <div class="overflow-x-auto">
+                        <div class="data-table transition-opacity" wire:loading.class="opacity-50 pointer-events-none"
+                            wire:target="search,action,source,setPage,previousPage,nextPage">
+                        <div class="grid min-w-[760px] grid-cols-[14rem_minmax(0,1fr)_12rem_9rem] gap-4 border-b border-neutral-200 px-4 py-2 text-[11px] font-medium uppercase tracking-wide text-neutral-500 dark:border-white/[0.07] dark:text-fg-faint">
+                            <span>Actor</span>
+                            <span>Activity</span>
+                            <span>Source</span>
+                            <span class="text-right">Time</span>
+                        </div>
+                        @foreach ($events as $event)
+                            <div wire:key="audit-event-{{ $event->id }}"
+                                class="grid min-w-[760px] grid-cols-[14rem_minmax(0,1fr)_12rem_9rem] gap-4 border-b border-neutral-200 px-4 py-3 last:border-b-0 dark:border-white/[0.07]">
+                                <div class="min-w-0">
+                                    <div class="truncate text-[12px] font-medium text-black dark:text-fg">
+                                        {{ $event->actor_name ?: Str::headline($event->actor_type) }}
+                                    </div>
+                                    @if ($event->actor_email)
+                                        <div class="truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                            {{ $event->actor_email }}
+                                        </div>
+                                    @endif
+                                    @if ($event->actor_token_name)
+                                        <div class="truncate text-[11px] text-neutral-500 dark:text-fg-faint"
+                                            title="Token: {{ $event->actor_token_name }}">
+                                            Token: {{ $event->actor_token_name }}
+                                        </div>
+                                    @endif
+                                </div>
+                                <div class="min-w-0">
+                                    <div class="truncate text-[13px] font-medium text-black dark:text-fg">
+                                        {{ $event->description }}
+                                    </div>
+                                    <div class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                        {{ $event->event }}
+                                    </div>
+                                </div>
+                                <div class="flex items-center gap-2 text-[12px] text-neutral-500 dark:text-fg-dim">
+                                    <span class="rounded-md bg-neutral-100 px-2 py-1 dark:bg-white/[0.06]">
+                                        {{ Str::upper($event->source) }}
+                                    </span>
+                                    <span>{{ Str::headline($event->action) }}</span>
+                                </div>
+                                <time datetime="{{ $event->created_at->toIso8601String() }}"
+                                    title="{{ $event->created_at->toDayDateTimeString() }}"
+                                    class="self-center text-right text-[11px] text-neutral-500 dark:text-fg-faint">
+                                    {{ $event->created_at->diffForHumans() }}
+                                </time>
+                            </div>
+                        @endforeach
+                    </div>
+                    </div>
+
+                    <x-table-pagination :from="$events->firstItem() ?? 0" :to="$events->lastItem() ?? 0"
+                        :total="$events->total()" :current-page="$events->currentPage()"
+                        :last-page="$events->lastPage()" wire-target="setPage,previousPage,nextPage"
+                        previous-action="previousPage" next-action="nextPage">
+                        <x-slot:pageSize>
+                            <x-page-size-select model="perPage" livewire storage-key="coolify.page-size.audit-log"
+                                canGate="viewAdmin" :canResource="currentTeam()" />
+                        </x-slot:pageSize>
+                    </x-table-pagination>
+                @else
+                    <x-empty title="No activity found"
+                        description="Team actions will appear here as they happen." icon-name="time-back" size="sm" />
+                @endif
+            </x-application.settings-section>
+        </div>
+    </x-team.settings-layout>
+</div>
diff --git a/resources/views/livewire/team/danger-zone.blade.php b/resources/views/livewire/team/danger-zone.blade.php
index 8d0c022b12..b31ef2c5ab 100644
--- a/resources/views/livewire/team/danger-zone.blade.php
+++ b/resources/views/livewire/team/danger-zone.blade.php
@@ -1,4 +1,12 @@
 <div>
+    @php
+        $deletionBlockers = currentTeam()->deletionBlockers();
+        $blockerDetails = [
+            'projects' => ['label' => 'project', 'route' => 'project.index'],
+            'servers' => ['label' => 'server', 'route' => 'server.index'],
+            'sources' => ['label' => 'Git source', 'route' => 'source.all'],
+        ];
+    @endphp
     <x-slot:title>
         Team Danger Zone | Coolify
     </x-slot>
@@ -34,7 +42,7 @@
                                         {{ wireNavigate() }} href="{{ route('subscription.show') }}">subscription</a>
                                     before deleting this team.
                                 </p>
-                            @elseif(currentTeam()->isEmpty())
+                            @elseif($deletionBlockers === [])
                                 <p class="mt-2 max-w-2xl text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
                                     Permanently delete <strong class="font-semibold text-black dark:text-fg">{{ currentTeam()->name }}</strong>
                                     from Coolify. This action cannot be undone.
@@ -45,7 +53,20 @@
                                 </ul>
                             @else
                                 <p class="mt-2 text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
-                                    Remove or move every resource owned by this team before deleting it.
+                                    This team still owns:
+                                </p>
+                                <ul class="mt-2 space-y-1 text-[13px] text-neutral-600 dark:text-fg-dim">
+                                    @foreach ($deletionBlockers as $type => $count)
+                                        <li>
+                                            <a class="font-medium text-coollabs hover:underline dark:text-warning"
+                                                {{ wireNavigate() }} href="{{ route($blockerDetails[$type]['route']) }}">
+                                                {{ $count }} {{ str($blockerDetails[$type]['label'])->plural($count) }}
+                                            </a>
+                                        </li>
+                                    @endforeach
+                                </ul>
+                                <p class="mt-2 text-[13px] leading-5 text-neutral-600 dark:text-fg-dim">
+                                    Remove or move these resources before deleting the team.
                                 </p>
                             @endif
                         </div>
@@ -57,14 +78,15 @@
                                     auth()->user()->teams()->count() > 1 &&
                                     !auth()->user()->currentTeam()->personal_team &&
                                     !currentTeam()->subscription &&
-                                    currentTeam()->isEmpty())
+                                    $deletionBlockers === [])
                                 <x-modal-confirmation title="Confirm Team Deletion?" buttonTitle="Delete team"
                                     isErrorButton submitAction="delete"
                                     :actions="['The current team will be permanently deleted from Coolify and the database.']"
                                     confirmationText="{{ currentTeam()->name }}"
                                     confirmationLabel="Enter the team name to confirm permanent deletion"
                                     shortConfirmationLabel="Team name" :confirmWithPassword="false"
-                                    step2ButtonText="Permanently Delete" />
+                                    step2ButtonText="Permanently Delete" canGate="delete"
+                                    :canResource="$team" />
                             @else
                                 <x-forms.button disabled tooltip="Resolve the requirements shown before deleting this team.">
                                     Delete team
diff --git a/routes/api.php b/routes/api.php
index 2d19ae96dc..177c82f3ce 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -1,6 +1,8 @@
 <?php
 
 use App\Http\Controllers\Api\ApplicationsController;
+use App\Http\Controllers\Api\ApplicationSecretManagerController;
+use App\Http\Controllers\Api\AuditEventsController;
 use App\Http\Controllers\Api\CloudInitScriptsController;
 use App\Http\Controllers\Api\CloudProviderTokensController;
 use App\Http\Controllers\Api\DatabasesController;
@@ -11,6 +13,7 @@ use App\Http\Controllers\Api\GithubController;
 use App\Http\Controllers\Api\GitlabController;
 use App\Http\Controllers\Api\HetznerController;
 use App\Http\Controllers\Api\InstanceEmailSettingsController;
+use App\Http\Controllers\Api\IntegrationTokensController;
 use App\Http\Controllers\Api\NotificationsController;
 use App\Http\Controllers\Api\OtherController;
 use App\Http\Controllers\Api\ProjectController;
@@ -64,6 +67,7 @@ Route::group([
 ], function () {
 
     Route::get('/version', [OtherController::class, 'version'])->middleware(['api.ability:read']);
+    Route::get('/audit-events', [AuditEventsController::class, 'index'])->middleware(['api.ability:read']);
 
     Route::get('/teams', [TeamController::class, 'teams'])->middleware(['api.ability:read']);
     // Token's team
@@ -120,6 +124,7 @@ Route::group([
     Route::get('/security/keys/{uuid}', [SecurityController::class, 'key_by_uuid'])->middleware(['api.ability:read']);
     Route::patch('/security/keys/{uuid}', [SecurityController::class, 'update_key'])->middleware(['api.ability:write']);
     Route::delete('/security/keys/{uuid}', [SecurityController::class, 'delete_key'])->middleware(['api.ability:write']);
+    Route::post('/security/integration-tokens', [IntegrationTokensController::class, 'store'])->middleware(['api.ability:write']);
 
     Route::get('/cloud-tokens', [CloudProviderTokensController::class, 'index'])->middleware(['api.ability:read']);
     Route::post('/cloud-tokens', [CloudProviderTokensController::class, 'store'])->middleware(['api.ability:write']);
@@ -237,6 +242,7 @@ Route::group([
     Route::get('/applications/{uuid}', [ApplicationsController::class, 'application_by_uuid'])->middleware(['api.ability:read']);
     Route::patch('/applications/{uuid}', [ApplicationsController::class, 'update_by_uuid'])->middleware(['api.ability:write']);
     Route::delete('/applications/{uuid}', [ApplicationsController::class, 'delete_by_uuid'])->middleware(['api.ability:write']);
+    Route::patch('/applications/{uuid}/secret-manager', [ApplicationSecretManagerController::class, 'update'])->middleware(['api.ability:write']);
 
     Route::get('/applications/{uuid}/envs', [ApplicationsController::class, 'envs'])->middleware(['api.ability:read']);
     Route::post('/applications/{uuid}/envs', [ApplicationsController::class, 'create_env'])->middleware(['api.ability:write']);
@@ -277,6 +283,7 @@ Route::group([
     Route::post('/applications/{uuid}/restart', [ApplicationsController::class, 'action_restart'])->middleware(['api.ability:deploy']);
     Route::post('/applications/{uuid}/stop', [ApplicationsController::class, 'action_stop'])->middleware(['api.ability:deploy']);
 
+    Route::patch('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'update_preview_by_pull_request_id'])->middleware(['api.ability:write']);
     Route::delete('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'delete_preview_by_pull_request_id'])->middleware(['api.ability:write']);
 
     Route::get('/github-apps', [GithubController::class, 'list_github_apps'])->middleware(['api.ability:read']);
diff --git a/routes/web.php b/routes/web.php
index 7b5ada42a7..f561fd9ea6 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -12,6 +12,7 @@ use App\Livewire\Dashboard;
 use App\Livewire\Destination\Index as DestinationIndex;
 use App\Livewire\Destination\Resources as DestinationResources;
 use App\Livewire\Destination\Show as DestinationShow;
+use App\Livewire\Dev\LivewireRequestFailurePreview;
 use App\Livewire\ForcePasswordReset;
 use App\Livewire\Notifications\Discord as NotificationDiscord;
 use App\Livewire\Notifications\Email as NotificationEmail;
@@ -37,6 +38,7 @@ use App\Livewire\Project\Resource\Create as ResourceCreate;
 use App\Livewire\Project\Resource\Index as ResourceIndex;
 use App\Livewire\Project\Service\Configuration as ServiceConfiguration;
 use App\Livewire\Project\Service\DatabaseBackups as ServiceDatabaseBackups;
+use App\Livewire\Project\Service\ImportBackup as ServiceImportBackup;
 use App\Livewire\Project\Service\Index as ServiceIndex;
 use App\Livewire\Project\Service\VolumeBackup\Index;
 use App\Livewire\Project\Service\VolumeBackup\Show;
@@ -98,6 +100,7 @@ use App\Livewire\Subscription\Index as SubscriptionIndex;
 use App\Livewire\Subscription\Show as SubscriptionShow;
 use App\Livewire\Tags\Show as TagsShow;
 use App\Livewire\Team\AdminView as TeamAdminView;
+use App\Livewire\Team\AuditLog as TeamAuditLog;
 use App\Livewire\Team\DangerZone as TeamDangerZone;
 use App\Livewire\Team\Index as TeamIndex;
 use App\Livewire\Team\Member\Index as TeamMemberIndex;
@@ -122,6 +125,9 @@ Route::get('/auth/{provider}/callback', [OauthController::class, 'callback'])->n
 
 // Local/testing previews for HTTP error pages and the Laravel debug renderer (never in production).
 if (app()->environment(['local', 'testing'])) {
+    Route::get('/__livewire-request-failure', LivewireRequestFailurePreview::class)
+        ->name('dev.livewire-request-failure-preview');
+
     Route::get('/__exception', function () {
         throw new RuntimeException('Testing Laravel exception page');
     })->name('dev.exception-preview');
@@ -208,6 +214,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
     Route::prefix('team')->group(function () {
         Route::get('/', TeamIndex::class)->name('team.index');
         Route::get('/members', TeamMemberIndex::class)->name('team.member.index');
+        Route::get('/audit-log', TeamAuditLog::class)->name('team.audit-log');
         Route::get('/admin', TeamAdminView::class)->name('team.admin-view');
         Route::get('/danger', TeamDangerZone::class)->name('team.danger-zone');
     });
@@ -325,6 +332,8 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/logs', Logs::class)->name('project.service.logs');
         Route::get('/environment-variables', ServiceConfiguration::class)->name('project.service.environment-variables');
         Route::get('/storages', ServiceConfiguration::class)->name('project.service.storages');
+        Route::get('/import-backup', ServiceImportBackup::class)->name('project.service.import-backup')->middleware('can.update.resource');
+        Route::get('/import-backup/{stack_service_uuid}', ServiceImportBackup::class)->name('project.service.import-backup.database')->middleware('can.update.resource');
         Route::get('/storage-backups', Index::class)->name('project.service.volume-backups.index');
         Route::get('/storage-backups/{backup_uuid}', Show::class)->name('project.service.volume-backups.show');
         Route::get('/storage-backups/{backup_uuid}/s3', Show::class)->name('project.service.volume-backups.s3');
@@ -343,7 +352,7 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/retention', ServiceDatabaseBackups::class)->name('project.service.database.backup.retention');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/executions', ServiceDatabaseBackups::class)->name('project.service.database.backup.executions');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/danger', ServiceDatabaseBackups::class)->name('project.service.database.backup.danger');
-        Route::get('/{stack_service_uuid}/import', ServiceIndex::class)->name('project.service.database.import')->middleware('can.update.resource');
+        Route::get('/{stack_service_uuid}/import', ServiceImportBackup::class)->name('project.service.database.import')->middleware('can.update.resource');
         Route::get('/{stack_service_uuid}/advanced', ServiceIndex::class)->name('project.service.index.advanced');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
         Route::get('/tasks/{task_uuid}', ServiceConfiguration::class)->name('project.service.scheduled-tasks');
diff --git a/scripts/dev-helper b/scripts/dev-helper
new file mode 100755
index 0000000000..1e1bfae27b
--- /dev/null
+++ b/scripts/dev-helper
@@ -0,0 +1,280 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+REPOSITORY=${HELPER_IMAGE_REPOSITORY:-docker.io/coollabsio/coolify-helper}
+DEFAULT_TAG="dev-$(git -C "$ROOT_DIR" rev-parse --short HEAD)"
+COOLIFY_CONTAINER=${COOLIFY_CONTAINER:-coolify}
+
+usage() {
+    cat <<EOF
+Usage: $0 <command> [tag]
+
+Commands:
+  build [tag]   Build the local helper image
+  use [tag]     Configure local Coolify to use an existing helper image
+  verify [tag]  Verify tools and run a Docker Compose socket smoke test
+  deploy [tag]  Deploy seeded Dockerfile, Compose, and Nixpacks applications
+  reset         Clear the local helper version override
+  test [tag]    Build, select, verify, and run real seeded deployments
+
+Default tag: $DEFAULT_TAG
+EOF
+}
+
+require_local_coolify() {
+    local is_dev
+
+    if ! docker inspect "$COOLIFY_CONTAINER" >/dev/null 2>&1; then
+        echo "Coolify container '$COOLIFY_CONTAINER' is not running." >&2
+        exit 1
+    fi
+
+    is_dev=$(docker exec "$COOLIFY_CONTAINER" php artisan tinker --execute 'echo isDev() ? "yes" : "no";' 2>/dev/null | tail -1)
+    if [[ $is_dev != yes ]]; then
+        echo "The running Coolify instance is not in development mode." >&2
+        exit 1
+    fi
+}
+
+validate_tag() {
+    local tag=$1
+
+    if [[ ! $tag =~ ^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$ ]]; then
+        echo "Invalid Docker tag: $tag" >&2
+        exit 1
+    fi
+}
+
+image_for() {
+    echo "${REPOSITORY}:$1"
+}
+
+build_helper() {
+    local tag=$1
+    local image
+    image=$(image_for "$tag")
+
+    echo "Building $image"
+    docker build --progress=plain -f "$ROOT_DIR/docker/coolify-helper/Dockerfile" -t "$image" "$ROOT_DIR"
+}
+
+use_helper() {
+    local tag=$1
+    local image
+    image=$(image_for "$tag")
+
+    require_local_coolify
+    docker image inspect "$image" >/dev/null
+    docker exec -e DEV_HELPER_VERSION="$tag" "$COOLIFY_CONTAINER" php artisan tinker --execute '
+        App\Models\InstanceSettings::findOrFail(0)->update([
+            "dev_helper_version" => getenv("DEV_HELPER_VERSION"),
+        ]);
+    ' >/dev/null
+
+    local selected
+    selected=$(docker exec "$COOLIFY_CONTAINER" php artisan tinker --execute 'echo getHelperVersion();' 2>/dev/null | tail -1)
+    if [[ $selected != "$tag" ]]; then
+        echo "Coolify selected helper '$selected' instead of '$tag'." >&2
+        exit 1
+    fi
+
+    echo "Coolify now uses $image"
+}
+
+verify_helper() {
+    local tag=$1
+    local image project compose
+    image=$(image_for "$tag")
+    project="coolify-helper-${tag//[^A-Za-z0-9_-]/-}-smoke"
+    compose=$'services:\n  app:\n    image: alpine:3.21\n    command: ["sh", "-c", "sleep 30"]\n'
+
+    docker image inspect "$image" >/dev/null
+
+    docker run --rm "$image" docker --version
+    docker run --rm "$image" docker compose version
+    docker run --rm "$image" docker buildx version
+    docker run --rm "$image" pack version
+    docker run --rm "$image" nixpacks --version
+    docker run --rm "$image" railpack --version
+
+    docker run --rm -v /var/run/docker.sock:/var/run/docker.sock "$image" \
+        docker version --format 'client={{.Client.Version}} server={{.Server.Version}} api={{.Client.APIVersion}}/{{.Server.APIVersion}}'
+
+    cleanup_compose() {
+        printf '%s' "$compose" | docker run --rm -i \
+            -v /var/run/docker.sock:/var/run/docker.sock "$image" \
+            docker compose -p "$project" -f - down --remove-orphans >/dev/null 2>&1 || true
+    }
+    trap cleanup_compose RETURN
+
+    printf '%s' "$compose" | docker run --rm -i \
+        -v /var/run/docker.sock:/var/run/docker.sock "$image" \
+        docker compose -p "$project" -f - up -d --wait
+    printf '%s' "$compose" | docker run --rm -i \
+        -v /var/run/docker.sock:/var/run/docker.sock "$image" \
+        docker compose -p "$project" -f - ps --format json
+    cleanup_compose
+    trap - RETURN
+
+    if [[ -n $(docker ps -aq --filter "label=com.docker.compose.project=$project") ]]; then
+        echo "Compose smoke-test resources were not removed." >&2
+        exit 1
+    fi
+
+    echo "Helper verification passed for $image"
+}
+
+queue_deployment() {
+    local application_uuid=$1
+
+    docker exec -e APPLICATION_UUID="$application_uuid" "$COOLIFY_CONTAINER" php artisan tinker --execute '
+        $application = App\Models\Application::query()
+            ->where("uuid", getenv("APPLICATION_UUID"))
+            ->firstOrFail();
+        $deploymentUuid = (string) Illuminate\Support\Str::uuid();
+        queue_application_deployment(
+            application: $application,
+            deployment_uuid: $deploymentUuid,
+            force_rebuild: true,
+            no_questions_asked: true,
+        );
+        echo "DEPLOYMENT_UUID={$deploymentUuid}";
+    ' 2>/dev/null | sed -n 's/^DEPLOYMENT_UUID=//p' | tail -1
+}
+
+wait_for_deployment() {
+    local deployment_uuid=$1
+    local expected_image=$2
+    local status
+
+    for _ in $(seq 1 150); do
+        status=$(docker exec -e DEPLOYMENT_UUID="$deployment_uuid" "$COOLIFY_CONTAINER" php artisan tinker --execute '
+            $deployment = App\Models\ApplicationDeploymentQueue::query()
+                ->where("deployment_uuid", getenv("DEPLOYMENT_UUID"))
+                ->first();
+            echo $deployment?->status ?? "missing";
+        ' 2>/dev/null | tail -1)
+
+        case "$status" in
+            finished)
+                break
+                ;;
+            failed|cancelled|missing)
+                echo "Deployment $deployment_uuid ended with status: $status" >&2
+                return 1
+                ;;
+        esac
+
+        sleep 4
+    done
+
+    if [[ $status != finished ]]; then
+        echo "Deployment $deployment_uuid timed out with status: $status" >&2
+        return 1
+    fi
+
+    local used_expected_helper
+    used_expected_helper=$(docker exec \
+        -e DEPLOYMENT_UUID="$deployment_uuid" \
+        -e EXPECTED_HELPER_IMAGE="$expected_image" \
+        "$COOLIFY_CONTAINER" php artisan tinker --execute '
+            $deployment = App\Models\ApplicationDeploymentQueue::query()
+                ->where("deployment_uuid", getenv("DEPLOYMENT_UUID"))
+                ->firstOrFail();
+            $logs = collect(json_decode($deployment->logs, true))
+                ->pluck("output")
+                ->implode("\n");
+            echo str_contains(
+                $logs,
+                "Preparing container with helper image: ".getenv("EXPECTED_HELPER_IMAGE"),
+            ) ? "yes" : "no";
+        ' 2>/dev/null | tail -1)
+
+    if [[ $used_expected_helper != yes ]]; then
+        echo "Deployment $deployment_uuid did not use $expected_image." >&2
+        return 1
+    fi
+}
+
+deploy_examples() {
+    local tag=$1
+    local image application_uuid deployment_uuid fqdn
+    image=$(image_for "$tag")
+
+    require_local_coolify
+    use_helper "$tag"
+
+    for application_uuid in dockerfile docker-compose nodejs; do
+        echo "Deploying seeded application: $application_uuid"
+        deployment_uuid=$(queue_deployment "$application_uuid")
+        if [[ -z $deployment_uuid ]]; then
+            echo "Could not queue $application_uuid." >&2
+            exit 1
+        fi
+
+        wait_for_deployment "$deployment_uuid" "$image"
+
+        fqdn=$(docker exec -e APPLICATION_UUID="$application_uuid" "$COOLIFY_CONTAINER" php artisan tinker --execute '
+            echo App\Models\Application::query()
+                ->where("uuid", getenv("APPLICATION_UUID"))
+                ->value("fqdn") ?? "";
+        ' 2>/dev/null | tail -1)
+
+        if [[ -n $fqdn ]]; then
+            curl --fail --silent --show-error --output /dev/null "$fqdn"
+        fi
+
+        echo "Deployment passed: $application_uuid ($deployment_uuid)"
+    done
+}
+
+reset_helper() {
+    require_local_coolify
+    docker exec "$COOLIFY_CONTAINER" php artisan tinker --execute '
+        App\Models\InstanceSettings::findOrFail(0)->update([
+            "dev_helper_version" => null,
+        ]);
+    ' >/dev/null
+    echo "Development helper override cleared."
+}
+
+command=${1:-help}
+tag=${2:-$DEFAULT_TAG}
+
+case "$command" in
+    build)
+        validate_tag "$tag"
+        build_helper "$tag"
+        ;;
+    use)
+        validate_tag "$tag"
+        use_helper "$tag"
+        ;;
+    verify)
+        validate_tag "$tag"
+        verify_helper "$tag"
+        ;;
+    deploy)
+        validate_tag "$tag"
+        deploy_examples "$tag"
+        ;;
+    reset)
+        reset_helper
+        ;;
+    test)
+        validate_tag "$tag"
+        build_helper "$tag"
+        use_helper "$tag"
+        verify_helper "$tag"
+        deploy_examples "$tag"
+        ;;
+    help|-h|--help)
+        usage
+        ;;
+    *)
+        usage >&2
+        exit 1
+        ;;
+esac
diff --git a/svgs/obsidian-livesync.svg b/svgs/obsidian-livesync.svg
new file mode 100644
index 0000000000..97b77a9903
--- /dev/null
+++ b/svgs/obsidian-livesync.svg
@@ -0,0 +1,83 @@
+<svg width="832" height="832" viewBox="0 0 832 832" fill="none" xmlns="http://www.w3.org/2000/svg">
+<mask id="mask0_1_4" style="mask-type:luminance" maskUnits="userSpaceOnUse" x="0" y="0" width="832" height="832">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M832 259.119C832 249.242 832.004 239.364 831.943 229.486C831.894 221.165 831.798 212.846 831.572 204.529C831.083 186.402 830.014 168.119 826.79 150.194C823.52 132.01 818.181 115.086 809.767 98.5644C801.496 82.3253 790.691 67.4655 777.799 54.5826C764.91 41.6998 750.046 30.902 733.801 22.6356C717.263 14.2197 700.321 8.88238 682.117 5.61396C664.19 2.39502 645.902 1.32776 627.775 0.838055C619.452 0.612891 611.129 0.517979 602.804 0.466484C592.921 0.405901 583.038 0.41095 573.155 0.41095L458.404 0H372.58L259.86 0.41095C249.958 0.41095 240.055 0.405901 230.153 0.466484C221.811 0.517979 213.473 0.612891 205.134 0.838055C186.964 1.32776 168.635 2.39603 150.666 5.61901C132.437 8.88641 115.47 14.2217 98.9093 22.6315C82.6299 30.899 67.7338 41.6978 54.8177 54.5826C41.9036 67.4645 31.0786 82.3213 22.792 98.5573C14.3549 115.087 9.00553 132.021 5.72804 150.215C2.50103 168.133 1.43176 186.41 0.940032 204.529C0.715878 212.847 0.618947 221.166 0.568462 229.486C0.50788 239.365 0 251.636 0 261.514L0.0030291 372.672L0 459.416L0.512928 572.936C0.512928 582.827 0.508889 592.718 0.568462 602.609C0.618947 610.941 0.715878 619.271 0.941042 627.6C1.43176 645.751 2.50305 664.06 5.73308 682.009C9.00956 700.217 14.358 717.165 22.7879 733.708C31.0756 749.971 41.9026 764.85 54.8177 777.751C67.7328 790.652 82.6249 801.464 98.9012 809.742C115.472 818.169 132.448 823.513 150.687 826.786C168.648 830.01 186.971 831.079 205.134 831.569C213.473 831.794 221.812 831.89 230.154 831.94C240.056 832.001 249.958 831.997 259.86 831.997L373.599 832H459.636L573.155 831.996C583.038 831.996 592.921 832.001 602.804 831.94C611.129 831.89 619.452 831.794 627.775 831.569C645.909 831.078 664.203 830.008 682.138 826.782C700.331 823.509 717.264 818.167 733.794 809.745C750.042 801.468 764.909 790.654 777.799 777.751C790.689 764.852 801.493 749.975 809.764 733.715C818.183 717.164 823.522 700.208 826.794 681.988C830.015 664.046 831.083 645.744 831.573 627.6C831.798 619.27 831.894 610.94 831.943 602.609C832.005 592.718 832 582.827 832 572.936C832 572.936 831.994 461.42 831.994 459.416V372.581C831.994 371.101 832 259.119 832 259.119Z" fill="white"/>
+</mask>
+<g mask="url(#mask0_1_4)">
+<rect width="832" height="832" transform="translate(0.34375 -0.236816)" fill="#1B1B1B"/>
+<rect width="832" height="832" transform="translate(0.34375 -0.236816)" fill="url(#paint0_radial_1_4)"/>
+<rect width="832" height="832" transform="translate(0.34375 -0.236816)" fill="url(#paint1_radial_1_4)"/>
+<g filter="url(#filter0_f_1_4)">
+<path d="M572.262 707.437C568.044 738.596 537.382 762.936 506.911 754.532C463.495 742.638 413.226 724.086 367.994 720.629C362.031 720.173 298.67 715.396 298.67 715.396C287.462 714.602 276.942 709.732 269.115 701.717L149.663 579.398C136.608 566.032 133.075 546.099 140.745 529.1C140.745 529.1 214.608 367.682 217.351 359.288C220.095 350.893 230.162 277.68 236.128 238.349C237.71 227.926 242.884 218.372 250.766 211.322L392.074 84.9217C411.734 67.3369 442.249 69.9428 458.605 90.603L577.31 240.549C584.027 249.036 587.469 259.582 587.519 270.38C587.655 298.788 590.012 357.113 605.808 394.679C621.174 431.22 649.374 470.683 664.113 490.102C669.768 497.555 670.635 507.632 665.857 515.671C655.455 533.183 634.903 566.808 605.808 609.949C585.749 639.695 576.453 676.466 572.262 707.437Z" fill="black" fill-opacity="0.29"/>
+</g>
+<path d="M573.418 702.232C569.203 733.532 538.572 757.983 508.131 749.541C464.758 737.592 414.539 718.956 369.351 715.483C363.394 715.026 300.096 710.227 300.096 710.227C288.899 709.429 278.389 704.537 270.569 696.485L151.235 573.611C138.194 560.184 134.664 540.16 142.327 523.084C142.327 523.084 216.117 360.933 218.857 352.5C221.598 344.068 231.656 270.522 237.616 231.013C239.196 220.542 244.365 210.944 252.239 203.862L393.407 76.8878C413.048 59.2231 443.533 61.8408 459.873 82.595L578.461 233.222C585.171 241.747 588.609 252.341 588.66 263.188C588.795 291.726 591.15 350.316 606.93 388.053C622.281 424.759 650.454 464.402 665.178 483.909C670.828 491.396 671.694 501.519 666.92 509.594C656.529 527.186 635.997 560.963 606.93 604.301C586.891 634.182 577.605 671.12 573.418 702.232Z" fill="#6C31E3"/>
+<path d="M283.428 705.773C338.847 593.265 337.301 512.663 313.719 455.14C292.016 402.206 251.651 368.818 219.835 348.097C219.165 351.09 218.194 354.013 216.935 356.819L142.325 523.084C134.662 540.161 138.192 560.185 151.233 573.611L270.567 696.486C274.311 700.34 278.672 703.47 283.428 705.773Z" fill="url(#paint2_radial_1_4)"/>
+<path d="M508.146 749.525C538.58 757.966 569.207 733.516 573.421 702.216C577.05 675.269 584.499 643.949 599.449 616.632C565.148 542.797 523.669 504.508 478.197 487.537C430.064 469.573 377.458 475.496 324.157 488.44C336.073 542.665 328.94 613.483 283.491 705.763C288.666 708.269 294.309 709.795 300.14 710.21C300.14 710.21 332.936 712.972 371.94 715.732C410.943 718.493 468.984 738.665 508.146 749.525Z" fill="url(#paint3_radial_1_4)"/>
+<path d="M434.243 477.416C449.219 478.981 463.896 482.208 478.182 487.538C523.662 504.51 565.151 542.801 599.457 616.63C601.763 612.416 604.251 608.296 606.931 604.301C635.996 560.963 656.528 527.186 666.919 509.594C671.693 501.519 670.827 491.396 665.176 483.908C650.453 464.402 622.28 424.759 606.931 388.053C591.149 350.316 588.794 291.726 588.66 263.188C588.608 252.341 585.17 241.747 578.46 233.222L459.871 82.5946C459.238 81.7892 458.582 81.0112 457.907 80.2606C466.608 108.776 466.019 131.716 460.65 152.569C455.674 171.901 446.589 189.44 436.993 207.966L436.992 207.969C433.772 214.182 430.498 220.507 427.299 227.049C414.567 253.092 403.072 282.562 401.377 322.081C399.68 361.602 407.782 411.17 434.246 477.415L434.243 477.416Z" fill="url(#paint4_radial_1_4)"/>
+<path d="M434.227 477.415C407.764 411.172 399.659 361.602 401.356 322.08C403.052 282.558 414.547 253.087 427.28 227.042C430.48 220.499 433.756 214.175 436.975 207.96C446.569 189.433 455.654 171.896 460.63 152.566C465.999 131.708 466.588 108.762 457.879 80.2342C441.149 61.6665 412.27 59.9167 393.401 76.8878L252.233 203.862C244.359 210.944 239.189 220.542 237.61 231.013L220.425 344.931C220.265 345.988 220.068 347.038 219.835 348.082C251.652 368.803 292.024 402.194 313.729 455.135C317.968 465.476 321.496 476.559 324.108 488.443C361.594 479.339 398.738 473.71 434.227 477.415Z" fill="url(#paint5_radial_1_4)"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M401.632 319.477C399.931 358.681 404.824 403.653 431.232 469.759L422.94 469.01C399.247 400.027 394.092 364.659 395.817 324.912C397.544 285.147 410.392 254.569 423.197 228.485C426.44 221.879 434.007 209.474 437.244 203.248C446.832 184.811 453.213 175.073 458.691 158.221C466.347 134.675 464.691 123.523 463.818 112.425C469.897 152.545 446.824 187.432 429.381 222.964C416.675 248.848 403.332 280.291 401.632 319.477Z" fill="url(#paint6_radial_1_4)"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M321.527 458.055C324.659 465.298 327.618 471.146 329.485 480.107L322.566 481.662C319.686 471.199 317.462 463.755 313.477 454.779C289.631 398.521 251.361 369.583 220.087 348.358C257.863 368.682 296.635 400.492 321.527 458.055Z" fill="url(#paint7_radial_1_4)"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M329.887 487.185C343.101 548.675 328.36 626.792 284.919 702.728C321.23 627.472 338.832 555.193 324.172 488.411L329.887 487.185Z" fill="url(#paint8_radial_1_4)"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M479.822 481.654C551.046 508.308 578.471 566.832 598.969 615.651C573.652 564.53 538.456 508.074 477.267 487.119C430.708 471.173 391.388 473.064 324.168 488.32L322.67 481.654C394.009 465.4 431.309 463.499 479.822 481.654Z" fill="url(#paint9_radial_1_4)"/>
+<g filter="url(#filter1_i_1_4)" style="mix-blend-mode:screen">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M832.344 259.119C832.344 249.242 832.348 239.364 832.287 229.486C832.238 221.165 832.142 212.846 831.916 204.529C831.427 186.402 830.358 168.119 827.134 150.194C823.864 132.01 818.525 115.086 810.111 98.5644C801.84 82.3253 791.035 67.4655 778.143 54.5826C765.254 41.6998 750.39 30.902 734.145 22.6356C717.606 14.2197 700.664 8.88238 682.461 5.61396C664.533 2.39502 646.246 1.32776 628.118 0.838055C619.796 0.612891 611.473 0.517979 603.148 0.466484C593.265 0.405901 583.382 0.41095 573.499 0.41095L458.748 0H372.924L260.203 0.41095C250.301 0.41095 240.399 0.405901 230.497 0.466484C222.155 0.517979 213.817 0.612891 205.478 0.838055C187.308 1.32776 168.979 2.39603 151.009 5.61901C132.781 8.88641 115.814 14.2217 99.2531 22.6315C82.9737 30.899 68.0775 41.6978 55.1614 54.5826C42.2474 67.4645 31.4224 82.3213 23.1357 98.5573C14.6987 115.087 9.34928 132.021 6.07179 150.215C2.84478 168.133 1.77551 186.41 1.28378 204.529C1.05963 212.847 0.962697 221.166 0.912212 229.486C0.85163 239.365 0.34375 251.636 0.34375 261.514L0.346779 372.672L0.34375 459.416L0.856678 572.936C0.856678 582.827 0.852639 592.718 0.912212 602.609C0.962697 610.941 1.05963 619.271 1.28479 627.6C1.77551 645.751 2.8468 664.06 6.07683 682.009C9.35331 700.217 14.7017 717.165 23.1317 733.708C31.4193 749.971 42.2464 764.85 55.1614 777.751C68.0765 790.652 82.9686 801.464 99.245 809.742C115.816 818.169 132.791 823.513 151.031 826.786C168.992 830.01 187.315 831.079 205.478 831.569C213.817 831.794 222.156 831.89 230.498 831.94C240.4 832.001 250.301 831.997 260.203 831.997L373.942 832H459.98L573.499 831.996C583.382 831.996 593.265 832.001 603.148 831.94C611.473 831.89 619.796 831.794 628.118 831.569C646.253 831.078 664.546 830.008 682.482 826.782C700.675 823.509 717.608 818.167 734.138 809.745C750.386 801.468 765.253 790.654 778.143 777.751C791.033 764.852 801.837 749.975 810.108 733.715C818.527 717.164 823.866 700.208 827.138 681.988C830.359 664.046 831.427 645.744 831.917 627.6C832.142 619.27 832.238 610.94 832.287 602.609C832.349 592.718 832.344 582.827 832.344 572.936C832.344 572.936 832.338 461.42 832.338 459.416V372.581C832.338 371.101 832.344 259.119 832.344 259.119Z" fill="black"/>
+</g>
+</g>
+<defs>
+<filter id="filter0_f_1_4" x="123.736" y="60.2524" width="558.222" height="708.957" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
+<feGaussianBlur stdDeviation="6.5" result="effect1_foregroundBlur_1_4"/>
+</filter>
+<filter id="filter1_i_1_4" x="0.34375" y="0" width="832" height="833" filterUnits="userSpaceOnUse" color-interpolation-filters="sRGB">
+<feFlood flood-opacity="0" result="BackgroundImageFix"/>
+<feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape"/>
+<feColorMatrix in="SourceAlpha" type="matrix" values="0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 127 0" result="hardAlpha"/>
+<feOffset dy="6"/>
+<feGaussianBlur stdDeviation="0.5"/>
+<feComposite in2="hardAlpha" operator="arithmetic" k2="-1" k3="1"/>
+<feColorMatrix type="matrix" values="0 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0.07 0"/>
+<feBlend mode="normal" in2="shape" result="effect1_innerShadow_1_4"/>
+</filter>
+<radialGradient id="paint0_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(416 521.793) rotate(90) scale(339.695 441.724)">
+<stop stop-opacity="0.35"/>
+<stop offset="1" stop-opacity="0"/>
+</radialGradient>
+<radialGradient id="paint1_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(416) rotate(90) scale(832)">
+<stop stop-color="white" stop-opacity="0.05"/>
+<stop offset="1" stop-color="white" stop-opacity="0"/>
+</radialGradient>
+<radialGradient id="paint2_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(277.468 694.667) rotate(-104.574) scale(312.164 208.025)">
+<stop stop-color="white" stop-opacity="0.4"/>
+<stop offset="1" stop-opacity="0.1"/>
+</radialGradient>
+<radialGradient id="paint3_radial_1_4" cx="0" cy="0" r="1" gradientTransform="matrix(-112.742 -231.813 266.153 -129.482 494.168 764.607)" gradientUnits="userSpaceOnUse">
+<stop stop-color="white" stop-opacity="0.3"/>
+<stop offset="1" stop-opacity="0.25"/>
+</radialGradient>
+<radialGradient id="paint4_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(543.525 566.311) rotate(-82.4846) scale(512.246 378.451)">
+<stop stop-color="white" stop-opacity="0.55"/>
+<stop offset="1" stop-color="white" stop-opacity="0.05"/>
+</radialGradient>
+<radialGradient id="paint5_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(296.174 476.378) rotate(-77.7214) scale(437.431 298.317)">
+<stop stop-color="white" stop-opacity="0.83"/>
+<stop offset="1" stop-color="white" stop-opacity="0.4"/>
+</radialGradient>
+<radialGradient id="paint6_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(476.526 236.681) rotate(102.236) scale(227.604 153.482)">
+<stop stop-color="white" stop-opacity="0"/>
+<stop offset="1" stop-color="white" stop-opacity="0.17"/>
+</radialGradient>
+<radialGradient id="paint7_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(209.872 359.957) rotate(45.3237) scale(167.71 357.205)">
+<stop stop-color="white" stop-opacity="0.2"/>
+<stop offset="1" stop-color="white" stop-opacity="0.44"/>
+</radialGradient>
+<radialGradient id="paint8_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(336.488 439.314) rotate(80.2016) scale(196.566 417.419)">
+<stop stop-color="white" stop-opacity="0.12"/>
+<stop offset="1" stop-color="white" stop-opacity="0.35"/>
+</radialGradient>
+<radialGradient id="paint9_radial_1_4" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(597.124 599.809) rotate(-152.297) scale(299.519 942.568)">
+<stop stop-color="white" stop-opacity="0.21"/>
+<stop offset="0.46738" stop-color="white" stop-opacity="0.19"/>
+<stop offset="1" stop-color="white" stop-opacity="0.29"/>
+</radialGradient>
+</defs>
+</svg>
diff --git a/templates/compose/appsmith.yaml b/templates/compose/appsmith.yaml
index d4a05accc2..70f85fb085 100644
--- a/templates/compose/appsmith.yaml
+++ b/templates/compose/appsmith.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: lowcode, nocode, no, low, platform
 # logo: svgs/appsmith.svg
+# port: 80
 
 services:
   appsmith:
diff --git a/templates/compose/appwrite.yaml b/templates/compose/appwrite.yaml
index 2a8e90d18c..4f60baa11e 100644
--- a/templates/compose/appwrite.yaml
+++ b/templates/compose/appwrite.yaml
@@ -3,6 +3,7 @@
 # category: backend
 # tags: backend, backend-as-a-service, platform
 # logo: svgs/appwrite.svg
+# port: 3003
 
 services:
   appwrite:
diff --git a/templates/compose/babybuddy.yaml b/templates/compose/babybuddy.yaml
index a3b52ff989..af07b2282e 100644
--- a/templates/compose/babybuddy.yaml
+++ b/templates/compose/babybuddy.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: baby, parents, health, growth, activities
 # logo: svgs/babybuddy.png
+# port: 8000
 
 services:
   babybuddy:
diff --git a/templates/compose/budge.yaml b/templates/compose/budge.yaml
index 3d98408fc5..d4b7828540 100644
--- a/templates/compose/budge.yaml
+++ b/templates/compose/budge.yaml
@@ -3,6 +3,7 @@
 # category: finance
 # tags: personal finance, budgeting, expense tracking
 # logo: svgs/budge.png
+# port: 80
 
 services:
   budge:
diff --git a/templates/compose/classicpress-with-mariadb.yaml b/templates/compose/classicpress-with-mariadb.yaml
index 20cc9518a5..19ee86e424 100644
--- a/templates/compose/classicpress-with-mariadb.yaml
+++ b/templates/compose/classicpress-with-mariadb.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
   classicpress:
diff --git a/templates/compose/classicpress-with-mysql.yaml b/templates/compose/classicpress-with-mysql.yaml
index ed880538cd..2d90e046c9 100644
--- a/templates/compose/classicpress-with-mysql.yaml
+++ b/templates/compose/classicpress-with-mysql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
   classicpress:
diff --git a/templates/compose/classicpress-without-database.yaml b/templates/compose/classicpress-without-database.yaml
index b2d6d51755..c52fc38605 100644
--- a/templates/compose/classicpress-without-database.yaml
+++ b/templates/compose/classicpress-without-database.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
    classicpress:
diff --git a/templates/compose/dokuwiki.yaml b/templates/compose/dokuwiki.yaml
index d428877ee0..32ce13b293 100644
--- a/templates/compose/dokuwiki.yaml
+++ b/templates/compose/dokuwiki.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: wiki, documentation, knowledge, base
 # logo: svgs/dokuwiki.png
+# port: 80
 
 services:
   dokuwiki:
diff --git a/templates/compose/drupal-with-postgresql.yaml b/templates/compose/drupal-with-postgresql.yaml
index 8329970682..419f0e3002 100644
--- a/templates/compose/drupal-with-postgresql.yaml
+++ b/templates/compose/drupal-with-postgresql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, postgresql
 # logo: svgs/drupal.svg
+# port: 80
 
 services:
   drupal:
diff --git a/templates/compose/executor.yaml b/templates/compose/executor.yaml
new file mode 100644
index 0000000000..e6913ae5d7
--- /dev/null
+++ b/templates/compose/executor.yaml
@@ -0,0 +1,35 @@
+# documentation: https://executor.sh/docs/hosted/docker
+# slogan: Self-hosted AI agent integrations and code execution server.
+# category: development
+# tags: executor,ai,agents,mcp,automation,development
+# logo: svgs/executor.png
+# port: 4788
+
+services:
+  executor:
+    image: 'ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}'
+    environment:
+      - SERVICE_URL_EXECUTOR_4788
+      - EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}
+      - EXECUTOR_HOST=${EXECUTOR_HOST:-0.0.0.0}
+      - PORT=${PORT:-4788}
+      - EXECUTOR_DATA_DIR=/data
+      - EXECUTOR_DB_PATH=${EXECUTOR_DB_PATH:-/data/data.db}
+      - EXECUTOR_ORG_NAME=${EXECUTOR_ORG_NAME:-Default}
+      - EXECUTOR_ORG_SLUG=${EXECUTOR_ORG_SLUG:-default}
+      - EXECUTOR_ALLOW_LOCAL_NETWORK=${EXECUTOR_ALLOW_LOCAL_NETWORK:-false}
+    volumes:
+      - executor-data:/data
+    healthcheck:
+      test:
+        - CMD
+        - bun
+        - -e
+        - "fetch(`http://127.0.0.1:${process.env.PORT||4788}/api/health`).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+volumes:
+  executor-data:
diff --git a/templates/compose/grocy.yaml b/templates/compose/grocy.yaml
index a78373fdf1..fc96d272df 100644
--- a/templates/compose/grocy.yaml
+++ b/templates/compose/grocy.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: groceries, household, management, grocery, shopping
 # logo: svgs/grocy.svg
+# port: 80
 
 services:
   grocy:
diff --git a/templates/compose/heimdall.yaml b/templates/compose/heimdall.yaml
index 5fbdf763cb..56e193f1cf 100644
--- a/templates/compose/heimdall.yaml
+++ b/templates/compose/heimdall.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: dashboard, server, applications, interface
 # logo: svgs/heimdall.svg
+# port: 80
 
 services:
   heimdall:
diff --git a/templates/compose/logto.yaml b/templates/compose/logto.yaml
index ce83a2ec31..7aa840f6d6 100644
--- a/templates/compose/logto.yaml
+++ b/templates/compose/logto.yaml
@@ -3,6 +3,7 @@
 # category: auth
 # tags: logto,identity,login,authentication,oauth,oidc,openid
 # logo: svgs/logto_dark.svg
+# port: 3001
 
 services:
   logto:
diff --git a/templates/compose/obsidian-livesync.yaml b/templates/compose/obsidian-livesync.yaml
new file mode 100644
index 0000000000..1e6fce7472
--- /dev/null
+++ b/templates/compose/obsidian-livesync.yaml
@@ -0,0 +1,60 @@
+# documentation: https://github.com/vrtmrz/obsidian-livesync/blob/main/docs/setup_own_server.md
+# slogan: Self-hosted sync backend for Obsidian LiveSync plugin using CouchDB
+# category: storage
+# tags: obsidian,couchdb,sync,notes,markdown
+# logo: svgs/obsidian-livesync.svg
+# port: 5984
+
+services:
+  couchdb:
+    image: couchdb:3.4.2
+    environment:
+      # Tells Coolify to proxy this service on port 5984 at the assigned domain
+      - SERVICE_FQDN_COUCHDB_5984
+      # Coolify auto-generates and persists these — find them under Environment Variables
+      - COUCHDB_USER=${SERVICE_USER_COUCHDB}
+      - COUCHDB_PASSWORD=${SERVICE_PASSWORD_64_COUCHDB}
+      # Max size of a single document (bytes). Default: 50MB.
+      - MAX_DOCUMENT_SIZE=${MAX_DOCUMENT_SIZE:-52428800}
+      # Max HTTP request size (bytes). Should be slightly above MAX_DOCUMENT_SIZE to allow multipart overhead.
+      # Raise only if you attach very large files to your notes. Default: 64MB.
+      - MAX_HTTP_REQUEST_SIZE=${MAX_HTTP_REQUEST_SIZE:-67108864}
+    volumes:
+      - type: bind
+        source: ./local.ini
+        target: /opt/couchdb/etc/local.ini
+        content: |
+          [couchdb]
+          single_node=true
+          max_document_size = ${MAX_DOCUMENT_SIZE}
+
+          [chttpd]
+          require_valid_user = true
+          max_http_request_size = ${MAX_HTTP_REQUEST_SIZE}
+
+          [chttpd_auth]
+          require_valid_user = true
+          authentication_redirect = /_utils/session.html
+
+          [httpd]
+          WWW-Authenticate = Basic realm="couchdb"
+          enable_cors = true
+
+          [cors]
+          origins = app://obsidian.md,capacitor://localhost,http://localhost
+          credentials = true
+          headers = accept, authorization, content-type, origin, referer
+          methods = GET, PUT, POST, HEAD, DELETE
+          max_age = 3600
+      - couchdb-data:/opt/couchdb/data
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - curl -f -u "$${COUCHDB_USER}:$${COUCHDB_PASSWORD}" http://localhost:5984/_up
+      interval: 30s
+      timeout: 10s
+      start_period: 40s
+      retries: 3
+
+volumes:
+  couchdb-data:
\ No newline at end of file
diff --git a/templates/compose/phpmyadmin.yaml b/templates/compose/phpmyadmin.yaml
index 5732cdae02..6c95948e07 100644
--- a/templates/compose/phpmyadmin.yaml
+++ b/templates/compose/phpmyadmin.yaml
@@ -3,6 +3,7 @@
 # category: database
 # tags: database management
 # logo: svgs/phpmyadmin.svg
+# port: 80
 
 services:
   phpmyadmin:
diff --git a/templates/compose/snapdrop.yaml b/templates/compose/snapdrop.yaml
index 74d53b007d..6fba2adbb6 100644
--- a/templates/compose/snapdrop.yaml
+++ b/templates/compose/snapdrop.yaml
@@ -2,6 +2,7 @@
 # slogan: A self-hosted file-sharing service for secure and convenient file transfers, whether on a local network or the internet.
 # category: productivity
 # tags: file, sharing, transfer, local, network, internet
+# port: 80
 
 services:
   snapdrop:
diff --git a/templates/compose/vault.yaml b/templates/compose/vault.yaml
new file mode 100644
index 0000000000..c0af9cd517
--- /dev/null
+++ b/templates/compose/vault.yaml
@@ -0,0 +1,25 @@
+# documentation: https://developer.hashicorp.com/vault/docs/deploy/run-container
+# slogan: HashiCorp Vault securely stores and controls access to secrets.
+# category: security
+# tags: vault,hashicorp,secrets,security,encryption
+# port: 8200
+
+services:
+  vault:
+    image: 'hashicorp/vault:${VAULT_VERSION:-latest}'
+    command: server
+    environment:
+      - SERVICE_URL_VAULT_8200
+      - VAULT_ADDR=http://127.0.0.1:8200
+      - VAULT_API_ADDR=${SERVICE_URL_VAULT_8200}
+      - 'VAULT_LOCAL_CONFIG={"ui":true,"disable_mlock":true,"storage":{"file":{"path":"/vault/file"}},"listener":{"tcp":{"address":"0.0.0.0:8200","tls_disable":true}}}'
+    volumes:
+      - vault-data:/vault/file
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - 'wget -qO- "http://127.0.0.1:8200/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200" >/dev/null || exit 1'
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 15s
diff --git a/templates/compose/wordpress-with-mariadb.yaml b/templates/compose/wordpress-with-mariadb.yaml
index 952aa0498d..7822a05539 100644
--- a/templates/compose/wordpress-with-mariadb.yaml
+++ b/templates/compose/wordpress-with-mariadb.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, mariadb
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/compose/wordpress-with-mysql.yaml b/templates/compose/wordpress-with-mysql.yaml
index 34ad36d65b..269208e514 100644
--- a/templates/compose/wordpress-with-mysql.yaml
+++ b/templates/compose/wordpress-with-mysql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, mysql
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/compose/wordpress-without-database.yaml b/templates/compose/wordpress-without-database.yaml
index f451080364..cb9a459b58 100644
--- a/templates/compose/wordpress-without-database.yaml
+++ b/templates/compose/wordpress-without-database.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index ca9aa5e9ac..c6fc73c60d 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -138,7 +138,8 @@
         "category": "productivity",
         "logo": "svgs/appsmith.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
@@ -152,7 +153,8 @@
         "category": "backend",
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T19:52:21+05:30"
+        "template_last_updated_at": "2025-10-23T19:52:21+05:30",
+        "port": "3003"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -219,7 +221,7 @@
     },
     "autobase": {
         "documentation": "https://autobase.tech/docs/?utm_source=coolify.io",
-        "slogan": "Autobase for PostgreSQL\u00ae is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
+        "slogan": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
         "compose": "c2VydmljZXM6CiAgYXV0b2Jhc2U6CiAgICBpbWFnZTogJ2F1dG9iYXNlL2NvbnNvbGVfdWk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BVVRPQkFTRV84MAogICAgICAtICdQR19DT05TT0xFX0FVVEhPUklaQVRJT05fVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX1VJfScKICAgICAgLSBQR19DT05TT0xFX0FQSV9IT1NUPWF1dG9iYXNlLWFwaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBhdXRvYmFzZS1hcGk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhdXRvYmFzZS1kYjoKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9kYjoyLjUuMicKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdhdXRvYmFzZS1kYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgcG9zdGdyZXMnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogIGF1dG9iYXNlLWFwaToKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9hcGk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFBHX0NPTlNPTEVfREJfSE9TVD1hdXRvYmFzZS1kYgogICAgICAtICdQR19DT05TT0xFX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BHX0NPTlNPTEVfQVVUSE9SSVpBVElPTl9UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdQR19DT05TT0xFX0VOQ1JZUFRJT05LRVk9JHtTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnUEdfQ09OU09MRV9MT0dHRVJfTEVWRUw9JHtQR19DT05TT0xFX0xPR0dFUl9MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3RtcC9hbnNpYmxlOi90bXAvYW5zaWJsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWZzUycKICAgICAgICAtICctSCcKICAgICAgICAtICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24nCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2FwaS92MS92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgIGRlcGVuZHNfb246CiAgICAgIGF1dG9iYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "database",
@@ -248,7 +250,8 @@
         "category": "productivity",
         "logo": "svgs/babybuddy.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "8000"
     },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
@@ -377,7 +380,8 @@
         "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00"
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "port": "80"
     },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
@@ -679,7 +683,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-with-mysql": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -694,7 +699,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-without-database": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -709,7 +715,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
@@ -1070,7 +1077,8 @@
         "category": "cms",
         "logo": "svgs/dokuwiki.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "dolibarr": {
         "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
@@ -1149,7 +1157,8 @@
         "category": "cms",
         "logo": "svgs/drupal.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
@@ -1400,6 +1409,24 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
+    "executor": {
+        "documentation": "https://executor.sh/docs/hosted/docker?utm_source=coolify.io",
+        "slogan": "Self-hosted AI agent integrations and code execution server.",
+        "compose": "c2VydmljZXM6CiAgZXhlY3V0b3I6CiAgICBpbWFnZTogJ2doY3IuaW8vcmh5c3N1bGxpdmFuL2V4ZWN1dG9yLXNlbGZob3N0OiR7RVhFQ1VUT1JfVkVSU0lPTjotbGF0ZXN0fScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0VYRUNVVE9SXzQ3ODgKICAgICAgLSAnRVhFQ1VUT1JfV0VCX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfRVhFQ1VUT1JfNDc4OH0nCiAgICAgIC0gJ0VYRUNVVE9SX0hPU1Q9JHtFWEVDVVRPUl9IT1NUOi0wLjAuMC4wfScKICAgICAgLSAnUE9SVD0ke1BPUlQ6LTQ3ODh9JwogICAgICAtIEVYRUNVVE9SX0RBVEFfRElSPS9kYXRhCiAgICAgIC0gJ0VYRUNVVE9SX0RCX1BBVEg9JHtFWEVDVVRPUl9EQl9QQVRIOi0vZGF0YS9kYXRhLmRifScKICAgICAgLSAnRVhFQ1VUT1JfT1JHX05BTUU9JHtFWEVDVVRPUl9PUkdfTkFNRTotRGVmYXVsdH0nCiAgICAgIC0gJ0VYRUNVVE9SX09SR19TTFVHPSR7RVhFQ1VUT1JfT1JHX1NMVUc6LWRlZmF1bHR9JwogICAgICAtICdFWEVDVVRPUl9BTExPV19MT0NBTF9ORVRXT1JLPSR7RVhFQ1VUT1JfQUxMT1dfTE9DQUxfTkVUV09SSzotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnZXhlY3V0b3ItZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBidW4KICAgICAgICAtICctZScKICAgICAgICAtICdmZXRjaChgaHR0cDovLzEyNy4wLjAuMToke3Byb2Nlc3MuZW52LlBPUlR8fDQ3ODh9L2FwaS9oZWFsdGhgKS50aGVuKHI9PnByb2Nlc3MuZXhpdChyLm9rPzA6MSksKCk9PnByb2Nlc3MuZXhpdCgxKSknCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDIwcwp2b2x1bWVzOgogIGV4ZWN1dG9yLWRhdGE6IG51bGwK",
+        "tags": [
+            "executor",
+            "ai",
+            "agents",
+            "mcp",
+            "automation",
+            "development"
+        ],
+        "category": "development",
+        "logo": "svgs/executor.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "4788"
+    },
     "faraday": {
         "documentation": "https://faradaysec.com/?utm_source=coolify.io",
         "slogan": "Faraday is a powerful, open-source, web-based vulnerability management tool.",
@@ -1776,7 +1803,7 @@
     },
     "getoutline": {
         "documentation": "https://docs.getoutline.com/s/hosting/doc/hosting-outline-nipGaCRBDu?utm_source=coolify.io",
-        "slogan": "Your team\u2019s knowledge base",
+        "slogan": "Your team’s knowledge base",
         "compose": "c2VydmljZXM6CiAgb3V0bGluZToKICAgIGltYWdlOiAnZG9ja2VyLmdldG91dGxpbmUuY29tL291dGxpbmV3aWtpL291dGxpbmU6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZS1kYXRhOi92YXIvbGliL291dGxpbmUvZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PVVRMSU5FXzMwMDAKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gJ1NFQ1JFVF9LRVk9JHtTRVJWSUNFX0hFWF82NF9PVVRMSU5FfScKICAgICAgLSAnVVRJTFNfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9PVVRMSU5FfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF82NF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RBVEFCQVNFOi1vdXRsaW5lfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnVVJMPSR7U0VSVklDRV9VUkxfT1VUTElORX0nCiAgICAgIC0gJ1BPUlQ9JHtPVVRMSU5FX1BPUlQ6LTMwMDB9JwogICAgICAtICdGSUxFX1NUT1JBR0U9JHtGSUxFX1NUT1JBR0U6LWxvY2FsfScKICAgICAgLSAnRklMRV9TVE9SQUdFX0xPQ0FMX1JPT1RfRElSPSR7RklMRV9TVE9SQUdFX0xPQ0FMX1JPT1RfRElSOi0vdmFyL2xpYi9vdXRsaW5lL2RhdGF9JwogICAgICAtICdGSUxFX1NUT1JBR0VfVVBMT0FEX01BWF9TSVpFPSR7RklMRV9TVE9SQUdFX1VQTE9BRF9NQVhfU0laRTotMjAwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9JTVBPUlRfTUFYX1NJWkU9JHtGSUxFX1NUT1JBR0VfSU1QT1JUX01BWF9TSVpFOi0xMDB9JwogICAgICAtICdGSUxFX1NUT1JBR0VfV09SS1NQQUNFX0lNUE9SVF9NQVhfU0laRT0ke0ZJTEVfU1RPUkFHRV9XT1JLU1BBQ0VfSU1QT1JUX01BWF9TSVpFfScKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtBV1NfQUNDRVNTX0tFWV9JRH0nCiAgICAgIC0gJ0FXU19TRUNSRVRfQUNDRVNTX0tFWT0ke0FXU19TRUNSRVRfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ0FXU19SRUdJT049JHtBV1NfUkVHSU9OfScKICAgICAgLSAnQVdTX1MzX0FDQ0VMRVJBVEVfVVJMPSR7QVdTX1MzX0FDQ0VMRVJBVEVfVVJMfScKICAgICAgLSAnQVdTX1MzX1VQTE9BRF9CVUNLRVRfVVJMPSR7QVdTX1MzX1VQTE9BRF9CVUNLRVRfVVJMfScKICAgICAgLSAnQVdTX1MzX1VQTE9BRF9CVUNLRVRfTkFNRT0ke0FXU19TM19VUExPQURfQlVDS0VUX05BTUV9JwogICAgICAtICdBV1NfUzNfRk9SQ0VfUEFUSF9TVFlMRT0ke0FXU19TM19GT1JDRV9QQVRIX1NUWUxFOi10cnVlfScKICAgICAgLSAnQVdTX1MzX0FDTD0ke0FXU19TM19BQ0w6LXByaXZhdGV9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfSUQ9JHtHT09HTEVfQ0xJRU5UX0lEfScKICAgICAgLSAnR09PR0xFX0NMSUVOVF9TRUNSRVQ9JHtHT09HTEVfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0FaVVJFX0NMSUVOVF9JRD0ke0FaVVJFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0FaVVJFX0NMSUVOVF9TRUNSRVQ9JHtBWlVSRV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVfUkVTT1VSQ0VfQVBQX0lEPSR7QVpVUkVfUkVTT1VSQ0VfQVBQX0lEfScKICAgICAgLSAnT0lEQ19DTElFTlRfSUQ9JHtPSURDX0NMSUVOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX1NFQ1JFVD0ke09JRENfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ09JRENfQVVUSF9VUkk9JHtPSURDX0FVVEhfVVJJfScKICAgICAgLSAnT0lEQ19UT0tFTl9VUkk9JHtPSURDX1RPS0VOX1VSSX0nCiAgICAgIC0gJ09JRENfVVNFUklORk9fVVJJPSR7T0lEQ19VU0VSSU5GT19VUkl9JwogICAgICAtICdPSURDX0xPR09VVF9VUkk9JHtPSURDX0xPR09VVF9VUkl9JwogICAgICAtICdPSURDX1VTRVJOQU1FX0NMQUlNPSR7T0lEQ19VU0VSTkFNRV9DTEFJTX0nCiAgICAgIC0gJ09JRENfRElTUExBWV9OQU1FPSR7T0lEQ19ESVNQTEFZX05BTUV9JwogICAgICAtICdPSURDX1NDT1BFUz0ke09JRENfU0NPUEVTfScKICAgICAgLSAnR0lUSFVCX0NMSUVOVF9JRD0ke0dJVEhVQl9DTElFTlRfSUR9JwogICAgICAtICdHSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke0dJVEhVQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR0lUSFVCX0FQUF9OQU1FPSR7R0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnR0lUSFVCX0FQUF9JRD0ke0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdHSVRIVUJfQVBQX1BSSVZBVEVfS0VZPSR7R0lUSFVCX0FQUF9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ0RJU0NPUkRfQ0xJRU5UX0lEPSR7RElTQ09SRF9DTElFTlRfSUR9JwogICAgICAtICdESVNDT1JEX0NMSUVOVF9TRUNSRVQ9JHtESVNDT1JEX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdESVNDT1JEX1NFUlZFUl9JRD0ke0RJU0NPUkRfU0VSVkVSX0lEfScKICAgICAgLSAnRElTQ09SRF9TRVJWRVJfUk9MRVM9JHtESVNDT1JEX1NFUlZFUl9ST0xFU30nCiAgICAgIC0gJ1BHU1NMTU9ERT0ke1BHU1NMTU9ERTotZGlzYWJsZX0nCiAgICAgIC0gJ0ZPUkNFX0hUVFBTPSR7Rk9SQ0VfSFRUUFM6LXRydWV9JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlR9JwogICAgICAtICdTTVRQX1VTRVJOQU1FPSR7U01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEfScKICAgICAgLSAnU01UUF9GUk9NX0VNQUlMPSR7U01UUF9GUk9NX0VNQUlMfScKICAgICAgLSAnU01UUF9SRVBMWV9FTUFJTD0ke1NNVFBfUkVQTFlfRU1BSUx9JwogICAgICAtICdTTVRQX1RMU19DSVBIRVJTPSR7U01UUF9UTFNfQ0lQSEVSU30nCiAgICAgIC0gJ1NNVFBfU0VDVVJFPSR7U01UUF9TRUNVUkV9JwogICAgICAtICdTTVRQX05BTUU9JHtTTVRQX05BTUV9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIGRpc2FibGU6IHRydWUKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6YWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JFRElTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLXJlcXVpcmVwYXNzJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTItYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnZGF0YWJhc2UtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREFUQUJBU0U6LW91dGxpbmV9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBnX2lzcmVhZHkKICAgICAgICAtICctVScKICAgICAgICAtICcke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgICAgLSAnLWQnCiAgICAgICAgLSAnJHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMK",
         "tags": [
             "knowledge base",
@@ -2153,7 +2180,8 @@
         "category": "productivity",
         "logo": "svgs/grocy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-12T09:10:44+02:00"
+        "template_last_updated_at": "2026-05-12T09:10:44+02:00",
+        "port": "80"
     },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
@@ -2203,11 +2231,12 @@
         "category": "productivity",
         "logo": "svgs/heimdall.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
-        "slogan": "Hermes Agent \u2014 autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
+        "slogan": "Hermes Agent — autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
         "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50QHNoYTI1NjoyZjFmMmYxNzI1ZTVkYzlhNjFjZjZhMmRlYTVhY2E1MmE3NzZlYzRkMDIyY2IyOTY3OWU2YWEzZmYzMDNlNzdhJwogICAgY29tbWFuZDogJ2dhdGV3YXkgcnVuJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEVSTUVTX0hPTUU9L2hvbWUvaGVybWVzLy5oZXJtZXMKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lcy8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjkyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBoZXJtZXMtYWdlbnQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0hFUk1FU1dFQlVJXzg3ODcKICAgICAgLSBIRVJNRVNfV0VCVUlfSE9TVD0wLjAuMC4wCiAgICAgIC0gSEVSTUVTX1dFQlVJX1BPUlQ9ODc4NwogICAgICAtIEhFUk1FU19XRUJVSV9TVEFURV9ESVI9L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy93ZWJ1aQogICAgICAtIFdBTlRFRF9VSUQ9MTAwMAogICAgICAtIFdBTlRFRF9HSUQ9MTAwMAogICAgICAtICdIRVJNRVNfV0VCVUlfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0hFUk1FU1dFQlVJfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1hZ2VudC1zcmM6L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy9oZXJtZXMtYWdlbnQ6cm8nCiAgICAgIC0gJ2hlcm1lcy13b3Jrc3BhY2U6L3dvcmtzcGFjZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4Nzg3L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "ai",
@@ -2506,7 +2535,7 @@
     },
     "jitsi": {
         "documentation": "https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/?utm_source=coolify.io",
-        "slogan": "Self-hosted Jitsi Meet \u2014 open-source video conferencing platform",
+        "slogan": "Self-hosted Jitsi Meet — open-source video conferencing platform",
         "compose": "c2VydmljZXM6CiAgaml0c2ktd2ViOgogICAgaW1hZ2U6ICdqaXRzaS93ZWI6c3RhYmxlLTEwODg4JwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9VUkxfSklUU0kKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gRU5BQkxFX0dVRVNUUz0xCiAgICAgIC0gRU5BQkxFX0xFVFNFTkNSWVBUPTAKICAgICAgLSBFTkFCTEVfSFRUUF9SRURJUkVDVD0wCiAgICAgIC0gRElTQUJMRV9IVFRQUz0xCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9HVUVTVF9ET01BSU49Z3Vlc3QubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0lOVEVSTkFMX01VQ19ET01BSU49aW50ZXJuYWwuYXV0aC5tZWV0LmppdHNpCiAgICAgIC0gJ1hNUFBfQk9TSF9VUkxfQkFTRT1odHRwOi8vcHJvc29keTo1MjgwJwogICAgICAtIEpWQl9CUkVXRVJZX01VQz1qdmJicmV3ZXJ5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgICAgLSBqaWNvZm8KICAgICAgLSBqdmIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLXdlYjovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6CiAgICAgICAgYWxpYXNlczoKICAgICAgICAgIC0gbWVldC5qaXRzaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgcHJvc29keToKICAgIGltYWdlOiAnaml0c2kvcHJvc29keTpzdGFibGUtMTA4ODgnCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQVVUSF9UWVBFPWludGVybmFsCiAgICAgIC0gRU5BQkxFX0FVVEg9MAogICAgICAtIEVOQUJMRV9HVUVTVFM9MQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfR1VFU1RfRE9NQUlOPWd1ZXN0Lm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtICdKSUNPRk9fQ09NUE9ORU5UX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSklDT0ZPX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pJQ09GT30nCiAgICAgIC0gJ0pWQl9BVVRIX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KVkJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0xPR19MRVZFTD0ke0xPR19MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1wcm9zb2R5Oi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSB4bXBwLm1lZXQuaml0c2kKICAgICAgICAgIC0gYXV0aC5tZWV0LmppdHNpCiAgICAgICAgICAtIGd1ZXN0Lm1lZXQuaml0c2kKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1MjgwL2h0dHAtYmluZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGppY29mbzoKICAgIGltYWdlOiAnaml0c2kvamljb2ZvOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX1NFUlZFUj1wcm9zb2R5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSBKVkJfQlJFV0VSWV9NVUM9anZiYnJld2VyeQogICAgICAtIEpJQ09GT19FTkFCTEVfSEVBTFRIX0NIRUNLUz0xCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWppY29mbzovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4ODg4L2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGp2YjoKICAgIGltYWdlOiAnaml0c2kvanZiOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMTAwMDA6MTAwMDAvdWRwJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gWE1QUF9TRVJWRVI9cHJvc29keQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gSlZCX0FVVEhfVVNFUj1qdmIKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSBKVkJfUE9SVD0xMDAwMAogICAgICAtICdKVkJfQURWRVJUSVNFX0lQUz0ke0pWQl9BRFZFUlRJU0VfSVBTOi19JwogICAgICAtICdKVkJfU1RVTl9TRVJWRVJTPSR7SlZCX1NUVU5fU0VSVkVSUzotc3R1bi5sLmdvb2dsZS5jb206MTkzMDJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWp2YjovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQpuZXR3b3JrczoKICBtZWV0LmppdHNpOiBudWxsCg==",
         "tags": [
             "jitsi",
@@ -2957,7 +2986,8 @@
         "category": "auth",
         "logo": "svgs/logto_dark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-01T13:19:47Z"
+        "template_last_updated_at": "2026-04-01T13:19:47Z",
+        "port": "3001"
     },
     "lowcoder": {
         "documentation": "https://docs.lowcoder.cloud/?utm_source=coolify.io",
@@ -3265,7 +3295,7 @@
     },
     "moodle": {
         "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
+        "slogan": "Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.",
         "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX01PT0RMRV84MDgwCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX0hPU1Q9bWFyaWFkYgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9QT1JUX05VTUJFUj0zMzA2CiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX05BTUU9Yml0bmFtaV9tb29kbGUKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIEFMTE9XX0VNUFRZX1BBU1NXT1JEPW5vCiAgICAgIC0gJ01PT0RMRV9VU0VSTkFNRT0ke01PT0RMRV9VU0VSTkFNRTotdXNlcn0nCiAgICAgIC0gTU9PRExFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01PT0RMRQogICAgICAtIE1PT0RMRV9FTUFJTD11c2VyQGV4YW1wbGUuY29tCiAgICAgIC0gJ01PT0RMRV9TSVRFX05BTUU9JHtNT09ETEVfU0lURV9OQU1FOi1OZXcgU2l0ZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdtb29kbGUtZGF0YTovYml0bmFtaS9tb29kbGUnCiAgICAgIC0gJ21vb2RsZWRhdGEtZGF0YTovYml0bmFtaS9tb29kbGVkYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBocAogICAgICAgIC0gJy1yJwogICAgICAgIC0gImV4aXQoZmlsZV9leGlzdHMoJy9vcHQvYml0bmFtaS9tb29kbGUvY29uZmlnLnBocCcpID8gMCA6IDEpOyIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "moodle",
@@ -3392,7 +3422,7 @@
     },
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
-        "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
+        "slogan": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.",
         "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
@@ -3829,7 +3859,7 @@
     },
     "openobserve": {
         "documentation": "https://openobserve.ai/docs/?utm_source=coolify.io",
-        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays \u2014 a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
+        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays — a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
         "compose": "c2VydmljZXM6CiAgb3Blbm9ic2VydmU6CiAgICBpbWFnZTogJ3B1YmxpYy5lY3IuYXdzL3ppbmNsYWJzL29wZW5vYnNlcnZlOnYwLjkwLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PUEVOT0JTRVJWRV81MDgwCiAgICAgIC0gWk9fREFUQV9ESVI9L2RhdGEKICAgICAgLSAnWk9fUk9PVF9VU0VSX0VNQUlMPSR7Wk9fUk9PVF9VU0VSX0VNQUlMOi1yb290QGV4YW1wbGUuY29tfScKICAgICAgLSAnWk9fUk9PVF9VU0VSX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9PUEVOT0JTRVJWRX0nCiAgICAgIC0gJ1pPX1RFTEVNRVRSWT0ke1pPX1RFTEVNRVRSWTotZmFsc2V9JwogICAgICAtICdaT19DT09LSUVfU0VDVVJFX09OTFk9JHtaT19DT09LSUVfU0VDVVJFX09OTFk6LXRydWV9JwogICAgdm9sdW1lczoKICAgICAgLSAnb3Blbm9ic2VydmUtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSAvb3Blbm9ic2VydmUKICAgICAgICAtIG5vZGUKICAgICAgICAtIHN0YXR1cwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMK",
         "tags": [
             "logs",
@@ -4112,7 +4142,8 @@
         "category": "database",
         "logo": "svgs/phpmyadmin.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
@@ -4311,7 +4342,7 @@
     },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
-        "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
+        "slogan": "Prowlarr⁠ is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
         "compose": "c2VydmljZXM6CiAgcHJvd2xhcnI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvcHJvd2xhcnI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUFJPV0xBUlJfOTY5NgogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9QUk9XTEFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAncHJvd2xhcnItY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6OTY5Ni9waW5nJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
         "tags": [
             "media",
@@ -4346,7 +4377,7 @@
     },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
-        "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
+        "slogan": "The qBittorrent project aims to provide an open-source software alternative to μTorrent.",
         "compose": "c2VydmljZXM6CiAgcWJpdDoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9xYml0dG9ycmVudDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnV0VCVUlfUE9SVD0ke1dFQlVJX1BPUlQ6LTgwODB9JwogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgdm9sdW1lczoKICAgICAgLSAncWJpdHRvcnJlbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3FiaXR0b3JyZW50LWRvd25sb2FkczovZG93bmxvYWRzJwogICAgICAtICdxYml0dG9ycmVudC10b3JyZW50czovdG9ycmVudHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2dWV0b3JyZW50LWJhY2tlbmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vdnVldG9ycmVudC92dWV0b3JyZW50LWJhY2tlbmQ6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUUJJVE9SUkVOVF84MDgwCiAgICAgIC0gJ1BPUlQ9JHtXRUJVSV9QT1JUOi04MDgwfScKICAgICAgLSAnUUJJVF9CQVNFPSR7U0VSVklDRV9VUkxfUUJJVE9SUkVOVH0nCiAgICAgIC0gJ1JFTEVBU0VfVFlQRT0ke1JFTEVBU0VfVFlQRTotc3RhYmxlfScKICAgICAgLSAnVVBEQVRFX1ZUX0NST049JHtVUERBVEVfVlRfQ1JPTjotIjAgKiAqICogKiJ9JwogICAgdm9sdW1lczoKICAgICAgLSAndnVldG9ycmVudC1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLXEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwLycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "torrent",
@@ -4400,7 +4431,7 @@
     },
     "radarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io",
-        "slogan": "Radarr\u2060 - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
+        "slogan": "Radarr⁠ - A fork of Sonarr to work with movies à la Couchpotato.",
         "compose": "c2VydmljZXM6CiAgcmFkYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3JhZGFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9SQURBUlJfNzg3OAogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9SQURBUlIKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotQW1lcmljYS9Ub3JvbnRvfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JhZGFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo3ODc4L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -4803,7 +4834,8 @@
         "category": "productivity",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
@@ -4856,7 +4888,7 @@
     },
     "sonarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/sonarr?utm_source=coolify.io",
-        "slogan": "Sonarr\u2060 (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
+        "slogan": "Sonarr⁠ (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
         "compose": "c2VydmljZXM6CiAgc29uYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3NvbmFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TT05BUlJfODk4OQogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9TT05BUlIKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotQW1lcmljYS9Ub3JvbnRvfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NvbmFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4OTg5L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -5457,6 +5489,23 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "3000"
     },
+    "vault": {
+        "documentation": "https://developer.hashicorp.com/vault/docs/deploy/run-container?utm_source=coolify.io",
+        "slogan": "HashiCorp Vault securely stores and controls access to secrets.",
+        "compose": "c2VydmljZXM6CiAgdmF1bHQ6CiAgICBpbWFnZTogJ2hhc2hpY29ycC92YXVsdDoke1ZBVUxUX1ZFUlNJT046LWxhdGVzdH0nCiAgICBjb21tYW5kOiBzZXJ2ZXIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX1ZBVUxUXzgyMDAKICAgICAgLSAnVkFVTFRfQUREUj1odHRwOi8vMTI3LjAuMC4xOjgyMDAnCiAgICAgIC0gJ1ZBVUxUX0FQSV9BRERSPSR7U0VSVklDRV9VUkxfVkFVTFRfODIwMH0nCiAgICAgIC0gJ1ZBVUxUX0xPQ0FMX0NPTkZJRz17InVpIjp0cnVlLCJkaXNhYmxlX21sb2NrIjp0cnVlLCJzdG9yYWdlIjp7ImZpbGUiOnsicGF0aCI6Ii92YXVsdC9maWxlIn19LCJsaXN0ZW5lciI6eyJ0Y3AiOnsiYWRkcmVzcyI6IjAuMC4wLjA6ODIwMCIsInRsc19kaXNhYmxlIjp0cnVlfX19JwogICAgdm9sdW1lczoKICAgICAgLSAndmF1bHQtZGF0YTovdmF1bHQvZmlsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAnd2dldCAtcU8tICJodHRwOi8vMTI3LjAuMC4xOjgyMDAvdjEvc3lzL2hlYWx0aD9zdGFuZGJ5b2s9dHJ1ZSZzZWFsZWRjb2RlPTIwMCZ1bmluaXRjb2RlPTIwMCIgPi9kZXYvbnVsbCB8fCBleGl0IDEnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTIKICAgICAgc3RhcnRfcGVyaW9kOiAxNXMK",
+        "tags": [
+            "vault",
+            "hashicorp",
+            "secrets",
+            "security",
+            "encryption"
+        ],
+        "category": "security",
+        "logo": "svgs/default.webp",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "8200"
+    },
     "vaultwarden": {
         "documentation": "https://github.com/dani-garcia/vaultwarden?utm_source=coolify.io",
         "slogan": "Vaultwarden is a password manager that allows you to securely store and manage your passwords.",
@@ -5751,7 +5800,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-with-mysql": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5767,7 +5817,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-without-database": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5782,7 +5833,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
@@ -5865,7 +5917,7 @@
     },
     "marimo": {
         "documentation": "https://marimo.io/?utm_source=coolify.io",
-        "slogan": "An open-source reactive notebook for Python \u2014 reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
+        "slogan": "An open-source reactive notebook for Python — reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
         "compose": "c2VydmljZXM6CiAgbWFyaW1vOgogICAgaW1hZ2U6ICdnaGNyLmlvL21hcmltby10ZWFtL21hcmltbzpsYXRlc3Qtc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTUFSSU1PXzgwODAKICAgICAgLSBUT0tFTl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NQVJJTU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21hcmltbzovYXBwJwogICAgY29tbWFuZDoKICAgICAgLSBtYXJpbW8KICAgICAgLSBlZGl0CiAgICAgIC0gJy0tdG9rZW4tcGFzc3dvcmQnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF9NQVJJTU99JwogICAgICAtICctLXBvcnQnCiAgICAgIC0gJzgwODAnCiAgICAgIC0gJy0taG9zdCcKICAgICAgLSAwLjAuMC4wCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gdXZ4CiAgICAgICAgLSAnLS13aXRoJwogICAgICAgIC0gJ2h0dHB4W2NsaV0nCiAgICAgICAgLSBodHRweAogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "notebook",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index 550ccfabfd..c13c02896d 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -138,7 +138,8 @@
         "category": "productivity",
         "logo": "svgs/appsmith.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
@@ -152,7 +153,8 @@
         "category": "backend",
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T19:52:21+05:30"
+        "template_last_updated_at": "2025-10-23T19:52:21+05:30",
+        "port": "3003"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -219,7 +221,7 @@
     },
     "autobase": {
         "documentation": "https://autobase.tech/docs/?utm_source=coolify.io",
-        "slogan": "Autobase for PostgreSQL\u00ae is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
+        "slogan": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
         "compose": "c2VydmljZXM6CiAgYXV0b2Jhc2U6CiAgICBpbWFnZTogJ2F1dG9iYXNlL2NvbnNvbGVfdWk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BVVRPQkFTRV84MAogICAgICAtICdQR19DT05TT0xFX0FVVEhPUklaQVRJT05fVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX1VJfScKICAgICAgLSBQR19DT05TT0xFX0FQSV9IT1NUPWF1dG9iYXNlLWFwaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBhdXRvYmFzZS1hcGk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhdXRvYmFzZS1kYjoKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9kYjoyLjUuMicKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdhdXRvYmFzZS1kYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgcG9zdGdyZXMnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogIGF1dG9iYXNlLWFwaToKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9hcGk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFBHX0NPTlNPTEVfREJfSE9TVD1hdXRvYmFzZS1kYgogICAgICAtICdQR19DT05TT0xFX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BHX0NPTlNPTEVfQVVUSE9SSVpBVElPTl9UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdQR19DT05TT0xFX0VOQ1JZUFRJT05LRVk9JHtTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnUEdfQ09OU09MRV9MT0dHRVJfTEVWRUw9JHtQR19DT05TT0xFX0xPR0dFUl9MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3RtcC9hbnNpYmxlOi90bXAvYW5zaWJsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWZzUycKICAgICAgICAtICctSCcKICAgICAgICAtICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24nCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2FwaS92MS92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgIGRlcGVuZHNfb246CiAgICAgIGF1dG9iYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "database",
@@ -248,7 +250,8 @@
         "category": "productivity",
         "logo": "svgs/babybuddy.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "8000"
     },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
@@ -377,7 +380,8 @@
         "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00"
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "port": "80"
     },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
@@ -679,7 +683,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-with-mysql": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -694,7 +699,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-without-database": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -709,7 +715,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
@@ -1070,7 +1077,8 @@
         "category": "cms",
         "logo": "svgs/dokuwiki.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "dolibarr": {
         "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
@@ -1149,7 +1157,8 @@
         "category": "cms",
         "logo": "svgs/drupal.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
@@ -1400,6 +1409,24 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
+    "executor": {
+        "documentation": "https://executor.sh/docs/hosted/docker?utm_source=coolify.io",
+        "slogan": "Self-hosted AI agent integrations and code execution server.",
+        "compose": "c2VydmljZXM6CiAgZXhlY3V0b3I6CiAgICBpbWFnZTogJ2doY3IuaW8vcmh5c3N1bGxpdmFuL2V4ZWN1dG9yLXNlbGZob3N0OiR7RVhFQ1VUT1JfVkVSU0lPTjotbGF0ZXN0fScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9FWEVDVVRPUl80Nzg4CiAgICAgIC0gJ0VYRUNVVE9SX1dFQl9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9FWEVDVVRPUl80Nzg4fScKICAgICAgLSAnRVhFQ1VUT1JfSE9TVD0ke0VYRUNVVE9SX0hPU1Q6LTAuMC4wLjB9JwogICAgICAtICdQT1JUPSR7UE9SVDotNDc4OH0nCiAgICAgIC0gRVhFQ1VUT1JfREFUQV9ESVI9L2RhdGEKICAgICAgLSAnRVhFQ1VUT1JfREJfUEFUSD0ke0VYRUNVVE9SX0RCX1BBVEg6LS9kYXRhL2RhdGEuZGJ9JwogICAgICAtICdFWEVDVVRPUl9PUkdfTkFNRT0ke0VYRUNVVE9SX09SR19OQU1FOi1EZWZhdWx0fScKICAgICAgLSAnRVhFQ1VUT1JfT1JHX1NMVUc9JHtFWEVDVVRPUl9PUkdfU0xVRzotZGVmYXVsdH0nCiAgICAgIC0gJ0VYRUNVVE9SX0FMTE9XX0xPQ0FMX05FVFdPUks9JHtFWEVDVVRPUl9BTExPV19MT0NBTF9ORVRXT1JLOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdleGVjdXRvci1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGJ1bgogICAgICAgIC0gJy1lJwogICAgICAgIC0gJ2ZldGNoKGBodHRwOi8vMTI3LjAuMC4xOiR7cHJvY2Vzcy5lbnYuUE9SVHx8NDc4OH0vYXBpL2hlYWx0aGApLnRoZW4ocj0+cHJvY2Vzcy5leGl0KHIub2s/MDoxKSwoKT0+cHJvY2Vzcy5leGl0KDEpKScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMjBzCnZvbHVtZXM6CiAgZXhlY3V0b3ItZGF0YTogbnVsbAo=",
+        "tags": [
+            "executor",
+            "ai",
+            "agents",
+            "mcp",
+            "automation",
+            "development"
+        ],
+        "category": "development",
+        "logo": "svgs/executor.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "4788"
+    },
     "faraday": {
         "documentation": "https://faradaysec.com/?utm_source=coolify.io",
         "slogan": "Faraday is a powerful, open-source, web-based vulnerability management tool.",
@@ -1776,7 +1803,7 @@
     },
     "getoutline": {
         "documentation": "https://docs.getoutline.com/s/hosting/doc/hosting-outline-nipGaCRBDu?utm_source=coolify.io",
-        "slogan": "Your team\u2019s knowledge base",
+        "slogan": "Your team’s knowledge base",
         "compose": "c2VydmljZXM6CiAgb3V0bGluZToKICAgIGltYWdlOiAnZG9ja2VyLmdldG91dGxpbmUuY29tL291dGxpbmV3aWtpL291dGxpbmU6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZS1kYXRhOi92YXIvbGliL291dGxpbmUvZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1VUTElORV8zMDAwCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtICdTRUNSRVRfS0VZPSR7U0VSVklDRV9IRVhfNjRfT1VUTElORX0nCiAgICAgIC0gJ1VUSUxTX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfT1VUTElORX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovLzoke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9QHJlZGlzOjYzNzknCiAgICAgIC0gJ1VSTD0ke1NFUlZJQ0VfRlFETl9PVVRMSU5FfScKICAgICAgLSAnUE9SVD0ke09VVExJTkVfUE9SVDotMzAwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRT0ke0ZJTEVfU1RPUkFHRTotbG9jYWx9JwogICAgICAtICdGSUxFX1NUT1JBR0VfTE9DQUxfUk9PVF9ESVI9JHtGSUxFX1NUT1JBR0VfTE9DQUxfUk9PVF9ESVI6LS92YXIvbGliL291dGxpbmUvZGF0YX0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9VUExPQURfTUFYX1NJWkU9JHtGSUxFX1NUT1JBR0VfVVBMT0FEX01BWF9TSVpFOi0yMDAwfScKICAgICAgLSAnRklMRV9TVE9SQUdFX0lNUE9SVF9NQVhfU0laRT0ke0ZJTEVfU1RPUkFHRV9JTVBPUlRfTUFYX1NJWkU6LTEwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9XT1JLU1BBQ0VfSU1QT1JUX01BWF9TSVpFPSR7RklMRV9TVE9SQUdFX1dPUktTUEFDRV9JTVBPUlRfTUFYX1NJWkV9JwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke0FXU19BQ0NFU1NfS0VZX0lEfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgLSAnQVdTX1JFR0lPTj0ke0FXU19SRUdJT059JwogICAgICAtICdBV1NfUzNfQUNDRUxFUkFURV9VUkw9JHtBV1NfUzNfQUNDRUxFUkFURV9VUkx9JwogICAgICAtICdBV1NfUzNfVVBMT0FEX0JVQ0tFVF9VUkw9JHtBV1NfUzNfVVBMT0FEX0JVQ0tFVF9VUkx9JwogICAgICAtICdBV1NfUzNfVVBMT0FEX0JVQ0tFVF9OQU1FPSR7QVdTX1MzX1VQTE9BRF9CVUNLRVRfTkFNRX0nCiAgICAgIC0gJ0FXU19TM19GT1JDRV9QQVRIX1NUWUxFPSR7QVdTX1MzX0ZPUkNFX1BBVEhfU1RZTEU6LXRydWV9JwogICAgICAtICdBV1NfUzNfQUNMPSR7QVdTX1MzX0FDTDotcHJpdmF0ZX0nCiAgICAgIC0gJ1NMQUNLX0NMSUVOVF9JRD0ke1NMQUNLX0NMSUVOVF9JRH0nCiAgICAgIC0gJ1NMQUNLX0NMSUVOVF9TRUNSRVQ9JHtTTEFDS19DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX0NMSUVOVF9JRD0ke0dPT0dMRV9DTElFTlRfSUR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVfQ0xJRU5UX0lEPSR7QVpVUkVfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVfQ0xJRU5UX1NFQ1JFVD0ke0FaVVJFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRV9SRVNPVVJDRV9BUFBfSUQ9JHtBWlVSRV9SRVNPVVJDRV9BUFBfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9JRD0ke09JRENfQ0xJRU5UX0lEfScKICAgICAgLSAnT0lEQ19DTElFTlRfU0VDUkVUPSR7T0lEQ19DTElFTlRfU0VDUkVUfScKICAgICAgLSAnT0lEQ19BVVRIX1VSST0ke09JRENfQVVUSF9VUkl9JwogICAgICAtICdPSURDX1RPS0VOX1VSST0ke09JRENfVE9LRU5fVVJJfScKICAgICAgLSAnT0lEQ19VU0VSSU5GT19VUkk9JHtPSURDX1VTRVJJTkZPX1VSSX0nCiAgICAgIC0gJ09JRENfTE9HT1VUX1VSST0ke09JRENfTE9HT1VUX1VSSX0nCiAgICAgIC0gJ09JRENfVVNFUk5BTUVfQ0xBSU09JHtPSURDX1VTRVJOQU1FX0NMQUlNfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0NPUEVTPSR7T0lEQ19TQ09QRVN9JwogICAgICAtICdHSVRIVUJfQ0xJRU5UX0lEPSR7R0lUSFVCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7R0lUSFVCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdHSVRIVUJfQVBQX05BTUU9JHtHSVRIVUJfQVBQX05BTUV9JwogICAgICAtICdHSVRIVUJfQVBQX0lEPSR7R0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9BUFBfUFJJVkFURV9LRVk9JHtHSVRIVUJfQVBQX1BSSVZBVEVfS0VZfScKICAgICAgLSAnRElTQ09SRF9DTElFTlRfSUQ9JHtESVNDT1JEX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0RJU0NPUkRfQ0xJRU5UX1NFQ1JFVD0ke0RJU0NPUkRfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0RJU0NPUkRfU0VSVkVSX0lEPSR7RElTQ09SRF9TRVJWRVJfSUR9JwogICAgICAtICdESVNDT1JEX1NFUlZFUl9ST0xFUz0ke0RJU0NPUkRfU0VSVkVSX1JPTEVTfScKICAgICAgLSAnUEdTU0xNT0RFPSR7UEdTU0xNT0RFOi1kaXNhYmxlfScKICAgICAgLSAnRk9SQ0VfSFRUUFM9JHtGT1JDRV9IVFRQUzotdHJ1ZX0nCiAgICAgIC0gJ1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ1NNVFBfUE9SVD0ke1NNVFBfUE9SVH0nCiAgICAgIC0gJ1NNVFBfVVNFUk5BTUU9JHtTTVRQX1VTRVJOQU1FfScKICAgICAgLSAnU01UUF9QQVNTV09SRD0ke1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdTTVRQX0ZST01fRU1BSUw9JHtTTVRQX0ZST01fRU1BSUx9JwogICAgICAtICdTTVRQX1JFUExZX0VNQUlMPSR7U01UUF9SRVBMWV9FTUFJTH0nCiAgICAgIC0gJ1NNVFBfVExTX0NJUEhFUlM9JHtTTVRQX1RMU19DSVBIRVJTfScKICAgICAgLSAnU01UUF9TRUNVUkU9JHtTTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ1NNVFBfTkFNRT0ke1NNVFBfTkFNRX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgZGlzYWJsZTogdHJ1ZQogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczphbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcmVkaXMtc2VydmVyCiAgICAgIC0gJy0tcmVxdWlyZXBhc3MnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxMi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhYmFzZS1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdfaXNyZWFkeQogICAgICAgIC0gJy1VJwogICAgICAgIC0gJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgICAtICctZCcKICAgICAgICAtICcke1BPU1RHUkVTX0RBVEFCQVNFOi1vdXRsaW5lfScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "knowledge base",
@@ -2153,7 +2180,8 @@
         "category": "productivity",
         "logo": "svgs/grocy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-12T09:10:44+02:00"
+        "template_last_updated_at": "2026-05-12T09:10:44+02:00",
+        "port": "80"
     },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
@@ -2203,11 +2231,12 @@
         "category": "productivity",
         "logo": "svgs/heimdall.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
-        "slogan": "Hermes Agent \u2014 autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
+        "slogan": "Hermes Agent — autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
         "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50QHNoYTI1NjoyZjFmMmYxNzI1ZTVkYzlhNjFjZjZhMmRlYTVhY2E1MmE3NzZlYzRkMDIyY2IyOTY3OWU2YWEzZmYzMDNlNzdhJwogICAgY29tbWFuZDogJ2dhdGV3YXkgcnVuJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEVSTUVTX0hPTUU9L2hvbWUvaGVybWVzLy5oZXJtZXMKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lcy8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjkyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBoZXJtZXMtYWdlbnQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9IRVJNRVNXRUJVSV84Nzg3CiAgICAgIC0gSEVSTUVTX1dFQlVJX0hPU1Q9MC4wLjAuMAogICAgICAtIEhFUk1FU19XRUJVSV9QT1JUPTg3ODcKICAgICAgLSBIRVJNRVNfV0VCVUlfU1RBVEVfRElSPS9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvd2VidWkKICAgICAgLSBXQU5URURfVUlEPTEwMDAKICAgICAgLSBXQU5URURfR0lEPTEwMDAKICAgICAgLSAnSEVSTUVTX1dFQlVJX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9IRVJNRVNXRUJVSX0nCiAgICB2b2x1bWVzOgogICAgICAtICdoZXJtZXMtaG9tZTovaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvaGVybWVzLWFnZW50OnJvJwogICAgICAtICdoZXJtZXMtd29ya3NwYWNlOi93b3Jrc3BhY2UnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODc4Ny9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "ai",
@@ -2506,7 +2535,7 @@
     },
     "jitsi": {
         "documentation": "https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/?utm_source=coolify.io",
-        "slogan": "Self-hosted Jitsi Meet \u2014 open-source video conferencing platform",
+        "slogan": "Self-hosted Jitsi Meet — open-source video conferencing platform",
         "compose": "c2VydmljZXM6CiAgaml0c2ktd2ViOgogICAgaW1hZ2U6ICdqaXRzaS93ZWI6c3RhYmxlLTEwODg4JwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtIEVOQUJMRV9BVVRIPTAKICAgICAgLSBFTkFCTEVfR1VFU1RTPTEKICAgICAgLSBFTkFCTEVfTEVUU0VOQ1JZUFQ9MAogICAgICAtIEVOQUJMRV9IVFRQX1JFRElSRUNUPTAKICAgICAgLSBESVNBQkxFX0hUVFBTPTEKICAgICAgLSBYTVBQX0RPTUFJTj1tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9BVVRIX0RPTUFJTj1hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0dVRVNUX0RPTUFJTj1ndWVzdC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9NVUNfRE9NQUlOPWNvbmZlcmVuY2UubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSAnWE1QUF9CT1NIX1VSTF9CQVNFPWh0dHA6Ly9wcm9zb2R5OjUyODAnCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSAnSklDT0ZPX0NPTVBPTkVOVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pJQ09GT30nCiAgICAgIC0gJ0pJQ09GT19BVVRIX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKVkJfQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSlZCfScKICAgICAgLSAnVFo9JHtUWjotVVRDfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gcHJvc29keQogICAgICAtIGppY29mbwogICAgICAtIGp2YgogICAgdm9sdW1lczoKICAgICAgLSAnaml0c2ktd2ViOi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSBtZWV0LmppdHNpCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwcm9zb2R5OgogICAgaW1hZ2U6ICdqaXRzaS9wcm9zb2R5OnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gRU5BQkxFX0dVRVNUUz0xCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9HVUVTVF9ET01BSU49Z3Vlc3QubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0lOVEVSTkFMX01VQ19ET01BSU49aW50ZXJuYWwuYXV0aC5tZWV0LmppdHNpCiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9GUUROX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0xPR19MRVZFTD0ke0xPR19MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1wcm9zb2R5Oi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSB4bXBwLm1lZXQuaml0c2kKICAgICAgICAgIC0gYXV0aC5tZWV0LmppdHNpCiAgICAgICAgICAtIGd1ZXN0Lm1lZXQuaml0c2kKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1MjgwL2h0dHAtYmluZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGppY29mbzoKICAgIGltYWdlOiAnaml0c2kvamljb2ZvOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX1NFUlZFUj1wcm9zb2R5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSBKVkJfQlJFV0VSWV9NVUM9anZiYnJld2VyeQogICAgICAtIEpJQ09GT19FTkFCTEVfSEVBTFRIX0NIRUNLUz0xCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWppY29mbzovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4ODg4L2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGp2YjoKICAgIGltYWdlOiAnaml0c2kvanZiOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMTAwMDA6MTAwMDAvdWRwJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gWE1QUF9TRVJWRVI9cHJvc29keQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gSlZCX0FVVEhfVVNFUj1qdmIKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSBKVkJfUE9SVD0xMDAwMAogICAgICAtICdKVkJfQURWRVJUSVNFX0lQUz0ke0pWQl9BRFZFUlRJU0VfSVBTOi19JwogICAgICAtICdKVkJfU1RVTl9TRVJWRVJTPSR7SlZCX1NUVU5fU0VSVkVSUzotc3R1bi5sLmdvb2dsZS5jb206MTkzMDJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtICdUWj0ke1RaOi1VVEN9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwcm9zb2R5CiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1qdmI6L2NvbmZpZycKICAgIG5ldHdvcmtzOgogICAgICBtZWV0LmppdHNpOiBudWxsCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9hYm91dC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKbmV0d29ya3M6CiAgbWVldC5qaXRzaTogbnVsbAo=",
         "tags": [
             "jitsi",
@@ -2957,7 +2986,8 @@
         "category": "auth",
         "logo": "svgs/logto_dark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-01T13:19:47Z"
+        "template_last_updated_at": "2026-04-01T13:19:47Z",
+        "port": "3001"
     },
     "lowcoder": {
         "documentation": "https://docs.lowcoder.cloud/?utm_source=coolify.io",
@@ -3265,7 +3295,7 @@
     },
     "moodle": {
         "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
+        "slogan": "Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.",
         "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9NT09ETEVfODA4MAogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9IT1NUPW1hcmlhZGIKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUE9SVF9OVU1CRVI9MzMwNgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9VU0VSPSRTRVJWSUNFX1VTRVJfTUFSSUFEQgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9OQU1FPWJpdG5hbWlfbW9vZGxlCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01BUklBREIKICAgICAgLSBBTExPV19FTVBUWV9QQVNTV09SRD1ubwogICAgICAtICdNT09ETEVfVVNFUk5BTUU9JHtNT09ETEVfVVNFUk5BTUU6LXVzZXJ9JwogICAgICAtIE1PT0RMRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NT09ETEUKICAgICAgLSBNT09ETEVfRU1BSUw9dXNlckBleGFtcGxlLmNvbQogICAgICAtICdNT09ETEVfU0lURV9OQU1FPSR7TU9PRExFX1NJVEVfTkFNRTotTmV3IFNpdGV9JwogICAgdm9sdW1lczoKICAgICAgLSAnbW9vZGxlLWRhdGE6L2JpdG5hbWkvbW9vZGxlJwogICAgICAtICdtb29kbGVkYXRhLWRhdGE6L2JpdG5hbWkvbW9vZGxlZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwaHAKICAgICAgICAtICctcicKICAgICAgICAtICJleGl0KGZpbGVfZXhpc3RzKCcvb3B0L2JpdG5hbWkvbW9vZGxlL2NvbmZpZy5waHAnKSA/IDAgOiAxKTsiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUK",
         "tags": [
             "moodle",
@@ -3392,7 +3422,7 @@
     },
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
-        "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
+        "slogan": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.",
         "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
@@ -3829,7 +3859,7 @@
     },
     "openobserve": {
         "documentation": "https://openobserve.ai/docs/?utm_source=coolify.io",
-        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays \u2014 a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
+        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays — a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
         "compose": "c2VydmljZXM6CiAgb3Blbm9ic2VydmU6CiAgICBpbWFnZTogJ3B1YmxpYy5lY3IuYXdzL3ppbmNsYWJzL29wZW5vYnNlcnZlOnYwLjkwLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1BFTk9CU0VSVkVfNTA4MAogICAgICAtIFpPX0RBVEFfRElSPS9kYXRhCiAgICAgIC0gJ1pPX1JPT1RfVVNFUl9FTUFJTD0ke1pPX1JPT1RfVVNFUl9FTUFJTDotcm9vdEBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1pPX1JPT1RfVVNFUl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfT1BFTk9CU0VSVkV9JwogICAgICAtICdaT19URUxFTUVUUlk9JHtaT19URUxFTUVUUlk6LWZhbHNlfScKICAgICAgLSAnWk9fQ09PS0lFX1NFQ1VSRV9PTkxZPSR7Wk9fQ09PS0lFX1NFQ1VSRV9PTkxZOi10cnVlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29wZW5vYnNlcnZlLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL29wZW5vYnNlcnZlCiAgICAgICAgLSBub2RlCiAgICAgICAgLSBzdGF0dXMKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCg==",
         "tags": [
             "logs",
@@ -4112,7 +4142,8 @@
         "category": "database",
         "logo": "svgs/phpmyadmin.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
@@ -4311,7 +4342,7 @@
     },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
-        "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
+        "slogan": "Prowlarr⁠ is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
         "compose": "c2VydmljZXM6CiAgcHJvd2xhcnI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvcHJvd2xhcnI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1BST1dMQVJSXzk2OTYKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1BST1dMQVJSCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUFtZXJpY2EvVG9yb250b30nCiAgICB2b2x1bWVzOgogICAgICAtICdwcm93bGFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo5Njk2L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -4346,7 +4377,7 @@
     },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
-        "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
+        "slogan": "The qBittorrent project aims to provide an open-source software alternative to μTorrent.",
         "compose": "c2VydmljZXM6CiAgcWJpdDoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9xYml0dG9ycmVudDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnV0VCVUlfUE9SVD0ke1dFQlVJX1BPUlQ6LTgwODB9JwogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgdm9sdW1lczoKICAgICAgLSAncWJpdHRvcnJlbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3FiaXR0b3JyZW50LWRvd25sb2FkczovZG93bmxvYWRzJwogICAgICAtICdxYml0dG9ycmVudC10b3JyZW50czovdG9ycmVudHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2dWV0b3JyZW50LWJhY2tlbmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vdnVldG9ycmVudC92dWV0b3JyZW50LWJhY2tlbmQ6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1FCSVRPUlJFTlRfODA4MAogICAgICAtICdQT1JUPSR7V0VCVUlfUE9SVDotODA4MH0nCiAgICAgIC0gJ1FCSVRfQkFTRT0ke1NFUlZJQ0VfRlFETl9RQklUT1JSRU5UfScKICAgICAgLSAnUkVMRUFTRV9UWVBFPSR7UkVMRUFTRV9UWVBFOi1zdGFibGV9JwogICAgICAtICdVUERBVEVfVlRfQ1JPTj0ke1VQREFURV9WVF9DUk9OOi0iMCAqICogKiAqIn0nCiAgICB2b2x1bWVzOgogICAgICAtICd2dWV0b3JyZW50LWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctcScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODAvJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "torrent",
@@ -4400,7 +4431,7 @@
     },
     "radarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io",
-        "slogan": "Radarr\u2060 - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
+        "slogan": "Radarr⁠ - A fork of Sonarr to work with movies à la Couchpotato.",
         "compose": "c2VydmljZXM6CiAgcmFkYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3JhZGFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fUkFEQVJSXzc4NzgKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1JBREFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAncmFkYXJyLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0Ojc4NzgvcGluZycKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "media",
@@ -4803,7 +4834,8 @@
         "category": "productivity",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
@@ -4856,7 +4888,7 @@
     },
     "sonarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/sonarr?utm_source=coolify.io",
-        "slogan": "Sonarr\u2060 (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
+        "slogan": "Sonarr⁠ (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
         "compose": "c2VydmljZXM6CiAgc29uYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3NvbmFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU09OQVJSXzg5ODkKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1NPTkFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAnc29uYXJyLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0Ojg5ODkvcGluZycKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "media",
@@ -5457,6 +5489,23 @@
         "template_last_updated_at": "2026-04-06T11:35:16-05:00",
         "port": "3000"
     },
+    "vault": {
+        "documentation": "https://developer.hashicorp.com/vault/docs/deploy/run-container?utm_source=coolify.io",
+        "slogan": "HashiCorp Vault securely stores and controls access to secrets.",
+        "compose": "c2VydmljZXM6CiAgdmF1bHQ6CiAgICBpbWFnZTogJ2hhc2hpY29ycC92YXVsdDoke1ZBVUxUX1ZFUlNJT046LWxhdGVzdH0nCiAgICBjb21tYW5kOiBzZXJ2ZXIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9WQVVMVF84MjAwCiAgICAgIC0gJ1ZBVUxUX0FERFI9aHR0cDovLzEyNy4wLjAuMTo4MjAwJwogICAgICAtICdWQVVMVF9BUElfQUREUj0ke1NFUlZJQ0VfRlFETl9WQVVMVF84MjAwfScKICAgICAgLSAnVkFVTFRfTE9DQUxfQ09ORklHPXsidWkiOnRydWUsImRpc2FibGVfbWxvY2siOnRydWUsInN0b3JhZ2UiOnsiZmlsZSI6eyJwYXRoIjoiL3ZhdWx0L2ZpbGUifX0sImxpc3RlbmVyIjp7InRjcCI6eyJhZGRyZXNzIjoiMC4wLjAuMDo4MjAwIiwidGxzX2Rpc2FibGUiOnRydWV9fX0nCiAgICB2b2x1bWVzOgogICAgICAtICd2YXVsdC1kYXRhOi92YXVsdC9maWxlJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd3Z2V0IC1xTy0gImh0dHA6Ly8xMjcuMC4wLjE6ODIwMC92MS9zeXMvaGVhbHRoP3N0YW5kYnlvaz10cnVlJnNlYWxlZGNvZGU9MjAwJnVuaW5pdGNvZGU9MjAwIiA+L2Rldi9udWxsIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMgogICAgICBzdGFydF9wZXJpb2Q6IDE1cwo=",
+        "tags": [
+            "vault",
+            "hashicorp",
+            "secrets",
+            "security",
+            "encryption"
+        ],
+        "category": "security",
+        "logo": "svgs/default.webp",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "8200"
+    },
     "vaultwarden": {
         "documentation": "https://github.com/dani-garcia/vaultwarden?utm_source=coolify.io",
         "slogan": "Vaultwarden is a password manager that allows you to securely store and manage your passwords.",
@@ -5751,7 +5800,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-with-mysql": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5767,7 +5817,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-without-database": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5782,7 +5833,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
@@ -5865,7 +5917,7 @@
     },
     "marimo": {
         "documentation": "https://marimo.io/?utm_source=coolify.io",
-        "slogan": "An open-source reactive notebook for Python \u2014 reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
+        "slogan": "An open-source reactive notebook for Python — reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
         "compose": "c2VydmljZXM6CiAgbWFyaW1vOgogICAgaW1hZ2U6ICdnaGNyLmlvL21hcmltby10ZWFtL21hcmltbzpsYXRlc3Qtc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX01BUklNT184MDgwCiAgICAgIC0gVE9LRU5fUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSU1PCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpbW86L2FwcCcKICAgIGNvbW1hbmQ6CiAgICAgIC0gbWFyaW1vCiAgICAgIC0gZWRpdAogICAgICAtICctLXRva2VuLXBhc3N3b3JkJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSU1PfScKICAgICAgLSAnLS1wb3J0JwogICAgICAtICc4MDgwJwogICAgICAtICctLWhvc3QnCiAgICAgIC0gMC4wLjAuMAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHV2eAogICAgICAgIC0gJy0td2l0aCcKICAgICAgICAtICdodHRweFtjbGldJwogICAgICAgIC0gaHR0cHgKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwODAvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "notebook",
diff --git a/tests/Feature/AllResourceRestartLimitsTest.php b/tests/Feature/AllResourceRestartLimitsTest.php
new file mode 100644
index 0000000000..8418b552cd
--- /dev/null
+++ b/tests/Feature/AllResourceRestartLimitsTest.php
@@ -0,0 +1,223 @@
+<?php
+
+use App\Models\ApplicationPreview;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Traits\HasRestartLimit;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+it('gives every independently runnable non-application resource restart limit state', function (string $modelClass) {
+    expect(class_uses_recursive($modelClass))->toContain(HasRestartLimit::class);
+
+    $resource = new $modelClass;
+
+    expect($resource->getFillable())->toContain(
+        'restart_count',
+        'max_restart_count',
+        'restart_limit_reached',
+        'last_restart_at',
+        'last_restart_type',
+    )->and($resource->getCasts())->toMatchArray([
+        'restart_count' => 'integer',
+        'max_restart_count' => 'integer',
+        'restart_limit_reached' => 'boolean',
+        'last_restart_at' => 'datetime',
+    ]);
+})->with([
+    ApplicationPreview::class,
+    ServiceApplication::class,
+    ServiceDatabase::class,
+    StandaloneClickhouse::class,
+    StandaloneDragonfly::class,
+    StandaloneKeydb::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneMysql::class,
+    StandalonePostgresql::class,
+    StandaloneRedis::class,
+]);
+
+it('collects restart counts for preview and service containers from both status sources', function () {
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($dockerStatus)
+        ->toContain('previewContainerRestartCounts')
+        ->toContain('serviceContainerRestartCounts')
+        ->and($sentinelStatus)
+        ->toContain('previewContainerRestartCounts')
+        ->toContain('serviceContainerRestartCounts');
+});
+
+it('ignores docker compose one-off job containers in both status sources', function () {
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($dockerStatus)
+        ->toContain("filter_var(data_get(\$labels, 'com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)")
+        ->and($sentinelStatus)
+        ->toContain("filter_var(\$labels->get('com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)");
+});
+
+it('shows restart limit warnings for every resource family', function () {
+    $previews = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
+    $serviceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+    $applicationStatus = file_get_contents(resource_path('views/livewire/project/application/status.blade.php'));
+    $databaseStatus = file_get_contents(resource_path('views/livewire/project/database/status.blade.php'));
+
+    expect($previews)->toContain('<x-application.restart-limit-warning :application="$preview" />')
+        ->and($serviceCard)->toContain('<x-application.restart-limit-warning :application="$resource" />')
+        ->and($applicationStatus)->toContain('<x-application.restart-limit-warning :application="$application" />')
+        ->and($databaseStatus)->toContain('<x-application.restart-limit-warning :application="$database" />');
+
+    $serviceStatus = file_get_contents(resource_path('views/livewire/project/service/status.blade.php'));
+    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    expect($serviceStatus)->toContain('<x-application.restart-limit-warning :application="$selectedResource" />')
+        ->and($serviceStatus)->toContain('$selectedResource?->status ?? $service->status')
+        ->and($serviceHeading)->toContain('<x-application.restart-limit-warning :application="$selectedResource" />')
+        ->and($serviceHeading)->toContain('$selectedResource?->status ?? $service->status');
+});
+
+it('matches application restart badge layout on mobile resource headings', function () {
+    $applicationHeading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
+    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+
+    foreach ([$applicationHeading, $databaseHeading, $serviceHeading] as $heading) {
+        expect($heading)
+            ->toContain('class="relative flex w-full min-w-0 items-center gap-2"')
+            ->toContain('class="flex w-full flex-wrap gap-1"');
+    }
+});
+
+it('shows database restart limits in shared resource listings', function () {
+    $resourceIndex = file_get_contents(app_path('Livewire/Project/Resource/Index.php'));
+    $serverResources = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+    $destination = file_get_contents(resource_path('views/livewire/project/shared/destination.blade.php'));
+
+    expect($resourceIndex)
+        ->toContain("method_exists(\$item, 'stoppedAfterRestartLimit')")
+        ->not->toContain("\$type === 'application' && \$item->stoppedAfterRestartLimit()")
+        ->and($serverResources)
+        ->toContain('<x-application.restart-limit-warning :application="$resource" />')
+        ->and($destination)
+        ->toContain('<x-application.restart-limit-warning :application="$resource" />');
+});
+
+it('keeps the service resource table readable with horizontal scrolling on mobile', function () {
+    $configuration = file_get_contents(resource_path('views/livewire/project/service/configuration.blade.php'));
+    $resourceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+
+    expect($configuration)
+        ->toContain("'overflow-x-auto rounded-xl")
+        ->toContain('min-w-[48rem]')
+        ->and($resourceCard)
+        ->toContain('min-w-[48rem]')
+        ->not->toContain('<div class="hidden truncate font-mono');
+});
+
+it('opens service resource settings when a table row is clicked', function () {
+    $resourceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+
+    expect($resourceCard)
+        ->toContain('x-on:click="openSettings($event)"')
+        ->toContain('x-on:keydown.enter="openSettings($event)"')
+        ->toContain("closest('a, button')")
+        ->toContain('role="link"')
+        ->toContain('tabindex="0"');
+});
+
+it('uses selected service resource actions instead of parent complex status actions', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    $headingClass = file_get_contents(app_path('Livewire/Project/Service/Heading.php'));
+
+    expect(substr_count($heading, "\$selectedResource && \$selectedResource->container_present !== false && \$selectedResourceStatus->startsWith('exited')"))->toBe(2)
+        ->and($heading)
+        ->toContain('Remove container')
+        ->toContain('removeSelectedResourceContainer')
+        ->and($headingClass)
+        ->toContain('public function removeSelectedResourceContainer(): void');
+});
+
+it('imports the application model used when claiming a restart limit', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+
+    expect($statusAction)
+        ->toContain('use App\\Models\\Application;')
+        ->toContain('Application::query()');
+});
+
+it('adds restart limit columns to previews services and standalone databases', function () {
+    $migrations = collect(glob(database_path('migrations/*.php')))
+        ->map(fn (string $path): string => file_get_contents($path))
+        ->implode("\n");
+
+    expect($migrations)
+        ->toContain("'application_previews'")
+        ->toContain("'service_applications'")
+        ->toContain("'service_databases'")
+        ->toContain("'max_restart_count'")
+        ->toContain("'restart_limit_reached'");
+
+    $restartLimitMigrations = collect(glob(database_path('migrations/*_add_restart_limit_to_*.php')));
+
+    expect($restartLimitMigrations)->toHaveCount(11);
+    expect($restartLimitMigrations->map(
+        fn (string $path): string => substr(basename($path), 0, 17)
+    )->unique())->toHaveCount(11);
+    $restartLimitMigrations->each(function (string $path): void {
+        expect(file_get_contents($path))->not->toContain('foreach (');
+    });
+});
+
+it('atomically claims a resource restart limit once and can reset it', function () {
+    Schema::create('restart_limit_test_resources', function (Blueprint $table): void {
+        $table->id();
+        $table->string('status')->default('running');
+        $table->integer('restart_count')->default(0);
+        $table->integer('max_restart_count')->default(2);
+        $table->boolean('restart_limit_reached')->default(false);
+        $table->timestamp('last_restart_at')->nullable();
+        $table->string('last_restart_type')->nullable();
+        $table->timestamps();
+    });
+
+    $resource = new class extends Model
+    {
+        use HasRestartLimit;
+
+        protected $table = 'restart_limit_test_resources';
+    };
+    $resource->save();
+    $resource->refresh();
+
+    expect($resource->trackRestartCount(2))->toBeTrue()
+        ->and($resource->fresh()->restart_limit_reached)->toBeTrue()
+        ->and($resource->trackRestartCount(2))->toBeFalse();
+
+    $resource->resetRestartLimit();
+
+    expect($resource->fresh()->restart_count)->toBe(0)
+        ->and($resource->restart_limit_reached)->toBeFalse();
+
+    $resourceWithExistingRestarts = $resource->newInstance();
+    $resourceWithExistingRestarts->max_restart_count = 0;
+    $resourceWithExistingRestarts->save();
+    expect($resourceWithExistingRestarts->trackRestartCount(17))->toBeFalse();
+
+    $resourceWithExistingRestarts->update(['max_restart_count' => 10]);
+    expect($resourceWithExistingRestarts->trackRestartCount(17))->toBeTrue()
+        ->and($resourceWithExistingRestarts->fresh()->restart_limit_reached)->toBeTrue();
+
+    Schema::drop('restart_limit_test_resources');
+});
diff --git a/tests/Feature/Api/ApplicationBuildSecretsSettingApiTest.php b/tests/Feature/Api/ApplicationBuildSecretsSettingApiTest.php
index 3b3721545f..1847c00221 100644
--- a/tests/Feature/Api/ApplicationBuildSecretsSettingApiTest.php
+++ b/tests/Feature/Api/ApplicationBuildSecretsSettingApiTest.php
@@ -254,4 +254,58 @@ describe('other application creation endpoints use_build_secrets', function () {
 
         expect($application->settings->use_build_secrets)->toBeTrue();
     });
+
+    test('creates an application from a system-wide GitHub App owned by another team', function () {
+        $ownerTeam = Team::factory()->create();
+        $privateKey = PrivateKey::create([
+            'name' => 'System-wide GitHub App Key',
+            'private_key' => buildSecretsGithubPrivateKey(),
+            'team_id' => $ownerTeam->id,
+        ]);
+        $githubApp = GithubApp::create([
+            'name' => 'System-wide GitHub App',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'app_id' => 54321,
+            'installation_id' => 9876,
+            'client_id' => 'system-wide-client-id',
+            'client_secret' => 'system-wide-client-secret',
+            'webhook_secret' => 'system-wide-webhook-secret',
+            'private_key_id' => $privateKey->id,
+            'team_id' => $ownerTeam->id,
+            'is_system_wide' => true,
+            'is_public' => false,
+        ]);
+
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+                'Date' => now()->toRfc7231String(),
+            ]),
+            'https://api.github.com/app/installations/9876/access_tokens' => Http::response([
+                'token' => 'github-installation-token',
+            ], 201),
+            'https://api.github.com/repos/coolify/system-wide-test' => Http::response([
+                'id' => 654321,
+            ]),
+        ]);
+
+        $response = $this->withHeaders(buildSecretsApiHeaders($this->bearerToken))
+            ->postJson('/api/v1/applications/private-github-app', [
+                'project_uuid' => $this->project->uuid,
+                'environment_uuid' => $this->environment->uuid,
+                'server_uuid' => $this->server->uuid,
+                'github_app_uuid' => $githubApp->uuid,
+                'git_repository' => 'coolify/system-wide-test',
+                'git_branch' => 'main',
+                'build_pack' => 'nixpacks',
+                'ports_exposes' => '3000',
+                'autogenerate_domain' => false,
+            ])
+            ->assertCreated();
+
+        $application = Application::where('uuid', $response->json('uuid'))->firstOrFail();
+
+        expect($application->source_id)->toBe($githubApp->id)
+            ->and($application->environment_id)->toBe($this->environment->id);
+    });
 });
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index c1d08bf388..55d25927a3 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -138,6 +138,33 @@ test('proxy settings regenerate managed labels', function () {
     expect(base64_decode($this->application->fresh()->custom_labels))->not->toContain('sentinel-label=true');
 });
 
+test('changing a domain port regenerates managed labels with the requested port', function () {
+    $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'ports_exposes' => '80',
+        'domain_port_overrides' => [
+            'https://app.example.com' => 3000,
+        ],
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://app.example.com:8080',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+    $labels = $application->parseContainerLabels();
+
+    expect($application->fqdn)->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 8080,
+        ])
+        ->and($labels)->toContain('loadbalancer.server.port=8080')
+        ->and($labels)->not->toContain('loadbalancer.server.port=3000');
+});
+
 test('http basic auth updates regenerate managed labels', function () {
     $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
     $this->application->update([
@@ -279,6 +306,34 @@ test('PATCH /api/v1/applications/{uuid} updates preview_url_template and max_res
         ->and($application->max_restart_count)->toBe(5);
 });
 
+test('PATCH /api/v1/applications/{uuid} clears ports_exposes with null or an empty string', function (mixed $portsExposes) {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'ports_exposes' => $portsExposes,
+        ])
+        ->assertOk();
+
+    expect($this->application->fresh()->ports_exposes)->toBeNull();
+})->with([
+    'null' => null,
+    'empty string' => '',
+]);
+
+test('PATCH /api/v1/applications/{uuid} rejects invalid exposed ports', function (string $portsExposes) {
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'ports_exposes' => $portsExposes,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors('ports_exposes');
+})->with([
+    'not numeric' => '80,abc',
+    'zero' => '0',
+    'above TCP range' => '65536',
+]);
+
 test('GET /api/v1/applications/{uuid} includes advanced settings', function () {
     $this->application->settings->update(advancedApplicationSettingsPayload());
     $this->application->update([
diff --git a/tests/Feature/Api/LifecycleApisTest.php b/tests/Feature/Api/LifecycleApisTest.php
index 913eac59a5..4973453e93 100644
--- a/tests/Feature/Api/LifecycleApisTest.php
+++ b/tests/Feature/Api/LifecycleApisTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\DeleteResourceJob;
 use App\Jobs\ScheduledTaskJob;
 use App\Models\Application;
 use App\Models\CloudInitScript;
@@ -276,6 +277,60 @@ describe('POST /api/v1/services/{uuid}/clone', function () {
     });
 });
 
+describe('DELETE resource endpoints', function () {
+    test('soft deletes an application before queuing cleanup', function () {
+        Queue::fake();
+
+        $this->withHeaders($this->headers)
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}")
+            ->assertOk();
+
+        expect(Application::find($this->application->id))->toBeNull()
+            ->and(Application::withTrashed()->find($this->application->id)?->trashed())->toBeTrue();
+        Queue::assertPushed(DeleteResourceJob::class);
+    });
+
+    test('soft deletes a service before queuing cleanup', function () {
+        Queue::fake();
+        $service = Service::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'server_id' => $this->server->id,
+        ]);
+
+        $this->withHeaders($this->headers)
+            ->deleteJson("/api/v1/services/{$service->uuid}")
+            ->assertOk();
+
+        expect(Service::find($service->id))->toBeNull()
+            ->and(Service::withTrashed()->find($service->id)?->trashed())->toBeTrue();
+        Queue::assertPushed(DeleteResourceJob::class);
+    });
+
+    test('soft deletes a database before queuing cleanup', function () {
+        Queue::fake();
+        $database = StandalonePostgresql::create([
+            'name' => 'database-to-delete',
+            'image' => 'postgres:17-alpine',
+            'postgres_user' => 'postgres',
+            'postgres_password' => 'password',
+            'postgres_db' => 'postgres',
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        $this->withHeaders($this->headers)
+            ->deleteJson("/api/v1/databases/{$database->uuid}")
+            ->assertOk();
+
+        expect(StandalonePostgresql::find($database->id))->toBeNull()
+            ->and(StandalonePostgresql::withTrashed()->find($database->id)?->trashed())->toBeTrue();
+        Queue::assertPushed(DeleteResourceJob::class);
+    });
+});
+
 describe('POST /api/v1/applications/{uuid}/scheduled-tasks/{task_uuid}/execute', function () {
     test('dispatches ScheduledTaskJob for an application task', function () {
         Queue::fake();
diff --git a/tests/Feature/ApplicationConfigurationChangedTest.php b/tests/Feature/ApplicationConfigurationChangedTest.php
index d9d365b966..4650e2b12c 100644
--- a/tests/Feature/ApplicationConfigurationChangedTest.php
+++ b/tests/Feature/ApplicationConfigurationChangedTest.php
@@ -77,6 +77,47 @@ it('reports noindex domain changes as requiring a redeploy', function () {
         ->and($change['impact'])->toBe('redeploy');
 });
 
+it('reports domain port-only changes as requiring a redeploy', function () {
+    $application = configurationChangedTestApplication([
+        'fqdn' => 'https://app.example.com',
+        'domain_port_overrides' => ['https://app.example.com' => 3000],
+    ]);
+    $deployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    $application->update([
+        'domain_port_overrides' => ['https://app.example.com' => 8080],
+    ]);
+
+    $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+    $change = collect($diff->changes())->firstWhere('key', 'domains.domain_port_overrides');
+
+    expect($diff->isChanged())->toBeTrue()
+        ->and($change)->not->toBeNull()
+        ->and($change['impact'])->toBe('redeploy');
+});
+
+it('keeps application deployment snapshots stable when port overrides are reordered', function () {
+    $application = configurationChangedTestApplication([
+        'fqdn' => 'https://one.example.com,https://two.example.com',
+        'domain_port_overrides' => [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    ]);
+    $deployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    $application->update([
+        'domain_port_overrides' => [
+            'https://two.example.com' => 8080,
+            'https://one.example.com' => 3000,
+        ],
+    ]);
+
+    expect($application->refresh()->pendingDeploymentConfigurationDiff()->isChanged())->toBeFalse();
+});
+
 it('does not flag applications whose older snapshot omitted noindex domains', function () {
     $application = configurationChangedTestApplication([
         'fqdn' => 'https://app.example.com',
diff --git a/tests/Feature/ApplicationContainerPresenceTest.php b/tests/Feature/ApplicationContainerPresenceTest.php
new file mode 100644
index 0000000000..4a80631dd8
--- /dev/null
+++ b/tests/Feature/ApplicationContainerPresenceTest.php
@@ -0,0 +1,56 @@
+<?php
+
+use App\Models\Application;
+
+it('stores nullable application container presence as a boolean', function () {
+    $application = new Application;
+    $application->forceFill(['container_present' => 1]);
+    $migration = file_get_contents(base_path('database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php'));
+
+    expect($application->container_present)->toBeTrue()
+        ->and($migration)->toContain("boolean('container_present')->nullable()");
+});
+
+it('updates container presence at application lifecycle boundaries', function () {
+    $stopAction = file_get_contents(app_path('Actions/Application/StopApplication.php'));
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($stopAction)->toContain('$containerPresent = ! $removeContainers;')
+        ->and($stopAction)->toMatch('/if \(\$server->isSwarm\(\)\).*?\$containerPresent = false;.*?docker stack rm/s')
+        ->and($stopAction)->toContain("'container_present' => \$containerPresent")
+        ->and($dockerStatus)->toContain("'container_present' => true")
+        ->and($dockerStatus)->toContain("'container_present' => false")
+        ->and($sentinelStatus)->toContain("'container_present' => true")
+        ->and($sentinelStatus)->toContain("'container_present' => false");
+});
+
+it('shows accurate destructive actions and the restart warning on mobile', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $mobileActions = str($heading)
+        ->after('id="application-mobile-actions"')
+        ->before('<div class="hidden" aria-hidden="true">')
+        ->toString();
+
+    expect($heading)->toContain('<x-application.restart-limit-warning :application="$application" />')
+        ->and(substr_count($heading, '$application->container_present !== false'))->toBe(2)
+        ->and($heading)->toContain("\$application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy'")
+        ->and($heading)->toContain("\$application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)'")
+        ->and($heading)->toContain('Remove container')
+        ->and($mobileActions)->toContain('Deploy (without cache)')
+        ->and($mobileActions)->toContain('Remove container')
+        ->and(strrpos($mobileActions, 'Remove container'))->toBeGreaterThan(strrpos($mobileActions, 'Deploy (without cache)'));
+});
+
+it('shows restart limit reached as a yellow state in environment resource lists', function () {
+    $indexClass = file_get_contents(app_path('Livewire/Project/Resource/Index.php'));
+    $indexView = file_get_contents(resource_path('views/livewire/project/resource/index.blade.php'));
+
+    expect($indexClass)->toContain("'restartLimitReached' => \$type === 'application' && \$item->stoppedAfterRestartLimit()")
+        ->and($indexClass)->toContain('? max($item->restart_count ?? 0, $item->max_restart_count ?? 0)')
+        ->and($indexClass)->toContain("'maxRestartCount' => \$item->max_restart_count ?? 0")
+        ->and($indexView)->toContain("if (item.restartLimitReached) {\n                    return 'restart-limit';")
+        ->and($indexView)->toContain("return 'Restart limit reached';")
+        ->and($indexView)->toContain("if (item.restartLimitReached) {\n                    return 'bg-warning';")
+        ->and($indexView)->toContain('x-bind:title="statusTitle(item)"');
+});
diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
index 83244c5675..afec2fe9fb 100644
--- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Exceptions\DeploymentException;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
@@ -11,13 +12,80 @@ use App\Models\Server;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Collection;
+use Symfony\Component\Process\Process;
 
 uses(RefreshDatabase::class);
 
+it('does not persist environment write commands or generated Dockerfiles in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'APP_SECRET',
+        'value' => 'sensitive-value',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'configuration_dir' => '/data/coolify/applications/test-app',
+        'remote_secrets_cache' => [],
+        'saved_outputs' => [
+            'dockerfile' => "FROM php:8.4-cli\nRUN php -v",
+        ],
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'save_runtime_environment_variables');
+    invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+    invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
+
+    $writeCommands = collect($job->recordedCommands)
+        ->flatMap(fn (array $commands): array => $commands)
+        ->filter(function (mixed $command): bool {
+            if (! is_array($command)) {
+                return false;
+            }
+
+            $commandString = $command['command'] ?? $command[0] ?? null;
+
+            return is_string($commandString) && str_contains($commandString, 'base64 -d | tee');
+        })
+        ->values();
+
+    expect($writeCommands)->toHaveCount(4)
+        ->each->toHaveKey('skip_command_log', true);
+});
+
+it('redacts resolved remote secrets from command output', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'remote_secrets_cache' => ['API_TOKEN' => 'remote-secret-value'],
+    ]);
+
+    expect(invokeDeploymentJobMethod($job, $reflection, 'redact_sensitive_info', 'token=remote-secret-value'))
+        ->toBe('token='.REDACTED);
+});
+
+it('ignores empty and non-string remote secrets when redacting command output', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'remote_secrets_cache' => [
+            'EMPTY_SECRET' => '',
+            'NULL_SECRET' => null,
+            'NUMERIC_SECRET' => 123,
+            'API_TOKEN' => 'remote-secret-value',
+        ],
+    ]);
+
+    expect(invokeDeploymentJobMethod($job, $reflection, 'redact_sensitive_info', 'id=123 token=remote-secret-value'))
+        ->toBe('id=123 token='.REDACTED);
+});
+
 class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
 {
     public array $recordedCommands = [];
 
+    public array $recordedLogEntries = [];
+
+    public array $writtenArtifacts = [];
+
     public ?string $writtenDockerfile = null;
 
     public function __construct() {}
@@ -36,6 +104,10 @@ class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
             if (preg_match('/echo .*?([A-Za-z0-9+\\/=]{16,}).*?\\| base64 -d \\| tee \\/artifacts\\/test-app\\/Dockerfile > \\/dev\\/null/', $commandString, $matches) === 1) {
                 $this->writtenDockerfile = base64_decode($matches[1]) ?: null;
             }
+
+            if (preg_match('~echo .*?([A-Za-z0-9+/=]{8,}).*?\\| base64 -d \\| tee (/artifacts/[^ ]+) > /dev/null~', $commandString, $matches) === 1) {
+                $this->writtenArtifacts[$matches[2]] = base64_decode($matches[1]);
+            }
         }
     }
 }
@@ -92,7 +164,11 @@ function makeControlVarFilteringJob(Application $application, Server $server, ar
     $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
 
     $queue = Mockery::mock(ApplicationDeploymentQueue::class);
-    $queue->shouldReceive('addLogEntry')->andReturnNull();
+    $queue->shouldReceive('addLogEntry')->andReturnUsing(function (string $message, string $type = 'stdout', bool $hidden = false) use ($job) {
+        $job->recordedLogEntries[] = $message;
+
+        return null;
+    });
 
     $properties = [
         'application' => $application->fresh(),
@@ -130,12 +206,12 @@ function makeControlVarFilteringJob(Application $application, Server $server, ar
     return [$job, $reflection];
 }
 
-function invokeDeploymentJobMethod(object $job, ReflectionClass $reflection, string $method): mixed
+function invokeDeploymentJobMethod(object $job, ReflectionClass $reflection, string $method, mixed ...$arguments): mixed
 {
     $reflectionMethod = $reflection->getMethod($method);
     $reflectionMethod->setAccessible(true);
 
-    return $reflectionMethod->invoke($job);
+    return $reflectionMethod->invoke($job, ...$arguments);
 }
 
 function readDeploymentJobProperty(object $job, ReflectionClass $reflection, string $property): mixed
@@ -205,6 +281,345 @@ it('filters buildpack control vars from preview build-time env files', function
     expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith('RAILPACK_NODE_VERSION=')))->toBeFalse();
 });
 
+it('rejects unsafe Nixpacks plan variable keys before writing the build-time env file', function (string $key) {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'value',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+})->with([
+    'command substitution' => 'X$(id)',
+    'backticks' => 'X`id`',
+    'newline' => "X\nid",
+    'shell assignment' => 'X=value',
+    'semicolon' => 'X;id',
+    'pipe' => 'X|id',
+    'ampersand' => 'X&id',
+    'leading dollar' => '$(id)',
+    'command substitution with arguments' => 'X$(docker run --rm -v /:/mnt alpine true)',
+]);
+
+it('keeps persisted dotted user build-time variable keys', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'X.VALUE',
+        'value' => 'unsafe',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs)->toContain('X.VALUE="unsafe"');
+});
+
+it('loads shell variables and passes dotted variables through the build-time environment launcher', function () {
+    $temporaryDirectory = sys_get_temp_dir().'/coolify-build-env-'.str()->random(8);
+    expect(mkdir($temporaryDirectory))->toBeTrue();
+    $shellEnvironmentPath = $temporaryDirectory.'/build-time-shell.env';
+    $launcherPath = $temporaryDirectory.'/run-with-build-time-env';
+    $injectionMarkerPath = $temporaryDirectory.'/injection-marker';
+
+    try {
+        [$application, $server] = makeDeploymentControlVarFixture();
+
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'BASE_VALUE',
+            'value' => 'expanded',
+        ]);
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'X.VALUE',
+            'value' => '$BASE_VALUE',
+        ]);
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'DOTTED.VALUE',
+            'value' => "$(touch {$injectionMarkerPath})",
+        ]);
+
+        [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+        invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_PATH])
+            ->toContain('BASE_VALUE="expanded"')
+            ->toContain('X.VALUE="$BASE_VALUE"');
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH])
+            ->toContain('BASE_VALUE="expanded"')
+            ->not->toContain('X.VALUE');
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH])
+            ->toContain('source '.ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH)
+            ->toContain('X.VALUE="$BASE_VALUE"')
+            ->toContain('exec env');
+
+        $wrappedCommand = invokeDeploymentJobMethod($job, $reflection, 'wrap_build_command_with_env_export', 'printenv X.VALUE');
+
+        expect($wrappedCommand)
+            ->toContain(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH)
+            ->toContain("/bin/bash -c 'printenv X.VALUE'")
+            ->not->toContain('source '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH);
+
+        file_put_contents($shellEnvironmentPath, $job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH]);
+        file_put_contents(
+            $launcherPath,
+            str_replace(
+                'source '.ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH,
+                'source '.$shellEnvironmentPath,
+                $job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH],
+            ),
+        );
+        chmod($launcherPath, 0700);
+
+        $process = new Process(['/bin/bash', $launcherPath, '/bin/bash', '-c', 'printenv X.VALUE; printenv DOTTED.VALUE']);
+        $process->mustRun();
+
+        expect($process->getOutput())
+            ->toContain("expanded\n")
+            ->toContain("$(touch {$injectionMarkerPath})");
+        expect(file_exists($injectionMarkerPath))->toBeFalse();
+    } finally {
+        @unlink($launcherPath);
+        @unlink($shellEnvironmentPath);
+        @unlink($injectionMarkerPath);
+        @rmdir($temporaryDirectory);
+    }
+});
+
+it('keeps the original sourced environment path when build-time keys are shell safe', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_VALUE',
+        'value' => 'safe',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+    expect($job->writtenArtifacts)
+        ->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_ENV_PATH)
+        ->not->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH)
+        ->not->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH);
+
+    $wrappedCommand = invokeDeploymentJobMethod($job, $reflection, 'wrap_build_command_with_env_export', 'docker build .');
+
+    expect($wrappedCommand)
+        ->toContain('set -a && source '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH.' && set +a && docker build .')
+        ->not->toContain(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH);
+});
+
+it('uses BuildKit secrets for dotted Nixpacks variables instead of invalid Dockerfile expansion', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'dockerBuildkitSupported' => true,
+        'dockerSecretsAvailable' => true,
+        'env_args' => collect(['X.VALUE' => 'dotted-buildtime-ok']),
+        'nixpacks_plan_json' => collect([
+            'variables' => ['X.VALUE' => 'dotted-buildtime-ok'],
+        ]),
+        'saved_outputs' => collect([
+            'dockerfile_content' => "FROM alpine\nARG SAFE X.VALUE\nENV SAFE=\$SAFE X.VALUE=\$X.VALUE\nRUN printenv X.VALUE",
+        ]),
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'generate_build_env_variables');
+
+    expect(readDeploymentJobProperty($job, $reflection, 'dockerSecretsSupported'))->toBeTrue();
+    expect(readDeploymentJobProperty($job, $reflection, 'build_secrets'))->toContain('--secret id=X.VALUE,env=X.VALUE');
+
+    invokeDeploymentJobMethod($job, $reflection, 'modify_dockerfile_for_secrets', '/artifacts/test-app/.nixpacks/Dockerfile');
+
+    $dockerfile = $job->writtenArtifacts['/artifacts/test-app/.nixpacks/Dockerfile'];
+
+    expect($dockerfile)
+        ->not->toContain('ARG X.VALUE')
+        ->not->toContain('X.VALUE=$X.VALUE')
+        ->toContain('ARG SAFE')
+        ->toContain('ENV SAFE=$SAFE')
+        ->toContain('RUN --mount=type=secret,id=X.VALUE,env=X.VALUE')
+        ->toContain('printenv X.VALUE');
+});
+
+it('rejects dotted Nixpacks variables when Docker build secrets are unavailable', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'dockerBuildkitSupported' => true,
+        'dockerSecretsAvailable' => false,
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'X.VALUE' => 'dotted-buildtime-ok',
+                'ANOTHER.DOTTED.VALUE' => 'also-dotted',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_build_env_variables'))
+        ->toThrow(
+            DeploymentException::class,
+            'Dotted Nixpacks build-time environment variable names require Docker BuildKit secret support: X.VALUE, ANOTHER.DOTTED.VALUE. Rename these keys to use underscores instead of dots, or upgrade Docker on the build server.'
+        );
+});
+
+it('writes dotted Nixpacks ARG and ENV removal when the Dockerfile has no run command', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'env_args' => collect(['X.VALUE' => 'dotted-buildtime-ok']),
+        'nixpacks_plan_json' => collect([
+            'variables' => ['X.VALUE' => 'dotted-buildtime-ok'],
+        ]),
+        'build_secrets' => '--secret id=X.VALUE,env=X.VALUE',
+        'saved_outputs' => collect([
+            'dockerfile_content' => "FROM alpine\nARG X.VALUE=default\nENV X.VALUE=\$X.VALUE",
+        ]),
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'modify_dockerfile_for_secrets', '/artifacts/test-app/.nixpacks/Dockerfile');
+
+    expect($job->writtenArtifacts['/artifacts/test-app/.nixpacks/Dockerfile'])
+        ->not->toContain('X.VALUE');
+});
+
+it('skips unsafe reserved Nixpacks plan variable keys before validation', function (string $key) {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'value',
+            ],
+        ]),
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith($key.'=')))->toBeFalse();
+})->with([
+    'Coolify key' => 'COOLIFY_$(id)',
+    'service key' => 'SERVICE_$(id)',
+]);
+
+it('explains invalid Nixpacks plan variable keys in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'XPACK;SECURITY;ENABLED' => 'true',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class, 'Invalid environment variable name from the Nixpacks plan: XPACK;SECURITY;ENABLED');
+
+    $logs = implode("\n", $job->recordedLogEntries);
+
+    expect($logs)
+        ->toContain('Invalid environment variable name from the Nixpacks plan: XPACK;SECURITY;ENABLED')
+        ->toContain('must start with a letter or underscore')
+        ->toContain('How to fix')
+        ->toContain('nixpacks.toml')
+        ->toContain('https://nixpacks.com/docs/configuration/file');
+});
+
+it('truncates long Nixpacks plan variable keys in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $key = 'X$(docker run --rm alpine sh -c "'.str_repeat('a', 200).'TAIL_SHOULD_BE_TRUNCATED")';
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'x',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+
+    $logs = implode("\n", $job->recordedLogEntries);
+
+    expect($logs)
+        ->toContain('Invalid environment variable name from the Nixpacks plan: X$(docker run --rm')
+        ->toContain('...')
+        ->not->toContain('TAIL_SHOULD_BE_TRUNCATED')
+        ->toContain('nixpacks.toml');
+});
+
+it('bounds every deployment log entry for long invalid Nixpacks variable keys', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $key = 'X'.str_repeat('$', 10_000);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'x',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+
+    $longestLogEntryLength = max(array_map(strlen(...), $job->recordedLogEntries));
+
+    expect($longestLogEntryLength)->toBeLessThanOrEqual(200);
+});
+
+it('keeps shell-safe Nixpacks plan variables in the build-time env file', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'APP_NAME' => 'coolify',
+                '_PRIVATE_VALUE' => 'secret',
+                'X.VALUE' => 'dotted',
+            ],
+        ]),
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs)->toContain("APP_NAME='coolify'")
+        ->toContain("_PRIVATE_VALUE='secret'")
+        ->toContain("X.VALUE='dotted'");
+});
+
 it('does not let preview docker compose service names override generated build-time service names', function () {
     $compose = <<<'YAML'
 services:
@@ -403,10 +818,50 @@ it('filters buildpack control vars from dockerfile arg injection', function () {
     invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
 
     expect($job->writtenDockerfile)->toContain('ARG APP_ENV=production');
+    expect($job->writtenDockerfile)->toContain('ARG COOLIFY_BUILD_SECRETS_HASH=');
     expect($job->writtenDockerfile)->not->toContain('ARG NIXPACKS_NODE_VERSION=');
     expect($job->writtenDockerfile)->not->toContain('ARG RAILPACK_NODE_VERSION=');
 });
 
+it('injects raw escaped remote secrets into Dockerfile args and hashes the same values', function (int $pullRequestId, bool $isPreview) {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SECRET_TOKEN',
+        'value' => '{{vault.API_TOKEN}}',
+        'is_preview' => $isPreview,
+        'is_runtime' => false,
+        'is_buildtime' => true,
+    ]);
+
+    $secret = "secret\$value'quoted";
+    $escapedSecret = escapeBashEnvValue($secret);
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'pull_request_id' => $pullRequestId,
+        'remote_secrets_cache' => ['API_TOKEN' => $secret],
+        'saved_outputs' => [
+            'dockerfile' => "FROM php:8.4-cli\nRUN php -v",
+        ],
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'add_build_env_variables_to_dockerfile');
+
+    $expectedHash = invokeDeploymentJobMethod(
+        $job,
+        $reflection,
+        'generate_secrets_hash',
+        collect(['SECRET_TOKEN' => $escapedSecret]),
+    );
+
+    expect($job->writtenDockerfile)
+        ->toContain("ARG SECRET_TOKEN={$escapedSecret}")
+        ->toContain("ARG COOLIFY_BUILD_SECRETS_HASH={$expectedHash}")
+        ->not->toContain('$$');
+})->with([
+    'production' => [0, false],
+    'preview' => [99, true],
+]);
+
 it('builds railpack variables from generic buildtime vars railpack vars and coolify vars only', function () {
     [$application, $server] = makeDeploymentControlVarFixture([
         'build_pack' => 'railpack',
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 50c71fe958..9d0739d1ce 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -1,7 +1,11 @@
 <?php
 
+use App\Jobs\CheckDomainDnsJob;
 use App\Livewire\Project\Application\Domains;
+use App\Livewire\Project\Application\PreviewDomains;
+use App\Livewire\Project\Application\Previews;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -12,6 +16,7 @@ use App\Models\User;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
 
@@ -19,6 +24,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
 
     InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
         ['id' => 0],
@@ -96,6 +102,478 @@ it('uses safe domain validation rules on the domains form', function () {
         ->and($validator->errors()->has('newDomain'))->toBeTrue();
 });
 
+it('does not add a single-label hostname as an application domain', function () {
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'aaa')
+        ->call('addDomain')
+        ->assertDispatched('error');
+
+    expect($this->application->fresh()->fqdn)->toBeNull();
+});
+
+it('generates a preview domain when the application has no domain', function () {
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 41,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/41',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)
+        ->not->toBeNull()
+        ->toContain('41.');
+});
+
+it('generates compose preview domains when the application has no domains', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/42',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)
+        ->not->toBeNull()
+        ->toContain('42.');
+});
+
+it('derives preview domain services from compose and defaults the selected service', function () {
+    Queue::fake();
+
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker-pr-49:\n    image: nginx:alpine\n  database:\n    image: postgres:17\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 49,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/49',
+        'docker_compose_domains' => json_encode([
+            'removed-service' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertViewHas('composeServices', ['web', 'worker-pr-49'])
+        ->assertSet('newDomainService', 'web')
+        ->set('newDomainService', 'worker-pr-49')
+        ->set('newDomainParts.host', 'worker-preview.example.com')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertSet('newDomainService', 'web');
+
+    $preview->generate_preview_fqdn_compose();
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))
+        ->toHaveKey('worker-pr-49')
+        ->not->toHaveKey('worker');
+});
+
+it('handles compose parsing failures without exposing stale preview services', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services: [\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 52,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/52',
+        'docker_compose_domains' => json_encode([
+            'stale-service' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertViewHas('composeServices', [])
+        ->assertSet('newDomainService', null);
+});
+
+it('does not erase preview domains when compose parsing fails during persistence', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+    ]);
+
+    $storedDomains = [
+        'web' => ['domain' => 'https://web-preview.example.com'],
+        'worker' => ['domain' => 'https://worker-preview.example.com'],
+    ];
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 53,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/53',
+        'docker_compose_domains' => json_encode($storedDomains),
+        'fqdn' => 'https://web-preview.example.com,https://worker-preview.example.com',
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+
+    $application = Mockery::mock($component->instance()->preview->application)->makePartial();
+    $application->shouldReceive('parse')->once()->andThrow(new RuntimeException('Temporary parse failure'));
+    $component->instance()->preview->setRelation('application', $application);
+
+    $component->instance()->removeDomain(0);
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe($storedDomains)
+        ->and($preview->fresh()->fqdn)->toBe('https://web-preview.example.com,https://worker-preview.example.com')
+        ->and($component->get('domainRows'))->toHaveCount(2);
+});
+
+it('preserves empty compose service slots after removing the last preview domain', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 50,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/50',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web-preview.example.com'],
+        ]),
+        'fqdn' => 'https://web-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomain', 0)
+        ->assertViewHas('composeServices', ['web', 'worker']);
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => ''],
+        'worker' => ['domain' => ''],
+    ]);
+});
+
+it('rejects missing and unknown services when adding compose preview domains', function (?string $service) {
+    Queue::fake();
+
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 51,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/51',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainService', $service)
+        ->call('addDomain')
+        ->assertHasErrors('newDomainService')
+        ->assertCount('domainRows', 0);
+
+    expect($preview->fresh()->docker_compose_domains)->toBeNull()
+        ->and($preview->fresh()->fqdn)->toBeNull();
+    Queue::assertNothingPushed();
+})->with([null, 'unknown']);
+
+it('generates a compose preview domain only for the selected service', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com'],
+            'api' => ['domain' => 'https://api.example.com'],
+        ]),
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://custom-web.example.net'],
+            'api' => ['domain' => 'https://custom-api.example.net'],
+        ]),
+        'fqdn' => 'https://custom-web.example.net,https://custom-api.example.net',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainService', 'api')
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    $domains = json_decode($preview->fresh()->docker_compose_domains, true);
+
+    expect($domains['web']['domain'])->toBe('https://custom-web.example.net')
+        ->and($domains['api']['domain'])->toStartWith('https://custom-api.example.net,')
+        ->and($domains['api']['domain'])->toContain('48.api.example.com');
+});
+
+it('keeps compose services without application domains private when configuring a preview', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com'],
+            'worker' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $this->application->uuid,
+        ])
+        ->call('add', 43, 'https://github.com/coollabsio/coolify/pull/43');
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $this->application->id)
+        ->where('pull_request_id', 43)
+        ->firstOrFail();
+    $composeDomains = json_decode($preview->docker_compose_domains, true);
+
+    expect($composeDomains['web']['domain'])
+        ->toContain('web.example.com')
+        ->and($composeDomains['worker']['domain'])->toBe('')
+        ->and($preview->fqdn)->toContain('web.example.com')
+        ->not->toContain('worker');
+});
+
+it('generates a domain when configuring a preview', function () {
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $this->application->uuid,
+        ])
+        ->call('add', 43, 'https://github.com/coollabsio/coolify/pull/43')
+        ->assertDispatched('success');
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $this->application->id)
+        ->where('pull_request_id', 43)
+        ->firstOrFail();
+
+    expect($preview->fqdn)
+        ->not->toBeNull()
+        ->toContain('43.');
+});
+
+it('manages preview domains and their dns status', function () {
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 44,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/44',
+        'fqdn' => 'https://44.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.url', 'https://44.example.com')
+        ->call('checkDomainDns', 0)
+        ->assertSet('domainRows.0.dns_status', 'skipped')
+        ->set('newDomainParts.host', 'second.example.com')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertCount('domainRows', 2)
+        ->call('removeDomain', 0)
+        ->assertCount('domainRows', 1);
+
+    expect($preview->fresh()->fqdn)->toBe('https://second.example.com')
+        ->and($preview->fresh()->domain_dns_statuses)->not->toBeNull();
+});
+
+it('removes the intended preview domains by stable identities after reindexing', function () {
+    $domains = [
+        'https://first.example.com',
+        'https://second.example.com',
+        'https://third.example.com',
+    ];
+    $domainKeys = array_map(fn (string $domain): string => hash('sha256', $domain.'|'), $domains);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 47,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/47',
+        'fqdn' => implode(',', $domains),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomainByKey', $domainKeys[0])
+        ->assertSet('domainRows.0.url', $domains[1])
+        ->call('removeDomainByKey', $domainKeys[1])
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.url', $domains[2]);
+
+    expect($preview->fresh()->fqdn)->toBe($domains[2]);
+});
+
+it('renders preview domain delete confirmations with stable keys', function () {
+    $domains = [
+        'https://first.example.com',
+        'https://second.example.com',
+    ];
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'fqdn' => implode(',', $domains),
+    ]);
+
+    $renderedHtml = html_entity_decode(
+        Livewire::test(PreviewDomains::class, ['preview' => $preview])->html(),
+        ENT_QUOTES,
+    );
+
+    foreach ($domains as $domain) {
+        $domainKey = hash('sha256', $domain.'|');
+
+        expect($renderedHtml)->toMatch("/submitAction:\\s*[\"']removeDomainByKey\\({$domainKey}\\)[\"']/");
+    }
+
+    expect($renderedHtml)->not->toMatch('/submitAction:\\s*[\"\']removeDomain\\(\\d+\\)[\"\']/');
+});
+
+it('removes only the matching compose preview domain when services share a URL', function () {
+    $url = 'https://shared.example.com';
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+    ]);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 49,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/49',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => $url],
+            'worker' => ['domain' => $url],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomainByKey', hash('sha256', $url.'|worker'))
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.url', $url)
+        ->assertSet('domainRows.0.service', 'web');
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => $url],
+        'worker' => ['domain' => ''],
+    ]);
+});
+
+it('adds a preview domain and starts its dns check asynchronously', function () {
+    Queue::fake();
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 45,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/45',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->call('addDomain')
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.dns_status', 'checking')
+        ->assertDispatched('success', 'Domain added. DNS check started.');
+
+    Queue::assertPushed(CheckDomainDnsJob::class, fn (CheckDomainDnsJob $job): bool => $job->resource->is($preview)
+        && $job->url === 'https://preview.example.com');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and(collect($preview->fresh()->domain_dns_statuses)->first()['status'])->toBe('checking');
+});
+
+it('notifies when an asynchronous preview dns check finds a mismatch', function () {
+    $url = 'https://preview.example.com';
+    $statusKey = hash('sha256', $url.'|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 46,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/46',
+        'fqdn' => $url,
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'preview-check',
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.dns_status', 'checking');
+
+    $preview->update([
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'failed',
+                'message' => 'Required DNS record type A pointing to 203.0.113.10',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ],
+    ]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('domainRows.0.dns_status', 'failed')
+        ->assertDispatched('error', 'DNS is not configured for preview.example.com. Review the required DNS record.');
+});
+
+it('does not overwrite a completed preview dns result with stale checking state', function () {
+    $url = 'https://preview.example.com';
+    $statusKey = hash('sha256', $url.'|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'fqdn' => $url,
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'stale-check',
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+
+    $preview->update([
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'ok',
+                'message' => 'DNS looks correct.',
+                'check_id' => 'completed-check',
+            ],
+        ],
+    ]);
+
+    $method = new ReflectionMethod($component->instance(), 'persistDnsStatuses');
+    $method->invoke($component->instance());
+
+    expect($preview->fresh()->domain_dns_statuses[$statusKey])
+        ->toMatchArray([
+            'status' => 'ok',
+            'message' => 'DNS looks correct.',
+            'check_id' => 'completed-check',
+        ]);
+});
+
 it('lists existing domains as individual rows', function () {
     $this->application->update([
         'fqdn' => 'https://example.com,https://www.example.com,https://another.example.com,https://www.another.example.com',
@@ -248,7 +726,7 @@ it('adds a domain to the application', function () {
         ->call('addDomain')
         ->assertHasNoErrors()
         ->assertSet('addDomainDnsFailed', false)
-        ->assertDispatched('success')
+        ->assertDispatched('success', 'Domain added. DNS check started.')
         ->assertDispatched('close-modal');
 
     $this->application->refresh();
@@ -267,9 +745,14 @@ it('composes the complete port on the server without duplicating an existing www
         ->assertHasNoErrors()
         ->assertDispatched('success');
 
-    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
-        'https://www.example.com:3000',
-        'https://example.com:3000',
+    $application = $this->application->fresh();
+
+    expect(explode(',', (string) $application->fqdn))->toBe([
+        'https://www.example.com',
+        'https://example.com',
+    ])->and($application->domain_port_overrides)->toBe([
+        'https://www.example.com' => 3000,
+        'https://example.com' => 3000,
     ]);
 });
 
@@ -290,7 +773,9 @@ it('adds multiple domains without replacing existing ones', function () {
         ->toContain('https://api.example.com');
 });
 
-it('blocks adding a domain with bad dns until the user continues', function () {
+it('saves a domain before checking dns in a separate request', function () {
+    Queue::fake();
+
     $settings = InstanceSettings::get();
     $settings->is_dns_validation_enabled = true;
     $settings->save();
@@ -298,15 +783,8 @@ it('blocks adding a domain with bad dns until the user continues', function () {
     $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->set('newDomain', 'https://this-domain-should-not-resolve-for-coolify-tests.invalid')
         ->call('addDomain')
-        ->assertSet('addDomainDnsFailed', true)
-        ->assertSee('DNS is not pointing to the right IP')
-        ->assertSee('Are you sure you want to add it anyway');
-
-    $this->application->refresh();
-    expect($this->application->fqdn)->toBeNull();
-
-    $component->call('confirmAddDomainDespiteDns')
         ->assertSet('addDomainDnsFailed', false)
+        ->assertSet('domainRows.0.dns_status', 'checking')
         ->assertDispatched('success')
         ->assertDispatched('close-modal');
 
@@ -315,17 +793,24 @@ it('blocks adding a domain with bad dns until the user continues', function () {
         'https://this-domain-should-not-resolve-for-coolify-tests.invalid',
         'https://www.this-domain-should-not-resolve-for-coolify-tests.invalid',
     ]);
+
+    expect($this->application->domain_dns_statuses['https://this-domain-should-not-resolve-for-coolify-tests.invalid']['status'] ?? null)
+        ->toBe('checking');
+
+    Queue::assertPushed(CheckDomainDnsJob::class, 2);
+
+    $jobs = Queue::pushed(CheckDomainDnsJob::class);
+
+    expect($jobs->pluck('statusKey')->all())->toEqualCanonicalizing([
+        'https://this-domain-should-not-resolve-for-coolify-tests.invalid',
+        'https://www.this-domain-should-not-resolve-for-coolify-tests.invalid',
+    ])->and($jobs->pluck('checkId')->unique())->toHaveCount(2);
 });
 
 it('resets the dns gate when the domain input changes', function () {
-    $settings = InstanceSettings::get();
-    $settings->is_dns_validation_enabled = true;
-    $settings->save();
-
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
-        ->set('newDomain', 'https://this-domain-should-not-resolve-for-coolify-tests.invalid')
-        ->call('addDomain')
-        ->assertSet('addDomainDnsFailed', true)
+        ->set('addDomainDnsFailed', true)
+        ->set('forceSaveDns', true)
         ->set('newDomain', 'https://another.example.com')
         ->assertSet('addDomainDnsFailed', false)
         ->assertSet('forceSaveDns', false);
@@ -342,12 +827,14 @@ it('updates a domain in place via modal', function () {
         ->assertSet('editingDomain', 'https://old.example.com')
         ->assertSee('Direction')
         ->assertSee('Search engine indexing')
-        ->set('editingDomain', 'https://new.example.com')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'new.example.com')
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertSet('showEditDomainModal', false)
         ->assertDispatched('edit-domain-saved')
-        ->assertDispatched('success');
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
 
     $this->application->refresh();
 
@@ -365,7 +852,8 @@ it('blocks editing a domain with bad dns until the user continues', function ()
 
     $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->call('startEdit', 0)
-        ->set('editingDomain', 'https://this-domain-should-not-resolve-for-coolify-tests.invalid')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'this-domain-should-not-resolve-for-coolify-tests.invalid')
         ->call('updateDomain')
         ->assertSet('editDomainDnsFailed', true)
         ->assertSet('showEditDomainModal', true)
@@ -398,6 +886,21 @@ it('removes a domain', function () {
     expect($this->application->fqdn)->toBe('https://www.example.com');
 });
 
+it('removes consecutive domains by stable row identity after indexes change', function () {
+    $this->application->update([
+        'fqdn' => 'https://first.example.com,https://second.example.com,https://third.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    $component
+        ->call('removeDomainByKey', hash('sha256', 'https://first.example.com|'))
+        ->call('removeDomainByKey', hash('sha256', 'https://second.example.com|'))
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->fqdn)->toBe('https://third.example.com');
+});
+
 it('does not revalidate dns on remaining domains when removing one', function () {
     $settings = InstanceSettings::get();
     $settings->is_dns_validation_enabled = true;
@@ -727,6 +1230,98 @@ it('persists dns status after checking a domain', function () {
         ->and($entry['checked_at'] ?? null)->not->toBeNull();
 });
 
+it('polls a queued dns check and notifies about a mismatch', function () {
+    $domain = 'https://app.example.com';
+    $this->application->update([
+        'fqdn' => $domain,
+        'domain_dns_statuses' => [
+            $domain => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => null,
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Checking DNS...')
+        ->assertSee('wire:poll.2000ms="pollDnsChecks"', false);
+
+    $this->application->update([
+        'domain_dns_statuses' => [
+            $domain => [
+                'status' => 'failed',
+                'message' => 'Required DNS record type A pointing to 203.0.113.10',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ],
+    ]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('domainRows.0.dns_status', 'failed')
+        ->assertDispatched('error', 'DNS is not configured for app.example.com. Review the required DNS record.');
+});
+
+it('does not overwrite a completed queued dns result with stale checking state', function () {
+    $domain = 'https://app.example.com';
+    $this->application->update([
+        'fqdn' => $domain,
+        'domain_dns_statuses' => [
+            $domain => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => null,
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    $this->application->update([
+        'domain_dns_statuses' => [
+            $domain => [
+                'status' => 'ok',
+                'message' => 'DNS looks correct.',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ],
+    ]);
+
+    $method = new ReflectionMethod($component->instance(), 'persistDomainDnsStatuses');
+    $method->invoke($component->instance());
+
+    expect($this->application->fresh()->domain_dns_statuses[$domain]['status'])->toBe('ok');
+});
+
+it('does not overwrite a newer queued dns check with stale completed component state', function () {
+    $domain = 'https://app.example.com';
+    $status = [
+        'status' => 'ok',
+        'message' => 'DNS looks correct.',
+        'expected_ip' => '203.0.113.10',
+        'checked_at' => null,
+        'check_id' => null,
+    ];
+    $this->application->update([
+        'fqdn' => $domain,
+        'domain_dns_statuses' => [$domain => $status],
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    $status['check_id'] = 'newer-check';
+    $this->application->update(['domain_dns_statuses' => [$domain => $status]]);
+
+    $method = new ReflectionMethod($component->instance(), 'persistDomainDnsStatuses');
+    $method->invoke($component->instance());
+
+    expect($this->application->fresh()->domain_dns_statuses[$domain]['check_id'])->toBe('newer-check');
+});
+
 it('resolves hostname server addresses to a real ip for dns messages', function () {
     $this->server->update(['ip' => 'localhost']);
     $this->application->update([
@@ -1106,7 +1701,10 @@ it('saves after confirming a domain conflict on add', function () {
         ->assertSet('pendingAction', null)
         ->assertDispatched('success');
 
-    expect($this->application->fresh()->fqdn)->toBe('https://shared.example.com');
+    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
+        'https://shared.example.com',
+        'https://www.shared.example.com',
+    ]);
 });
 
 it('saves after confirming a domain conflict on edit', function () {
@@ -1124,7 +1722,8 @@ it('saves after confirming a domain conflict on edit', function () {
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->call('startEdit', 0)
-        ->set('editingDomain', 'https://taken.example.com')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'taken.example.com')
         ->call('updateDomain')
         ->assertSet('showDomainConflictModal', true)
         ->assertSet('pendingAction', 'update')
@@ -1379,6 +1978,72 @@ it('auto-adds missing www pair for a single compose service redirect', function
         ->and($webDomains)->toContain('https://www.web.example.com');
 });
 
+it('saves domain port overrides separately from the public FQDN', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)
+        ->toBe('https://one.example.com,https://two.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+});
+
+it('retains an existing domain port override when saving a portless domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000',
+    ]);
+
+    $this->application->update([
+        'fqdn' => 'https://one.example.com',
+    ]);
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://one.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://one.example.com' => 3000]);
+});
+
+it('prunes a domain port override when that domain is removed', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $this->application->update([
+        'fqdn' => 'https://two.example.com',
+    ]);
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://two.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 8080]);
+});
+
+it('keeps a legacy port-bearing application domain after refresh and reparse', function () {
+    $this->application->update([
+        'fqdn' => 'https://legacy.example.com',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+    ]);
+
+    $application = Application::find($this->application->id);
+    $application->refresh();
+
+    expect($application->fqdn)->toBe('https://legacy.example.com:9090');
+
+    applicationParser($application);
+    $application->update(['description' => 'unrelated reparse']);
+
+    expect($application->fresh()->fqdn)->toBe('https://legacy.example.com:9090');
+});
+
 it('updates search engine indexing from the domains view', function () {
     $this->application->update(['fqdn' => 'https://app.example.com,https://staging.example.com']);
 
@@ -1400,3 +2065,498 @@ it('updates search engine indexing from the domains view', function () {
     expect($this->application->refresh()->noindexDomains()->all())
         ->toBe(['https://staging.example.com']);
 });
+
+it('keeps noindex domains when normalizing a custom domain port', function () {
+    $this->application->update([
+        'fqdn' => 'https://staging.example.com:8080',
+        'noindex_domains' => ['https://staging.example.com:8080'],
+    ]);
+
+    expect($this->application->refresh())
+        ->fqdn->toBe('https://staging.example.com')
+        ->noindex_domains->toBe(['https://staging.example.com'])
+        ->and($this->application->domain_port_overrides)
+        ->toBe(['https://staging.example.com' => 8080]);
+});
+
+it('saves a port override from the segmented add-domain form', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('https://example.com:8080');
+
+    $this->application->refresh();
+
+    expect(explode(',', (string) $this->application->fqdn))
+        ->toContain('https://example.com')
+        ->not->toContain('https://example.com:8080')
+        ->and($this->application->domain_port_overrides['https://example.com'] ?? null)
+        ->toBe(8080);
+});
+
+it('rejects adding a domain whose portless URL is already configured', function () {
+    $this->application->update([
+        'fqdn' => 'https://example.com:3000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasErrors('newDomain');
+
+    expect($this->application->fresh()->fqdn)->toBe('https://example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://example.com' => 3000]);
+});
+
+it('rejects renaming a domain to a port variant of another configured domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://first.example.com:3000,https://second.example.com:4000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->set('editingDomainParts.host', 'first.example.com')
+        ->set('editingDomainParts.port', '8080')
+        ->call('updateDomain')
+        ->assertHasErrors('editingDomain');
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://first.example.com,https://second.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe([
+            'https://first.example.com' => 3000,
+            'https://second.example.com' => 4000,
+        ]);
+});
+
+it('composes segmented add-domain fields into a port override when the changed flag is false', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->set('newDomainPartsChanged', false)
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->fqdn)
+        ->toContain('https://example.com')
+        ->not->toContain(':8080')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toHaveKey('https://example.com', 8080);
+});
+
+it('retains different port overrides for two application domains', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'one.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainParts.host', 'two.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $this->application->refresh();
+
+    expect($this->application->domain_port_overrides['https://one.example.com'] ?? null)->toBe(3000)
+        ->and($this->application->domain_port_overrides['https://two.example.com'] ?? null)->toBe(8080)
+        ->and(explode(',', (string) $this->application->fqdn))
+        ->toContain('https://one.example.com')
+        ->toContain('https://two.example.com')
+        ->not->toContain('https://one.example.com:3000')
+        ->not->toContain('https://two.example.com:8080');
+});
+
+it('reopens edit with the saved domain port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com:8080',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.url', 'https://example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'example.com');
+});
+
+it('does not prefill the default internal port when editing a domain without a port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '');
+});
+
+it('clears a domain port override and shows the default internal port', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:8080,https://two.example.com:9090',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertSee('Internal port 9090')
+        ->assertDontSee('Internal port 8080');
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)
+        ->toContain('https://one.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->not->toHaveKey('https://one.example.com')
+        ->toHaveKey('https://two.example.com', 9090);
+});
+
+it('prunes a domain port override when removing the domain from the ui', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:8080,https://two.example.com:3000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)->toBe('https://two.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 3000]);
+});
+
+it('renders a portless domain link with an internal port badge for overrides', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com:8080',
+    ]);
+
+    $html = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->assertSee('https://example.com')
+        ->assertDontSee('https://example.com:8080')
+        ->html();
+
+    expect($html)
+        ->toContain('href="'.getFqdnWithoutPort('https://example.com').'"')
+        ->not->toContain('href="https://example.com:8080"')
+        ->toContain('Custom internal port for this domain')
+        ->not->toContain('Inherited from Ports Exposes');
+});
+
+it('shows an error badge when a domain has no internal port and ports exposes is empty', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertSee('No internal port')
+        ->assertDontSee('Internal port ')
+        ->assertSee('table-badge-danger', false);
+});
+
+it('keeps the internal port badge when a domain override exists without ports exposes', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => [
+            'https://example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('No internal port');
+});
+
+it('distinguishes an inherited internal port from a domain port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 3000')
+        ->assertSee('Inherited from Ports Exposes', false)
+        ->assertDontSee('Custom internal port for this domain', false);
+});
+
+it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://legacy.example.com',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.url', 'https://legacy.example.com:9090')
+        ->assertSet('domainRows.0.internal_port', 9090)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->assertSee('Internal port 9090')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '9090');
+});
+
+it('stores compose domain port overrides without wiping other services', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
+        ]),
+        'domain_port_overrides' => [
+            'https://api.example.com' => 4000,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainService', 'web')
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->set('newDomainPartsChanged', false)
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 8080');
+
+    $this->application->refresh();
+    $domains = json_decode($this->application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'web.domain'))
+        ->toContain('https://web.example.com')
+        ->not->toContain(':8080')
+        ->and($this->application->fqdn)->toBeNull()
+        ->and($this->application->domain_port_overrides)
+        ->toHaveKey('https://web.example.com', 8080)
+        ->toHaveKey('https://api.example.com', 4000);
+});
+
+it('prunes a compose domain port override when that domain is removed', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com', 'redirect' => 'both'],
+            'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
+        ]),
+        'domain_port_overrides' => [
+            'https://web.example.com' => 8080,
+            'https://api.example.com' => 4000,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $this->application->refresh();
+
+    expect($this->application->domain_port_overrides)
+        ->not->toHaveKey('https://web.example.com')
+        ->toHaveKey('https://api.example.com', 4000)
+        ->and($this->application->fqdn)->toBeNull();
+});
+
+function applicationDomainPortOverrideApiToken(User $user, Team $team): string
+{
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'application-domain-port-override-api',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $team->id,
+    ]);
+    auth()->logout();
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+it('application domain port override API update containing a port persists a portless FQDN and override', function () {
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://example.com:8080',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe(['https://example.com' => 8080]);
+});
+
+it('application domain port override API update omitting ports preserves overrides for unchanged domains', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://one.example.com,https://two.example.com',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://one.example.com,https://two.example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+});
+
+it('application domain port override API domain removal prunes the override', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://two.example.com',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://two.example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 8080]);
+});
+
+it('application domain port override API update of an unrelated field does not rewrite a legacy FQDN', function () {
+    $this->application->update([
+        'fqdn' => 'https://legacy.example.com',
+        'description' => 'before',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertOk();
+
+    expect($this->application->fresh()->fqdn)->toBe('https://legacy.example.com:9090');
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'description' => 'unrelated',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://legacy.example.com:9090')
+        ->and($application->description)->toBe('unrelated')
+        ->and($application->domain_port_overrides)->toBeNull();
+});
+
+it('treats ports exposes and existing domain ports as available internal ports', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:9090',
+    ]);
+
+    $application = $this->application->fresh();
+
+    expect($application->availableInternalPorts())->toBe([3000, 8080, 9090])
+        ->and($application->portRequiresConfirmation(3000))->toBeFalse()
+        ->and($application->portRequiresConfirmation(8080))->toBeFalse()
+        ->and($application->portRequiresConfirmation(9090))->toBeFalse()
+        ->and($application->portRequiresConfirmation(5555))->toBeTrue()
+        ->and($application->portRequiresConfirmation(null))->toBeFalse();
+});
+
+it('shows a port warning when an application domain uses a port that is not exposed or already used', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '5555')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 5555)
+        ->assertSee('Use a different port?');
+
+    expect($this->application->fresh()->fqdn)->toBeNull();
+});
+
+it('saves an unrecognized application domain port after confirming the warning', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '5555')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    $application = $this->application->fresh();
+
+    expect(explode(',', (string) $application->fqdn))
+        ->toContain('https://example.com')
+        ->and($application->domain_port_overrides['https://example.com'] ?? null)->toBe(5555);
+});
+
+it('does not warn when editing an application domain to a port already used by another domain', function () {
+    $this->application->update([
+        'ports_exposes' => '3000',
+        'fqdn' => 'https://one.example.com:9090,https://two.example.com',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->set('editingDomainParts.port', '9090')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
diff --git a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
index 08f769eb6a..54183b9300 100644
--- a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
+++ b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
@@ -15,6 +15,19 @@ use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
+class GeneralWithoutBuildpackSubmitSideEffects extends General
+{
+    public function render(): mixed
+    {
+        return view('livewire.project.application.general');
+    }
+
+    public function submit($showToaster = true): void
+    {
+        $this->application->save();
+    }
+}
+
 beforeEach(function () {
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -85,3 +98,54 @@ test('existing application shows railpack without beta label in build pack selec
         ->assertDontSee('Railpack (Beta)')
         ->assertDontSee('Railpack (beta)');
 });
+
+test('switching from railpack to compose preserves the existing application domains', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'railpack',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'fqdn' => 'https://example.com,https://www.example.com',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(GeneralWithoutBuildpackSubmitSideEffects::class, ['application' => $application])
+        ->assertSuccessful()
+        ->set('buildPack', 'dockercompose')
+        ->assertSet('dockerComposeLocation', '/docker-compose.yaml');
+
+    expect($application->refresh()->fqdn)
+        ->toBe('https://example.com,https://www.example.com');
+});
+
+test('networking section hints that internal ports can be set per domain', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'ports_exposes' => '3000,3001',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    $domainsUrl = route('project.application.domains', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->assertSeeInOrder([
+            'Ports exposes',
+            'You can also set an internal port per domain on',
+            'Port mappings',
+        ])
+        ->assertSee($domainsUrl, false);
+});
diff --git a/tests/Feature/ApplicationGeneralLayoutTest.php b/tests/Feature/ApplicationGeneralLayoutTest.php
index f2daac9a96..41f62022af 100644
--- a/tests/Feature/ApplicationGeneralLayoutTest.php
+++ b/tests/Feature/ApplicationGeneralLayoutTest.php
@@ -13,6 +13,14 @@ test('compose actions are grouped with the application details header', function
         ->toContain('Reload compose');
 });
 
+test('compose file loading waits for the user to confirm the file location', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
+
+    expect($view)
+        ->toContain('x-on:click="$wire.dispatch(\'loadCompose\', false)"')
+        ->not->toContain('x-init="$wire.dispatch(\'loadCompose\', true)"');
+});
+
 test('docker compose heading separates its title and action', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
 
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index ebcb51fe19..0c40d4a86c 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -10,10 +10,20 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use phpseclib3\Crypt\EC;
 
 uses(RefreshDatabase::class);
 
+function disableExactProxyLabels(Application $application): Application
+{
+    $settings = $application->destination->server->settings;
+    $settings->generate_exact_labels = false;
+    $settings->save();
+
+    return $application;
+}
+
 beforeEach(function () {
     $this->user = User::factory()->create();
     $this->team = Team::factory()->create();
@@ -454,3 +464,138 @@ YAML,
         ->toContain('traefik.docker.network=custom-network')
         ->not->toContain("traefik.docker.network={$application->uuid}");
 });
+
+test('generateLabelsApplication routes portless domains to saved internal port overrides for Traefik and Caddy', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '80',
+        'fqdn' => 'https://one.example.com,https://two.example.com',
+        'domain_port_overrides' => [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    $labels = collect(generateLabelsApplication($application));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$application->uuid.'.rule=Host(`one.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-'.$application->uuid.'.rule=Host(`two.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-'.$application->uuid.'.loadbalancer.server.port=8080')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('Host(`one.example.com:3000`)')
+        ->not->toContain('Host(`two.example.com:8080`)');
+});
+
+test('generateLabelsApplication uses the first ports_exposes value when a portless domain has no override', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '4000,5000',
+        'fqdn' => 'https://plain.example.com',
+        'domain_port_overrides' => null,
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    $labels = collect(generateLabelsApplication($application));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=4000')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}');
+});
+
+test('generateLabelsApplication keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '80',
+        'fqdn' => 'https://legacy.example.com',
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    DB::table('applications')->where('id', $application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($application->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$application->uuid.'.rule=Host(`legacy.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=9090')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
+
+test('applicationParser compose labels receive the application domain port override map', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $application->update([
+        'domain_port_overrides' => [
+            'https://frontend.example.com' => 8080,
+        ],
+    ]);
+
+    $parsedCompose = applicationParser($application->fresh());
+    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8080')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8080}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
+        ->toBeTrue();
+});
+
+test('applicationParser compose labels use the first ports_exposes value when a portless domain has no override', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $parsedCompose = applicationParser($application->fresh());
+    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=3000')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 3000}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
+        ->toBeTrue();
+});
diff --git a/tests/Feature/ApplicationPreviewApiTest.php b/tests/Feature/ApplicationPreviewApiTest.php
index bc405d48ba..a994833990 100644
--- a/tests/Feature/ApplicationPreviewApiTest.php
+++ b/tests/Feature/ApplicationPreviewApiTest.php
@@ -12,6 +12,7 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Visus\Cuid2\Cuid2;
 
@@ -19,6 +20,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     Bus::fake();
+    config()->set('app.maintenance.store', 'array');
     InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
 
     $this->team = Team::factory()->create();
@@ -130,3 +132,273 @@ describe('DELETE /api/v1/applications/{uuid}/previews/{pull_request_id}', functi
         $response->assertForbidden();
     });
 });
+
+describe('PATCH /api/v1/applications/{uuid}/previews/{pull_request_id}', function () {
+    test('stores preview domain ports separately from portless public domains', function () {
+        $preview = createPreview($this->application, 42);
+
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/42", [
+                'domains' => 'https://one.example.com:3000,https://two.example.com:8080',
+            ])
+            ->assertOk()
+            ->assertJsonPath('domains', 'https://one.example.com,https://two.example.com');
+
+        expect($response->json('domain_port_overrides'))->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+
+        expect($preview->fresh()->fqdn)->toBe('https://one.example.com,https://two.example.com')
+            ->and($preview->fresh()->domain_port_overrides)->toBe([
+                'https://one.example.com' => 3000,
+                'https://two.example.com' => 8080,
+            ]);
+    });
+
+    test('clears an existing preview domain override when the submitted domain is portless', function () {
+        $preview = createPreview($this->application, 43);
+        $preview->update(['fqdn' => 'https://preview.example.com:8080']);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/43", [
+                'domains' => 'https://preview.example.com',
+            ])
+            ->assertOk()
+            ->assertJsonPath('domain_port_overrides', null);
+
+        expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+            ->and($preview->fresh()->domain_port_overrides)->toBeNull();
+    });
+
+    test('rejects invalid preview domains', function () {
+        createPreview($this->application, 44);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/44", [
+                'domains' => 'not-a-domain',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    });
+
+    test('rejects preview domain ports outside the valid TCP range', function (string $domain) {
+        createPreview($this->application, 59);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/59", [
+                'domains' => $domain,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    })->with([
+        'zero' => 'https://preview.example.com:0',
+        'above maximum' => 'https://preview.example.com:65536',
+    ]);
+
+    test('returns 403 when token lacks write ability', function () {
+        $readOnlyToken = createTeamApiToken($this->user, $this->team, ['read']);
+        createPreview($this->application, 45);
+
+        $this->withHeaders(previewAuthHeaders($readOnlyToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/45", [
+                'domains' => 'https://preview.example.com:3000',
+            ])
+            ->assertForbidden();
+    });
+
+    test('rejects a non-integer pull request id', function () {
+        createPreview($this->application, 1);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/1.9", [
+                'domains' => 'https://preview.example.com:3000',
+            ])
+            ->assertUnprocessable()
+            ->assertJson(['message' => 'Invalid pull_request_id.']);
+    });
+
+    test('detects conflicts after removing the submitted internal port', function () {
+        $otherApplication = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'fqdn' => 'https://taken.example.com',
+        ]);
+        createPreview($this->application, 46);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/46", [
+                'domains' => 'https://taken.example.com:3000',
+            ])
+            ->assertConflict()
+            ->assertJsonPath('conflicts.0.resource_uuid', $otherApplication->uuid);
+    });
+
+    test('detects conflicts with another preview domain', function () {
+        createPreview($this->application, 47)->update(['fqdn' => 'https://taken-preview.example.com:3000']);
+        createPreview($this->application, 48);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/48", [
+                'domains' => 'https://taken-preview.example.com:8080',
+            ])
+            ->assertConflict();
+    });
+
+    test('filters preview conflict candidates in the database', function () {
+        createPreview($this->application, 56)->update(['fqdn' => 'https://taken-preview.example.com']);
+        createPreview($this->application, 57)->update(['fqdn' => 'https://current-preview.example.com']);
+        createPreview($this->application, 58)->update(['fqdn' => 'https://unrelated.example.com']);
+
+        $queries = collect();
+        DB::listen(function ($query) use ($queries): void {
+            if (str_contains($query->sql, 'from "application_previews"')) {
+                $queries->push($query->sql);
+            }
+        });
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/57", [
+                'domains' => 'https://taken-preview.example.com',
+            ])
+            ->assertConflict();
+
+        expect($queries->first(fn (string $sql): bool => str_contains($sql, '"application_id" in (select')
+            && str_contains($sql, '"fqdn" is not null')
+            && str_contains($sql, '"fqdn" like ?')))->not->toBeNull();
+    });
+
+    test('updates Docker Compose preview domains with per-domain ports', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+        $preview = createPreview($this->application, 49);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/49", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://web-preview.example.com:8080'],
+                    ['name' => 'api', 'domain' => 'https://api-preview.example.com:3000'],
+                ],
+            ])
+            ->assertOk()
+            ->assertJsonPath('docker_compose_domains.0.name', 'web')
+            ->assertJsonPath('docker_compose_domains.0.domain', 'https://web-preview.example.com')
+            ->assertJsonPath('docker_compose_domains.1.name', 'api')
+            ->assertJsonPath('docker_compose_domains.1.domain', 'https://api-preview.example.com');
+
+        $preview->refresh();
+
+        expect(json_decode($preview->docker_compose_domains, true))->toBe([
+            'web' => ['domain' => 'https://web-preview.example.com'],
+            'api' => ['domain' => 'https://api-preview.example.com'],
+        ])->and($preview->fqdn)->toBe('https://web-preview.example.com,https://api-preview.example.com')
+            ->and($preview->domain_port_overrides)->toBe([
+                'https://web-preview.example.com' => 8080,
+                'https://api-preview.example.com' => 3000,
+            ]);
+    });
+
+    test('clears Docker Compose preview port overrides with portless domains', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        $preview = createPreview($this->application, 50);
+        $preview->update([
+            'fqdn' => 'https://web-preview.example.com:8080',
+            'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://web-preview.example.com']]),
+        ]);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/50", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://web-preview.example.com'],
+                ],
+            ])
+            ->assertOk()
+            ->assertJsonPath('domain_port_overrides', null);
+
+        expect($preview->fresh()->domain_port_overrides)->toBeNull();
+    });
+
+    test('rejects unknown Docker Compose preview services', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 51);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/51", [
+                'docker_compose_domains' => [
+                    ['name' => 'unknown', 'domain' => 'https://unknown.example.com:8080'],
+                ],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+
+    test('rejects the same Docker Compose preview domain on different internal ports', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 52);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/52", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://duplicate.example.com:8080'],
+                    ['name' => 'api', 'domain' => 'https://duplicate.example.com:3000'],
+                ],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+
+    test('rejects missing Compose services without changing the preview', function () {
+        $this->application->update(['build_pack' => 'dockercompose', 'docker_compose_raw' => '']);
+        $preview = createPreview($this->application, 53);
+        $originalFqdn = $preview->fresh()->fqdn;
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/53", [
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+
+        expect($preview->fresh()->fqdn)->toBe($originalFqdn);
+    });
+
+    test('rejects the domain field for Compose previews', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 54);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/54", [
+                'domains' => 'https://ignored.example.com',
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    });
+
+    test('rejects Docker Compose domains for non-Compose previews', function () {
+        createPreview($this->application, 55);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/55", [
+                'domains' => 'https://preview.example.com',
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+});
diff --git a/tests/Feature/ApplicationPreviewVolumeCleanupTest.php b/tests/Feature/ApplicationPreviewVolumeCleanupTest.php
new file mode 100644
index 0000000000..7f59f689fc
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewVolumeCleanupTest.php
@@ -0,0 +1,120 @@
+<?php
+
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $team = Team::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+        'user' => 'deploy',
+    ]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = $project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'build_pack' => 'dockerfile',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $this->preview = ApplicationPreview::create([
+        'uuid' => 'preview-volume-cleanup-test',
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/example/repository/pull/42',
+    ]);
+});
+
+it('deletes only named volumes that have the preview suffix enabled', function () {
+    $this->application->persistentStorages()->create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'host_path' => null,
+        'is_preview_suffix_enabled' => true,
+    ]);
+    $this->application->persistentStorages()->create([
+        'name' => 'shared-cache',
+        'mount_path' => '/cache',
+        'host_path' => null,
+        'is_preview_suffix_enabled' => false,
+    ]);
+    $this->application->persistentStorages()->create([
+        'name' => 'seed-data',
+        'mount_path' => '/seed',
+        'host_path' => '/srv/seed',
+        'is_preview_suffix_enabled' => true,
+    ]);
+    Process::fake(['*' => Process::result(output: '')]);
+
+    $this->preview->forceDelete();
+
+    Process::assertRanTimes(fn ($process) => str_contains($process->command, 'docker volume rm'), 1);
+    Process::assertRan(fn ($process) => str_contains($process->command, "docker volume rm -f 'app-data-pr-42'"));
+    Process::assertRan(fn ($process) => str_contains($process->command, "sudo docker volume rm -f 'app-data-pr-42'"));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'shared-cache'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'seed-data'));
+});
+
+it('reports Docker volume removal failures and keeps the preview record', function () {
+    $this->application->persistentStorages()->create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'host_path' => null,
+        'is_preview_suffix_enabled' => true,
+    ]);
+    Process::fake(['*' => Process::result(errorOutput: 'volume is in use', exitCode: 1)]);
+
+    expect(fn () => $this->preview->forceDelete())
+        ->toThrow(RuntimeException::class, 'volume is in use');
+
+    expect(ApplicationPreview::find($this->preview->id))->not->toBeNull();
+});
+
+it('continues removing preview volumes when an earlier volume is already absent', function () {
+    $this->application->persistentStorages()->create([
+        'name' => 'already-removed',
+        'mount_path' => '/removed',
+        'host_path' => null,
+        'is_preview_suffix_enabled' => true,
+    ]);
+    $this->application->persistentStorages()->create([
+        'name' => 'app-data',
+        'mount_path' => '/data',
+        'host_path' => null,
+        'is_preview_suffix_enabled' => true,
+    ]);
+    Process::fake(function ($process) {
+        if (str_contains($process->command, "docker volume rm -f 'already-removed-pr-42'")) {
+            return Process::result(
+                errorOutput: 'Error response from daemon: volume already-removed-pr-42 not found',
+                exitCode: 1,
+            );
+        }
+
+        return Process::result(output: 'app-data-pr-42');
+    });
+
+    $this->preview->forceDelete();
+
+    Process::assertRan(fn ($process) => str_contains($process->command, "docker volume rm -f 'already-removed-pr-42'"));
+    Process::assertRan(fn ($process) => str_contains($process->command, "docker volume rm -f 'app-data-pr-42'"));
+    expect(ApplicationPreview::find($this->preview->id))->toBeNull();
+});
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 6b82d55689..3e6e04629d 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -1,16 +1,24 @@
 <?php
 
 use App\Actions\Application\StopApplication;
+use App\Actions\Docker\GetContainersStatus;
+use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\BaseModel;
+use App\Models\Server;
 use App\Notifications\Application\RestartLimitReached;
+use Mockery\MockInterface;
 
 function applicationWithRestartState(array $attributes = []): Application
 {
     $application = new Application;
     $application->forceFill(array_merge([
         'status' => 'exited:unhealthy',
+        'container_present' => true,
         'restart_count' => 2,
         'max_restart_count' => 2,
+        'restart_limit_reached' => true,
         'last_restart_type' => 'crash',
         'last_restart_at' => now(),
     ], $attributes));
@@ -21,9 +29,51 @@ function applicationWithRestartState(array $attributes = []): Application
 it('detects applications stopped after reaching the crash restart limit', function () {
     expect(applicationWithRestartState()->stoppedAfterRestartLimit())->toBeTrue()
         ->and(applicationWithRestartState(['status' => 'running:unhealthy'])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['restart_count' => 1])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['max_restart_count' => 0])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['last_restart_type' => null])->stoppedAfterRestartLimit())->toBeFalse();
+        ->and(applicationWithRestartState(['restart_limit_reached' => false])->stoppedAfterRestartLimit())->toBeFalse();
+});
+
+it('keeps the restart limit state after Docker resets its counter', function () {
+    expect(applicationWithRestartState([
+        'restart_count' => 0,
+        'last_restart_type' => null,
+        'last_restart_at' => null,
+    ])->stoppedAfterRestartLimit())->toBeTrue();
+});
+
+it('preserves exited application state when the container snapshot is empty', function () {
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->setRelation('additional_servers', collect());
+    $application->forceFill([
+        'id' => 1,
+        'status' => 'exited:unhealthy',
+        'container_present' => true,
+        'restart_limit_reached' => true,
+    ]);
+    $application->shouldNotReceive('update');
+
+    $services = Mockery::mock();
+    $services->shouldReceive('get')->once()->andReturn(collect());
+
+    $server = Mockery::mock(Server::class, function (MockInterface $mock) use ($application, $services) {
+        $mock->shouldReceive('isFunctional')->once()->andReturnTrue();
+        $mock->shouldReceive('applications')->once()->andReturn(collect([$application]));
+        $mock->shouldReceive('databases')->once()->andReturn(collect());
+        $mock->shouldReceive('services')->once()->andReturn($services);
+        $mock->shouldReceive('previews')->once()->andReturn(collect());
+    })->makePartial();
+    $server->setRelation('team', (object) ['id' => 1]);
+
+    GetContainersStatus::run($server, collect(), collect());
+
+    expect($application->container_present)->toBeTrue()
+        ->and($application->restart_limit_reached)->toBeTrue();
+});
+
+it('does not infer the restart limit from an exited existing container', function () {
+    expect(applicationWithRestartState([
+        'container_present' => true,
+        'restart_limit_reached' => false,
+    ])->stoppedAfterRestartLimit())->toBeFalse();
 });
 
 it('shows a stopped after restart limit warning in the status badge', function () {
@@ -32,7 +82,8 @@ it('shows a stopped after restart limit warning in the status badge', function (
         'showRefreshButton' => false,
     ])->render();
 
-    expect($html)->toContain('Stopped after reaching restart limit (2/2).')
+    expect($html)->toContain('Restart limit reached')
+        ->not->toContain('Stopped after reaching restart limit (2/2).')
         ->and($html)->toContain('Container has crashed and Coolify stopped it after 2 restart attempts.');
 });
 
@@ -41,11 +92,12 @@ it('does not show the restart limit warning for a normal manual stop', function
         'resource' => applicationWithRestartState([
             'restart_count' => 0,
             'last_restart_type' => null,
+            'restart_limit_reached' => false,
         ]),
         'showRefreshButton' => false,
     ])->render();
 
-    expect($html)->not->toContain('Stopped after reaching restart limit');
+    expect($html)->not->toContain('Restart limit reached');
 });
 
 it('keeps restart tracking configurable when stopping an application', function () {
@@ -56,6 +108,59 @@ it('keeps restart tracking configurable when stopping an application', function
         ->and($resetRestartCount->getDefaultValue())->toBeTrue();
 });
 
+it('can stop an application without removing its containers', function () {
+    $method = new ReflectionMethod(StopApplication::class, 'handle');
+    $removeContainers = collect($method->getParameters())->firstWhere('name', 'removeContainers');
+    $action = file_get_contents(app_path('Actions/Application/StopApplication.php'));
+
+    expect($removeContainers)->not->toBeNull()
+        ->and($removeContainers->getDefaultValue())->toBeTrue()
+        ->and($action)->toContain('docker update --restart=no')
+        ->and($action)->toContain('if ($removeContainers)');
+});
+
+it('preserves containers and skips cleanup when the restart limit is reached', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($statusAction)->toContain('dockerCleanup: false')
+        ->and($statusAction)->toContain('resetRestartCount: false')
+        ->and($statusAction)->toContain('removeContainers: false')
+        ->and($statusAction)->toContain("['restart_limit_reached' => true]")
+        ->and($sentinelJob)->toContain("['restart_limit_reached' => true]");
+});
+
+it('atomically claims the restart limit transition before stopping and notifying', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    foreach ([$statusAction, $sentinelJob] as $detector) {
+        expect($detector)
+            ->toContain("->where('restart_limit_reached', false)")
+            ->toContain("->update(['restart_limit_reached' => true]) === 1");
+    }
+});
+
+it('clears the explicit restart limit state only after a successful main deployment', function () {
+    $method = new ReflectionMethod(ApplicationDeploymentJob::class, 'handleSuccessfulDeployment');
+    $source = file($method->getFileName());
+    $deploymentJob = implode(array_slice($source, $method->getStartLine() - 1, $method->getEndLine() - $method->getStartLine() + 1));
+
+    expect(substr_count($deploymentJob, "'restart_limit_reached'] = false"))->toBe(1)
+        ->and($deploymentJob)->toContain("if (\$this->pull_request_id === 0) {\n            \$restartState['restart_limit_reached'] = false;\n        }")
+        ->and($deploymentJob)->toContain('$this->application->update($restartState);')
+        ->and(substr_count($deploymentJob, '$this->application->update('))->toBe(1);
+});
+
+it('preserves restart-limit applications only while their exited container exists', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($statusAction)->toContain("'container_present' => false")
+        ->and($statusAction)->toContain("'restart_limit_reached' => false")
+        ->and($sentinelJob)->toContain('if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(');
+});
+
 it('uses the application link for restart limit notifications', function () {
     $application = new class extends Application
     {
@@ -80,3 +185,55 @@ it('uses the application link for restart limit notifications', function () {
 
     expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
 });
+
+it('uses the resolved environment project name in Slack restart limit notifications', function () {
+    $environment = (object) [
+        'uuid' => 'environment-uuid',
+        'name' => 'production',
+        'project' => (object) [
+            'uuid' => 'project-uuid',
+            'name' => 'Coolify',
+        ],
+    ];
+
+    $application = new class extends Application
+    {
+        public function link(): string
+        {
+            return 'https://coolify.test/application';
+        }
+    };
+    $application->forceFill(['name' => 'app']);
+    $application->setRelation('environment', $environment);
+
+    $preview = new ApplicationPreview;
+    $preview->forceFill([
+        'uuid' => 'preview-uuid',
+        'pull_request_id' => 42,
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $preview->setRelation('application', $application);
+
+    $serviceResource = new class extends BaseModel {};
+    $serviceResource->forceFill([
+        'name' => 'database',
+        'uuid' => 'service-resource-uuid',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $serviceResource->setRelation('service', new class($environment)
+    {
+        public function __construct(public object $environment) {}
+
+        public function link(): string
+        {
+            return 'https://coolify.test/service';
+        }
+    });
+
+    expect((new RestartLimitReached($preview))->toSlack()->description)
+        ->toContain('*Project:* Coolify')
+        ->and((new RestartLimitReached($serviceResource))->toSlack()->description)
+        ->toContain('*Project:* Coolify');
+});
diff --git a/tests/Feature/AuditEventsTest.php b/tests/Feature/AuditEventsTest.php
new file mode 100644
index 0000000000..703e70750e
--- /dev/null
+++ b/tests/Feature/AuditEventsTest.php
@@ -0,0 +1,1008 @@
+<?php
+
+use App\Http\Kernel;
+use App\Livewire\Project\Service\Heading;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
+use App\Livewire\Team\AuditLog;
+use App\Livewire\Team\Index as TeamIndex;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\AuditEvent;
+use App\Models\Environment;
+use App\Models\EnvironmentVariable;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use App\Traits\Auditable;
+use Illuminate\Database\QueryException;
+use Illuminate\Foundation\Http\Middleware\InvokeDeferredCallbacks;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+
+    InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    Log::spy();
+});
+
+test('audit inserts are deferred until after the response', function () {
+    $this->withDefer();
+
+    auditLog('ui.project.updated', [
+        'team_id' => $this->team->id,
+        'project_uuid' => 'project-123',
+        'project_name' => 'Website',
+    ]);
+
+    expect(AuditEvent::query()->count())->toBe(0);
+
+    defer()->invoke();
+
+    expect(AuditEvent::query()->count())->toBe(1);
+});
+
+test('multiple audit inserts in one request are all deferred', function () {
+    $this->withDefer();
+
+    auditLog('ui.application.deployed', [
+        'team_id' => $this->team->id,
+        'application_uuid' => 'app-123',
+    ]);
+    auditLog('ui.application.updated', [
+        'team_id' => $this->team->id,
+        'application_uuid' => 'app-123',
+    ]);
+
+    defer()->invoke();
+
+    expect(AuditEvent::query()->pluck('event')->all())->toBe([
+        'ui.application.deployed',
+        'ui.application.updated',
+    ]);
+});
+
+test('http kernel invokes deferred callbacks', function () {
+    $kernel = app(Kernel::class);
+    $middleware = (new ReflectionClass($kernel))->getProperty('middleware')->getValue($kernel);
+
+    expect($middleware)->toContain(InvokeDeferredCallbacks::class);
+});
+
+test('audit persistence failures do not fail the action', function () {
+    Schema::rename('audit_events', 'unavailable_audit_events');
+
+    try {
+        expect(fn () => auditLog('ui.project.updated', ['team_id' => $this->team->id]))
+            ->not->toThrow(Throwable::class);
+
+        Log::shouldHaveReceived('warning')->once()->with(
+            'Audit event persistence failed',
+            Mockery::on(fn (array $context): bool => $context === [
+                'event' => 'ui.project.updated',
+                'exception' => QueryException::class,
+            ]),
+        );
+    } finally {
+        Schema::rename('unavailable_audit_events', 'audit_events');
+    }
+});
+
+test('audit preparation failures log sanitized diagnostics without failing the action', function () {
+    $resourceName = new class
+    {
+        public function __toString(): string
+        {
+            throw new RuntimeException('sensitive audit metadata');
+        }
+    };
+
+    expect(fn () => auditLog('ui.project.updated', [
+        'team_id' => $this->team->id,
+        'project_name' => $resourceName,
+        'secret' => 'must not be logged',
+    ]))->not->toThrow(Throwable::class);
+
+    Log::shouldHaveReceived('warning')->once()->with(
+        'Audit event preparation failed',
+        Mockery::on(fn (array $context): bool => $context === [
+            'event' => 'ui.project.updated',
+            'exception' => RuntimeException::class,
+        ]),
+    );
+});
+
+test('audit log persists a structured event for the current team', function () {
+    auditLog('ui.application.updated', [
+        'application_uuid' => 'app-123',
+        'application_name' => 'Website',
+        'changed' => ['name'],
+    ]);
+
+    $event = AuditEvent::query()->sole();
+
+    expect($event->team_id)->toBe($this->team->id)
+        ->and($event->actor_id)->toBe($this->user->id)
+        ->and($event->actor_email)->toBe($this->user->email)
+        ->and($event->source)->toBe('ui')
+        ->and($event->action)->toBe('updated')
+        ->and($event->resource_type)->toBe('application')
+        ->and($event->resource_uuid)->toBe('app-123')
+        ->and($event->resource_name)->toBe('Website')
+        ->and($event->metadata['changed'])->toBe(['name']);
+});
+
+test('auditable models record authenticated create update and delete actions', function () {
+    $project = Project::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Website project',
+    ]);
+    $project->update(['name' => 'Renamed project']);
+    $project->delete();
+
+    $events = AuditEvent::query()->where('resource_type', 'project')->orderBy('id')->get();
+
+    expect($events->pluck('event')->all())->toBe([
+        'ui.project.created',
+        'ui.project.updated',
+        'ui.project.deleted',
+    ])->and($events[1]->metadata['changed_fields'])->toBe(['name']);
+});
+
+test('deleting a project dispatches deleted events for its environments', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = $project->environments()->sole();
+    AuditEvent::query()->delete();
+
+    $project->delete();
+
+    expect(AuditEvent::query()
+        ->where('event', 'ui.environment.deleted')
+        ->where('resource_uuid', $environment->uuid)
+        ->exists())->toBeTrue();
+});
+
+test('deleting a team dispatches updated events for transferred system-wide sources', function () {
+    Team::factory()->create(['id' => 0]);
+    $githubApp = GithubApp::query()->create([
+        'name' => 'System GitHub source',
+        'team_id' => $this->team->id,
+        'is_system_wide' => true,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+    ]);
+    $gitlabApp = GitlabApp::query()->create([
+        'name' => 'System GitLab source',
+        'team_id' => $this->team->id,
+        'is_system_wide' => true,
+        'api_url' => 'https://gitlab.com/api/v4',
+        'html_url' => 'https://gitlab.com',
+    ]);
+    AuditEvent::query()->delete();
+
+    $this->team->delete();
+
+    expect(AuditEvent::query()
+        ->where('event', 'ui.github_app.updated')
+        ->where('resource_uuid', $githubApp->uuid)
+        ->exists())->toBeTrue()
+        ->and(AuditEvent::query()
+            ->where('event', 'ui.gitlab_app.updated')
+            ->where('resource_uuid', $gitlabApp->uuid)
+            ->exists())->toBeTrue();
+});
+
+test('auditable model mutations succeed when audit persistence fails', function () {
+    Schema::rename('audit_events', 'unavailable_audit_events');
+
+    try {
+        $project = Project::factory()->create([
+            'team_id' => $this->team->id,
+            'name' => 'Persisted project',
+        ]);
+    } finally {
+        Schema::rename('unavailable_audit_events', 'audit_events');
+    }
+
+    expect($project->exists)->toBeTrue()
+        ->and(Project::query()->whereKey($project->id)->exists())->toBeTrue();
+});
+
+test('repeated events for the same resource are each persisted', function () {
+    auditLog('api.project.updated', [
+        'team_id' => $this->team->id,
+        'project_uuid' => 'project-123',
+        'changed_fields' => ['name'],
+    ]);
+    auditLog('api.project.updated', [
+        'team_id' => $this->team->id,
+        'project_uuid' => 'project-123',
+        'changed_fields' => ['description'],
+    ]);
+
+    $events = AuditEvent::query()->orderBy('id')->get();
+
+    expect($events)->toHaveCount(2)
+        ->and($events[0]->metadata['changed_fields'])->toBe(['name'])
+        ->and($events[1]->metadata['changed_fields'])->toBe(['description']);
+});
+
+test('automatic and explicit auditing both preserve their events', function () {
+    $project = Project::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Website project',
+    ]);
+
+    auditLog('ui.project.created', [
+        'team_id' => $this->team->id,
+        'project_uuid' => $project->uuid,
+        'project_name' => $project->name,
+        'audit_description' => 'Project created through the API',
+        'request_field' => 'preserved',
+    ]);
+
+    $events = AuditEvent::query()->where('event', 'ui.project.created')->orderBy('id')->get();
+
+    expect($events)->toHaveCount(2)
+        ->and($events[1]->description)->toBe('Project created through the API')
+        ->and($events[1]->metadata['request_field'])->toBe('preserved');
+});
+
+test('auditable models ignore unauthenticated mutations', function () {
+    auth()->logout();
+
+    Project::factory()->create(['team_id' => $this->team->id]);
+
+    expect(AuditEvent::query()->count())->toBe(0);
+});
+
+test('webhook audits resolve the team from the application', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    AuditEvent::query()->delete();
+    auth()->logout();
+    session()->forget('currentTeam');
+
+    auditLog('webhook.deployment.queued', [
+        'application_uuid' => $application->uuid,
+        'application_name' => $application->name,
+    ]);
+
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'webhook.deployment.queued',
+        'resource_uuid' => $application->uuid,
+    ]);
+});
+
+test('unauthenticated webhook failures without a team are preserved', function () {
+    auth()->logout();
+    session()->forget('currentTeam');
+
+    auditLogWebhookFailure('sentinel', 'token_missing');
+    auditLogWebhookFailure('stripe', 'invalid_signature');
+
+    $events = AuditEvent::query()->orderBy('id')->get();
+
+    expect($events)->toHaveCount(2)
+        ->and($events->pluck('event')->all())->toBe([
+            'webhook.sentinel.signature_failed',
+            'webhook.stripe.signature_failed',
+        ])
+        ->and($events->pluck('team_id')->all())->toBe([null, null]);
+});
+
+test('early Sentinel and Stripe rejections persist unscoped audit events', function () {
+    auth()->logout();
+    session()->forget('currentTeam');
+
+    $this->postJson('/api/v1/sentinel/push', [])->assertUnauthorized();
+
+    config(['subscription.stripe_webhook_secret' => 'whsec_test']);
+    $this->withHeader('Stripe-Signature', 'invalid')
+        ->call('POST', '/webhooks/payments/stripe/events', [], [], [], [], '{}')
+        ->assertBadRequest();
+
+    expect(AuditEvent::query()->orderBy('id')->pluck('event')->all())->toBe([
+        'webhook.sentinel.signature_failed',
+        'webhook.stripe.signature_failed',
+    ])->and(AuditEvent::query()->whereNotNull('team_id')->doesntExist())->toBeTrue();
+});
+
+test('unscoped audit events are only visible to the instance team', function () {
+    AuditEvent::factory()->create([
+        'team_id' => null,
+        'description' => 'Unscoped security failure',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertDontSee('Unscoped security failure');
+
+    $instanceTeam = Team::factory()->create(['id' => 0]);
+    $instanceTeam->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->user->unsetRelation('teams');
+    session(['currentTeam' => $instanceTeam]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('Unscoped security failure');
+});
+
+test('auditable models identify personal access token mutations as api events', function () {
+    $newToken = $this->user->createToken('audit-api');
+    $newToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $this->actingAs($this->user->withAccessToken($newToken->accessToken->fresh()));
+
+    Project::factory()->create(['team_id' => $this->team->id]);
+
+    expect(AuditEvent::query()->where('resource_type', 'project')->firstOrFail()->event)
+        ->toBe('api.project.created');
+});
+
+test('API audit events identify the responsible access token', function () {
+    $firstToken = $this->user->createToken('first-token');
+    $firstToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    $secondToken = $this->user->createToken('second-token');
+    $secondToken->accessToken->forceFill(['team_id' => $this->team->id])->save();
+
+    foreach ([$firstToken->accessToken->fresh(), $secondToken->accessToken->fresh()] as $token) {
+        $this->actingAs($this->user->withAccessToken($token));
+        auditLog('api.project.updated', ['team_id' => $this->team->id]);
+    }
+
+    $events = AuditEvent::query()->orderBy('id')->get();
+
+    expect($events->pluck('actor_token_id')->all())->toBe([
+        $firstToken->accessToken->id,
+        $secondToken->accessToken->id,
+    ])->and($events->pluck('actor_token_name')->all())->toBe([
+        'first-token',
+        'second-token',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('Token: first-token')
+        ->assertSee('Token: second-token');
+});
+
+test('API model mutations produce one audit event', function () {
+    $this->withoutExceptionHandling();
+    $token = $this->user->createToken('audit-api', ['root']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $response = $this->withToken($token->plainTextToken)->postJson('/api/v1/projects', [
+        'name' => 'Single API audit event',
+    ]);
+
+    $response->assertCreated();
+
+    expect(AuditEvent::query()
+        ->where('event', 'api.project.created')
+        ->where('resource_uuid', $response->json('uuid'))
+        ->count())->toBe(1);
+});
+
+test('API application updates produce one audit event', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    AuditEvent::query()->delete();
+
+    $token = $this->user->createToken('audit-api', ['root']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->patchJson("/api/v1/applications/{$application->uuid}", ['description' => 'Updated through API'])
+        ->assertOk();
+
+    expect(AuditEvent::query()
+        ->where('event', 'api.application.updated')
+        ->where('resource_uuid', $application->uuid)
+        ->count())->toBe(1);
+});
+
+test('deployment queue records rollback and cancellation operations', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+    AuditEvent::query()->delete();
+
+    $deployment = ApplicationDeploymentQueue::query()->create([
+        'application_id' => $application->id,
+        'deployment_uuid' => 'rollback-deployment',
+        'commit' => 'abc123',
+        'rollback' => true,
+        'status' => 'queued',
+    ]);
+
+    $deployment->update(['status' => 'cancelled-by-user']);
+
+    expect(AuditEvent::query()->orderBy('id')->pluck('event')->all())->toBe([
+        'ui.application.rollback',
+        'ui.deployment.cancelled',
+    ]);
+});
+
+test('team resource models opt in to automatic auditing', function (string $model) {
+    expect(class_uses_recursive($model))->toContain(Auditable::class);
+})->with([
+    Application::class,
+    Service::class,
+    Server::class,
+    Project::class,
+    Environment::class,
+    EnvironmentVariable::class,
+    SharedEnvironmentVariable::class,
+    PrivateKey::class,
+    StandalonePostgresql::class,
+    StandaloneMysql::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneRedis::class,
+    StandaloneKeydb::class,
+    StandaloneDragonfly::class,
+    StandaloneClickhouse::class,
+]);
+
+test('withoutAuditLogging suppresses mutations until the outer callback ends', function () {
+    $project = Project::factory()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Original project',
+        'description' => 'Original description',
+    ]);
+    AuditEvent::query()->delete();
+
+    $project->withoutAuditLogging(function () use ($project) {
+        $project->update(['name' => 'Outer suppressed']);
+
+        $project->withoutAuditLogging(function () use ($project) {
+            $project->update(['description' => 'Inner suppressed']);
+        });
+
+        $project->update(['name' => 'Still suppressed']);
+    });
+
+    expect(AuditEvent::query()->count())->toBe(0);
+
+    $project->update(['description' => 'Logged after suppression']);
+
+    expect(AuditEvent::query()->pluck('event')->all())->toBe(['ui.project.updated']);
+});
+
+test('status-only database updates do not record last online audit changes', function () {
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    foreach ([StandaloneClickhouse::class, StandaloneRedis::class] as $model) {
+        $attributes = [
+            'uuid' => fake()->uuid(),
+            'name' => 'Status test database',
+            'status' => 'exited',
+            'environment_id' => $environment->id,
+            'destination_type' => Server::class,
+            'destination_id' => 0,
+        ];
+        if ($model === StandaloneClickhouse::class) {
+            $attributes['clickhouse_admin_password'] = 'password';
+        }
+
+        $database = $model::create($attributes);
+        AuditEvent::query()->delete();
+
+        $database->update(['status' => 'running']);
+
+        expect(AuditEvent::query()->count())->toBe(0);
+
+        $database->update(['name' => 'Renamed status test database']);
+
+        $event = AuditEvent::query()->sole();
+
+        expect($event->metadata['changed_fields'])->toBe(['name']);
+        AuditEvent::query()->delete();
+    }
+});
+
+test('audit log redacts sensitive metadata', function () {
+    auditLog('api.application.updated', [
+        'team_id' => $this->team->id,
+        'application_uuid' => 'app-123',
+        'token' => 'secret-token',
+        'nested' => ['password' => 'secret-password', 'safe' => 'visible'],
+    ]);
+
+    $metadata = AuditEvent::query()->sole()->metadata;
+
+    expect($metadata['token'])->toBe('[REDACTED]')
+        ->and($metadata['nested']['password'])->toBe('[REDACTED]')
+        ->and($metadata['nested']['safe'])->toBe('visible');
+});
+
+test('audit log redacts common credential metadata keys', function (string $key) {
+    auditLog('api.application.updated', [
+        'team_id' => $this->team->id,
+        $key => 'sensitive-value',
+    ]);
+
+    expect(AuditEvent::query()->sole()->metadata[$key])->toBe('[REDACTED]');
+})->with([
+    'api_key',
+    'access_key',
+    'authorization',
+    'cookie',
+    'client_secret',
+]);
+
+test('audit event classification can use explicit resource and action context', function () {
+    auditLog('mcp.control', [
+        'team_id' => $this->team->id,
+        'resource' => 'application',
+        'action' => 'restart',
+        'resource_uuid' => 'app-123',
+    ]);
+
+    $event = AuditEvent::query()->sole();
+
+    expect($event->resource_type)->toBe('application')
+        ->and($event->action)->toBe('restart')
+        ->and($event->resource_uuid)->toBe('app-123');
+});
+
+test('team invitation audit logs redact the invitation email', function () {
+    auditLog('ui.team_invitation.created', [
+        'team_id' => $this->team->id,
+        'invitation_uuid' => 'invitation-123',
+        'invitation_email' => 'invitee@example.com',
+        'role' => 'member',
+        'via' => 'email',
+    ]);
+
+    $metadata = AuditEvent::query()->sole()->metadata;
+
+    expect($metadata['invitation_email'])->toBe('[REDACTED]')
+        ->and($metadata['invitation_uuid'])->toBe('invitation-123')
+        ->and($metadata['role'])->toBe('member')
+        ->and($metadata['via'])->toBe('email');
+});
+
+test('audit log page only shows events for the current team', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'description' => 'Website created',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => Team::factory()->create()->id,
+        'description' => 'Private app deleted',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('Website created')
+        ->assertDontSee('Private app deleted');
+});
+
+test('audit log is available under team settings', function () {
+    $this->get('/team/audit-log')
+        ->assertSuccessful()
+        ->assertSeeLivewire(AuditLog::class);
+});
+
+test('team members cannot view the audit log page', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    $this->get('/team/audit-log')->assertForbidden();
+});
+
+test('demoted team admins cannot make subsequent audit log requests', function () {
+    $component = Livewire::test(AuditLog::class);
+
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    auth()->setUser($this->user->fresh());
+
+    $component->set('search', 'deployment')->assertStatus(403);
+});
+
+test('team admins can query only their team audit events through the api', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'api.project.updated',
+        'source' => 'api',
+        'action' => 'updated',
+        'description' => 'Visible event',
+        'actor_email' => 'owner@example.com',
+        'actor_token_name' => 'production token',
+        'metadata' => ['changed_fields' => ['name']],
+        'ip_address' => '192.0.2.1',
+        'user_agent' => 'Sensitive user agent',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => Team::factory()->create()->id,
+        'event' => 'api.project.updated',
+        'source' => 'api',
+        'action' => 'updated',
+        'description' => 'Other team event',
+    ]);
+
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?source=api&action=updated')
+        ->assertOk()
+        ->assertJsonCount(1, 'data')
+        ->assertJsonPath('data.0.description', 'Visible event')
+        ->assertJsonMissingPath('data.0.actor_email')
+        ->assertJsonMissingPath('data.0.actor_token_id')
+        ->assertJsonMissingPath('data.0.actor_token_name')
+        ->assertJsonMissingPath('data.0.metadata')
+        ->assertJsonMissingPath('data.0.ip_address')
+        ->assertJsonMissingPath('data.0.user_agent');
+});
+
+test('team admins with sensitive read access can query full audit event details', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'actor_email' => 'owner@example.com',
+        'actor_token_name' => 'production token',
+        'metadata' => ['changed_fields' => ['name']],
+        'ip_address' => '192.0.2.1',
+        'user_agent' => 'Sensitive user agent',
+    ]);
+
+    $token = $this->user->createToken('audit-sensitive-read', ['read', 'read:sensitive']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events')
+        ->assertOk()
+        ->assertJsonPath('data.0.actor_email', 'owner@example.com')
+        ->assertJsonPath('data.0.actor_token_name', 'production token')
+        ->assertJsonPath('data.0.metadata.changed_fields.0', 'name')
+        ->assertJsonPath('data.0.ip_address', '192.0.2.1')
+        ->assertJsonPath('data.0.user_agent', 'Sensitive user agent');
+});
+
+test('tokens without sensitive read access cannot search private audit fields', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'actor_email' => 'private-audit@example.com',
+        'description' => 'Public description',
+    ]);
+
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?search=private-audit@example.com')
+        ->assertOk()
+        ->assertJsonCount(0, 'data');
+});
+
+test('team members cannot query audit events through the api', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+    $token = $member->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events')
+        ->assertForbidden();
+});
+
+test('audit events api rejects pagination and filter values outside the allowed bounds', function (string $query, string $field) {
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?'.$query)
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors([$field]);
+})->with([
+    'per_page below minimum' => ['per_page=0', 'per_page'],
+    'per_page above maximum' => ['per_page=101', 'per_page'],
+    'page below minimum' => ['page=0', 'page'],
+    'unsupported source' => ['source=unknown', 'source'],
+    'action longer than 255 characters' => ['action='.str_repeat('a', 256), 'action'],
+]);
+
+test('audit events api accepts valid pagination and filter values', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'api.project.updated',
+        'source' => 'api',
+        'action' => 'updated',
+        'description' => 'Visible event',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'ui.project.created',
+        'source' => 'ui',
+        'action' => 'created',
+        'description' => 'Other event',
+    ]);
+
+    $token = $this->user->createToken('audit-read', ['read']);
+    $token->accessToken->forceFill(['team_id' => $this->team->id])->save();
+    auth()->logout();
+    auth()->forgetGuards();
+
+    $this->withToken($token->plainTextToken)
+        ->getJson('/api/v1/audit-events?per_page=1&source=api&action=updated&search=Visible')
+        ->assertOk()
+        ->assertJsonCount(1, 'data')
+        ->assertJsonPath('data.0.description', 'Visible event')
+        ->assertJsonPath('per_page', 1);
+});
+
+test('audit source filter omits the unused system source', function () {
+    Livewire::test(AuditLog::class)
+        ->assertSee('All sources')
+        ->assertSee('Web UI')
+        ->assertSee('API')
+        ->assertSee('MCP')
+        ->assertSee('Webhook')
+        ->assertDontSee('System');
+});
+
+test('audit action filter includes actions recorded for the current team', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'action' => 'backup_schedule_deleted',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertViewHas('actionOptions', fn (array $options): bool => in_array([
+            'value' => 'backup_schedule_deleted',
+            'label' => 'Backup Schedule Deleted',
+        ], $options, true));
+});
+
+test('resource clone audit starts only after the destination server capability check', function () {
+    $source = file_get_contents(app_path('Livewire/Project/Shared/ResourceOperations.php'));
+
+    expect(strpos($source, "auditLog('ui.resource.clone_started'"))
+        ->toBeGreaterThan(strpos($source, 'if (! $server->canHostResources())'));
+});
+
+test('pull and restart records the service restart audit event after starting the service', function () {
+    $method = new ReflectionMethod(Heading::class, 'pullAndRestartEvent');
+    $source = file($method->getFileName());
+    $methodSource = implode('', array_slice($source, $method->getStartLine() - 1, $method->getEndLine() - $method->getStartLine() + 1));
+
+    expect($methodSource)
+        ->toContain("auditServiceAction('ui.service.restarted')")
+        ->and(strpos($methodSource, 'StartService::run'))->toBeLessThan(strpos($methodSource, 'auditServiceAction'));
+});
+
+test('critical operational events persist with their source action and actor', function (string $event) {
+    auditLog($event, [
+        'team_id' => $this->team->id,
+        'resource_uuid' => 'resource-123',
+        'resource_name' => 'Test resource',
+    ]);
+
+    $auditEvent = AuditEvent::query()->sole();
+
+    expect($auditEvent->event)->toBe($event)
+        ->and($auditEvent->source)->toBe(str($event)->before('.')->value())
+        ->and($auditEvent->action)->toBe(str($event)->afterLast('.')->value())
+        ->and($auditEvent->actor_email)->toBe($this->user->email);
+})->with([
+    'ui.application.stopped',
+    'ui.application.preview_stopped',
+    'ui.application.destination_stopped',
+    'ui.application.rollback',
+    'ui.deployment.cancelled',
+    'ui.service.started',
+    'ui.service.stopped',
+    'ui.service.restarted',
+    'ui.database.started',
+    'ui.database.stopped',
+    'ui.database.restarted',
+    'ui.proxy.stopped',
+    'ui.proxy.restarted',
+    'ui.database.backup_started',
+    'ui.database.backup_schedule_deleted',
+    'ui.database.import_started',
+    'ui.database.restore_started',
+    'ui.scheduled_task.executed',
+    'ui.api_token.created',
+    'ui.api_token.revoked',
+    'ui.team_member.role_updated',
+    'ui.team_member.removed',
+    'ui.team_invitation.created',
+    'ui.team_invitation.revoked',
+    'ui.server.docker_cleanup_started',
+    'ui.server.imported',
+    'ui.project.clone_started',
+    'ui.resource.clone_started',
+    'api.database.started',
+    'api.database.stopped',
+    'api.database.restarted',
+]);
+
+test('audit log uses the standard horizontally scrollable table layout on mobile', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'actor_name' => 'Visible Actor',
+        'actor_token_name' => 'visible-audit-token',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSeeHtml('class="overflow-x-auto"')
+        ->assertSeeHtml('class="data-table transition-opacity"')
+        ->assertSeeHtml('class="grid min-w-[760px] grid-cols-[14rem_minmax(0,1fr)_12rem_9rem]')
+        ->assertSeeHtml('class="self-center text-right text-[11px]')
+        ->assertSeeHtml('title="Token: visible-audit-token"')
+        ->assertSee('Actor')
+        ->assertSee('Visible Actor');
+});
+
+test('audit log displays source abbreviations in uppercase', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'source' => 'cli',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->assertSee('CLI');
+});
+
+test('audit log page filters events by search and action', function () {
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'action' => 'created',
+        'description' => 'Website created',
+        'resource_name' => 'Website',
+    ]);
+    AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'event' => 'api.server.deleted',
+        'action' => 'deleted',
+        'description' => 'Build server deleted',
+        'resource_name' => 'Build server',
+    ]);
+
+    Livewire::test(AuditLog::class)
+        ->set('search', 'Website')
+        ->assertSee('Website created')
+        ->assertDontSee('Build server deleted')
+        ->set('search', '')
+        ->set('action', 'deleted')
+        ->assertDontSee('Website created')
+        ->assertSee('Build server deleted');
+});
+
+test('updating team settings records an audit event', function () {
+    Livewire::test(TeamIndex::class)
+        ->set('name', 'Renamed team')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $event = AuditEvent::query()->where('action', 'updated')->sole();
+
+    expect($event->event)->toBe('ui.team.updated')
+        ->and($event->team_id)->toBe($this->team->id)
+        ->and($event->resource_name)->toBe('Renamed team');
+});
+
+test('updating an environment variable records an event without its value', function () {
+    $variable = SharedEnvironmentVariable::create([
+        'team_id' => $this->team->id,
+        'type' => 'team',
+        'key' => 'API_SECRET',
+        'value' => 'old-secret',
+    ]);
+
+    Livewire::test(Show::class, [
+        'env' => $variable,
+        'type' => 'team',
+    ])
+        ->call('loadValues')
+        ->set('value', 'new-secret')
+        ->call('submit')
+        ->assertHasNoErrors();
+
+    $event = AuditEvent::query()
+        ->where('resource_type', 'shared_environment_variable')
+        ->where('action', 'updated')
+        ->sole();
+
+    expect($event->event)->toBe('ui.shared_environment_variable.updated')
+        ->and($event->resource_name)->toBe('API_SECRET')
+        ->and(json_encode($event->metadata))->not->toContain('new-secret');
+});
+
+test('creating an application environment variable records an audit event', function () {
+    $this->withDefer();
+
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create(['environment_id' => $environment->id]);
+
+    $application->environment_variables()->create([
+        'key' => 'API_SECRET',
+        'value' => 'secret-value',
+    ]);
+
+    defer()->invoke();
+
+    $event = AuditEvent::query()
+        ->where('resource_type', 'environment_variable')
+        ->where('action', 'created')
+        ->where('resource_name', 'API_SECRET')
+        ->firstOrFail();
+
+    expect($event->team_id)->toBe($this->team->id)
+        ->and($event->resource_name)->toBe('API_SECRET')
+        ->and(json_encode($event->metadata))->not->toContain('secret-value');
+});
+
+test('database cleanup removes audit events older than 90 days', function () {
+    $old = AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'created_at' => now()->subDays(91),
+    ]);
+    $recent = AuditEvent::factory()->create([
+        'team_id' => $this->team->id,
+        'created_at' => now()->subDays(89),
+    ]);
+
+    AuditEvent::pruneExpired();
+
+    expect($old->fresh())->toBeNull()
+        ->and($recent->fresh())->not->toBeNull();
+});
diff --git a/tests/Feature/Auth/LoginRateLimitIPTest.php b/tests/Feature/Auth/LoginRateLimitIPTest.php
index e1b85ae5c0..9c2214c58a 100644
--- a/tests/Feature/Auth/LoginRateLimitIPTest.php
+++ b/tests/Feature/Auth/LoginRateLimitIPTest.php
@@ -8,7 +8,9 @@ use Illuminate\Support\Facades\RateLimiter;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    config()->set('app.maintenance.store', 'array');
+
+    InstanceSettings::forceCreate(['id' => 0]);
     RateLimiter::clear('login');
 
     $this->user = User::factory()->create([
@@ -66,3 +68,27 @@ test('successful login is still possible within rate limit', function () {
     $response->assertRedirect();
     expect($response->status())->not->toBe(429);
 });
+
+test('cloud login rate limits use the Cloudflare client ip', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    foreach (range(1, 5) as $attempt) {
+        $this->withHeader('CF-Connecting-IP', '2001:db8::10')
+            ->withHeader('X-Forwarded-For', '2001:db8::10, 108.162.221.29')
+            ->withServerVariables(['REMOTE_ADDR' => '10.0.0.5'])
+            ->post('/login', [
+                'email' => 'test@example.com',
+                'password' => 'wrong-password',
+            ])
+            ->assertRedirect();
+    }
+
+    $this->withHeader('CF-Connecting-IP', '2001:db8::20')
+        ->withHeader('X-Forwarded-For', '2001:db8::20, 108.162.221.29')
+        ->withServerVariables(['REMOTE_ADDR' => '10.0.0.5'])
+        ->post('/login', [
+            'email' => 'test@example.com',
+            'password' => 'wrong-password',
+        ])
+        ->assertRedirect();
+});
diff --git a/tests/Feature/AuthRateLimitClientIpTest.php b/tests/Feature/AuthRateLimitClientIpTest.php
new file mode 100644
index 0000000000..ff32dab6a9
--- /dev/null
+++ b/tests/Feature/AuthRateLimitClientIpTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Http\Request;
+
+it('uses the Cloudflare client ip on cloud', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    $request = Request::create('/', server: [
+        'REMOTE_ADDR' => '10.0.0.5',
+        'HTTP_CF_CONNECTING_IP' => '2001:db8::10',
+    ]);
+
+    expect(auth_rate_limit_ip($request))->toBe('2001:db8::10');
+});
+
+it('falls back to the resolved request ip when the Cloudflare header is invalid', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    $request = Request::create('/', server: [
+        'REMOTE_ADDR' => '203.0.113.10',
+        'HTTP_CF_CONNECTING_IP' => 'invalid',
+    ]);
+
+    expect(auth_rate_limit_ip($request))->toBe('203.0.113.10');
+});
+
+it('ignores the Cloudflare header on self-hosted instances', function () {
+    config()->set('constants.coolify.self_hosted', true);
+
+    $request = Request::create('/', server: [
+        'REMOTE_ADDR' => '203.0.113.20',
+        'HTTP_CF_CONNECTING_IP' => '2001:db8::20',
+    ]);
+
+    expect(auth_rate_limit_ip($request))->toBe('203.0.113.20');
+});
diff --git a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
index 31c30c1245..eb331a775f 100644
--- a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
@@ -1,8 +1,11 @@
 <?php
 
 use App\Livewire\Project\Application\Advanced as ApplicationAdvanced;
+use App\Livewire\Project\Application\General as ApplicationGeneral;
 use App\Livewire\Project\Application\Heading as ApplicationHeading;
 use App\Livewire\Project\Application\Rollback as ApplicationRollback;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show as EnvironmentVariableShow;
+use App\Livewire\Project\Shared\GetLogs;
 use App\Models\Application;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -10,9 +13,11 @@ use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -168,6 +173,60 @@ test('member cannot update application general settings', function () {
     expect($this->member->can('update', $this->application))->toBeFalse();
 });
 
+test('member cannot reset application labels', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $originalLabels = $this->application->custom_labels;
+
+    $component = app(ApplicationGeneral::class);
+    $component->application = $this->application;
+    $component->isContainerLabelReadonlyEnabled = true;
+
+    expect(fn () => $component->resetDefaultLabels(true))
+        ->toThrow(AuthorizationException::class);
+
+    expect($this->application->fresh()->custom_labels)->toBe($originalLabels);
+});
+
+test('member cannot load application environment variable values', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $environmentVariable = $this->application->environment_variables()->create([
+        'key' => 'SECRET_KEY',
+        'value' => 'super-secret-value',
+        'is_preview' => false,
+    ]);
+
+    Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $environmentVariable,
+        'type' => 'application',
+    ])
+        ->call('loadValues')
+        ->assertForbidden()
+        ->assertSet('valuesLoaded', false)
+        ->assertSet('value', null);
+});
+
+test('member cannot save application log timestamp settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $originalValue = $this->application->settings->is_include_timestamps;
+
+    Livewire::test(GetLogs::class, [
+        'resource' => $this->application,
+        'server' => $this->server,
+        'container' => $this->application->uuid,
+    ])
+        ->set('showTimeStamps', ! $originalValue)
+        ->call('instantSave')
+        ->assertSuccessful();
+
+    expect($this->application->settings->fresh()->is_include_timestamps)->toBe($originalValue);
+});
+
 // --- Application Advanced Livewire actions ---
 
 test('member cannot save application advanced settings', function () {
@@ -188,6 +247,21 @@ test('member cannot submit application advanced settings', function () {
         ->assertDispatched('error');
 });
 
+test('the private application advanced syncData helper is not remotely callable', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $original = (bool) $this->application->settings->is_force_https_enabled;
+
+    $component = Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->set('isForceHttpsEnabled', ! $original);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect((bool) $this->application->settings->fresh()->is_force_https_enabled)->toBe($original);
+});
+
 // --- Application Rollback Livewire actions ---
 
 test('member cannot save rollback settings', function () {
diff --git a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
index 89c3d5e2f4..7807f00a27 100644
--- a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Livewire\Project\Database\Heading;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -10,11 +11,12 @@ use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
 
     $this->team = Team::factory()->create();
 
@@ -89,6 +91,18 @@ test('member cannot update database', function () {
     expect($this->member->can('update', $this->database))->toBeFalse();
 });
 
+test('member cannot persist database activity status', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Heading::class, ['database' => $this->database])
+        ->call('activityFinished')
+        ->assertSuccessful()
+        ->assertDispatched('refresh');
+
+    expect($this->database->fresh()->started_at)->toBeNull();
+});
+
 // --- Database Policy: delete ---
 
 test('admin can delete database', function () {
diff --git a/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php b/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php
new file mode 100644
index 0000000000..68bb0ac8b2
--- /dev/null
+++ b/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php
@@ -0,0 +1,117 @@
+<?php
+
+use App\Livewire\Security\PrivateKey\Show as PrivateKeyShow;
+use App\Livewire\Source\Github\Change as GithubAppChange;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Storage::fake('ssh-keys');
+
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->member = User::factory()->create();
+    $this->team->members()->attach($this->owner, ['role' => 'owner']);
+    $this->team->members()->attach($this->member, ['role' => 'member']);
+});
+
+it('does not serialize a private key for a member who cannot update it', function () {
+    $privateKeyValue = PrivateKey::generateNewKeyPair('ed25519')['private_key'];
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key' => $privateKeyValue,
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyShow::class, ['private_key_uuid' => $privateKey->uuid])
+        ->assertSuccessful()
+        ->assertSet('privateKeyValue', '')
+        ->assertDontSee($privateKeyValue);
+});
+
+it('keeps a private key available to an owner who can update it', function () {
+    $privateKeyValue = PrivateKey::generateNewKeyPair('ed25519')['private_key'];
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key' => $privateKeyValue,
+    ]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyShow::class, ['private_key_uuid' => $privateKey->uuid])
+        ->assertSuccessful()
+        ->assertSet('privateKeyValue', $privateKeyValue);
+});
+
+it('does not serialize GitHub App secrets for a member who cannot update it', function () {
+    $githubApp = createGithubAppWithSecrets($this->team);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', null)
+        ->assertSet('webhookSecret', null)
+        ->assertDontSee('stored-client-secret')
+        ->assertDontSee('stored-webhook-secret');
+});
+
+it('does not serialize secrets from a system-wide GitHub App for another team', function () {
+    $githubApp = createGithubAppWithSecrets($this->team, isSystemWide: true);
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherTeam->members()->attach($otherUser, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', null)
+        ->assertSet('webhookSecret', null)
+        ->assertDontSee('stored-client-secret')
+        ->assertDontSee('stored-webhook-secret');
+});
+
+it('keeps GitHub App secrets available to an owner who can update it', function () {
+    $githubApp = createGithubAppWithSecrets($this->team);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', 'stored-client-secret')
+        ->assertSet('webhookSecret', 'stored-webhook-secret');
+});
+
+function createGithubAppWithSecrets(Team $team, bool $isSystemWide = false): GithubApp
+{
+    return GithubApp::query()->create([
+        'team_id' => $team->id,
+        'name' => 'security-test-app',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'client_secret' => 'stored-client-secret',
+        'webhook_secret' => 'stored-webhook-secret',
+        'is_system_wide' => $isSystemWide,
+    ]);
+}
diff --git a/tests/Feature/Authorization/NotificationAuthorizationTest.php b/tests/Feature/Authorization/NotificationAuthorizationTest.php
index 793f76b1f2..d4fa8dfc94 100644
--- a/tests/Feature/Authorization/NotificationAuthorizationTest.php
+++ b/tests/Feature/Authorization/NotificationAuthorizationTest.php
@@ -10,6 +10,7 @@ use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -43,13 +44,14 @@ test('member cannot send test notification on discord', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update discord notification settings', function () {
+test('the private discord syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(DiscordNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(DiscordNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update discord notification settings', function () {
@@ -78,13 +80,14 @@ test('member cannot send test notification on slack', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update slack notification settings', function () {
+test('the private slack syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(SlackNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(SlackNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update slack notification settings', function () {
@@ -114,13 +117,14 @@ test('member cannot send test notification on telegram', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update telegram notification settings', function () {
+test('the private telegram syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(TelegramNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(TelegramNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update telegram notification settings', function () {
@@ -132,6 +136,83 @@ test('admin can update telegram notification settings', function () {
     expect($this->admin->can('update', $settings))->toBeTrue();
 });
 
+test('telegram restart limit thread id accepts 255 characters', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 255))
+        ->call('submit')
+        ->assertHasNoErrors(['telegramNotificationsRestartLimitReachedThreadId']);
+
+    expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
+        ->toBe(str_repeat('a', 255));
+});
+
+test('telegram restart limit thread id rejects 256 characters', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 256))
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
+        ->not->toBe(str_repeat('a', 256));
+});
+
+test('member cannot view telegram thread ids', function () {
+    $threadIds = [
+        'telegram_notifications_deployment_success_thread_id' => 'deployment-success-thread',
+        'telegram_notifications_deployment_failure_thread_id' => 'deployment-failure-thread',
+        'telegram_notifications_status_change_thread_id' => 'status-change-thread',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'restart-limit-thread',
+        'telegram_notifications_backup_success_thread_id' => 'backup-success-thread',
+        'telegram_notifications_backup_failure_thread_id' => 'backup-failure-thread',
+        'telegram_notifications_scheduled_task_success_thread_id' => 'scheduled-task-success-thread',
+        'telegram_notifications_scheduled_task_failure_thread_id' => 'scheduled-task-failure-thread',
+        'telegram_notifications_docker_cleanup_success_thread_id' => 'docker-cleanup-success-thread',
+        'telegram_notifications_docker_cleanup_failure_thread_id' => 'docker-cleanup-failure-thread',
+        'telegram_notifications_server_disk_usage_thread_id' => 'server-disk-usage-thread',
+        'telegram_notifications_server_reachable_thread_id' => 'server-reachable-thread',
+        'telegram_notifications_server_unreachable_thread_id' => 'server-unreachable-thread',
+        'telegram_notifications_server_patch_thread_id' => 'server-patch-thread',
+        'telegram_notifications_traefik_outdated_thread_id' => 'traefik-outdated-thread',
+    ];
+
+    $this->team->telegramNotificationSettings->update($threadIds);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(TelegramNotification::class);
+
+    foreach ($threadIds as $column => $threadId) {
+        $component
+            ->assertSet(str($column)->camel()->toString(), null)
+            ->assertDontSee($threadId);
+    }
+});
+
+test('admin can view telegram thread ids', function () {
+    $threadIds = [
+        'telegram_notifications_deployment_success_thread_id' => 'deployment-success-thread',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'restart-limit-thread',
+    ];
+
+    $this->team->telegramNotificationSettings->update($threadIds);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(TelegramNotification::class);
+
+    foreach ($threadIds as $column => $threadId) {
+        $component->assertSet(str($column)->camel()->toString(), $threadId);
+    }
+});
+
 // --- Email ---
 
 test('member cannot send test email notification', function () {
@@ -152,13 +233,14 @@ test('member cannot send test email notification', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update email notification settings', function () {
+test('the private email syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(EmailNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(EmailNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('member cannot update smtp email transport directly', function () {
@@ -256,13 +338,14 @@ test('member cannot send test notification on pushover', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update pushover notification settings', function () {
+test('the private pushover syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(PushoverNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(PushoverNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update pushover notification settings', function () {
@@ -291,13 +374,14 @@ test('member cannot send test notification on webhook', function () {
         ->assertDispatched('error');
 });
 
-test('member cannot update webhook notification settings', function () {
+test('the private webhook syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(WebhookNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(WebhookNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update webhook notification settings', function () {
diff --git a/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php b/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
new file mode 100644
index 0000000000..5a44b26c40
--- /dev/null
+++ b/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
@@ -0,0 +1,180 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\Add;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Events\RouteMatched;
+use Illuminate\Support\Facades\Event;
+use Livewire\Exceptions\MethodNotFoundException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $this->project->environments()->first();
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $this->application->id,
+        'name' => 'validate-benign',
+        'command' => 'echo scheduled-ok',
+        'frequency' => '0 0 * * *',
+        'timeout' => 300,
+        'enabled' => true,
+    ]);
+});
+
+afterEach(function () {
+    Event::forget(RouteMatched::class);
+});
+
+function bindApplicationScheduledTaskRoute(Application $application, ScheduledTask $task): void
+{
+    $application->loadMissing('environment.project');
+
+    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($application, $task): void {
+        $event->route->setParameter('task_uuid', $task->uuid);
+        $event->route->setParameter('project_uuid', $application->environment->project->uuid);
+        $event->route->setParameter('environment_uuid', $application->environment->uuid);
+        $event->route->setParameter('application_uuid', $application->uuid);
+    });
+}
+
+function originalScheduledTaskState(ScheduledTask $task): array
+{
+    return $task->only(['name', 'command', 'frequency', 'timeout', 'enabled', 'container']);
+}
+
+test('read-only member can view an existing scheduled task', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    Livewire::test(Show::class)
+        ->assertSuccessful()
+        ->assertSet('name', 'validate-benign')
+        ->assertSet('command', 'echo scheduled-ok')
+        ->assertSet('frequency', '0 0 * * *');
+});
+
+test('the private syncData helper is not remotely callable through Livewire', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    $original = originalScheduledTaskState($this->task);
+
+    $component = Livewire::test(Show::class)
+        ->set('name', 'member-edited')
+        ->set('command', 'echo member-edited')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 120)
+        ->set('isEnabled', true);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect(originalScheduledTaskState($this->task->fresh()))->toBe($original);
+});
+
+test('read-only member cannot persist scheduled task changes through submit', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    $original = originalScheduledTaskState($this->task);
+
+    Livewire::test(Show::class)
+        ->set('name', 'member-edited')
+        ->set('command', 'echo member-edited')
+        ->set('frequency', '* * * * *')
+        ->call('submit');
+
+    expect(originalScheduledTaskState($this->task->fresh()))->toBe($original);
+});
+
+test('the private saveScheduledTask helper is not remotely callable through Livewire', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(Add::class, [
+        'id' => (string) $this->application->id,
+        'type' => 'application',
+        'containerNames' => collect(),
+    ])
+        ->set('name', 'member-created')
+        ->set('command', 'id')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 300);
+
+    expect(fn () => $component->call('saveScheduledTask'))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect(ScheduledTask::query()->where('name', 'member-created')->exists())->toBeFalse();
+});
+
+test('read-only member cannot create a scheduled task through submit', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Add::class, [
+        'id' => (string) $this->application->id,
+        'type' => 'application',
+        'containerNames' => collect(),
+    ])
+        ->set('name', 'member-created')
+        ->set('command', 'id')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 300)
+        ->call('submit');
+
+    expect(ScheduledTask::query()->where('name', 'member-created')->exists())->toBeFalse();
+});
+
+test('admin can persist scheduled task changes through submit', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    Livewire::test(Show::class)
+        ->set('name', 'updated-by-admin')
+        ->set('command', 'echo admin-ok')
+        ->set('frequency', '0 1 * * *')
+        ->set('timeout', 600)
+        ->call('submit')
+        ->assertSuccessful();
+
+    $this->task->refresh();
+
+    expect($this->task->name)->toBe('updated-by-admin')
+        ->and($this->task->command)->toBe('echo admin-ok')
+        ->and($this->task->frequency)->toBe('0 1 * * *')
+        ->and($this->task->timeout)->toBe(600);
+});
diff --git a/tests/Feature/Authorization/SecurityAuthorizationTest.php b/tests/Feature/Authorization/SecurityAuthorizationTest.php
new file mode 100644
index 0000000000..b36bcc3e49
--- /dev/null
+++ b/tests/Feature/Authorization/SecurityAuthorizationTest.php
@@ -0,0 +1,57 @@
+<?php
+
+use App\Livewire\Security\CloudInitScripts;
+use App\Livewire\Security\CloudProviderTokenForm;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+});
+
+test('member cannot create a cloud provider token through the public action', function () {
+    Http::fake(['*' => Http::response([], 200)]);
+
+    Livewire::test(CloudProviderTokenForm::class)
+        ->set('provider', 'hetzner')
+        ->set('token', 'secret-token')
+        ->set('name', 'Unauthorized token')
+        ->call('addToken')
+        ->assertForbidden();
+
+    expect(CloudProviderToken::query()->count())->toBe(0);
+});
+
+test('member cannot load cloud-init scripts through the public action', function () {
+    $script = CloudInitScript::query()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Protected script',
+        'script' => '#cloud-config',
+    ]);
+
+    CloudInitScript::query()->whereKey($script)->update(['uuid' => null]);
+
+    $component = app(CloudInitScripts::class);
+
+    expect(fn () => $component->loadScripts())
+        ->toThrow(AuthorizationException::class);
+
+    expect($script->refresh()->uuid)->toBeNull();
+});
diff --git a/tests/Feature/Authorization/ServerAuthorizationTest.php b/tests/Feature/Authorization/ServerAuthorizationTest.php
index c9e7ec10d6..353c6a687d 100644
--- a/tests/Feature/Authorization/ServerAuthorizationTest.php
+++ b/tests/Feature/Authorization/ServerAuthorizationTest.php
@@ -3,7 +3,9 @@
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Livewire\Server\Create as ServerCreate;
 use App\Livewire\Server\Index as ServerIndex;
+use App\Livewire\Server\LogDrains;
 use App\Livewire\Server\Navbar as ServerNavbar;
+use App\Livewire\Server\ValidateAndInstall;
 use App\Models\CloudProviderToken;
 use App\Models\InstanceSettings;
 use App\Models\Server;
@@ -12,6 +14,7 @@ use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -59,6 +62,24 @@ test('member cannot update server', function () {
     expect($this->member->can('update', $this->server))->toBeFalse();
 });
 
+test('member cannot invoke server validation write steps', function (string $method) {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    $before = $this->server->fresh()->getAttributes();
+
+    Livewire::test(ValidateAndInstall::class, ['server' => $this->server])
+        ->call($method)
+        ->assertForbidden();
+
+    expect($this->server->fresh()->getAttributes())->toBe($before);
+})->with([
+    'init',
+    'validateOS',
+    'validatePrerequisites',
+    'validateDockerEngine',
+    'validateDockerVersion',
+]);
+
 // --- Server Policy: delete ---
 
 test('admin can delete server', function () {
@@ -79,6 +100,20 @@ test('member can view server', function () {
     expect($this->member->can('view', $this->server))->toBeTrue();
 });
 
+test('the private log drain syncData helper is not remotely callable', function () {
+    $this->withoutVite();
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('isLogDrainAxiomEnabled', true);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect((bool) $this->server->settings->fresh()->is_logdrain_axiom_enabled)->toBeFalse();
+});
+
 // --- Server Policy: manageProxy ---
 
 test('admin can manage proxy', function () {
diff --git a/tests/Feature/CheckDomainDnsJobTest.php b/tests/Feature/CheckDomainDnsJobTest.php
new file mode 100644
index 0000000000..d760fdcc45
--- /dev/null
+++ b/tests/Feature/CheckDomainDnsJobTest.php
@@ -0,0 +1,148 @@
+<?php
+
+use App\Actions\Shared\CheckDomainDns;
+use App\Jobs\CheckDomainDnsJob;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+afterEach(fn () => CheckDomainDns::clearFake());
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::create([
+        'id' => 0,
+        'is_dns_validation_enabled' => false,
+    ]));
+
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => 1,
+        'destination_type' => 'App\\Models\\StandaloneDocker',
+        'fqdn' => 'https://app.example.com',
+        'domain_dns_statuses' => [
+            'https://app.example.com' => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'expected_ip' => null,
+                'checked_at' => null,
+                'check_id' => 'test-check',
+            ],
+        ],
+    ]);
+});
+
+it('persists a skipped result when dns validation is disabled', function () {
+    (new CheckDomainDnsJob(
+        $this->application,
+        'https://app.example.com',
+        'https://app.example.com',
+        null,
+        null,
+        'test-check',
+    ))->handle();
+
+    $status = $this->application->fresh()->domain_dns_statuses['https://app.example.com'];
+
+    expect($status['status'])->toBe('skipped')
+        ->and($status['message'])->toBe('DNS validation is disabled in instance settings.')
+        ->and($status['checked_at'])->not->toBeNull();
+});
+
+it('persists dns results for application previews', function () {
+    $statusKey = hash('sha256', 'https://preview.example.com|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 41,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/41',
+        'fqdn' => 'https://preview.example.com',
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'preview-check',
+            ],
+        ],
+    ]);
+
+    (new CheckDomainDnsJob(
+        $preview,
+        $statusKey,
+        'https://preview.example.com',
+        null,
+        null,
+        'preview-check',
+    ))->handle();
+
+    expect($preview->fresh()->domain_dns_statuses[$statusKey]['status'])->toBe('skipped');
+});
+
+it('does not restore a dns status removed before the job finishes', function () {
+    $this->application->update(['domain_dns_statuses' => null]);
+
+    (new CheckDomainDnsJob(
+        $this->application,
+        'https://app.example.com',
+        'https://app.example.com',
+        null,
+        null,
+        'test-check',
+    ))->handle();
+
+    expect($this->application->fresh()->domain_dns_statuses)->toBeNull();
+});
+
+it('uses the shared dns action', function () {
+    CheckDomainDns::shouldRun()
+        ->once()
+        ->andReturn([
+            'https://app.example.com' => [
+                'status' => 'ok',
+                'message' => 'DNS looks correct.',
+                'expected_ip' => null,
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ]);
+
+    (new CheckDomainDnsJob(
+        $this->application,
+        'https://app.example.com',
+        'https://app.example.com',
+        null,
+        null,
+        'test-check',
+    ))->handle();
+
+    expect($this->application->fresh()->domain_dns_statuses['https://app.example.com']['status'])->toBe('ok');
+});
+
+it('does not let an older job overwrite a newer check for the same domain', function () {
+    $oldJob = new CheckDomainDnsJob(
+        $this->application,
+        'https://app.example.com',
+        'https://app.example.com',
+        null,
+        null,
+        'test-check',
+    );
+
+    $statuses = $this->application->domain_dns_statuses;
+    $statuses['https://app.example.com']['check_id'] = 'newer-check';
+    $this->application->update(['domain_dns_statuses' => $statuses]);
+
+    $oldJob->handle();
+
+    $status = $this->application->fresh()->domain_dns_statuses['https://app.example.com'];
+
+    expect($status['status'])->toBe('checking')
+        ->and($status['check_id'])->toBe('newer-check');
+});
diff --git a/tests/Feature/CleanupStuckedResourcesTest.php b/tests/Feature/CleanupStuckedResourcesTest.php
new file mode 100644
index 0000000000..24229cf3d1
--- /dev/null
+++ b/tests/Feature/CleanupStuckedResourcesTest.php
@@ -0,0 +1,44 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+it('deletes scheduled tasks whose configured owner no longer exists', function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+    Queue::fake();
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = $project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $project->id]);
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+    $validTask = ScheduledTask::factory()->create([
+        'team_id' => $team->id,
+        'application_id' => $application->id,
+    ]);
+    $orphanedTask = ScheduledTask::factory()->create([
+        'team_id' => $team->id,
+        'application_id' => PHP_INT_MAX,
+    ]);
+
+    $this->artisan('cleanup:stucked-resources')->assertSuccessful();
+
+    expect($validTask->fresh())->not->toBeNull()
+        ->and($orphanedTask->fresh())->toBeNull();
+});
diff --git a/tests/Feature/ComposeEditorLayoutTest.php b/tests/Feature/ComposeEditorLayoutTest.php
index d8538e82d7..d3fe92e45d 100644
--- a/tests/Feature/ComposeEditorLayoutTest.php
+++ b/tests/Feature/ComposeEditorLayoutTest.php
@@ -48,6 +48,27 @@ it('renders the compose editor with clear guidance settings and actions', functi
         ->not->toContain('Show Deployable Compose');
 });
 
+it('keeps the compose modal usable on mobile screens', function () {
+    $stackForm = file_get_contents(resource_path('views/livewire/project/service/stack-form.blade.php'));
+    $editor = file_get_contents(resource_path('views/livewire/project/service/edit-compose.blade.php'));
+    $modal = file_get_contents(resource_path('views/components/modal-input.blade.php'));
+
+    expect($modal)
+        ->toContain('justify-center p-2')
+        ->toContain('sm:p-4')
+        ->toContain('flex-wrap! sm:flex-nowrap!')
+        ->toContain('order-3 w-full sm:order-none sm:w-auto')
+        ->toContain('order-2 sm:order-none')
+        ->toContain("'mt-2 sm:mt-0' => isset(\$headerActions)");
+
+    expect($stackForm)
+        ->toContain('w-full items-center gap-2 overflow-x-auto sm:w-auto');
+
+    expect($editor)
+        ->toContain('flex-col items-stretch')
+        ->toContain('sm:flex-row sm:flex-wrap sm:items-center');
+});
+
 it('keeps the save button loading until the parent compose save finishes', function () {
     $component = file_get_contents(app_path('Livewire/Project/Service/StackForm.php'));
 
diff --git a/tests/Feature/DatabaseBackupUploadValidationTest.php b/tests/Feature/DatabaseBackupUploadValidationTest.php
index 74835feefd..88978eeaba 100644
--- a/tests/Feature/DatabaseBackupUploadValidationTest.php
+++ b/tests/Feature/DatabaseBackupUploadValidationTest.php
@@ -18,10 +18,45 @@ function writeScanPayload(string $content, bool $gzip = false): string
 /**
  * Execute the real shell scanner snippet (as it runs inside the container)
  * against a local payload file and return true when the restore is blocked.
+ *
+ * @param  array<string, string>  $env
  */
-function scannerBlocks(string $script): bool
+function scannerBlocks(string $script, array $env = []): bool
 {
-    return Process::run(['sh', '-c', $script])->exitCode() === 1;
+    $command = $script;
+
+    if ($env !== []) {
+        $exports = [];
+        foreach ($env as $name => $value) {
+            $exports[] = $name.'='.escapeshellarg($value);
+        }
+        $command = implode(' ', $exports).'; '.$script;
+    }
+
+    return Process::run(['sh', '-c', $command])->exitCode() === 1;
+}
+
+function fakePgRestorePath(string $sql, int $listExitCode = 0): string
+{
+    $dir = sys_get_temp_dir().'/coolify-fake-pg-'.uniqid();
+    mkdir($dir);
+
+    $sqlFile = $dir.'/archive.sql';
+    file_put_contents($sqlFile, $sql);
+
+    $escapedSqlFile = escapeshellarg($sqlFile);
+    file_put_contents($dir.'/pg_restore', <<<SH
+#!/bin/sh
+if [ "\$1" = '-l' ]; then exit {$listExitCode}; fi
+if [ "\$1" = '-f' ] && [ "\$2" = '-' ]; then
+  cat {$escapedSqlFile}
+  exit 0
+fi
+exit 1
+SH);
+    chmod($dir.'/pg_restore', 0755);
+
+    return $dir;
 }
 
 function invokeHasAllowedExtension(string $name): bool
@@ -185,15 +220,21 @@ test('file scanner allows ordinary gzipped dumps', function () {
     expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzClean))->toBeFalse();
 });
 
-test('file scanner allows PostgreSQL custom format archives', function () {
+test('file scanner detects program execution payloads inside custom format archives', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload");
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
 });
 
-test('file scanner allows gzipped PostgreSQL custom format archives', function () {
+test('file scanner detects program execution payloads inside gzipped custom format archives', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload", gzip: true);
 
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+});
+
+test('file scanner allows custom format archives without program execution', function () {
+    $archive = writeScanPayload("PGDMP\0binary archive without restore programs");
+
     expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
@@ -226,6 +267,8 @@ test('remote postgresql scanner blocks bypass payloads', function (string $conte
     'psql pipe redirect' => ["\\o | id\n", false],
     'psql query pipe redirect' => ["\\g | id\n", false],
     'gzipped comment bypass' => ["COPY x FROM/**/PROGRAM 'id';\n", true],
+    'custom format archive' => ["PGDMP\0binary COPY records FROM PROGRAM payload", false],
+    'custom format gzip archive' => ["PGDMP\0binary COPY records FROM PROGRAM payload", true],
 ]);
 
 test('remote postgresql scanner allows legitimate restores', function (string $content, bool $gzip) {
@@ -241,11 +284,26 @@ test('remote postgresql scanner allows legitimate restores', function (string $c
     'copy from stdin' => ["COPY users FROM stdin;\n1\tTaylor\n\\.\n", false],
     'plain select' => ["SELECT * FROM users;\n", false],
     'gzipped clean dump' => ["CREATE TABLE users (id int);\n", true],
-    'custom format archive' => ["PGDMP\0binary COPY records FROM PROGRAM payload", false],
-    'custom format gzip archive' => ["PGDMP\0binary COPY records FROM PROGRAM payload", true],
     'copy words in table data' => ["COPY notes FROM stdin;\n1\tcopy files from program storage\n\\.\n", false],
 ]);
 
+test('remote postgresql scanner inspects custom archives instead of skipping them', function () {
+    $component = backupValidationImportFormWithResource(StandalonePostgresql::class);
+    $safeArchive = writeScanPayload("PGDMP\0binary archive");
+    $maliciousSql = "COPY x FROM PROGRAM 'id';\n";
+    $safeSql = "CREATE TABLE users (id integer);\nCOPY users FROM stdin;\n1\tTaylor\n\\.\n";
+
+    $maliciousPath = fakePgRestorePath($maliciousSql);
+    $safePath = fakePgRestorePath($safeSql);
+    $unreadablePath = fakePgRestorePath($safeSql, listExitCode: 1);
+    $path = getenv('PATH') ?: '/usr/bin:/bin';
+
+    expect(scannerBlocks($component->buildPostgresRestoreScanScript($safeArchive), ['PATH' => $maliciousPath.':'.$path]))->toBeTrue()
+        ->and(scannerBlocks($component->buildPostgresRestoreScanScript($safeArchive), ['PATH' => $safePath.':'.$path]))->toBeFalse()
+        ->and(scannerBlocks($component->buildPostgresRestoreScanScript($safeArchive), ['PATH' => $unreadablePath.':'.$path]))->toBeTrue()
+        ->and(scannerBlocks($component->buildPostgresRestoreScanScript($safeArchive)))->toBeTrue();
+});
+
 test('MAX_BYTES constant is 10 GiB', function () {
     $constant = (new ReflectionClass(UploadController::class))->getConstant('MAX_BYTES');
     expect($constant)->toBe(10 * 1024 * 1024 * 1024);
diff --git a/tests/Feature/DatabaseRestoreDialogTest.php b/tests/Feature/DatabaseRestoreDialogTest.php
index 0086a6cf2f..5f78706a8c 100644
--- a/tests/Feature/DatabaseRestoreDialogTest.php
+++ b/tests/Feature/DatabaseRestoreDialogTest.php
@@ -8,3 +8,13 @@ test('database restore output opens in the centered process dialog', function ()
         ->toContain('<livewire:activity-monitor wire:key="database-restore-{{ $resourceUuid }}" header="Logs" fullHeight />')
         ->not->toContain('<x-slide-over @databaserestore.window="slideOverOpen = true"');
 });
+
+test('postgresql dump all restore warns that administrator passwords are overwritten', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/database/import-form.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($dumpAll)')
+        ->toContain('Full restore overwrites administrator passwords')
+        ->toContain('The backup replaces PostgreSQL administrator role passwords, including the destination administrator password.')
+        ->toContain("If the administrator password changes, update it in Coolify's database configuration after the restore.");
+});
diff --git a/tests/Feature/DatabaseStartActivityLoggingTest.php b/tests/Feature/DatabaseStartActivityLoggingTest.php
new file mode 100644
index 0000000000..ff8f0e8ec8
--- /dev/null
+++ b/tests/Feature/DatabaseStartActivityLoggingTest.php
@@ -0,0 +1,34 @@
+<?php
+
+use App\Actions\Database\StartDatabase;
+use App\Jobs\DatabaseStartJob;
+use App\Models\Server;
+use App\Models\ServerSetting;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneRedis;
+use Illuminate\Support\Facades\Bus;
+use Spatie\Activitylog\ActivityLogStatus;
+
+it('returns an actionable error when database start activity logging is disabled', function () {
+    config()->set('activitylog.enabled', false);
+    app(ActivityLogStatus::class)->disable();
+    Bus::fake();
+
+    $server = new Server(['ip' => '192.0.2.1']);
+    $server->setRelation('settings', new ServerSetting([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]));
+
+    $destination = new StandaloneDocker;
+    $destination->setRelation('server', $server);
+
+    $database = new StandaloneRedis;
+    $database->setRelation('destination', $destination);
+
+    $result = (new StartDatabase)->handle($database);
+
+    expect($result)->toBe('Database start could not be queued because activity logging is disabled.');
+    Bus::assertNotDispatched(DatabaseStartJob::class);
+});
diff --git a/tests/Feature/DeleteResourceJobAtomicityTest.php b/tests/Feature/DeleteResourceJobAtomicityTest.php
index 11955a82cd..801db44d14 100644
--- a/tests/Feature/DeleteResourceJobAtomicityTest.php
+++ b/tests/Feature/DeleteResourceJobAtomicityTest.php
@@ -2,13 +2,17 @@
 
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\ScheduledVolumeBackup;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
+use Illuminate\Foundation\Console\QueuedCommand;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\Queue;
 
@@ -45,6 +49,7 @@ it('deletes the Coolify resource when remote cleanup fails', function () {
     (new DeleteResourceJob($this->application))->handle();
 
     expect(Application::withTrashed()->find($this->application->id))->toBeNull();
+    Queue::assertNotPushed(QueuedCommand::class);
 });
 
 it('rolls back local metadata deletion when deleting the resource fails', function () {
@@ -62,3 +67,47 @@ it('rolls back local metadata deletion when deleting the resource fails', functi
     expect($this->storage->fresh())->not->toBeNull()
         ->and(Application::withTrashed()->find($this->application->id))->not->toBeNull();
 });
+
+it('deletes scheduled volume backups outside the local deletion transaction', function () {
+    $backup = $this->storage->scheduledBackups()->create([
+        'team_id' => $this->application->environment->project->team_id,
+        'frequency' => 'daily',
+        'timeout' => 3600,
+    ]);
+    $transactionLevel = DB::transactionLevel();
+    $deletingTransactionLevel = null;
+
+    ScheduledVolumeBackup::deleting(function (ScheduledVolumeBackup $deletingBackup) use ($backup, &$deletingTransactionLevel): void {
+        if ($deletingBackup->is($backup)) {
+            $deletingTransactionLevel = DB::transactionLevel();
+        }
+    });
+    Process::fake(['*' => Process::result(output: '')]);
+
+    (new DeleteResourceJob($this->application))->handle();
+
+    expect($deletingTransactionLevel)->toBe($transactionLevel);
+});
+
+it('deletes preview metadata locally when its application destination is missing', function () {
+    $this->application->restore();
+    $this->application->update(['destination_id' => PHP_INT_MAX]);
+    $preview = ApplicationPreview::create([
+        'uuid' => 'preview-without-destination',
+        'application_id' => $this->application->id,
+        'pull_request_id' => 45,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/45',
+    ]);
+    $previewStorage = $preview->persistentStorages()->create([
+        'name' => 'preview-without-destination-data',
+        'mount_path' => '/preview-data',
+        'host_path' => null,
+    ]);
+    Process::fake();
+
+    (new DeleteResourceJob($preview))->handle();
+
+    Process::assertNothingRan();
+    expect(ApplicationPreview::withTrashed()->find($preview->id))->toBeNull()
+        ->and($previewStorage->fresh())->toBeNull();
+});
diff --git a/tests/Feature/DeploymentLogsLayoutTest.php b/tests/Feature/DeploymentLogsLayoutTest.php
index dc0b921003..be825c663b 100644
--- a/tests/Feature/DeploymentLogsLayoutTest.php
+++ b/tests/Feature/DeploymentLogsLayoutTest.php
@@ -4,6 +4,7 @@ use App\Enums\ApplicationDeploymentStatus;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
+use App\Models\GithubApp;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -214,6 +215,40 @@ it('keeps deployment history fields and the log status badge accessible on mobil
         ->toContain(".logs-viewer-primary .logs-viewer-actions {\n    width: auto;\n    flex: 1 1 auto;");
 });
 
+it('links deployment commit hashes to the source commit page', function () {
+    $githubApp = GithubApp::query()->create([
+        'team_id' => $this->team->id,
+        'name' => 'GitHub',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+    ]);
+    $this->application->update([
+        'source_id' => $githubApp->id,
+        'source_type' => $githubApp->getMorphClass(),
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+    ]);
+    ApplicationDeploymentQueue::query()->create([
+        'application_id' => $this->application->id,
+        'deployment_uuid' => 'deploy-commit-link-test',
+        'server_id' => $this->server->id,
+        'status' => ApplicationDeploymentStatus::FINISHED->value,
+        'commit' => '1234567890abcdef1234567890abcdef12345678',
+    ]);
+
+    $response = $this->get(route('project.application.deployment.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee(
+        'href="https://github.com/coollabsio/coolify/commit/1234567890abcdef1234567890abcdef12345678" target="_blank" rel="noopener noreferrer"',
+        false,
+    );
+});
+
 it('places cancel deployment controls inside the deployment logs toolbar', function () {
     $deployment = ApplicationDeploymentQueue::create([
         'application_id' => $this->application->id,
diff --git a/tests/Feature/DevHelperVersionValidationTest.php b/tests/Feature/DevHelperVersionValidationTest.php
index 03316598c3..0a91141850 100644
--- a/tests/Feature/DevHelperVersionValidationTest.php
+++ b/tests/Feature/DevHelperVersionValidationTest.php
@@ -88,3 +88,22 @@ test('buildHelperImage refuses previously stored invalid version', function () {
         ->call('buildHelperImage')
         ->assertDispatched('error');
 });
+
+test('development helper version is read fresh for queue workers', function () {
+    config(['app.env' => 'local']);
+
+    InstanceSettings::findOrFail(0)->update(['dev_helper_version' => 'first']);
+    expect(getHelperVersion())->toBe('first');
+
+    InstanceSettings::query()->whereKey(0)->update(['dev_helper_version' => 'second']);
+
+    expect(getHelperVersion())->toBe('second');
+});
+
+test('development helper build uses the configured helper repository', function () {
+    $component = file_get_contents(app_path('Livewire/Settings/Index.php'));
+
+    expect($component)
+        ->toContain('$imageRef = escapeshellarg(coolifyHelperImage().":{$version}");')
+        ->not->toContain('"ghcr.io/coollabsio/coolify-helper:{$version}"');
+});
diff --git a/tests/Feature/DnsValidationTest.php b/tests/Feature/DnsValidationTest.php
index aed8eb85c8..a9ac104c71 100644
--- a/tests/Feature/DnsValidationTest.php
+++ b/tests/Feature/DnsValidationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Actions\Shared\CheckDomainDns;
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -9,6 +10,27 @@ use PurplePixie\PhpDns\DNSTypes;
 
 uses(RefreshDatabase::class);
 
+it('returns a skipped dns result when instance validation is disabled', function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(
+        ['id' => 0],
+        ['is_dns_validation_enabled' => false]
+    ));
+
+    $result = CheckDomainDns::run(
+        ['https://example.com' => 'https://example.com'],
+        new Server(['ip' => '203.0.113.10']),
+        '203.0.113.10',
+    );
+
+    expect($result['https://example.com'])
+        ->toMatchArray([
+            'status' => 'skipped',
+            'message' => 'DNS validation is disabled in instance settings.',
+            'expected_ip' => '203.0.113.10',
+        ])
+        ->and($result['https://example.com']['checked_at'])->not->toBeNull();
+});
+
 it('stops querying DNS servers after finding a matching IP', function (string $resolvedIp) {
     InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(
         ['id' => 0],
@@ -51,7 +73,40 @@ it('stops querying DNS servers after finding a matching IP', function (string $r
 
     expect(validateDNSEntry('https://example.com', $server))->toBeTrue()
         ->and($queriedServers->getArrayCopy())->toBe(['192.0.2.1']);
+
+    $result = CheckDomainDns::run(['example' => 'https://example.com'], $server, $targetIp);
+
+    expect($result['example']['status'])->toBe('ok')
+        ->and($queriedServers->getArrayCopy())->toBe(['192.0.2.1', '192.0.2.1']);
 })->with([
     'target server IP' => '203.0.113.10',
     'Cloudflare IP' => '104.16.0.1',
 ]);
+
+it('does not start another resolver query after the total dns budget is exhausted', function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(
+        ['id' => 0],
+        [
+            'is_dns_validation_enabled' => true,
+            'custom_dns_servers' => '192.0.2.1,192.0.2.2',
+        ]
+    ));
+
+    $queryCount = new ArrayObject;
+    app()->bind(DNSQuery::class, function () use ($queryCount) {
+        $queryCount->append(true);
+
+        return new DNSQuery('192.0.2.1');
+    });
+
+    $result = CheckDomainDns::run(
+        ['example' => 'https://example.com'],
+        new Server(['ip' => '203.0.113.10']),
+        '203.0.113.10',
+        timeoutSeconds: 0,
+    );
+
+    expect($result['example']['status'])->toBe('failed')
+        ->and($result['example']['message'])->toBe('Could not validate DNS for this domain.')
+        ->and($queryCount)->toHaveCount(0);
+});
diff --git a/tests/Feature/EnvVarInputDesignTest.php b/tests/Feature/EnvVarInputDesignTest.php
index 992c4d8b09..9e1403f282 100644
--- a/tests/Feature/EnvVarInputDesignTest.php
+++ b/tests/Feature/EnvVarInputDesignTest.php
@@ -11,3 +11,54 @@ it('uses the current listbox design for environment variable suggestions', funct
         ->toContain('border-emerald-500/25 bg-emerald-500/10')
         ->not->toContain('dark:bg-coolgray-100');
 });
+
+it('keeps the environment variable input enabled while secret manager keys load', function () {
+    $view = file_get_contents(resource_path('views/components/forms/env-var-input.blade.php'));
+
+    expect($view)->toContain('wire:target.except="fetchSecretManagerKeys"');
+});
+
+it('allows secret manager key loading to retry after a failed request', function () {
+    $view = file_get_contents(resource_path('views/components/forms/env-var-input.blade.php'));
+    $failureHandler = explode('});', explode('.catch(() => {', $view, 2)[1], 2)[0];
+
+    expect($failureHandler)
+        ->toContain('this.vaultKeysLoading = false;')
+        ->not->toContain("this.availableVars['vault'] = [];");
+});
+
+it('authorizes secret-enabled environment variable inputs at the component boundary', function () {
+    $addView = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/add.blade.php'));
+    $showView = file_get_contents(resource_path('views/livewire/project/shared/environment-variable/show.blade.php'));
+
+    foreach ([$addView, $showView] as $view) {
+        preg_match('/<x-forms\.env-var-input[\s\S]*?\/>/', $view, $matches);
+
+        expect($matches[0] ?? '')
+            ->toContain('canGate="manageEnvironment"')
+            ->toContain(':canResource="$resource"');
+    }
+});
+
+it('passes the remove source warning without compiling remote secret syntax as blade', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/secret-manager-links.blade.php'));
+
+    expect($view)
+        ->toContain('with {{vault.KEY}}. Values are fetched')
+        ->not->toContain('{{doppler.KEY}}')
+        ->not->toContain('{{infisical.KEY}}')
+        ->toContain(':actions="[$removeSourceWarning]"')
+        ->not->toContain(':actions="[\'Existing {{vault.*}}');
+});
+
+it('shows secret manager configuration for applications services and databases', function () {
+    $views = [
+        resource_path('views/livewire/project/application/configuration.blade.php'),
+        resource_path('views/livewire/project/service/configuration.blade.php'),
+        resource_path('views/livewire/project/database/configuration.blade.php'),
+    ];
+
+    foreach ($views as $view) {
+        expect(file_get_contents($view))->toContain('livewire:project.shared.secret-manager-links');
+    }
+});
diff --git a/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php b/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
index 2514ae94a6..c299f65350 100644
--- a/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
+++ b/tests/Feature/EnvironmentVariable/EnvironmentVariableSharedSpacingTest.php
@@ -144,6 +144,23 @@ test('is_shared attribute detects variable without spaces', function () {
     expect($env->is_shared)->toBeTrue();
 });
 
+test('is_shared persisted value rejects unsupported reference types', function () {
+    $env = EnvironmentVariable::create([
+        'key' => 'TEST',
+        'value' => '{{vault.KEY}}',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    $env->refresh();
+
+    expect($env->is_shared)->toBeFalse()
+        ->and(EnvironmentVariable::query()
+            ->whereKey($env->id)
+            ->where('is_shared', false)
+            ->exists())->toBeTrue();
+});
+
 test('non-shared variable preserves spaces', function () {
     $env = EnvironmentVariable::create([
         'key' => 'REGULAR',
diff --git a/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php b/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
index c98a200caf..77df86e2d8 100644
--- a/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
+++ b/tests/Feature/EnvironmentVariableMultilineToggleViewTest.php
@@ -29,6 +29,8 @@ it('lazy-loads decrypted values only when opening the edit modal', function () {
         ->toContain('wireOpen="editorOpen"')
         ->toContain('$valuesLoaded')
         ->toContain('Loading value...');
+
+    expect($view)->toContain('<x-forms.input loading loadingText="Loading value..."');
 });
 
 it('keeps the environment variable delete button compact', function () {
diff --git a/tests/Feature/FileStorageMountPathTest.php b/tests/Feature/FileStorageMountPathTest.php
index b43aae4b19..cd301c2557 100644
--- a/tests/Feature/FileStorageMountPathTest.php
+++ b/tests/Feature/FileStorageMountPathTest.php
@@ -4,7 +4,6 @@ use App\Jobs\ServerStorageSaveJob;
 use App\Livewire\Project\Service\FileStorage;
 use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Shared\Storages\All;
-use App\Livewire\Project\Shared\Storages\Show;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
@@ -135,13 +134,44 @@ test('livewire volume storage refreshes the storage list and configuration warni
         ->set('mount_path', '/app/data')
         ->call('submitPersistentVolume')
         ->assertDispatched('success')
-        ->assertDispatched('refreshStorages')
+        ->assertNotDispatched('refreshStorages')
+        ->assertNotDispatched('refreshVolumeList')
         ->assertDispatched('configurationChanged')
         ->assertSet('activeTab', 'volumes')
         ->assertSet('volumeCount', 1)
         ->assertSee($this->application->uuid.'-data');
 });
 
+test('adding another volume refreshes only the mounted volume list', function () {
+    LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-first',
+        'mount_path' => '/app/first',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('name', 'second')
+        ->set('mount_path', '/app/second')
+        ->call('submitPersistentVolume')
+        ->assertDispatched('refreshVolumeList')
+        ->assertNotDispatched('refreshStorages');
+});
+
+test('deleting a volume asks only the parent storage component to refresh its counts', function () {
+    $volume = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-data',
+        'mount_path' => '/app/data',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    Livewire::test(All::class, ['resource' => $this->application])
+        ->call('delete', $volume->id, 'password')
+        ->assertDispatched('storageCountsChanged')
+        ->assertNotDispatched('refreshStorages');
+});
+
 test('volume storage list shows volumes added after it was mounted', function () {
     $firstVolume = LocalPersistentVolume::create([
         'name' => $this->application->uuid.'-first',
@@ -191,7 +221,9 @@ test('deleting a file mount refreshes the configuration warning', function () {
 
     Livewire::test(FileStorage::class, ['fileStorage' => $file])
         ->call('delete', 'password')
-        ->assertDispatched('configurationChanged');
+        ->assertDispatched('configurationChanged')
+        ->assertDispatched('storageCountsChanged')
+        ->assertNotDispatched('refreshStorages');
 
     expect($file->fresh())->toBeNull();
 });
@@ -214,8 +246,8 @@ test('deleting a volume mount refreshes the configuration warning', function ()
         'resource_type' => $database->getMorphClass(),
     ]);
 
-    Livewire::test(Show::class, ['storage' => $volume, 'resource' => $database])
-        ->call('delete', 'password')
+    Livewire::test(All::class, ['resource' => $database])
+        ->call('delete', $volume->id, 'password')
         ->assertDispatched('configurationChanged');
 
     expect($volume->fresh())->toBeNull();
diff --git a/tests/Feature/ForgotPasswordRateLimitTest.php b/tests/Feature/ForgotPasswordRateLimitTest.php
index 02dbce6507..20fbd22596 100644
--- a/tests/Feature/ForgotPasswordRateLimitTest.php
+++ b/tests/Feature/ForgotPasswordRateLimitTest.php
@@ -6,6 +6,8 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+
     InstanceSettings::query()->forceCreate(['id' => 0]);
 });
 
diff --git a/tests/Feature/ImportBackupUploadIconTest.php b/tests/Feature/ImportBackupUploadIconTest.php
index 2729278de6..6fc9158bef 100644
--- a/tests/Feature/ImportBackupUploadIconTest.php
+++ b/tests/Feature/ImportBackupUploadIconTest.php
@@ -28,11 +28,11 @@ it('uses the upload reicon for import backup in database configuration nav', fun
         ->toContain("'icon' => 'upload'");
 });
 
-it('uses the upload reicon for import backup in service database sidebar', function () {
-    $contents = file_get_contents(resource_path('views/components/service-database/sidebar.blade.php'));
+it('uses the upload reicon for import backup in service navigation', function () {
+    $contents = file_get_contents(resource_path('views/components/service/configuration-sidebar.blade.php'));
 
     expect($contents)
         ->toContain("'label' => 'Import Backup'")
         ->toContain("'icon' => 'upload'")
-        ->not->toMatch("/'label' => 'Import Backup',\s*'route' => 'project\.service\.database\.import',\s*'icon' => 'storages'/s");
+        ->toContain("'route' => 'project.service.import-backup'");
 });
diff --git a/tests/Feature/LayoutPopupsUiTest.php b/tests/Feature/LayoutPopupsUiTest.php
index 167a23a04f..d405268d02 100644
--- a/tests/Feature/LayoutPopupsUiTest.php
+++ b/tests/Feature/LayoutPopupsUiTest.php
@@ -36,3 +36,30 @@ test('non-critical reminders collapse after ten seconds', function () {
         ->toContain('reminders.sponsorship.compact = true')
         ->toContain('reminders.notification.compact = true');
 });
+
+test('sponsorship reminder is disabled in development', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+
+    expect($view)
+        ->toContain('this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup')
+        ->toContain('x-on:show-sponsorship-reminder.window="popups.sponsorship = true')
+        ->toContain('x-on:show-sponsorship-reminder.window="bannerVisible = true"');
+});
+
+test('sponsorship reminder listener is not parsed as a blade directive', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+    $compiledView = Blade::compileString($view);
+
+    expect($compiledView)
+        ->toContain('x-on:show-sponsorship-reminder.window=')
+        ->not->toContain('$__env->yieldSection()');
+});
+
+test('advanced settings provides a development-only sponsorship reminder preview', function () {
+    $view = file_get_contents(resource_path('views/livewire/settings/advanced.blade.php'));
+
+    expect($view)
+        ->toContain('@if (isDev())')
+        ->toContain("@click=\"\$dispatch('show-sponsorship-reminder')\"")
+        ->toContain('Show sponsorship reminder');
+});
diff --git a/tests/Feature/Livewire/ConfigurationCheckerTest.php b/tests/Feature/Livewire/ConfigurationCheckerTest.php
index ff1400847c..3b80ed209c 100644
--- a/tests/Feature/Livewire/ConfigurationCheckerTest.php
+++ b/tests/Feature/Livewire/ConfigurationCheckerTest.php
@@ -1,22 +1,29 @@
 <?php
 
+use App\Events\ApplicationConfigurationChanged;
+use App\Livewire\Project\Service\Configuration;
 use App\Livewire\Project\Shared\ConfigurationChecker;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable;
+use App\Models\InstanceSettings;
 use App\Models\LocalFileVolume;
 use App\Models\Project;
+use App\Models\Server;
 use App\Models\Service;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
@@ -121,6 +128,39 @@ it('warns when a service has missing required environment variables', function (
 
 });
 
+it('broadcasts a configuration update after a required service variable is set', function () {
+    Event::fake([ApplicationConfigurationChanged::class]);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $server->id,
+    ]);
+    $environmentVariable = $service->environment_variables()->create([
+        'key' => 'PLUNK_API_KEY',
+        'value' => '',
+        'is_required' => true,
+    ]);
+
+    Livewire::test(Show::class, ['env' => $environmentVariable, 'type' => 'service'])
+        ->call('loadValues')
+        ->set('value', 'secret')
+        ->call('submit');
+
+    Event::assertDispatched(
+        ApplicationConfigurationChanged::class,
+        fn (ApplicationConfigurationChanged $event): bool => $event->teamId === $this->team->id,
+    );
+});
+
+it('refreshes the service configuration when a websocket configuration event arrives', function () {
+    $listeners = app(Configuration::class)->getListeners();
+
+    expect($listeners)
+        ->toHaveKey("echo-private:team.{$this->team->id},ApplicationConfigurationChanged", 'refreshServices')
+        ->toHaveKey('configurationChanged', 'refreshServices');
+});
+
 it('marks the service environment variables menu when required values are missing', function () {
     $configuration = file_get_contents(resource_path('views/livewire/project/service/configuration.blade.php'));
     $sidebar = file_get_contents(resource_path('views/components/service/configuration-sidebar.blade.php'));
diff --git a/tests/Feature/LivewireRequestFailurePreviewTest.php b/tests/Feature/LivewireRequestFailurePreviewTest.php
new file mode 100644
index 0000000000..8877d28ce7
--- /dev/null
+++ b/tests/Feature/LivewireRequestFailurePreviewTest.php
@@ -0,0 +1,47 @@
+<?php
+
+use App\Livewire\Dev\LivewireRequestFailurePreview;
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Route;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::forceCreate(['id' => 0]);
+});
+
+it('registers the Livewire request failure preview in testing', function () {
+    expect(Route::has('dev.livewire-request-failure-preview'))->toBeTrue();
+
+    $this->get('/__livewire-request-failure')
+        ->assertSuccessful()
+        ->assertSee('Livewire request failure preview')
+        ->assertSee('Gateway timeout')
+        ->assertSee('504');
+});
+
+it('returns proxy-style html for supported statuses', function () {
+    Livewire::test(LivewireRequestFailurePreview::class)
+        ->call('fail', 504)
+        ->assertStatus(504)
+        ->assertContent('<!doctype html><html><body><h1>Gateway time-out</h1><p>cloudflare proxy error 504</p></body></html>');
+});
+
+it('rejects statuses outside the supported list', function () {
+    Livewire::test(LivewireRequestFailurePreview::class)
+        ->call('fail', 500)
+        ->assertStatus(404);
+});
+
+it('keeps the preview statuses in sync with the JS handler', function () {
+    $source = file_get_contents(resource_path('js/livewire-request-failure.js'));
+
+    expect(preg_match('/INFRASTRUCTURE_FAILURE_STATUSES = new Set\(\[([\d,\s]+)\]\)/', $source, $matches))->toBe(1);
+
+    $jsStatuses = array_map('intval', array_map('trim', explode(',', $matches[1])));
+
+    expect((new LivewireRequestFailurePreview)->statuses)->toBe($jsStatuses);
+});
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index f6991025c8..0e7bc1d0c7 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -43,7 +43,7 @@ it('hides resource action menus when the user cannot manage the resource', funct
 
     foreach (['mobile', 'desktop'] as $viewport) {
         expect($source)->toMatch(
-            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<div id=\"{$prefix}-{$viewport}-actions\"/"
+            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<x-split-action id=\"{$prefix}-{$viewport}-actions\"/"
         );
     }
 })->with([
@@ -53,6 +53,57 @@ it('hides resource action menus when the user cannot manage the resource', funct
     'server actions' => ['views/livewire/server/navbar.blade.php', 'manageProxy', 'server', 'server'],
 ]);
 
+it('declares deploy authorization on the application stop confirmation', function () {
+    $source = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+
+    expect($source)->toMatch(
+        '/<x-modal-confirmation\s+canGate="deploy" :canResource="\$application"/'
+    );
+});
+
+it('declares deploy authorization on the service container removal confirmation', function () {
+    $source = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+
+    expect($source)->toMatch(
+        '/<x-modal-confirmation(?=[^>]*title="Confirm Container Removal\?")(?=[^>]*canGate="deploy")(?=[^>]*:canResource="\$service")[^>]*>/'
+    );
+});
+
+it('declares update authorization on service backup mutation controls', function () {
+    $importBackupView = file_get_contents(resource_path('views/livewire/project/service/import-backup.blade.php'));
+    $volumeBackupView = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($importBackupView)->toMatch(
+        '/<x-forms\.listbox(?=[^>]*id="selectedDatabaseUuid")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/'
+    );
+
+    expect($volumeBackupView)
+        ->toMatch('/<x-modal-input(?=[^>]*:title="\'Edit backup schedule\'")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'database\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'storage\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/');
+});
+
+it('declares update authorization on application port controls', function () {
+    $domainsView = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
+    $previewDomainsView = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+    $generalView = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
+
+    expect($domainsView)
+        ->toMatch('/<x-forms\.button(?=[^>]*canGate="update")(?=[^>]*:canResource="\$application")[^>]*>\s*Cancel/s')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click="confirmUseUnknownPort")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$application")[^>]*>/s');
+
+    expect($previewDomainsView)
+        ->toMatch('/<x-forms\.button[^\n]*canGate="update" :canResource="\$preview->application"[\s\S]{0,150}?Cancel/')
+        ->toMatch('/<x-forms\.button[^\n]*wire:click="confirmUseUnknownPort" canGate="update"\s+:canResource="\$preview->application"/');
+
+    $portsExposesControls = str($generalView)
+        ->after("@if (\$isStatic || \$buildPack === 'static')")
+        ->before('<p class="mt-1.5 text-xs');
+
+    expect($portsExposesControls->substrCount('id="portsExposes"'))->toBe(3)
+        ->and($portsExposesControls->substrCount('canGate="update" :canResource="$application"'))->toBe(3);
+});
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
diff --git a/tests/Feature/NotificationRestartLimitSettingTest.php b/tests/Feature/NotificationRestartLimitSettingTest.php
new file mode 100644
index 0000000000..e068ea594b
--- /dev/null
+++ b/tests/Feature/NotificationRestartLimitSettingTest.php
@@ -0,0 +1,48 @@
+<?php
+
+it('uses a dedicated notification event for restart limits', function () {
+    $notification = file_get_contents(app_path('Notifications/Application/RestartLimitReached.php'));
+    $telegramChannel = file_get_contents(app_path('Notifications/Channels/TelegramChannel.php'));
+    $eventGrid = file_get_contents(resource_path('views/components/notification/event-grid.blade.php'));
+
+    expect($notification)->toContain("getEnabledChannels('restart_limit_reached')")
+        ->and($eventGrid)
+        ->toContain("'Resources' => [")
+        ->toContain("'key' => 'statusChange'")
+        ->toContain("'helper' => 'Notify when a resource stops or Coolify automatically restarts it.'")
+        ->toContain("'key' => 'restartLimitReached'")
+        ->toContain("'label' => 'Restart limit reached'")
+        ->and($telegramChannel)
+        ->toContain('RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id');
+});
+
+it('persists a restart limit notification preference for every channel', function (string $channel) {
+    $studly = Str::studly($channel);
+    $component = file_get_contents(app_path("Livewire/Notifications/{$studly}.php"));
+    $model = file_get_contents(app_path('Models/'.$studly.'NotificationSettings.php'));
+    $column = "restart_limit_reached_{$channel}_notifications";
+    $property = "restartLimitReached{$studly}Notifications";
+
+    expect($component)
+        ->toContain("public bool \${$property} = true;")
+        ->toContain("\$this->settings->{$column} = \$this->{$property};")
+        ->toContain("\$this->{$property} = \$this->settings->{$column};")
+        ->and($model)
+        ->toContain("'{$column}'");
+})->with(['email', 'discord', 'telegram', 'slack', 'pushover', 'webhook']);
+
+it('enables restart limit notifications by default in every channel migration', function () {
+    $migrations = collect(glob(database_path('migrations/*_add_restart_limit_reached_notifications_to_*')));
+
+    expect($migrations)->toHaveCount(6);
+    $migrations->each(fn (string $migration) => expect(file_get_contents($migration))->toContain('->default(true)'));
+});
+
+it('uses the inline validator facade for notification API updates', function () {
+    $controller = file_get_contents(app_path('Http/Controllers/Api/NotificationsController.php'));
+
+    expect($controller)
+        ->toContain('use Illuminate\\Support\\Facades\\Validator;')
+        ->toContain("Validator::make(\$body, \$config['rules'])")
+        ->not->toContain("customApiValidator(\$body, \$config['rules'])");
+});
diff --git a/tests/Feature/PersistentStoragePerformanceTest.php b/tests/Feature/PersistentStoragePerformanceTest.php
index caad5822a1..6d1df54607 100644
--- a/tests/Feature/PersistentStoragePerformanceTest.php
+++ b/tests/Feature/PersistentStoragePerformanceTest.php
@@ -91,7 +91,7 @@ function createPerfApplicationWithVolumes(int $volumeCount = 5): array
     return [$application, $firstVolume, $team];
 }
 
-it('renders volume rows without nesting Livewire Show components', function () {
+it('renders volume rows inline without nested Livewire row components', function () {
     [$application] = createPerfApplicationWithVolumes(5);
 
     $html = Livewire::test(All::class, ['resource' => $application])->html();
@@ -100,7 +100,6 @@ it('renders volume rows without nesting Livewire Show components', function () {
         ->toContain('data-table')
         ->toContain('openBackupModal')
         ->toContain('wire:submit="submit(')
-        ->not->toContain('livewire:project.shared.storages.show')
         ->not->toContain('shared-configure-volume-backup-');
 });
 
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index d906cfb6a1..6546a00e31 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -33,6 +33,18 @@ it('keeps storage backup schedule tables horizontally scrollable on mobile', fun
         ->and($css)->toMatch('/\.backup-table-grid\s*\{[^}]*min-width:\s*50rem;/');
 });
 
+
+it('keeps nested storage component keys stable when mounts are added or deleted', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
+
+    expect($view)
+        ->toContain('wire:key="volumes-{{ $resource->id }}"')
+        ->toContain('wire:key="svc-volumes-{{ $resource->id }}"')
+        ->not->toContain('wire:key="volumes-{{ $resource->id }}-{{ $this->volumeCount }}"')
+        ->not->toContain('wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"');
+});
+
+
 use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
 use App\Livewire\Project\Shared\Storages\All;
@@ -129,7 +141,6 @@ function createApplicationWithVolume(array $applicationAttributes = [], array $v
 
 it('renders volumes as a data table with shared column headers', function () {
     $allView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
-    $showView = file_get_contents(resource_path('views/livewire/project/shared/storages/show.blade.php'));
     $storageView = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
 
     expect($allView)
@@ -147,17 +158,10 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toContain('data-table-row')
         ->toContain('volumes-mobile-label')
         ->not->toContain('table-badge table-badge-success')
-        ->not->toContain('livewire:project.shared.storages.show')
         ->not->toContain('x-status-badge')
         ->not->toContain('font-mono')
         ->not->toContain('Service volume mounts are read-only here.');
 
-    // Show remains available for isolated embeds/tests but is no longer nested from All.
-    expect($showView)
-        ->toContain('data-table-row')
-        ->toContain('volumes-table-grid')
-        ->not->toContain('font-mono');
-
     // Service stack page: one settings-section card per compose service/resource.
     expect($storageView)
         ->toContain('Str::headline($resource->name)')
@@ -422,16 +426,13 @@ it('hides PR deployment suffix for databases', function () {
 });
 
 it('uses a compact table badge for enabled backups instead of status-badge', function () {
-    $showView = file_get_contents(resource_path('views/livewire/project/shared/storages/show.blade.php'));
+    $allView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
 
-    expect($showView)
-        ->toContain('table-badge-success')
+    expect($allView)
+        ->toContain("'table-badge-success' => \$hasS3Backup")
         ->toContain('Volume backup is enabled')
         ->not->toContain('x-status-badge')
         ->not->toContain('status="Backup enabled"');
-
-    // Badge label is the short "Backup" text, not the old pill-with-label that broke the input row.
-    expect(preg_match('/table-badge-success[^>]*>\s*Backup\s*</', $showView))->toBeGreaterThan(0);
 });
 
 it('gates file storage PR suffix markup behind git_based applications', function () {
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
new file mode 100644
index 0000000000..b40193cb29
--- /dev/null
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -0,0 +1,674 @@
+<?php
+
+use App\Livewire\Project\Application\PreviewDomains;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        [
+            'id' => 0,
+            'is_dns_validation_enabled' => false,
+        ]
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+        'ip' => '203.0.113.10',
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'generate_exact_labels' => false,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Preview Port App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => null,
+        'redirect' => 'both',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000,8080',
+        'is_http_basic_auth_enabled' => false,
+    ]);
+});
+
+function createPreviewForPortTests(Application $application, int $pullRequestId, array $attributes = []): ApplicationPreview
+{
+    return ApplicationPreview::create(array_merge([
+        'application_id' => $application->id,
+        'pull_request_id' => $pullRequestId,
+        'pull_request_html_url' => "https://github.com/coollabsio/coolify/pull/{$pullRequestId}",
+    ], $attributes));
+}
+
+it('saves preview domain port overrides separately from the public FQDN', function () {
+    $preview = createPreviewForPortTests($this->application, 101);
+
+    $preview->update([
+        'fqdn' => 'https://one-pr-101.example.com:3000,https://two-pr-101.example.com:8080',
+    ]);
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toBe('https://one-pr-101.example.com,https://two-pr-101.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe([
+            'https://one-pr-101.example.com' => 3000,
+            'https://two-pr-101.example.com' => 8080,
+        ]);
+});
+
+it('retains an existing preview port override when saving a portless domain', function () {
+    $preview = createPreviewForPortTests($this->application, 102, [
+        'fqdn' => 'https://one-pr-102.example.com:3000',
+    ]);
+
+    $preview->update([
+        'fqdn' => 'https://one-pr-102.example.com',
+    ]);
+
+    expect($preview->fresh()->fqdn)
+        ->toBe('https://one-pr-102.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://one-pr-102.example.com' => 3000]);
+});
+
+it('saves a preview port override from the add-domain form', function () {
+    $preview = createPreviewForPortTests($this->application, 103);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('https://preview.example.com:8080');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toBe('https://preview.example.com')
+        ->and($preview->domain_port_overrides['https://preview.example.com'] ?? null)
+        ->toBe(8080);
+});
+
+it('retains different port overrides for two preview domains', function () {
+    $preview = createPreviewForPortTests($this->application, 104);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'one-preview.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainParts.host', 'two-preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+
+    expect($preview->domain_port_overrides['https://one-preview.example.com'] ?? null)->toBe(3000)
+        ->and($preview->domain_port_overrides['https://two-preview.example.com'] ?? null)->toBe(8080)
+        ->and(explode(',', (string) $preview->fqdn))
+        ->toContain('https://one-preview.example.com')
+        ->toContain('https://two-preview.example.com')
+        ->not->toContain('https://one-preview.example.com:3000')
+        ->not->toContain('https://two-preview.example.com:8080');
+});
+
+it('reopens preview domain edit with the saved port override', function () {
+    $preview = createPreviewForPortTests($this->application, 105, [
+        'fqdn' => 'https://preview.example.com:8080',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.url', 'https://preview.example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'preview.example.com');
+});
+
+it('does not prefill the default internal port when editing a preview domain without an override', function () {
+    $preview = createPreviewForPortTests($this->application, 106, [
+        'fqdn' => 'https://preview.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '');
+});
+
+it('clears a preview domain port override and shows the default internal port', function () {
+    $preview = createPreviewForPortTests($this->application, 107, [
+        'fqdn' => 'https://one-preview.example.com:8080,https://two-preview.example.com:9090',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSee('Internal port 8080')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertSee('Internal port 9090')
+        ->assertDontSee('Internal port 8080');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toContain('https://one-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->not->toHaveKey('https://one-preview.example.com')
+        ->toHaveKey('https://two-preview.example.com', 9090);
+});
+
+it('prunes a preview domain port override when removing the domain', function () {
+    $preview = createPreviewForPortTests($this->application, 108, [
+        'fqdn' => 'https://one-preview.example.com:8080,https://two-preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)->toBe('https://two-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe(['https://two-preview.example.com' => 3000]);
+});
+
+it('shows an error badge when a preview domain has no internal port and ports exposes is empty', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 109, [
+        'fqdn' => 'https://preview.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSee('No internal port')
+        ->assertDontSee('Internal port');
+});
+
+it('rejects adding a preview domain whose portless URL is already configured', function () {
+    $preview = createPreviewForPortTests($this->application, 110, [
+        'fqdn' => 'https://preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasErrors('newDomainParts.host');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 3000]);
+});
+
+it('saves compose preview domain port overrides per service without putting the port in the public URL', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 111);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainService', 'web')
+        ->set('newDomainParts.host', 'web-preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainService', 'api')
+        ->set('newDomainParts.host', 'api-preview.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+    $composeDomains = json_decode($preview->docker_compose_domains, true);
+
+    expect(data_get($composeDomains, 'web.domain'))->toBe('https://web-preview.example.com')
+        ->and(data_get($composeDomains, 'api.domain'))->toBe('https://api-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe([
+            'https://web-preview.example.com' => 8080,
+            'https://api-preview.example.com' => 3000,
+        ]);
+});
+
+it('copies the parent domain port override onto a generated preview domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com:8080',
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 112);
+    $preview->generate_preview_fqdn();
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toContain('112.')
+        ->not->toContain(':8080')
+        ->and($preview->domain_port_overrides)
+        ->toHaveCount(1)
+        ->and(array_values($preview->domain_port_overrides))
+        ->toBe([8080]);
+});
+
+it('saves generated preview domains once in the application parser', function () {
+    $parser = file_get_contents(base_path('bootstrap/helpers/parsers.php'));
+    $previewGeneration = Str::of($parser)
+        ->after('// If the domain is set, we need to generate the FQDNs for the preview')
+        ->before('$defaultLabels = defaultLabels');
+
+    expect($previewGeneration->substrCount('$preview->save();'))->toBe(1)
+        ->and((string) $previewGeneration)->toContain('$preview->fqdn = $fqdns->implode(\',\');');
+});
+
+it('keeps every generated preview domain port override in the legacy compose parser', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: nginx:alpine
+YAML,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://one.example.com:3000,https://two.example.com:8080'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 124);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 124, preview_id: $preview->id);
+
+    $preview->refresh();
+
+    $previewDomains = explode(',', (string) $preview->fqdn);
+
+    expect($previewDomains)->toHaveCount(2)
+        ->and(collect($previewDomains)
+            ->filter(fn (string $domain): bool => parse_url($domain, PHP_URL_PORT) !== null))
+        ->toBeEmpty()
+        ->and($preview->domain_port_overrides)->toHaveCount(2)
+        ->and(array_keys($preview->domain_port_overrides))->toBe($previewDomains)
+        ->and(array_values($preview->domain_port_overrides))->toBe([3000, 8080]);
+});
+
+it('finds the legacy compose preview by pull request when its id is unavailable', function (?int $previewId) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com:3000'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 125);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 125, preview_id: $previewId);
+
+    expect($preview->fresh()->fqdn)->not->toBeNull();
+})->with([
+    'missing id' => null,
+    'stale id' => PHP_INT_MAX,
+]);
+
+it('throws a controlled exception when the legacy compose preview does not exist', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com:3000'],
+        ]),
+    ]);
+
+    expect(fn () => parseDockerComposeFile(
+        $this->application->fresh(),
+        pull_request_id: 126,
+        preview_id: PHP_INT_MAX,
+    ))->toThrow(RuntimeException::class, 'Preview not found.');
+});
+
+it('preserves an existing preview port override in the legacy compose parser', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: nginx:alpine
+YAML,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 126, [
+        'fqdn' => 'https://126.frontend.example.com',
+        'domain_port_overrides' => [
+            'https://126.frontend.example.com' => 8080,
+        ],
+    ]);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 126, preview_id: $preview->id);
+
+    expect($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://126.frontend.example.com' => 8080]);
+});
+
+it('does not copy production domain port overrides onto preview proxy labels', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'domain_port_overrides' => [
+            'https://app.example.com' => 9090,
+        ],
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 113, [
+        'fqdn' => 'https://113.app.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-113.loadbalancer.server.port=3000')
+        ->not->toContain('loadbalancer.server.port=9090');
+});
+
+it('routes portless preview domains to saved preview internal port overrides', function () {
+    $preview = createPreviewForPortTests($this->application, 114, [
+        'fqdn' => 'https://one-pr.example.com,https://two-pr.example.com',
+        'domain_port_overrides' => [
+            'https://one-pr.example.com' => 3000,
+            'https://two-pr.example.com' => 8080,
+        ],
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+    $uuid = $this->application->uuid.'-pr-114';
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$uuid.'.rule=Host(`one-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$uuid.'.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-'.$uuid.'.rule=Host(`two-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-'.$uuid.'.loadbalancer.server.port=8080')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('Host(`one-pr.example.com:3000`)')
+        ->not->toContain('Host(`two-pr.example.com:8080`)');
+});
+
+it('uses the first ports_exposes value for a portless preview domain without an override', function () {
+    $preview = createPreviewForPortTests($this->application, 115, [
+        'fqdn' => 'https://plain-pr.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-115.loadbalancer.server.port=3000')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}');
+});
+
+it('keeps routing a legacy port-bearing preview FQDN without an override map', function () {
+    $preview = createPreviewForPortTests($this->application, 116, [
+        'fqdn' => 'https://legacy-pr.example.com',
+    ]);
+
+    DB::table('application_previews')->where('id', $preview->id)->update([
+        'fqdn' => 'https://legacy-pr.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$this->application->uuid.'-pr-116.rule=Host(`legacy-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-116.loadbalancer.server.port=9090')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
+
+it('passes preview domain port overrides into compose pull-request labels', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+        'domain_port_overrides' => [
+            'https://frontend.example.com' => 80,
+        ],
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 117, [
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://117.frontend.example.com'],
+        ]),
+        'fqdn' => 'https://117.frontend.example.com',
+        'domain_port_overrides' => [
+            'https://117.frontend.example.com' => 8080,
+        ],
+    ]);
+
+    $parsedCompose = applicationParser($this->application->fresh(), 117, $preview->id);
+    $labels = collect(data_get($parsedCompose, 'services.frontend-pr-117.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8080')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8080}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`117.frontend.example.com`)')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=80')))
+        ->toBeFalse();
+});
+
+it('uses ports_exposes as the compose preview fallback when a domain has no override', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'ports_exposes' => '4000,5000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 118, [
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://118.frontend.example.com'],
+        ]),
+        'fqdn' => 'https://118.frontend.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $parsedCompose = applicationParser($this->application->fresh(), 118, $preview->id);
+    $labels = collect(data_get($parsedCompose, 'services.frontend-pr-118.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=4000')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 4000}}')))
+        ->toBeTrue();
+});
+
+it('shows a port warning when a preview domain uses a port that is not exposed or used by the application', function () {
+    $preview = createPreviewForPortTests($this->application, 119);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 9090)
+        ->assertSee('Use a different port?')
+        ->assertSee('9090');
+
+    expect($preview->fresh()->fqdn)->toBeNull();
+});
+
+it('does not warn when a preview domain port is listed in ports exposes', function () {
+    $preview = createPreviewForPortTests($this->application, 120);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
+it('does not warn when a preview domain port is already used by an application domain', function () {
+    $this->application->update([
+        'ports_exposes' => '3000',
+        'fqdn' => 'https://app.example.com:9090',
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 121);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
+it('saves an unrecognized preview domain port after confirming the warning', function () {
+    $preview = createPreviewForPortTests($this->application, 122);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 9090]);
+});
+
+it('cancels an unrecognized preview domain port without saving', function () {
+    $preview = createPreviewForPortTests($this->application, 123);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('cancelUseUnknownPort')
+        ->assertSet('showPortWarningModal', false);
+
+    expect($preview->fresh()->fqdn)->toBeNull();
+});
+
+it('warns when editing a preview domain to an unrecognized port', function () {
+    $preview = createPreviewForPortTests($this->application, 124, [
+        'fqdn' => 'https://preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '5555')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 5555);
+
+    expect($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 3000]);
+});
+
+it('does not warn when re-saving a preview domain with the same custom port', function () {
+    $preview = createPreviewForPortTests($this->application, 125, [
+        'fqdn' => 'https://preview.example.com:9090',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '9090')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
diff --git a/tests/Feature/PreviewStatusSummaryTest.php b/tests/Feature/PreviewStatusSummaryTest.php
index 6c17135618..a31fd836df 100644
--- a/tests/Feature/PreviewStatusSummaryTest.php
+++ b/tests/Feature/PreviewStatusSummaryTest.php
@@ -19,6 +19,16 @@ it('aggregates preview container and health check status', function () {
         ->toContain('w-[min(16rem,calc(100vw-1.5rem))]!');
 });
 
+it('shows degraded aggregate service status as a warning', function () {
+    $html = Blade::render('<x-status-summary status="degraded:unhealthy" title="Service status" container-name="Containers" />');
+    $summaryButton = str($html)->between('<button', '</button>')->toString();
+
+    expect($summaryButton)
+        ->toContain('Degraded')
+        ->toContain('bg-warning')
+        ->not->toContain('bg-error');
+});
+
 it('uses the aggregated preview status in the previews list', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
 
@@ -42,7 +52,7 @@ it('uses the aggregated status badge for databases and services', function () {
     expect($databaseStatus)
         ->toContain('<x-status-summary :status="$database->status" title="Database status" />')
         ->and($serviceStatus)
-        ->toContain('<x-status-summary :status="$service->status" title="Service status" container-name="Containers" />');
+        ->toContain('<x-status-summary :status="$displayStatus" :title="$selectedResource ? \'Resource status\' : \'Service status\'"');
 });
 
 it('groups preview deployment actions in a dropdown', function () {
@@ -77,3 +87,22 @@ it('places links and logs dropdowns beside preview actions', function () {
         ->toContain('title="Preview logs"')
         ->toContain('title="Preview actions"');
 });
+
+it('uses the shared domain list treatment for preview domains', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
+    $domainsView = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+
+    expect($view)
+        ->toContain('<livewire:project.application.preview-domains')
+        ->and($domainsView)
+        ->toContain('Recheck DNS')
+        ->toContain('Add domain')
+        ->toContain('data-table-header')
+        ->toContain('domains-table-grid-service')
+        ->toContain('class="env-table-item"')
+        ->toContain('No domains configured')
+        ->toContain('class="data-table-row')
+        ->toContain('DNS OK')
+        ->toContain('Edit domain')
+        ->toContain('Remove domain');
+});
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index cf313882f4..68ced553d5 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -2,6 +2,8 @@
 
 use App\Livewire\Profile\Index;
 use App\Models\InstanceSettings;
+use App\Models\S3Storage;
+use App\Models\Team;
 use App\Models\User;
 use App\Services\AvatarStorageService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -73,6 +75,71 @@ it('serves the authenticated users profile picture', function () {
         ->assertHeader('content-type', 'image/jpeg');
 });
 
+it('loads an S3 profile picture from the configured CDN', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe("https://avatars.example.com/media/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+});
+
+it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
+    config()->set('constants.coolify.avatar_cdn_url');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe("https://s3.example.com/avatars/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+});
+
+it('does not use an unrelated S3 storage URL for a profile picture', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
+    $storage = S3Storage::query()->create([
+        'team_id' => Team::factory()->create()->id,
+        'name' => 'Unrelated storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://unrelated.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe(route('profile.avatar', ['v' => $user->updated_at->timestamp]));
+});
+
 it('removes the current profile picture', function () {
     Storage::fake('images');
     $user = User::factory()->create([
@@ -120,7 +187,7 @@ it('automatically uploads a selected profile picture and keeps the current avata
         ->not->toContain('Upload picture')
         ->not->toContain('type="file" x-on:change')
         ->and($menu)
-        ->toContain("route('profile.avatar',");
+        ->toContain('profile_avatar_url($user)');
 });
 
 it('offers runtime local or existing S3 profile picture storage', function () {
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index b5b6ed0887..fc03c9f30e 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -6,6 +6,7 @@ use App\Livewire\Project\Index;
 use App\Livewire\SharedVariables\Project\Index as SharedVariablesProjectIndex;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -102,6 +103,76 @@ it('exposes the icon URL on the projects index', function () {
         ]));
 });
 
+it('loads an S3 project icon from the configured CDN', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    Livewire::test(Index::class)
+        ->assertViewHas('projectsJs', fn (array $projects): bool => $projects[0]['iconUrl'] === "https://avatars.example.com/media/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+});
+
+it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
+    config()->set('constants.coolify.avatar_cdn_url');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    expect(project_icon_url($this->project))->toBe("https://s3.example.com/avatars/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+});
+
+it('does not use an unusable S3 storage URL for a project icon', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Unusable storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://unusable.example.com',
+        'is_usable' => false,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    expect(project_icon_url($this->project))->toBe(route('project.icon', [
+        'project_uuid' => $this->project->uuid,
+        'v' => $this->project->updated_at->timestamp,
+    ]));
+});
+
 it('displays the project icon on the dashboard', function () {
     $this->project->forceFill([
         'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
diff --git a/tests/Feature/Proxy/RestartProxyTest.php b/tests/Feature/Proxy/RestartProxyTest.php
index 16cddd36ea..0c393c03b5 100644
--- a/tests/Feature/Proxy/RestartProxyTest.php
+++ b/tests/Feature/Proxy/RestartProxyTest.php
@@ -1,16 +1,20 @@
 <?php
 
+use App\Actions\Proxy\StartProxy;
 use App\Enums\ProxyTypes;
+use App\Models\AuditEvent;
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
+use Spatie\Activitylog\Models\Activity;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    $this->withoutDefer();
     InstanceSettings::forceCreate(['id' => 0]);
 });
 
@@ -187,3 +191,20 @@ test('start proxy button shows a loading state while proxy startup actions run',
         ->assertSeeHtml('wire:loading.class="is-loading"')
         ->assertSeeHtml('wire:target="checkProxy,startProxy"');
 });
+
+test('starting a proxy records a team audit event', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    $activity = Activity::create([
+        'description' => 'proxy start',
+        'properties' => ['team_id' => $team->id],
+    ]);
+    StartProxy::shouldRun()->andReturn($activity);
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test('server.navbar', ['server' => $server])
+        ->call('startProxy');
+
+    expect(AuditEvent::query()->sole()->event)->toBe('ui.proxy.started');
+});
diff --git a/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php b/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
index 7194555399..9a2378be2f 100644
--- a/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
+++ b/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
@@ -6,14 +6,14 @@ use Illuminate\Foundation\Testing\RefreshDatabase;
 
 uses(RefreshDatabase::class);
 
-it('discovers running container networks instead of relying on cached resource statuses', function () {
+it('discovers managed container networks regardless of container status', function () {
     $team = Team::factory()->create();
     $server = Server::factory()->create(['team_id' => $team->id]);
 
     $commands = connectProxyToNetworks($server)->implode("\n");
 
     expect($commands)
-        ->toContain('docker ps --filter label=coolify.managed=true')
+        ->toContain('docker ps -a --filter label=coolify.managed=true')
         ->toContain('.NetworkSettings.Networks')
         ->toContain('docker network inspect "$network"')
         ->toContain('docker network connect "$network" coolify-proxy')
diff --git a/tests/Feature/QueueApplicationDeploymentCommitTest.php b/tests/Feature/QueueApplicationDeploymentCommitTest.php
index ac6be5c9e9..8273a5c61c 100644
--- a/tests/Feature/QueueApplicationDeploymentCommitTest.php
+++ b/tests/Feature/QueueApplicationDeploymentCommitTest.php
@@ -3,17 +3,20 @@
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\AuditEvent;
 use App\Models\Environment;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
+use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Bus;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    $this->withoutDefer();
     Bus::fake([ApplicationDeploymentJob::class]);
 
     $this->team = Team::factory()->create();
@@ -42,6 +45,59 @@ function makeApplication(int $environmentId, int $destinationId, ?string $gitCom
 }
 
 describe('queue_application_deployment commit resolution', function () {
+    test('records a team audit event when a user queues a deployment', function () {
+        $user = User::factory()->create();
+        $this->team->members()->attach($user, ['role' => 'owner']);
+        $this->actingAs($user);
+        session(['currentTeam' => $this->team]);
+        $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+
+        queue_application_deployment($application, 'audit-deploy-uuid');
+
+        $this->assertDatabaseHas('audit_events', [
+            'team_id' => $this->team->id,
+            'event' => 'ui.application.deployed',
+            'resource_uuid' => $application->uuid,
+        ]);
+    });
+
+    test('uses the deployed application team for the audit event', function () {
+        $actorTeam = Team::factory()->create();
+        $user = User::factory()->create();
+        $actorTeam->members()->attach($user, ['role' => 'owner']);
+        $this->actingAs($user);
+        session()->forget('currentTeam');
+        $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+
+        queue_application_deployment($application, 'resource-team-audit-deploy');
+
+        $event = AuditEvent::query()->where('event', 'ui.application.deployed')->sole();
+
+        expect($event->team_id)->toBe($this->team->id)
+            ->and($event->team_id)->not->toBe($actorTeam->id)
+            ->and($event->resource_uuid)->toBe($application->uuid)
+            ->and($event->metadata)->not->toHaveKey('team_id');
+    });
+
+    test('records only the rollback audit event when a user queues a rollback', function () {
+        $user = User::factory()->create();
+        $this->team->members()->attach($user, ['role' => 'owner']);
+        $this->actingAs($user);
+        $application = makeApplication($this->environment->id, $this->destination->id, 'HEAD');
+        AuditEvent::query()->delete();
+
+        queue_application_deployment(
+            application: $application,
+            deployment_uuid: 'audit-rollback-uuid',
+            commit: 'previous-commit',
+            rollback: true,
+        );
+
+        expect(AuditEvent::query()->pluck('event')->all())->toBe([
+            'ui.application.rollback',
+        ]);
+    });
+
     test('uses application git_commit_sha when commit parameter omitted', function () {
         $pinnedSha = 'abc123def456abc123def456abc123def456abc1';
         $application = makeApplication($this->environment->id, $this->destination->id, $pinnedSha);
diff --git a/tests/Feature/RegistrationRateLimitTest.php b/tests/Feature/RegistrationRateLimitTest.php
index 7130ed36e6..3f7c4920db 100644
--- a/tests/Feature/RegistrationRateLimitTest.php
+++ b/tests/Feature/RegistrationRateLimitTest.php
@@ -1,13 +1,17 @@
 <?php
 
+use App\Jobs\SendVerificationEmailJob;
 use App\Models\InstanceSettings;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Facades\RateLimiter;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
+
     InstanceSettings::query()->forceCreate([
         'id' => 0,
         'is_registration_enabled' => true,
@@ -72,6 +76,43 @@ it('rate limits dotted plus-address variants of the same email identity across i
         ->assertTooManyRequests();
 });
 
+it('keeps clients behind the same reverse proxy in separate ip rate limit buckets', function () {
+    foreach (range(1, 3) as $attempt) {
+        $this->withServerVariables(['REMOTE_ADDR' => '172.18.0.2'])
+            ->withHeaders(['X-Forwarded-For' => '203.0.113.50'])
+            ->post('/register', [
+                'name' => "Proxied User {$attempt}",
+                'email' => "proxied{$attempt}@example.com",
+                'password' => 'Password1!@',
+                'password_confirmation' => 'Password1!@',
+            ])
+            ->assertRedirect();
+
+        auth()->logout();
+        $this->flushSession();
+    }
+
+    $this->withServerVariables(['REMOTE_ADDR' => '172.18.0.2'])
+        ->withHeaders(['X-Forwarded-For' => '203.0.113.50'])
+        ->post('/register', [
+            'name' => 'Blocked User',
+            'email' => 'blocked-proxied@example.com',
+            'password' => 'Password1!@',
+            'password_confirmation' => 'Password1!@',
+        ])
+        ->assertTooManyRequests();
+
+    $this->withServerVariables(['REMOTE_ADDR' => '172.18.0.2'])
+        ->withHeaders(['X-Forwarded-For' => '203.0.113.51'])
+        ->post('/register', [
+            'name' => 'Other Client',
+            'email' => 'other-proxied@example.com',
+            'password' => 'Password1!@',
+            'password_confirmation' => 'Password1!@',
+        ])
+        ->assertRedirect();
+});
+
 it('keeps distinct dotted and plus-addressed mailboxes in separate rate limit buckets on ordinary domains', function () {
     $registrationIpKey = 'registration:ip:'.sha1('127.0.0.1');
     $emails = [
@@ -95,3 +136,24 @@ it('keeps distinct dotted and plus-addressed mailboxes in separate rate limit bu
         RateLimiter::clear($registrationIpKey);
     }
 });
+
+it('queues the verification email for cloud registrations', function () {
+    config()->set('constants.coolify.self_hosted', false);
+    Queue::fake();
+
+    $this->withHeader('CF-Connecting-IP', '2001:db8::30')
+        ->post('/register', [
+            'name' => 'Cloud User',
+            'email' => 'cloud-user@example.com',
+            'password' => 'Password1!@',
+            'password_confirmation' => 'Password1!@',
+        ])
+        ->assertRedirect();
+
+    $user = User::query()->where('email', 'cloud-user@example.com')->firstOrFail();
+
+    Queue::assertPushed(
+        SendVerificationEmailJob::class,
+        fn (SendVerificationEmailJob $job) => $job->user->is($user)
+    );
+});
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 77506e2029..b6c221afe6 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -163,14 +163,14 @@ it('keeps advanced operations in a dedicated Advanced dropdown', function () {
     expect(substr_count($application, 'resource-heading-navbar'))->toBe(1);
 });
 
-it('groups desktop application lifecycle controls in one Actions dropdown', function () {
+it('groups desktop application lifecycle controls in one split control', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $desktop = str($heading)->after('resource-heading-actions flex')->toString();
 
     expect($desktop)
         ->toContain('application-desktop-actions')
-        ->toContain('Actions')
-        ->toContain('listbox-panel top-full! right-0! left-auto!')
+        ->toContain('<x-split-action')
+        ->toContain('<x-slot:main')
         ->toContain('listbox-option')
         ->toContain('Deploy')
         ->toContain('Restart')
@@ -217,8 +217,8 @@ it('groups service restart options in the Actions dropdown', function () {
     $mobile = str($heading)->before("@teleport('#resource-action-hud-slot')")->toString();
 
     expect($mobile)
-        ->toContain('Restart current version')
-        ->toContain('Pull latest and restart')
+        ->toContain('Restart')
+        ->toContain('Restart (pull latest)')
         ->not->toContain('Pull Latest Images & Restart');
 });
 
@@ -232,21 +232,17 @@ it('orders service restart actions before stop and advanced operations', functio
         ->toBeLessThan(strpos($actions, 'Stop'));
 });
 
-it('groups application lifecycle options in an Actions dropdown', function () {
+it('promotes the primary application action in the desktop split control', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $desktop = str($heading)->after('resource-heading-actions flex')->toString();
-    $trigger = str($desktop)->after('id="application-desktop-actions"')->before('<div x-cloak')->toString();
 
     expect($desktop)
         ->toContain('id="application-desktop-actions"')
-        ->toContain('Actions')
+        ->toContain('<x-slot:main wire:click="deploy">')
         ->toContain('Deploy')
         ->toContain('Deploy (without cache)')
         ->toContain('force_deploy_without_cache')
-        ->toContain('deploy(true)')
-        ->and($trigger)
-        ->toContain('button button-highlighted')
-        ->not->toContain('play-circle');
+        ->toContain('deploy(true)');
 
     $mobile = str($heading)->before("@teleport('#resource-action-hud-slot')")->toString();
 
@@ -255,6 +251,25 @@ it('groups application lifecycle options in an Actions dropdown', function () {
         ->not->toContain('Force deploy without cache');
 });
 
+it('shows stop in application action menus when the application is exited', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $desktopExitedActions = str($heading)
+        ->after("@if (str(\$application->status)->startsWith('exited'))")
+        ->before('@else')
+        ->toString();
+
+    $mobileActions = str($heading)
+        ->after('id="application-mobile-actions"')
+        ->before('<div class="hidden" aria-hidden="true">')
+        ->toString();
+
+    expect($mobileActions)->toContain('application-mobile-stop-trigger')
+        ->and($desktopExitedActions)->toContain('application-mobile-stop-trigger')
+        ->and($mobileActions)->toContain('Deploy (without cache)')
+        ->and(strrpos($mobileActions, 'Deploy (without cache)'))
+        ->toBeLessThan(strrpos($mobileActions, 'application-mobile-stop-trigger'));
+});
+
 it('places the state-aware no-cache action immediately after deploy or redeploy', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $actions = str($heading)->after('id="application-desktop-actions"')->before('@endteleport')->toString();
@@ -277,27 +292,28 @@ it('uses the shared Coollabs gradient for primary resource actions in the deskto
         ->toContain('@apply button-highlighted;');
 });
 
-it('uses iconless highlighted Actions dropdowns for service and proxy lifecycle controls', function () {
+it('promotes a primary action for service and proxy lifecycle controls', function () {
     foreach ([
         resource_path('views/livewire/project/service/heading.blade.php') => 'service-desktop-actions',
         resource_path('views/livewire/server/navbar.blade.php') => 'server-desktop-actions',
     ] as $path => $id) {
         $heading = file_get_contents($path);
-        $trigger = str($heading)->after("id=\"{$id}\"")->before('<div x-cloak')->toString();
+        $control = str($heading)->after("id=\"{$id}\"")->before('</x-split-action>')->toString();
 
-        expect($trigger)
-            ->toContain('button button-highlighted')
-            ->toContain('Actions')
-            ->not->toContain('play-circle');
+        expect($control)
+            ->toContain('<x-slot:main')
+            ->toContain('listbox-option');
     }
 });
 
-it('places the Traefik dashboard last in the server Actions menu', function () {
+it('links the Traefik dashboard beside the server actions instead of inside the dropdown', function () {
     $navbar = file_get_contents(resource_path('views/livewire/server/navbar.blade.php'));
-    $actions = str($navbar)->after('id="server-desktop-actions"')->before('@endcan')->toString();
+    $desktopActions = str($navbar)->after('id="server-desktop-actions"')->before('</x-split-action>')->toString();
+    $mobileActions = str($navbar)->after('id="server-mobile-actions"')->before('</x-split-action>')->toString();
 
-    expect(strpos($actions, 'Refresh Proxy Status'))
-        ->toBeLessThan(strpos($actions, 'Traefik Dashboard'));
+    expect($desktopActions)->not->toContain('Traefik')
+        ->and($mobileActions)->not->toContain('Traefik')
+        ->and($navbar)->toContain('Traefik Dashboard');
 });
 
 it('keeps database lifecycle controls direct and highlights the primary action', function () {
@@ -305,10 +321,10 @@ it('keeps database lifecycle controls direct and highlights the primary action',
     $desktop = str($heading)->after('resource-heading-actions flex')->before('@endteleport')->toString();
 
     expect($desktop)
+        ->toContain('<x-split-action')
+        ->toContain('<x-slot:main')
         ->toContain('Restart')
         ->toContain('Stop')
-        ->toContain('button button-highlighted')
-        ->not->toContain('<x-reicon')
         ->not->toContain('<x-resource-heading-overflow');
 });
 
@@ -498,7 +514,7 @@ it('uses the same mobile heading gap on deployment pages as application settings
     $deploymentShow = file_get_contents(resource_path('views/livewire/project/application/deployment/show.blade.php'));
 
     expect($configuration)->toContain('application-settings-workspace mt-4')
-        ->and($deploymentIndex)->toContain("'mt-4 max-w-[1180px] lg:mt-0' => ! \$embedded")
+        ->and($deploymentIndex)->toContain("'mt-4 max-w-none lg:mt-0' => ! \$embedded")
         ->and($deploymentShow)->toContain('application-settings-workspace mt-4')
         ->toContain('lg:mt-0');
 });
@@ -536,9 +552,9 @@ it('fits the combined deployment history and logs within the desktop viewport',
 
     expect($indexClass)->toContain('$this->defaultTake = 3;')
         ->and($showView)
-        ->toContain('xl:h-[calc(100dvh-7.5rem)]')
-        ->toContain('xl:overflow-hidden')
-        ->toContain('xl:flex-1');
+        ->toContain('min-h-[calc(100dvh-7.5rem)]')
+        ->toContain('xl:h-[32rem] xl:min-h-0 xl:flex-none')
+        ->toContain('overflow-hidden');
 });
 
 it('uses only the healthcheck toggle action to communicate enabled state', function () {
diff --git a/tests/Feature/ResourceIndexDescriptionSubtitleTest.php b/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
index ab570b7f34..eec80be0a2 100644
--- a/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
+++ b/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
@@ -9,3 +9,12 @@ test('resource table subtitle shows description only and never falls back to uui
         ->not->toContain('item.description || item.fqdn || item.uuid')
         ->not->toContain('item.fqdn || item.uuid');
 });
+
+test('resource grid does not show a placeholder when a domain is missing', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/resource/index.blade.php'));
+    $gridView = explode('x-show="viewMode === \'grid\'"', $view, 2)[1];
+
+    expect($gridView)
+        ->not->toContain('x-show="!item.fqdn"')
+        ->not->toContain('>-</span>');
+});
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index 49d5926892..ef2d80e648 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -58,3 +58,15 @@ it('does not schedule Stripe subscription reconciliation automatically', functio
 
     expect($event)->toBeNull();
 });
+
+it('schedules stuck resource cleanup once per day on one server', function () {
+    $schedule = app(Schedule::class);
+
+    $event = collect($schedule->events())->first(
+        fn ($event) => str_contains($event->command, 'cleanup:stucked-resources')
+    );
+
+    expect($event)->not->toBeNull()
+        ->and($event->expression)->toBe('0 0 * * *')
+        ->and($event->onOneServer)->toBeTrue();
+});
diff --git a/tests/Feature/SecretManagerApiTest.php b/tests/Feature/SecretManagerApiTest.php
new file mode 100644
index 0000000000..22c7ca1faf
--- /dev/null
+++ b/tests/Feature/SecretManagerApiTest.php
@@ -0,0 +1,119 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    config(['app.maintenance.driver' => 'file']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0, 'is_api_enabled' => true]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->bearerToken = $this->user->createToken('secret-manager-api-test', ['*'])->plainTextToken;
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function secretManagerApiHeaders(string $token): array
+{
+    return ['Authorization' => 'Bearer '.$token];
+}
+
+test('a secret manager integration token can be created through the api', function () {
+    Http::fake(['https://api.doppler.com/v3/me' => Http::response([], 200)]);
+
+    $response = $this->withHeaders(secretManagerApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/security/integration-tokens', [
+            'provider' => 'doppler',
+            'name' => 'Production secrets',
+            'token' => 'dp.st.secret',
+        ])
+        ->assertCreated()
+        ->assertJsonStructure(['uuid']);
+
+    $token = IntegrationToken::query()->whereUuid($response->json('uuid'))->firstOrFail();
+
+    expect($token->team_id)->toBe($this->team->id)
+        ->and($token->capabilities)->toBe(['secrets']);
+
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'api.integration_token.created',
+        'resource_uuid' => $token->uuid,
+    ]);
+});
+
+test('secret manager provider base urls only accept http and https', function (string $provider, array $metadata) {
+    Http::fake();
+
+    $this->withHeaders(secretManagerApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/security/integration-tokens', [
+            'provider' => $provider,
+            'name' => 'Invalid base URL',
+            'token' => 'token',
+            'metadata' => $metadata,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors('metadata.base_url');
+
+    Http::assertNothingSent();
+})->with([
+    'infisical' => ['infisical', ['base_url' => 'ftp://infisical.example.com', 'client_id' => 'client-1']],
+    'vault' => ['vault', ['base_url' => 'ftp://vault.example.com']],
+]);
+
+test('an application can be configured to use a secret manager through the api', function () {
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Production secrets',
+        'token' => 'dp.sa.secret',
+        'capabilities' => ['secrets'],
+    ]);
+
+    $this->withHeaders(secretManagerApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}/secret-manager", [
+            'integration_token_uuid' => $token->uuid,
+            'settings' => [
+                'project' => 'website',
+                'config' => 'production',
+            ],
+        ])
+        ->assertOk()
+        ->assertJsonPath('integration_token_uuid', $token->uuid)
+        ->assertJsonPath('provider', 'doppler')
+        ->assertJsonPath('settings.project', 'website');
+
+    $link = $this->application->secretManagerLink()->firstOrFail();
+
+    expect($link->integration_token_id)->toBe($token->id)
+        ->and($link->settings)->toBe(['project' => 'website', 'config' => 'production']);
+
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'api.application.secret_manager.updated',
+        'resource_uuid' => $this->application->uuid,
+    ]);
+});
diff --git a/tests/Feature/SecretManagerLinkMigrationTest.php b/tests/Feature/SecretManagerLinkMigrationTest.php
new file mode 100644
index 0000000000..f79b1ef948
--- /dev/null
+++ b/tests/Feature/SecretManagerLinkMigrationTest.php
@@ -0,0 +1,16 @@
+<?php
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Schema;
+
+uses(RefreshDatabase::class);
+
+test('resourceable columns have one composite unique index', function () {
+    $resourceableIndexes = collect(Schema::getIndexes('secret_manager_links'))
+        ->filter(fn (array $index): bool => $index['columns'] === ['resourceable_type', 'resourceable_id'])
+        ->values();
+
+    expect($resourceableIndexes)
+        ->toHaveCount(1)
+        ->and($resourceableIndexes->first()['unique'])->toBeTrue();
+});
diff --git a/tests/Feature/SecretManagers/SecretManagerLinkTest.php b/tests/Feature/SecretManagers/SecretManagerLinkTest.php
new file mode 100644
index 0000000000..bbf1924dfe
--- /dev/null
+++ b/tests/Feature/SecretManagers/SecretManagerLinkTest.php
@@ -0,0 +1,471 @@
+<?php
+
+use App\Actions\Database\StartRedis;
+use App\Exceptions\DeploymentException;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Security\IntegrationTokens;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\SecretManagerLink;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\SharedEnvironmentVariable;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Models\Team;
+use App\Models\User;
+use App\Traits\HasSecretManager;
+use Illuminate\Database\QueryException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+});
+
+function createSecretManagerLink(string $provider, array $settings = [], array $metadata = []): SecretManagerLink
+{
+    $token = IntegrationToken::query()->create([
+        'team_id' => test()->team->id,
+        'provider' => $provider,
+        'name' => ucfirst($provider).' token',
+        'token' => 'the-secret-token',
+        'capabilities' => ['secrets'],
+        'metadata' => $metadata ?: null,
+    ]);
+
+    return test()->application->secretManagerLink()->create([
+        'integration_token_id' => $token->id,
+        'settings' => $settings ?: null,
+    ]);
+}
+
+function makeDeploymentJobForSecrets(): ApplicationDeploymentJob
+{
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+
+    $queue = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'secrets-test-'.fake()->uuid(),
+        'status' => 'in_progress',
+        'server_id' => test()->application->destination->server->id,
+        'destination_id' => test()->application->destination->id,
+        'commit' => 'HEAD',
+        'pull_request_id' => 0,
+    ]);
+
+    $properties = [
+        'application' => test()->application,
+        'application_deployment_queue' => $queue,
+        'mainServer' => test()->application->destination->server,
+        'pull_request_id' => 0,
+    ];
+
+    foreach ($properties as $property => $value) {
+        $reflection = new ReflectionProperty($job, $property);
+        $reflection->setValue($job, $value);
+    }
+
+    return $job;
+}
+
+function resolveEnvOnJob(ApplicationDeploymentJob $job, $env): ?string
+{
+    return (new ReflectionMethod($job, 'resolve_environment_variable'))->invoke($job, $env);
+}
+
+function deploymentHasRemoteBuildtimeReferences(ApplicationDeploymentJob $job): bool
+{
+    return (new ReflectionMethod($job, 'has_remote_buildtime_secret_references'))->invoke($job);
+}
+
+test('remote build-time secret references prevent same-commit image reuse', function (string $reference) {
+    $this->application->environment_variables()->create([
+        'key' => 'BUILD_SECRET',
+        'value' => $reference,
+        'is_buildtime' => true,
+    ]);
+
+    expect(deploymentHasRemoteBuildtimeReferences(makeDeploymentJobForSecrets()))->toBeTrue();
+})->with([
+    'provider-neutral reference' => '{{vault.BUILD_SECRET}}',
+]);
+
+test('runtime-only remote secret references still allow same-commit image reuse', function () {
+    $this->application->environment_variables()->create([
+        'key' => 'RUNTIME_SECRET',
+        'value' => '{{vault.RUNTIME_SECRET}}',
+        'is_buildtime' => false,
+    ]);
+
+    expect(deploymentHasRemoteBuildtimeReferences(makeDeploymentJobForSecrets()))->toBeFalse();
+});
+
+test('a doppler link fetches secrets with the stored token', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 's3cret',
+        ]),
+    ]);
+
+    $link = createSecretManagerLink('doppler', ['project' => 'proj', 'config' => 'prd']);
+
+    expect($link->fetchSecrets())->toBe(['DB_PASSWORD' => 's3cret']);
+
+    Http::assertSent(fn ($request) => $request->hasHeader('Authorization', 'Bearer the-secret-token')
+        && str_contains($request->url(), 'project=proj'));
+});
+
+test('a vault link uses the base url and namespace from the token metadata', function () {
+    Http::fake([
+        'https://example.com:8200/v1/kv/data/apps/web' => Http::response([
+            'data' => ['data' => ['KEY' => 'value']],
+        ]),
+    ]);
+
+    $link = createSecretManagerLink('vault',
+        ['mount' => 'kv', 'path' => 'apps/web'],
+        ['base_url' => 'https://example.com:8200', 'namespace' => 'team-a'],
+    );
+
+    expect($link->fetchSecrets())->toBe(['KEY' => 'value']);
+
+    Http::assertSent(fn ($request) => $request->hasHeader('X-Vault-Namespace', 'team-a'));
+});
+
+test('services resolve environment variables from their configured secret manager', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'API_KEY' => 'remote-service-value',
+        ]),
+    ]);
+
+    $service = Service::factory()->create([
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+    ]);
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Service secrets',
+        'token' => 'the-secret-token',
+        'capabilities' => ['secrets'],
+    ]);
+    $service->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    $environmentVariable = $service->environment_variables()->create([
+        'key' => 'API_KEY',
+        'value' => '{{vault.API_KEY}}',
+    ]);
+
+    expect($service->resolveSecretManagerEnvironmentVariable($environmentVariable))->toBe('remote-service-value');
+});
+
+test('redis remote credentials stay deployment-local and use raw values in the start command', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'REDIS_PASSWORD' => 'p4$$word',
+            'REDIS_USERNAME' => 'remote-user',
+        ]),
+    ]);
+
+    $redis = StandaloneRedis::forceCreate([
+        'uuid' => 'redis-secret-test',
+        'name' => 'Redis secret test',
+        'image' => 'redis:7-alpine',
+        'environment_id' => $this->application->environment_id,
+        'destination_id' => $this->application->destination_id,
+        'destination_type' => $this->application->destination_type,
+    ]);
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Redis secrets',
+        'token' => 'the-secret-token',
+        'capabilities' => ['secrets'],
+    ]);
+    $redis->secretManagerLink()->create(['integration_token_id' => $token->id]);
+    $sharedPassword = SharedEnvironmentVariable::query()->create([
+        'key' => 'REDIS_PASSWORD',
+        'value' => '{{vault.REDIS_PASSWORD}}',
+        'type' => 'team',
+        'team_id' => $this->team->id,
+    ]);
+    $password = $redis->runtime_environment_variables()->create([
+        'key' => 'REDIS_PASSWORD',
+        'value' => '{{team.REDIS_PASSWORD}}',
+    ]);
+    $username = $redis->runtime_environment_variables()->create([
+        'key' => 'REDIS_USERNAME',
+        'value' => '{{vault.REDIS_USERNAME}}',
+    ]);
+
+    $action = new StartRedis;
+    $action->database = $redis;
+    $environmentVariables = (new ReflectionMethod($action, 'generate_environment_variables'))->invoke($action);
+    $startCommand = (new ReflectionMethod($action, 'buildStartCommand'))->invoke($action);
+
+    expect($password->fresh()->value)->toBe('{{team.REDIS_PASSWORD}}')
+        ->and($sharedPassword->fresh()->value)->toBe('{{vault.REDIS_PASSWORD}}')
+        ->and($username->fresh()->value)->toBe('{{vault.REDIS_USERNAME}}')
+        ->and($environmentVariables)->toContain('REDIS_PASSWORD=p4$$word')
+        ->and($environmentVariables)->toContain('REDIS_USERNAME=remote-user')
+        ->and($startCommand)->toContain('--requirepass p4$$word');
+});
+
+test('all deployable environment-variable resources support secret managers', function (string $resourceClass) {
+    expect(class_uses_recursive($resourceClass))->toContain(HasSecretManager::class);
+})->with([
+    Application::class,
+    Service::class,
+    StandalonePostgresql::class,
+    StandaloneMysql::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneRedis::class,
+    StandaloneKeydb::class,
+    StandaloneDragonfly::class,
+    StandaloneClickhouse::class,
+]);
+
+test('an application has at most one secret manager source', function () {
+    createSecretManagerLink('doppler');
+
+    $secondToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vault',
+        'name' => 'Vault token',
+        'token' => 'other-token',
+        'capabilities' => ['secrets'],
+        'metadata' => ['base_url' => 'https://vault.internal:8200'],
+    ]);
+
+    expect(fn () => $this->application->secretManagerLink()->create([
+        'integration_token_id' => $secondToken->id,
+    ]))->toThrow(QueryException::class);
+});
+
+test('a secret reference is substituted at deploy time and formatted as a dotenv literal', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'p4$$word',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DATABASE_URL',
+        'value' => 'postgres://app:{{vault.DB_PASSWORD}}@db:5432/app',
+    ]);
+
+    $job = makeDeploymentJobForSecrets();
+
+    expect(resolveEnvOnJob($job, $env))->toBe("'postgres://app:p4\$\$word@db:5432/app'");
+});
+
+test('provider alias references resolve against the single source', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'API_KEY' => 'abc',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'API_KEY',
+        'value' => '{{vault.API_KEY}}',
+    ]);
+
+    expect(resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))->toBe("'abc'");
+});
+
+test('the fetch happens once per deployment even with many references', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'A' => '1',
+            'B' => '2',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $first = $this->application->environment_variables()->create(['key' => 'A', 'value' => '{{vault.A}}']);
+    $second = $this->application->environment_variables()->create(['key' => 'B', 'value' => '{{vault.B}}']);
+
+    $job = makeDeploymentJobForSecrets();
+    resolveEnvOnJob($job, $first);
+    resolveEnvOnJob($job, $second);
+
+    Http::assertSentCount(1);
+});
+
+test('variables without references never contact the secret manager', function () {
+    Http::fake();
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'PLAIN',
+        'value' => 'plain-value',
+    ]);
+
+    expect(resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))->toBe('plain-value');
+
+    Http::assertNothingSent();
+});
+
+test('a null environment variable value remains null', function () {
+    $env = $this->application->environment_variables()->create([
+        'key' => 'EMPTY',
+        'value' => null,
+    ]);
+
+    expect($this->application->resolveSecretManagerEnvironmentVariable($env))->toBeNull();
+});
+
+test('a missing secret key fails the deployment and names the variable', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'OTHER' => 'value',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DB_PASSWORD',
+        'value' => '{{vault.GONE_KEY}}',
+    ]);
+
+    expect(fn () => resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))
+        ->toThrow(DeploymentException::class, 'Missing secret keys: GONE_KEY (referenced by DB_PASSWORD).');
+});
+
+test('a reference without a configured source fails the deployment', function () {
+    Http::fake();
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DB_PASSWORD',
+        'value' => '{{vault.DB_PASSWORD}}',
+    ]);
+
+    expect(fn () => resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))
+        ->toThrow(DeploymentException::class, 'no secret manager source is configured');
+
+    Http::assertNothingSent();
+});
+
+test('a fetch failure stops the deployment with a clear error', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'messages' => ['Invalid Auth token'],
+        ], 401),
+    ]);
+
+    createSecretManagerLink('doppler');
+
+    $env = $this->application->environment_variables()->create([
+        'key' => 'DB_PASSWORD',
+        'value' => '{{vault.DB_PASSWORD}}',
+    ]);
+
+    expect(fn () => resolveEnvOnJob(makeDeploymentJobForSecrets(), $env))
+        ->toThrow(DeploymentException::class, 'Could not fetch secrets from Doppler.');
+});
+
+test('import creates reference variables for missing keys only', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'EXISTING' => 'value-a',
+            'NEW_KEY' => 'value-b',
+        ]),
+    ]);
+
+    createSecretManagerLink('doppler');
+    $this->application->environment_variables()->create(['key' => 'EXISTING', 'value' => 'local']);
+
+    $imported = $this->application->secretManagerLink->importMissingReferences();
+
+    expect($imported)->toBe(['NEW_KEY']);
+
+    $created = $this->application->environment_variables()->where('key', 'NEW_KEY')->firstOrFail();
+    expect($created->value)->toBe('{{vault.NEW_KEY}}')
+        ->and($this->application->environment_variables()->where('key', 'EXISTING')->firstOrFail()->value)->toBe('local');
+});
+
+test('secret references are not marked as shared variables', function () {
+    $secretRef = $this->application->environment_variables()->create([
+        'key' => 'A',
+        'value' => '{{vault.A}}',
+    ]);
+    $sharedRef = $this->application->environment_variables()->create([
+        'key' => 'B',
+        'value' => '{{team.B}}',
+    ]);
+
+    expect($secretRef->refresh()->is_shared)->toBeFalse()
+        ->and($sharedRef->refresh()->is_shared)->toBeTrue();
+});
+
+test('remote secret values are formatted as dotenv literals', function () {
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $format = fn (string $value) => (new ReflectionMethod($job, 'format_remote_secret_value'))->invoke($job, $value);
+
+    expect($format('simple'))->toBe("'simple'")
+        ->and($format('with $dollar and spaces'))->toBe("'with \$dollar and spaces'")
+        ->and($format("it's quoted"))->toBe('"it\'s quoted"')
+        ->and($format('{"json": true}'))->toBe('\'{"json": true}\'');
+});
+
+test('deleting an integration token is blocked while links exist', function () {
+    $link = createSecretManagerLink('doppler');
+
+    Livewire\Livewire::test(IntegrationTokens::class)
+        ->call('deleteToken', $link->integration_token_id)
+        ->assertDispatched('error');
+
+    expect(IntegrationToken::query()->whereKey($link->integration_token_id)->exists())->toBeTrue();
+
+    $link->delete();
+
+    Livewire\Livewire::test(IntegrationTokens::class)
+        ->call('deleteToken', $link->integration_token_id)
+        ->assertDispatched('success');
+
+    expect(IntegrationToken::query()->whereKey($link->integration_token_id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/SecretManagers/SecretManagerLinksComponentTest.php b/tests/Feature/SecretManagers/SecretManagerLinksComponentTest.php
new file mode 100644
index 0000000000..28a8707b43
--- /dev/null
+++ b/tests/Feature/SecretManagers/SecretManagerLinksComponentTest.php
@@ -0,0 +1,317 @@
+<?php
+
+use App\Livewire\Project\Shared\EnvironmentVariable\Show;
+use App\Livewire\Project\Shared\SecretManagerLinks;
+use App\Models\Application;
+use App\Models\AuditEvent;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Js;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutDefer();
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ]);
+
+    $this->token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Doppler production',
+        'token' => 'dp.st.token',
+        'capabilities' => ['secrets'],
+    ]);
+});
+
+test('selecting a token in the dropdown saves the source automatically', function () {
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $this->token->uuid)
+        ->assertDispatched('success');
+
+    $this->assertDatabaseHas('secret_manager_links', [
+        'resourceable_type' => $this->application->getMorphClass(),
+        'resourceable_id' => $this->application->id,
+        'integration_token_id' => $this->token->id,
+    ]);
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'ui.application.secret_manager.source_updated',
+        'resource_uuid' => $this->application->uuid,
+    ]);
+});
+
+test('service account settings are required and save automatically on blur', function () {
+    $serviceAccountToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Doppler service account',
+        'token' => 'dp.sa.token',
+        'capabilities' => ['secrets'],
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $serviceAccountToken->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('saveSettings')
+        ->assertHasErrors(['settings.project', 'settings.config']);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('settings', ['project' => 'proj', 'config' => 'prd'])
+        ->call('saveSettings')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->secretManagerLink()->firstOrFail()->settings)
+        ->toBe(['project' => 'proj', 'config' => 'prd']);
+});
+
+test('doppler settings match the selected token type', function () {
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->assertSee('Project and config are fixed by this service token.')
+        ->assertDontSee('Project (required)');
+
+    $serviceAccountToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Doppler service account',
+        'token' => 'dp.sa.token',
+        'capabilities' => ['secrets'],
+    ]);
+
+    $this->application->secretManagerLink()->update([
+        'integration_token_id' => $serviceAccountToken->id,
+    ]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->assertSee('Project (required)')
+        ->assertSee('Config (required)');
+});
+
+test('selecting another token replaces the source and clears provider settings without checking references', function () {
+    $this->application->secretManagerLink()->create([
+        'integration_token_id' => $this->token->id,
+        'settings' => ['project' => 'proj'],
+    ]);
+    $this->application->environment_variables()->create(['key' => 'A', 'value' => '{{vault.A}}']);
+
+    $otherToken = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'vault',
+        'name' => 'Vault',
+        'token' => 'hvs.token',
+        'capabilities' => ['secrets'],
+        'metadata' => ['base_url' => 'https://vault.internal:8200'],
+    ]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $otherToken->uuid)
+        ->assertDispatched('success')
+        ->assertSet('settings', []);
+
+    $this->assertDatabaseCount('secret_manager_links', 1);
+    $this->assertDatabaseHas('secret_manager_links', [
+        'integration_token_id' => $otherToken->id,
+        'settings' => null,
+    ]);
+
+    Http::assertNothingSent();
+});
+
+test('browse keys shows key names only and search filters them', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'super-secret-value',
+            'API_KEY' => 'another-secret',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    $component = Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('loadKeys')
+        ->assertSee('DB_PASSWORD')
+        ->assertSee('API_KEY')
+        ->assertSee('{{vault.DB_PASSWORD}}')
+        ->assertSeeHtml('class="flex min-w-0 flex-col"')
+        ->assertDontSee('{{ $key }}')
+        ->assertDontSee('super-secret-value')
+        ->assertDontSee('another-secret');
+
+    expect($component->get('keys'))->toBe(['API_KEY', 'DB_PASSWORD']);
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.application.secret_manager.keys_viewed')->sole();
+    expect($auditEvent->metadata['key_count'])->toBe(2)
+        ->and($auditEvent->metadata)->not->toHaveKey('keys');
+
+    $component->set('search', 'db_pass')
+        ->assertSee('DB_PASSWORD')
+        ->assertDontSee('API_KEY');
+});
+
+test('browse key actions encode apostrophes and backslashes', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            "TEAM'S_KEY" => 'apostrophe-secret',
+            'TEAM\\KEY' => 'backslash-secret',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    $apostropheExpression = 'addReference('.Js::from("TEAM'S_KEY").')';
+    $backslashExpression = 'addReference('.Js::from('TEAM\\KEY').')';
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('loadKeys')
+        ->assertSeeHtml('wire:click="'.$apostropheExpression.'"')
+        ->assertSeeHtml('wire:target="'.$apostropheExpression.'"')
+        ->assertSeeHtml('wire:click="'.$backslashExpression.'"')
+        ->assertSeeHtml('wire:target="'.$backslashExpression.'"');
+});
+
+test('add reference creates a variable with a secret reference value', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'super-secret-value',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('loadKeys')
+        ->call('addReference', 'DB_PASSWORD')
+        ->assertDispatched('refreshEnvs')
+        ->assertDispatched('success');
+
+    $created = $this->application->environment_variables()->where('key', 'DB_PASSWORD')->firstOrFail();
+    expect($created->value)->toBe('{{vault.DB_PASSWORD}}');
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.application.secret_manager.reference_created')->sole();
+    expect($auditEvent->metadata['secret_key'])->toBe('[REDACTED]');
+});
+
+test('import all creates references for missing keys and skips existing ones', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'EXISTING' => 'a',
+            'NEW_KEY' => 'b',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+    $this->application->environment_variables()->create(['key' => 'EXISTING', 'value' => 'local']);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('importAll')
+        ->assertDispatched('refreshEnvs')
+        ->assertDispatched('success');
+
+    expect($this->application->environment_variables()->where('key', 'NEW_KEY')->firstOrFail()->value)
+        ->toBe('{{vault.NEW_KEY}}')
+        ->and($this->application->environment_variables()->where('key', 'EXISTING')->firstOrFail()->value)
+        ->toBe('local');
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.application.secret_manager.references_imported')->sole();
+    expect($auditEvent->metadata['key_count'])->toBe(1)
+        ->and($auditEvent->metadata['secret_keys'])->toBe('[REDACTED]');
+});
+
+test('the source can be removed', function () {
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->call('removeSource')
+        ->assertDispatched('success');
+
+    $this->assertDatabaseCount('secret_manager_links', 0);
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'ui.application.secret_manager.source_removed',
+        'resource_uuid' => $this->application->uuid,
+    ]);
+});
+
+test('members without update permission cannot save a source', function () {
+    $member = User::factory()->create();
+    $this->team->members()->attach($member->id, ['role' => 'member']);
+    $this->actingAs($member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(SecretManagerLinks::class, ['resource' => $this->application])
+        ->set('integration_token_uuid', $this->token->uuid)
+        ->assertDispatched('error', 'You need at least admin or owner permissions to update this application.');
+
+    $this->assertDatabaseCount('secret_manager_links', 0);
+});
+
+test('the edit modal value autocomplete offers the vault scope with lazy key fetch', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+            'DB_PASSWORD' => 'super-secret-value',
+        ]),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+    $env = $this->application->environment_variables()->create(['key' => 'MY_VAR', 'value' => 'plain']);
+
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application'])
+        ->call('loadValues')
+        ->assertSeeHtml('hasVaultSource: true');
+
+    expect($component->instance()->fetchSecretManagerKeys())->toBe(['DB_PASSWORD']);
+});
+
+test('the edit modal value autocomplete reports secret provider failures', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([], 503),
+    ]);
+
+    $this->application->secretManagerLink()->create(['integration_token_id' => $this->token->id]);
+    $env = $this->application->environment_variables()->create(['key' => 'MY_VAR', 'value' => 'plain']);
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application']);
+
+    expect(fn () => $component->instance()->fetchSecretManagerKeys())
+        ->toThrow(RuntimeException::class, 'Unable to fetch secret manager keys.');
+});
+
+test('the edit modal value autocomplete has no vault scope without a source', function () {
+    $env = $this->application->environment_variables()->create(['key' => 'MY_VAR', 'value' => 'plain']);
+
+    $component = Livewire::test(Show::class, ['env' => $env, 'type' => 'application'])
+        ->call('loadValues')
+        ->assertSeeHtml('hasVaultSource: false');
+
+    expect($component->instance()->fetchSecretManagerKeys())->toBe([]);
+});
diff --git a/tests/Feature/SecretManagers/SecretManagerServicesTest.php b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
new file mode 100644
index 0000000000..c4e4df36b7
--- /dev/null
+++ b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
@@ -0,0 +1,205 @@
+<?php
+
+use App\Services\DopplerService;
+use App\Services\InfisicalService;
+use App\Services\VaultService;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Validation\ValidationException;
+
+describe('DopplerService', function () {
+    test('downloads secrets as a flat key value map', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+                'DATABASE_URL' => 'postgres://user:pass@host/db',
+                'API_KEY' => 'secret-value',
+            ]),
+        ]);
+
+        $secrets = (new DopplerService('dp.st.test'))->fetchSecrets();
+
+        expect($secrets)->toBe([
+            'DATABASE_URL' => 'postgres://user:pass@host/db',
+            'API_KEY' => 'secret-value',
+        ]);
+
+        Http::assertSent(fn ($request) => $request->hasHeader('Authorization', 'Bearer dp.st.test')
+            && str_contains($request->url(), 'format=json')
+            && ! str_contains($request->url(), 'project='));
+    });
+
+    test('sends project and config for service account tokens', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response(['KEY' => 'value']),
+        ]);
+
+        (new DopplerService('dp.sa.test'))->fetchSecrets('my-project', 'prd');
+
+        Http::assertSent(fn ($request) => str_contains($request->url(), 'project=my-project')
+            && str_contains($request->url(), 'config=prd'));
+    });
+
+    test('throws a readable error when the download fails', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/configs/config/secrets/download*' => Http::response([
+                'messages' => ['Invalid Auth token'],
+            ], 401),
+        ]);
+
+        expect(fn () => (new DopplerService('bad-token'))->fetchSecrets())
+            ->toThrow(RuntimeException::class, 'Doppler API error: Invalid Auth token');
+    });
+
+    test('validates the token against the me endpoint', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/me' => Http::response(['type' => 'service_token']),
+        ]);
+
+        expect((new DopplerService('dp.st.test'))->validate())->toBeTrue();
+    });
+
+    test('validation fails for a rejected token', function () {
+        Http::fake([
+            'https://api.doppler.com/v3/me' => Http::response([], 401),
+        ]);
+
+        expect((new DopplerService('bad'))->validate())->toBeFalse();
+    });
+});
+
+describe('InfisicalService', function () {
+    test('rejects an unapproved endpoint before sending credentials', function () {
+        Http::fake();
+
+        expect(fn () => new InfisicalService('http://127.0.0.1:8080', 'client-id', 'client-secret'))
+            ->toThrow(ValidationException::class);
+
+        Http::assertNothingSent();
+    });
+
+    test('logs in with universal auth and fetches secrets from the v4 endpoint', function () {
+        Http::fake([
+            'https://example.com/infisical/api/v1/auth/universal-auth/login' => Http::response([
+                'accessToken' => 'short-lived-token',
+            ]),
+            'https://example.com/infisical/api/v4/secrets*' => Http::response([
+                'secrets' => [
+                    ['secretKey' => 'DB_PASSWORD', 'secretValue' => 's3cret'],
+                    ['secretKey' => 'API_KEY', 'secretValue' => 'abc'],
+                ],
+            ]),
+        ]);
+
+        $service = new InfisicalService('https://example.com/infisical/', 'client-id', 'client-secret');
+        $secrets = $service->fetchSecrets('project-1', 'prod', '/');
+
+        expect($secrets)->toBe([
+            'DB_PASSWORD' => 's3cret',
+            'API_KEY' => 'abc',
+        ]);
+
+        Http::assertSent(fn ($request) => str_contains($request->url(), '/api/v4/secrets')
+            && $request->hasHeader('Authorization', 'Bearer short-lived-token')
+            && str_contains($request->url(), 'projectId=project-1'));
+    });
+
+    test('falls back to the v3 raw endpoint on older self-hosted instances', function () {
+        Http::fake([
+            'https://example.com/infisical/api/v1/auth/universal-auth/login' => Http::response([
+                'accessToken' => 'short-lived-token',
+            ]),
+            'https://example.com/infisical/api/v4/secrets*' => Http::response([], 404),
+            'https://example.com/infisical/api/v3/secrets/raw*' => Http::response([
+                'secrets' => [
+                    ['secretKey' => 'LEGACY_KEY', 'secretValue' => 'legacy-value'],
+                ],
+            ]),
+        ]);
+
+        $service = new InfisicalService('https://example.com/infisical', 'client-id', 'client-secret');
+
+        expect($service->fetchSecrets('project-1', 'prod'))->toBe(['LEGACY_KEY' => 'legacy-value']);
+
+        Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1'));
+    });
+
+    test('throws when the login fails', function () {
+        Http::fake([
+            'https://example.com/infisical/api/v1/auth/universal-auth/login' => Http::response([
+                'message' => 'Invalid credentials',
+            ], 401),
+        ]);
+
+        $service = new InfisicalService('https://example.com/infisical', 'client-id', 'wrong');
+
+        expect($service->validate())->toBeFalse()
+            ->and(fn () => $service->fetchSecrets('project-1', 'prod'))
+            ->toThrow(RuntimeException::class, 'Infisical login failed: Invalid credentials');
+    });
+});
+
+describe('VaultService', function () {
+    test('rejects an unapproved endpoint before sending the token', function () {
+        Http::fake();
+
+        expect(fn () => new VaultService('http://127.0.0.1:8200', 'hvs.token'))
+            ->toThrow(ValidationException::class);
+
+        Http::assertNothingSent();
+    });
+
+    test('reads a kv v2 secret and stringifies non-string values', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/secret/data/my-app/production' => Http::response([
+                'data' => [
+                    'data' => [
+                        'DB_PASSWORD' => 's3cret',
+                        'REPLICAS' => 3,
+                    ],
+                ],
+            ]),
+        ]);
+
+        $secrets = (new VaultService('https://example.com:8200/vault/', 'hvs.token'))
+            ->fetchSecrets('secret', '/my-app/production/');
+
+        expect($secrets)->toBe([
+            'DB_PASSWORD' => 's3cret',
+            'REPLICAS' => '3',
+        ]);
+
+        Http::assertSent(fn ($request) => $request->hasHeader('X-Vault-Token', 'hvs.token')
+            && ! $request->hasHeader('X-Vault-Namespace'));
+    });
+
+    test('sends the namespace header when configured', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/secret/data/my-app' => Http::response([
+                'data' => ['data' => ['KEY' => 'value']],
+            ]),
+        ]);
+
+        (new VaultService('https://example.com:8200/vault', 'hvs.token', 'admin/team-a'))
+            ->fetchSecrets('secret', 'my-app');
+
+        Http::assertSent(fn ($request) => $request->hasHeader('X-Vault-Namespace', 'admin/team-a'));
+    });
+
+    test('throws a readable error when the read fails', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/secret/data/missing' => Http::response([
+                'errors' => ['permission denied'],
+            ], 403),
+        ]);
+
+        expect(fn () => (new VaultService('https://example.com:8200/vault', 'hvs.token'))->fetchSecrets('secret', 'missing'))
+            ->toThrow(RuntimeException::class, 'Vault API error: permission denied');
+    });
+
+    test('validates the token with lookup-self', function () {
+        Http::fake([
+            'https://example.com:8200/vault/v1/auth/token/lookup-self' => Http::response(['data' => []]),
+        ]);
+
+        expect((new VaultService('https://example.com:8200/vault', 'hvs.token'))->validate())->toBeTrue();
+    });
+});
diff --git a/tests/Feature/Security/IntegrationTokenFormTest.php b/tests/Feature/Security/IntegrationTokenFormTest.php
index 113fa4c032..2bffb5ae22 100644
--- a/tests/Feature/Security/IntegrationTokenFormTest.php
+++ b/tests/Feature/Security/IntegrationTokenFormTest.php
@@ -3,6 +3,7 @@
 use App\Livewire\Security\IntegrationTokenEditor;
 use App\Livewire\Security\IntegrationTokenForm;
 use App\Livewire\Security\IntegrationTokens;
+use App\Models\AuditEvent;
 use App\Models\InstanceSettings;
 use App\Models\IntegrationToken;
 use App\Models\Team;
@@ -15,6 +16,7 @@ use Livewire\Livewire;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    $this->withoutDefer();
     if (! InstanceSettings::query()->whereKey(0)->exists()) {
         $settings = new InstanceSettings;
         $settings->id = 0;
@@ -60,12 +62,34 @@ test('a cloudflare dns token is validated with read only requests before it is s
         'provider' => 'cloudflare',
         'name' => 'Production DNS',
     ]);
+    $this->assertDatabaseHas('audit_events', [
+        'team_id' => $this->team->id,
+        'event' => 'ui.integration_token.created',
+        'resource_name' => 'Production DNS',
+    ]);
 
     Http::assertSentCount(3);
     Http::assertSent(fn ($request) => $request->method() === 'GET'
         && $request->url() === 'https://api.cloudflare.com/client/v4/zones/zone-id/dns_records?per_page=1');
 });
 
+test('deleting an integration token is audited without storing its value', function () {
+    $token = IntegrationToken::query()->create([
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Production secrets',
+        'token' => 'dp.st.super-secret',
+        'capabilities' => ['secrets'],
+    ]);
+
+    Livewire::test(IntegrationTokens::class)->call('deleteToken', $token->id);
+
+    $auditEvent = AuditEvent::query()->where('event', 'ui.integration_token.deleted')->sole();
+
+    expect($auditEvent->resource_uuid)->toBe($token->uuid)
+        ->and(json_encode($auditEvent->metadata))->not->toContain('dp.st.super-secret');
+});
+
 test('a cloudflare token is not saved when scope validation fails', function () {
     Http::fake([
         'https://api.cloudflare.com/client/v4/user/tokens/verify' => Http::response([
@@ -100,6 +124,14 @@ test('at least one capability is required when adding a cloudflare token', funct
     Http::assertNothingSent();
 });
 
+test('provider validation uses the provider names declared by the model', function () {
+    $component = file_get_contents(app_path('Livewire/Security/IntegrationTokenForm.php'));
+
+    expect($component)
+        ->toContain("implode(',', array_keys(IntegrationToken::PROVIDER_NAMES))")
+        ->not->toContain('in:cloudflare,doppler,infisical,vault');
+});
+
 test('integration tokens page lists saved provider and capabilities', function () {
     IntegrationToken::query()->create([
         'team_id' => $this->team->id,
diff --git a/tests/Feature/Security/IntegrationTokenSecretProvidersTest.php b/tests/Feature/Security/IntegrationTokenSecretProvidersTest.php
new file mode 100644
index 0000000000..794195504a
--- /dev/null
+++ b/tests/Feature/Security/IntegrationTokenSecretProvidersTest.php
@@ -0,0 +1,191 @@
+<?php
+
+use App\Livewire\Security\IntegrationTokenForm;
+use App\Models\InstanceSettings;
+use App\Models\IntegrationToken;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    if (! InstanceSettings::query()->whereKey(0)->exists()) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->save();
+    }
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+test('a doppler token is validated against the doppler api before it is saved', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/me' => Http::response(['type' => 'service_token']),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class, ['modal_mode' => true])
+        ->set('provider', 'doppler')
+        ->set('name', 'Production secrets')
+        ->set('token', 'dp.st.token')
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('close-modal');
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'team_id' => $this->team->id,
+        'provider' => 'doppler',
+        'name' => 'Production secrets',
+    ]);
+});
+
+test('selecting a secret manager provider switches the capability to secrets', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->assertSet('capabilities', ['secrets'])
+        ->set('provider', 'cloudflare')
+        ->assertSet('capabilities', ['dns']);
+});
+
+test('an invalid doppler token is not saved', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/me' => Http::response([], 401),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Bad token')
+        ->set('token', 'dp.st.rejected')
+        ->call('addToken')
+        ->assertHasNoErrors()
+        ->assertDispatched('error');
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
+
+test('doppler only accepts service and service account tokens', function (string $token) {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Unsupported token')
+        ->set('token', $token)
+        ->call('addToken')
+        ->assertHasErrors(['token']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+})->with([
+    'personal token' => 'dp.pt.token',
+    'unknown token' => 'token',
+]);
+
+test('a doppler service account token is accepted', function () {
+    Http::fake([
+        'https://api.doppler.com/v3/me' => Http::response(['type' => 'service_account']),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Shared secrets')
+        ->set('token', 'dp.sa.token')
+        ->call('addToken')
+        ->assertHasNoErrors();
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'provider' => 'doppler',
+        'name' => 'Shared secrets',
+    ]);
+});
+
+test('an infisical token requires a base url and a client id', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'infisical')
+        ->set('name', 'Infisical')
+        ->set('token', 'client-secret')
+        ->set('metadata', [])
+        ->call('addToken')
+        ->assertHasErrors(['metadata.base_url', 'metadata.client_id']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
+
+test('secret manager provider base urls only accept http and https', function (string $provider, array $metadata) {
+    Http::fake();
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', $provider)
+        ->set('name', 'Invalid base URL')
+        ->set('token', 'token')
+        ->set('metadata', $metadata)
+        ->call('addToken')
+        ->assertHasErrors(['metadata.base_url']);
+
+    Http::assertNothingSent();
+    $this->assertDatabaseCount('integration_tokens', 0);
+})->with([
+    'infisical' => ['infisical', ['base_url' => 'ftp://infisical.example.com', 'client_id' => 'client-1']],
+    'vault' => ['vault', ['base_url' => 'ftp://vault.example.com']],
+]);
+
+test('the infisical fields put the client id before the client secret', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'infisical')
+        ->assertSeeInOrder(['Token name', 'Client ID', 'Client secret', 'Base URL']);
+});
+
+test('an infisical token stores its metadata after a successful login', function () {
+    Http::fake([
+        'https://example.com/api/v1/auth/universal-auth/login' => Http::response([
+            'accessToken' => 'token',
+        ]),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'infisical')
+        ->set('name', 'Infisical')
+        ->set('token', 'client-secret')
+        ->set('metadata', ['base_url' => 'https://example.com', 'client_id' => 'client-1'])
+        ->call('addToken')
+        ->assertHasNoErrors();
+
+    $token = IntegrationToken::query()->where('provider', 'infisical')->firstOrFail();
+
+    expect($token->metadata)->toBe(['base_url' => 'https://example.com', 'client_id' => 'client-1'])
+        ->and($token->capabilities)->toBe(['secrets']);
+});
+
+test('a vault token is validated with lookup-self before it is saved', function () {
+    Http::fake([
+        'https://example.com:8200/v1/auth/token/lookup-self' => Http::response(['data' => []]),
+    ]);
+
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'vault')
+        ->set('name', 'Vault')
+        ->set('token', 'hvs.token')
+        ->set('metadata', ['base_url' => 'https://example.com:8200'])
+        ->call('addToken')
+        ->assertHasNoErrors();
+
+    $this->assertDatabaseHas('integration_tokens', [
+        'provider' => 'vault',
+        'name' => 'Vault',
+    ]);
+});
+
+test('the dns capability is rejected for secret manager providers', function () {
+    Livewire::test(IntegrationTokenForm::class)
+        ->set('provider', 'doppler')
+        ->set('name', 'Doppler')
+        ->set('token', 'dp.st.token')
+        ->set('capabilities', ['dns'])
+        ->call('addToken')
+        ->assertHasErrors(['capabilities.0']);
+
+    $this->assertDatabaseCount('integration_tokens', 0);
+});
diff --git a/tests/Feature/Security/PrivateKeyDropdownTest.php b/tests/Feature/Security/PrivateKeyDropdownTest.php
index 5724af568e..ba32faf21d 100644
--- a/tests/Feature/Security/PrivateKeyDropdownTest.php
+++ b/tests/Feature/Security/PrivateKeyDropdownTest.php
@@ -70,8 +70,8 @@ test('saving a private key from its modal editor closes the modal', function ()
         'modalMode' => true,
     ])->set('name', 'Updated SSH key')
         ->call('changePrivateKey')
-        ->assertDispatched('securityResourceChanged')
-        ->assertDispatched('close-modal');
+        ->assertDispatched('privateKeyUpdated')
+        ->assertNoRedirect();
 
     expect($privateKey->fresh()->name)->toBe('Updated SSH key');
 });
diff --git a/tests/Feature/SecurityResourceModalEditorsTest.php b/tests/Feature/SecurityResourceModalEditorsTest.php
index b2cb0a5883..06d07a1676 100644
--- a/tests/Feature/SecurityResourceModalEditorsTest.php
+++ b/tests/Feature/SecurityResourceModalEditorsTest.php
@@ -1,11 +1,15 @@
 <?php
 
 use App\Livewire\Security\CloudInitScript\Show as CloudInitScriptShow;
+use App\Livewire\Security\PrivateKey\Index as PrivateKeyIndex;
+use App\Livewire\Security\PrivateKey\Show as PrivateKeyShow;
 use App\Models\CloudInitScript;
 use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
 
@@ -22,6 +26,7 @@ beforeEach(function () {
     $this->actingAs($user);
     session(['currentTeam' => $team]);
     $this->team = $team;
+    Storage::fake('ssh-keys');
 });
 
 it('opens security resources in modal editors and keeps create actions in card headers', function () {
@@ -40,12 +45,24 @@ it('opens security resources in modal editors and keeps create actions in card h
             ->toContain('<x-modal-input title="Edit')
             ->toContain('<x-reicon name="settings"')
             ->toContain(':contentClicks="false"')
-            ->toContain('@click="modalOpen=true"')
-            ->not->toContain('wire:click="openEditor(')
             ->not->toContain('href="{{ route(\'security.');
     }
 
-    expect(file_get_contents($views[0]))->toContain('>Private key</div>', '>Status</div>');
+    expect(file_get_contents($views[0]))
+        ->toContain('>Private key</div>', '>Status</div>')
+        ->toContain('wire:click="openEditor(\'{{ $key->uuid }}\')"')
+        ->toContain("\$dispatch('open-private-key-editor', { name:")
+        ->toContain('$refs.loadingPrivateKeyName.value = $event.detail.name')
+        ->toContain('wire:loading.flex wire:target="openEditor"')
+        ->toContain('aria-label="Loading private key editor"')
+        ->toContain('class="w-full flex-col gap-4"')
+        ->toContain('<x-forms.input label="Public key" loading')
+        ->toContain('<x-forms.input loading :allowToPeak="false" />')
+        ->toContain('<x-forms.input label="Name" required x-ref="loadingPrivateKeyName" />')
+        ->toContain('<x-forms.input label="Description" x-ref="loadingPrivateKeyDescription" />')
+        ->not->toContain('class="flex flex-col gap-1.5 lg:col-span-2"')
+        ->not->toContain('animate-pulse')
+        ->and(substr_count(file_get_contents($views[0]), '<livewire:security.private-key.show'))->toBe(1);
     expect(file_get_contents($views[1]))->toContain('>Token</div>', '>Provider</div>');
     expect(file_get_contents($views[2]))->toContain('>Script</div>', '>Last updated</div>');
 
@@ -82,3 +99,71 @@ it('deletes a cloud-init script from its modal editor without redirecting to a d
 
     $this->assertModelMissing($script);
 });
+
+it('keeps the remaining private key editor populated after deleting multiple keys', function () {
+    $privateKeys = collect(range(1, 3))->map(fn (int $index) => PrivateKey::factory()->create([
+        'name' => "private-key-regression-marker-{$index}",
+        'team_id' => $this->team->id,
+        'private_key' => PrivateKey::generateNewKeyPair('ed25519')['private_key'],
+    ]));
+    $index = Livewire::test(PrivateKeyIndex::class);
+
+    foreach ($privateKeys->take(2) as $privateKey) {
+        Livewire::test(PrivateKeyShow::class, [
+            'private_key_uuid' => $privateKey->uuid,
+            'modalMode' => true,
+        ])->call('delete')
+            ->assertDispatched('privateKeyDeleted')
+            ->assertNoRedirect();
+    }
+
+    $remainingPrivateKey = $privateKeys->last();
+
+    $index->dispatch('securityResourceChanged')
+        ->assertDontSee($privateKeys->get(0)->name)
+        ->assertDontSee($privateKeys->get(1)->name)
+        ->assertSee($remainingPrivateKey->name);
+
+    Livewire::test(PrivateKeyShow::class, [
+        'private_key_uuid' => $remainingPrivateKey->uuid,
+        'modalMode' => true,
+    ])->assertSet('name', $remainingPrivateKey->name)
+        ->assertSee($remainingPrivateKey->name);
+});
+
+it('loads only the selected private key editor and refreshes mutations without navigation', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    Livewire::test(PrivateKeyIndex::class)
+        ->call('openEditor', $privateKey->uuid)
+        ->assertSet('selectedPrivateKeyUuid', $privateKey->uuid)
+        ->dispatch('modalClosed')
+        ->assertSet('selectedPrivateKeyUuid', null)
+        ->dispatch('privateKeyCreated', keyId: $privateKey->id)
+        ->assertNoRedirect();
+});
+
+it('loads the public key with the editor instead of making a follow-up request', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    Livewire::test(PrivateKeyShow::class, [
+        'private_key_uuid' => $privateKey->uuid,
+        'modalMode' => true,
+    ])->assertSet('public_key', $privateKey->getPublicKey());
+
+    expect(file_get_contents(resource_path('views/livewire/security/private-key/show.blade.php')))
+        ->not->toContain('x-init="$wire.loadPublicKey()"');
+});
+
+it('shows deletion progress in the underlying private key editor', function () {
+    $view = file_get_contents(resource_path('views/livewire/security/private-key/show.blade.php'));
+
+    expect($view)
+        ->toContain('wire:loading.class="pointer-events-none opacity-50" wire:target="delete"')
+        ->toContain('wire:loading.flex wire:target="delete"')
+        ->toContain('<x-loading text="Deleting private key..." />');
+});
diff --git a/tests/Feature/SentinelPushDeduplicationTest.php b/tests/Feature/SentinelPushDeduplicationTest.php
index aef1b74849..bc6f2d260e 100644
--- a/tests/Feature/SentinelPushDeduplicationTest.php
+++ b/tests/Feature/SentinelPushDeduplicationTest.php
@@ -147,6 +147,16 @@ it('dispatches the job when container state changes', function () use ($running)
     Queue::assertPushed(PushServerUpdateJob::class, 2);
 });
 
+it('dispatches the job when only the container restart count changes', function () {
+    $beforeRestart = [['name' => 'app-1', 'state' => 'running', 'restart_count' => 0]];
+    $afterRestart = [['name' => 'app-1', 'state' => 'running', 'restart_count' => 1]];
+
+    pushSentinel($this->token, sentinelPayload($beforeRestart))->assertOk();
+    pushSentinel($this->token, sentinelPayload($afterRestart))->assertOk();
+
+    Queue::assertPushed(PushServerUpdateJob::class, 2);
+});
+
 it('ignores health status changes while container lifecycle state is unchanged', function () {
     $healthy = [['name' => 'app-1', 'state' => 'running', 'health_status' => 'healthy']];
     $unhealthy = [['name' => 'app-1', 'state' => 'running', 'health_status' => 'unhealthy']];
diff --git a/tests/Feature/ServerConnectionCheckIsolationTest.php b/tests/Feature/ServerConnectionCheckIsolationTest.php
index d098c39b55..895304c7d1 100644
--- a/tests/Feature/ServerConnectionCheckIsolationTest.php
+++ b/tests/Feature/ServerConnectionCheckIsolationTest.php
@@ -78,3 +78,21 @@ it('does not call cloud provider APIs during an SSH connection check', function
 
     Http::assertNothingSent();
 });
+
+it('resets unreachable_count after a successful connection check', function () {
+    $server = createServerForConnectionIsolationTest(['ip' => '203.0.113.10']);
+    // unreachable_count is not mass-assignable, so it must be set directly.
+    $server->unreachable_count = 5;
+    $server->save();
+
+    Process::fake([
+        '*' => Process::result(
+            output: '{"Server":{"Version":"27.0.0"}}',
+            exitCode: 0,
+        ),
+    ]);
+
+    (new ServerConnectionCheckJob($server->fresh(), disableMux: false))->handle();
+
+    expect($server->fresh()->unreachable_count)->toBe(0);
+});
diff --git a/tests/Feature/ServerStatusIndicatorDesignTest.php b/tests/Feature/ServerStatusIndicatorDesignTest.php
index 5e2b8b5faa..4b31a51d85 100644
--- a/tests/Feature/ServerStatusIndicatorDesignTest.php
+++ b/tests/Feature/ServerStatusIndicatorDesignTest.php
@@ -39,6 +39,10 @@ test('server status summary uses warning indicators for proxy updates and sentin
 
     expect($summary)
         ->toContain('$server->hasCurrentTraefikOutdatedInfo()')
+        ->toContain('$proxyStatusLabel = match (true)')
+        ->toContain("\$proxyConfigurationPending => 'Restart required'")
+        ->toContain("\$traefikUpdateAvailable => 'Update available'")
+        ->toContain('{{ $proxyStatusLabel }}')
         ->toContain("'bg-warning' => \$proxyNeedsAttention && (\$proxyUpdateAvailable")
         ->toContain("'bg-warning' => \$sentinelNeedsAttention")
         ->not->toContain("\$server->isSentinelLive() ? 'bg-success' : 'bg-error'");
diff --git a/tests/Feature/Service/EditDomainPortValidationTest.php b/tests/Feature/Service/EditDomainPortValidationTest.php
index c86fdca4db..0d569574ff 100644
--- a/tests/Feature/Service/EditDomainPortValidationTest.php
+++ b/tests/Feature/Service/EditDomainPortValidationTest.php
@@ -2,7 +2,9 @@
 
 use App\Livewire\Project\Service\Domains;
 use App\Livewire\Project\Service\EditDomain;
+use App\Livewire\Project\Service\Index;
 use App\Models\Environment;
+use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
@@ -10,14 +12,21 @@ use App\Models\ServiceApplication;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
 
+uses(RefreshDatabase::class);
+
 beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
     // Create user and team
     $this->user = User::factory()->create();
     $this->team = Team::factory()->create();
     $this->user->teams()->attach($this->team, ['role' => 'owner']);
     $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
 
     // Create server
     $this->server = Server::factory()->create([
@@ -25,9 +34,7 @@ beforeEach(function () {
     ]);
 
     // Create standalone docker destination
-    $this->destination = StandaloneDocker::factory()->create([
-        'server_id' => $this->server->id,
-    ]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
 
     // Create project and environment
     $this->project = Project::factory()->create([
@@ -48,8 +55,10 @@ beforeEach(function () {
     ]);
 
     // Create service application
-    $this->serviceApplication = ServiceApplication::factory()->create([
+    $this->serviceApplication = ServiceApplication::create([
         'service_id' => $this->service->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
         'fqdn' => 'http://example.com:8000',
     ]);
 
@@ -68,6 +77,42 @@ beforeEach(function () {
     }
 });
 
+it('loads a persisted port override in the service application editor', function () {
+    $this->serviceApplication->update([
+        'fqdn' => 'https://web.example.com',
+        'domain_port_overrides' => [
+            'https://web.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication->fresh(),
+        'parameters' => [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'service_uuid' => $this->service->uuid,
+            'stack_service_uuid' => $this->serviceApplication->uuid,
+        ],
+        'query' => [],
+    ])
+        ->assertSet('fqdn', 'https://web.example.com:8080')
+        ->assertOk();
+});
+
+it('initializes route state when mounting a service application directly', function () {
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication,
+    ])
+        ->assertSet('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'service_uuid' => $this->service->uuid,
+            'stack_service_uuid' => $this->serviceApplication->uuid,
+        ])
+        ->assertSet('query', [])
+        ->assertOk();
+});
+
 it('loads the EditDomain component with required port', function () {
     Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
         ->assertSet('requiredPort', 8000)
@@ -75,6 +120,28 @@ it('loads the EditDomain component with required port', function () {
         ->assertOk();
 });
 
+it('loads a persisted port override and moves it when the hostname changes', function () {
+    $this->serviceApplication->update([
+        'fqdn' => 'https://old.example.com',
+        'domain_port_overrides' => [
+            'https://old.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->assertSet('fqdn', 'https://old.example.com:8080')
+        ->set('fqdn', 'https://new.example.com:8080')
+        ->call('submit')
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('fqdn', 'https://new.example.com:8080');
+
+    expect($this->serviceApplication->fresh())
+        ->fqdn->toBe('https://new.example.com')
+        ->domain_port_overrides->toBe([
+            'https://new.example.com' => 8080,
+        ]);
+});
+
 it('marks noindex changes as pending configuration', function () {
     $this->service->isConfigurationChanged(save: true);
 
@@ -107,7 +174,7 @@ it('allows port removal when user confirms', function () {
 });
 
 it('cancels port removal when user cancels', function () {
-    $originalFqdn = $this->serviceApplication->fqdn;
+    $originalFqdn = $this->serviceApplication->url;
 
     Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
         ->set('fqdn', 'http://example.com') // Remove port
@@ -126,7 +193,10 @@ it('allows saving when port is changed to different port', function () {
 
     // Verify the FQDN was updated
     $this->serviceApplication->refresh();
-    expect($this->serviceApplication->fqdn)->toBe('http://example.com:3000');
+    expect($this->serviceApplication->fqdn)->toBe('http://example.com')
+        ->and($this->serviceApplication->domain_port_overrides)->toBe([
+            'http://example.com' => 3000,
+        ]);
 });
 
 it('allows saving when all domains have ports (multiple domains)', function () {
@@ -153,8 +223,10 @@ it('does not show warning for services without required port', function () {
         'environment_id' => $this->environment->id,
     ]);
 
-    $appWithoutPort = ServiceApplication::factory()->create([
+    $appWithoutPort = ServiceApplication::create([
         'service_id' => $serviceWithoutPort->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
         'fqdn' => 'http://example.com',
     ]);
 
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index c8dd33a46b..d6c687fbc5 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -20,6 +20,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     Queue::fake();
+    config()->set('app.maintenance.store', 'array');
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
 
     $this->team = Team::factory()->create();
@@ -173,6 +174,23 @@ describe('GET /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         $response->assertStatus(200);
         $response->assertJsonFragment(['uuid' => $ctx->serviceApplication->uuid, 'name' => 'web']);
     });
+
+    test('returns an editable url with persisted port overrides', function () {
+        $ctx = createServiceWithApplicationForApiTest($this);
+        $ctx->serviceApplication->update([
+            'fqdn' => 'https://web.example.com',
+            'domain_port_overrides' => [
+                'https://web.example.com' => 8080,
+            ],
+        ]);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
+            ->assertSuccessful()
+            ->assertJsonPath('url', 'https://web.example.com:8080')
+            ->assertJsonMissingPath('domain_port_overrides');
+    });
 });
 
 describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
@@ -199,6 +217,34 @@ describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         expect($ctx->serviceApplication->human_name)->toBe('Web UI');
     });
 
+    test('round trips and moves a port override when renaming a domain', function () {
+        $ctx = createServiceWithApplicationForApiTest($this);
+        $ctx->serviceApplication->update([
+            'fqdn' => 'https://old.example.com',
+            'domain_port_overrides' => [
+                'https://old.example.com' => 8080,
+            ],
+        ]);
+
+        $url = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
+            ->json('url');
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'url' => str_replace('old.example.com', 'new.example.com', $url),
+        ])->assertSuccessful()
+            ->assertJsonPath('url', 'https://new.example.com:8080');
+
+        expect($ctx->serviceApplication->fresh())
+            ->fqdn->toBe('https://new.example.com')
+            ->domain_port_overrides->toBe([
+                'https://new.example.com' => 8080,
+            ]);
+    });
+
     test('updates the HTTP to HTTPS redirect setting', function () {
         config(['app.maintenance.driver' => 'file']);
         $ctx = createServiceWithApplicationForApiTest($this);
@@ -225,6 +271,19 @@ describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
         $response->assertStatus(422);
     });
 
+    test('returns 422 for a url port outside the valid TCP range', function (string $url) {
+        $ctx = createServiceWithApplicationForApiTest($this);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'url' => $url,
+        ])->assertUnprocessable();
+    })->with([
+        'zero' => 'https://example.com:0',
+        'above maximum' => 'https://example.com:65536',
+    ]);
+
     test('returns 422 when enabling log drain but server has no log drain', function () {
         $ctx = createServiceWithApplicationForApiTest($this);
 
diff --git a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
index 1f2f7786a7..6b74156f53 100644
--- a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
+++ b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use App\Livewire\Project\Service\DatabaseBackups;
+
 it('moves service and database page navigation into their sidebars', function () {
     $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
     $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
@@ -58,7 +60,7 @@ it('groups database and service navigation by user workflow', function () {
         expect($serviceSidebar)
             ->toContain("'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage']")
             ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal']")
-            ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups']")
+            ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup']")
             ->toContain("'Operations' => ['Resource Operations', 'Tags', 'Danger Zone']");
     }
 });
@@ -110,7 +112,7 @@ it('combines service database and storage backups in one section', function () {
         ->toContain('class="data-table w-full overflow-x-auto"')
         ->toContain('backup-table-grid service-backup-table-grid')
         ->not->toContain('<span class="text-right">Executions</span>')
-        ->toContain('class="data-table-row backup-table-grid text-[13px]')
+        ->toMatch('/class="(?=[^"]*\\bdata-table-row\\b)(?=[^"]*\\bbackup-table-grid\\b)(?=[^"]*text-\\[13px\\])[^\"]*"/')
         ->toContain('class="listbox-option justify-start! gap-2.5!"')
         ->toContain('x-data="{ dropdownOpen: false }"')
         ->toContain('class="listbox-panel left-0! right-auto! z-[90]! w-52! min-w-52! sm:left-auto! sm:right-0!"')
@@ -119,15 +121,147 @@ it('combines service database and storage backups in one section', function () {
     expect($styles)->toContain('.service-backup-table-grid');
 });
 
-it('links compose database backups to the unified service backups page', function () {
+it('keeps backup navigation out of compose database settings', function () {
     $sidebar = file_get_contents(resource_path('views/components/service-database/sidebar.blade.php'));
 
     expect($sidebar)
-        ->toContain("'route' => 'project.service.volume-backups.index'")
-        ->toContain("'parameters' => \$serviceParameters")
+        ->not->toContain("'label' => 'Backups'")
+        ->not->toContain("'label' => 'Import Backup'")
         ->not->toContain("'route' => 'project.service.database.backups'");
 });
 
+it('links service backup details back to the unified service backups page', function () {
+    $sidebar = file_get_contents(resource_path('views/components/backup-sidebar.blade.php'));
+
+    expect($sidebar)->toContain("'back' => 'project.service.volume-backups.index'");
+});
+
+it('declares the database backup mount return type', function () {
+    $returnType = (new ReflectionMethod(DatabaseBackups::class, 'mount'))->getReturnType();
+
+    expect($returnType)->not->toBeNull()
+        ->and($returnType->getName())->toBe('mixed');
+});
+
+it('keeps service navigation visible on backup detail pages and uses section tabs', function () {
+    $databaseBackup = file_get_contents(resource_path('views/livewire/project/service/database-backups.blade.php'));
+    $storageBackup = file_get_contents(resource_path('views/livewire/project/service/volume-backup/show.blade.php'));
+
+    foreach ([$databaseBackup, $storageBackup] as $view) {
+        expect($view)
+            ->toContain('<x-service.configuration-sidebar :service="$service"')
+            ->toContain('<x-backup-tabs')
+            ->not->toContain('<x-backup-sidebar');
+    }
+
+    expect($databaseBackup)->toContain('context="service"')
+        ->and($storageBackup)->toContain('context="service-volume"');
+});
+
+it('opens service backup schedules in place without navigating', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)
+        ->toContain('wire:click="openSchedule(')
+        ->toContain('wireOpen="scheduleModalOpen"')
+        ->toContain('<x-backup-tabs')
+        ->not->toContain("route('project.service.backups.schedule.show'");
+});
+
+it('shows service backup executions below schedules without a separate view tab', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+    $executions = file_get_contents(resource_path('views/livewire/project/service/backup-executions.blade.php'));
+
+    expect($index)
+        ->toContain('<livewire:project.service.backup-executions :service="$service"')
+        ->not->toContain('aria-label="Backup views"')
+        ->not->toContain("route('project.service.backups.executions'");
+
+    expect($executions)
+        ->toContain('title="Executions"')
+        ->toContain('flush>');
+});
+
+it('wraps backup modal tabs and shows schedule loading feedback', function () {
+    $tabs = file_get_contents(resource_path('views/components/backup-tabs.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($tabs)
+        ->toContain('flex-wrap')
+        ->not->toContain('overflow-x-auto');
+
+    expect($index)
+        ->toContain('<x-table.loading target="openSchedule" text="Loading schedule..."')
+        ->not->toContain('Loading schedule\n');
+});
+
+it('loads every backup editor section when the modal opens and switches tabs locally', function () {
+    $tabs = file_get_contents(resource_path('views/components/backup-tabs.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)
+        ->toContain("x-data=\"{ activeSection: 'general' }\"")
+        ->toContain("@foreach (['general', 's3', 'retention', 'danger'] as \$modalSection)")
+        ->toContain("x-show=\"activeSection === '{{ \$modalSection }}'\"");
+
+    expect($tabs)
+        ->toContain("@click=\"activeSection = '{{ \$item['key'] }}'\"")
+        ->not->toContain('wire:click="selectScheduleSection');
+});
+
+it('adds a back up now action to every service backup schedule row', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+    $styles = file_get_contents(resource_path('css/app.css'));
+
+    expect($index)
+        ->toContain('<span class="text-right">Actions</span>')
+        ->toContain('<div class="min-w-[59rem]">')
+        ->toContain("wire:click.stop=\"backupNow('database',")
+        ->toContain("wire:click.stop=\"backupNow('storage',")
+        ->toContain('<x-forms.button')
+        ->toContain('Back up now</x-forms.button>')
+        ->not->toContain('class="icon-button shrink-0"')
+        ->not->toContain('class="contents cursor-pointer"');
+
+    expect($styles)
+        ->toContain('.service-backup-table-grid')
+        ->toContain('width: 100%;')
+        ->toContain('.data-table-row.service-backup-table-grid {')
+        ->not->toContain('.data-table-header.service-backup-table-grid > :last-child')
+        ->not->toContain('.data-table-row.service-backup-table-grid > :last-child');
+});
+
+it('refreshes backup executions from backup broadcasts on the current team channel', function () {
+    $serviceExecutions = file_get_contents(app_path('Livewire/Project/Service/BackupExecutions.php'));
+    $serviceBackups = file_get_contents(app_path('Livewire/Project/Service/VolumeBackup/Index.php'));
+    $databaseExecutions = file_get_contents(app_path('Livewire/Project/Database/BackupExecutions.php'));
+    $databaseBackupJob = file_get_contents(app_path('Jobs/DatabaseBackupJob.php'));
+
+    expect($serviceExecutions)
+        ->toContain('echo-private:team.{$teamId},BackupCreated')
+        ->toContain("=> '\$refresh'")
+        ->and($serviceBackups)
+        ->toContain('echo-private:team.{$teamId},BackupCreated')
+        ->and($databaseExecutions)
+        ->toContain('$teamId = currentTeam()->id')
+        ->not->toContain('$userId = Auth::id()')
+        ->and(strpos($databaseBackupJob, "'finished_at' => Carbon::now()->toImmutable()"))
+        ->toBeLessThan(strrpos($databaseBackupJob, 'BackupCreated::dispatch($this->team->id)'));
+});
+
+it('offers downloads from the service backup executions list', function () {
+    $component = file_get_contents(app_path('Livewire/Project/Service/BackupExecutions.php'));
+    $view = file_get_contents(resource_path('views/livewire/project/service/backup-executions.blade.php'));
+
+    expect($component)
+        ->toContain("route('download.backup'")
+        ->toContain("route('download.volume-backup'")
+        ->and($view)
+        ->toContain('<span class="text-right">Actions</span>')
+        ->toContain('aria-label="Download backup"')
+        ->toContain('@click.stop');
+});
+
 it('uses a distinct backup icon across resource sidebars', function () {
     $sidebars = [
         resource_path('views/components/application/configuration-sidebar.blade.php'),
diff --git a/tests/Feature/ServiceDomainPortCorruptionTest.php b/tests/Feature/ServiceDomainPortCorruptionTest.php
index 89a4b6bc21..37be302f92 100644
--- a/tests/Feature/ServiceDomainPortCorruptionTest.php
+++ b/tests/Feature/ServiceDomainPortCorruptionTest.php
@@ -63,7 +63,8 @@ YAML;
 
     $serviceApp->refresh();
 
-    expect($serviceApp->fqdn)->toBe('http://git.example.com:80')
+    expect($serviceApp->fqdn)->toBe('http://git.example.com')
+        ->and($serviceApp->domain_port_overrides['http://git.example.com'] ?? null)->toBe(80)
         ->and($serviceApp->fqdn)->not->toContain('//:80')
         ->and(fn () => Url::fromString($serviceApp->fqdn))->not->toThrow(Throwable::class);
 
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 899aa521f8..4f825f8e24 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\CheckDomainDnsJob;
 use App\Livewire\Project\Service\Domains;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
@@ -11,6 +12,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
 
@@ -90,6 +92,40 @@ beforeEach(function () {
     ]);
 });
 
+it('marks service application port-only changes as pending configuration', function () {
+    $this->webApp->update([
+        'fqdn' => 'http://example.com',
+        'domain_port_overrides' => ['http://example.com' => 8000],
+    ]);
+    $this->service->isConfigurationChanged(save: true);
+
+    $this->webApp->update([
+        'domain_port_overrides' => ['http://example.com' => 3000],
+    ]);
+
+    expect($this->service->refresh()->isConfigurationChanged())->toBeTrue();
+});
+
+it('does not mark reordered service application port overrides as changed', function () {
+    $this->webApp->update([
+        'fqdn' => 'http://one.example.com,http://two.example.com',
+        'domain_port_overrides' => [
+            'http://one.example.com' => 8000,
+            'http://two.example.com' => 3000,
+        ],
+    ]);
+    $this->service->isConfigurationChanged(save: true);
+
+    $this->webApp->update([
+        'domain_port_overrides' => [
+            'http://two.example.com' => 3000,
+            'http://one.example.com' => 8000,
+        ],
+    ]);
+
+    expect($this->service->refresh()->isConfigurationChanged())->toBeFalse();
+});
+
 it('groups configured domains and shows redirect settings in the table', function () {
     $this->apiApp->update([
         'fqdn' => 'https://api.example.com,https://admin.example.com',
@@ -125,6 +161,21 @@ it('groups configured domains and shows redirect settings in the table', functio
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
+it('removes consecutive service domains by stable row identity after indexes change', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://first.example.com,https://second.example.com,https://third.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
+
+    $component
+        ->call('removeDomainByKey', hash('sha256', 'https://first.example.com|'.$this->apiApp->id))
+        ->call('removeDomainByKey', hash('sha256', 'https://second.example.com|'.$this->apiApp->id))
+        ->assertDispatched('success');
+
+    expect($this->apiApp->fresh()->fqdn)->toBe('https://third.example.com');
+});
+
 it('shows and persists the HTTP redirect control for HTTPS service applications', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSee('Redirect HTTP to HTTPS')
@@ -176,6 +227,18 @@ it('resets the add domain dns gate when segmented domain fields change', functio
         ->assertSet('forceSaveDns', false);
 });
 
+it('does not add a single-label hostname as a service domain', function () {
+    $this->apiApp->update(['fqdn' => null]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->apiApp->id)
+        ->set('newDomainParts.host', 'aaa')
+        ->call('addDomain')
+        ->assertDispatched('error');
+
+    expect($this->apiApp->fresh()->fqdn)->toBeNull();
+});
+
 it('shows dns entries control next to Add', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSuccessful()
@@ -283,39 +346,38 @@ it('auto-adds missing non-www pair for a service application redirect', function
 it('adds only the entered domain when redirects allow both directions', function () {
     $this->webApp->update(['redirect' => 'both']);
 
-    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->set('newServiceApplicationId', $this->webApp->id)
         ->set('newDomain', 'https://web.example.com')
         ->call('addDomain')
         ->assertHasNoErrors()
-        ->assertDispatched('success')
+        ->assertDispatched('success');
+
+    $component->call('pollDnsChecks')
         ->assertSee('DNS skipped');
 
     expect($this->webApp->fresh()->fqdn)->toBe('https://web.example.com');
 });
 
 it('adds a domain to a selected service application', function () {
+    Queue::fake();
+
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->set('newServiceApplicationId', $this->webApp->id)
         ->set('newDomain', 'https://web.example.com')
         ->call('addDomain')
         ->assertHasNoErrors()
-        ->assertDispatched('success')
+        ->assertDispatched('success', 'Domain added. DNS check started.')
+        ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->firstWhere('url', 'https://web.example.com')['dns_status'] === 'checking')
         ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->pluck('url')->contains('https://web.example.com'))
         ->assertSee('https://web.example.com');
 
     $this->webApp->refresh();
     expect($this->webApp->fqdn)->toBe('https://web.example.com');
 
-    $dnsStatuses = $this->webApp->domain_dns_statuses;
+    expect($this->webApp->domain_dns_statuses['https://web.example.com']['status'] ?? null)->toBe('checking');
 
-    expect($dnsStatuses)
-        ->toHaveKey('https://web.example.com')
-        ->not->toHaveKey('https://www.web.example.com')
-        ->and($dnsStatuses['https://web.example.com']['status'])
-        ->toBe('skipped')
-        ->and($dnsStatuses['https://web.example.com']['checked_at'])
-        ->not->toBeNull();
+    Queue::assertPushed(CheckDomainDnsJob::class, 1);
 });
 
 it('adds a domain when the compose service has an empty environment section', function () {
@@ -428,7 +490,8 @@ it('prunes the previous dns status when a service domain is renamed', function (
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertDispatched('edit-domain-saved')
-        ->assertDispatched('success');
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
 
     $this->apiApp->refresh();
 
@@ -457,7 +520,7 @@ it('does not restore stale dns status when a removed service domain is re-added'
         ],
     ]);
 
-    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->call('removeDomain', 0)
         ->set('newServiceApplicationId', $this->apiApp->id)
         ->set('newDomain', 'https://api.example.com')
@@ -465,6 +528,8 @@ it('does not restore stale dns status when a removed service domain is re-added'
         ->assertHasNoErrors()
         ->assertDispatched('success');
 
+    $component->call('pollDnsChecks');
+
     $this->apiApp->refresh();
 
     expect(explode(',', (string) $this->apiApp->fqdn))
@@ -473,6 +538,133 @@ it('does not restore stale dns status when a removed service domain is re-added'
         ->and($this->apiApp->domain_dns_statuses['https://api.example.com']['message'] ?? null)->not->toBe('Stale DNS result.');
 });
 
+it('shows the port warning modal when adding a domain with a non-default port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('requiredPort', 8000)
+        ->assertSee('Use a different port?');
+
+    expect($this->webApp->fresh()->fqdn)->toBeNull();
+});
+
+it('saves a non-default domain port after confirming the warning', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmRemovePort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    $this->webApp->refresh();
+
+    expect($this->webApp->fqdn)->toContain('https://web.example.com')
+        ->and($this->webApp->domain_port_overrides['https://web.example.com'] ?? null)->toBe(3000);
+});
+
+it('clears a service domain port override when saving without a port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  api:
+    image: node:alpine
+    environment:
+      - SERVICE_FQDN_API_3000
+  web:
+    image: nginx:alpine
+YAML,
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertDontSee('Internal port 8080');
+
+    expect($this->apiApp->fresh()->domain_port_overrides ?? [])
+        ->not->toHaveKey('https://api.example.com');
+});
+
+it('reopens service domain edit with the saved port override', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.url', 'https://api.example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'api.example.com');
+});
+
+it('does not show the port warning modal when the domain uses the required port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '8000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
 it('saves after confirming both a domain conflict and a missing required port', function () {
     $this->service->update([
         'docker_compose_raw' => <<<'YAML'
@@ -494,7 +686,10 @@ YAML,
         ->call('confirmDomainUsage')
         ->assertSet('showDomainConflictModal', false)
         ->assertSet('showPortWarningModal', true)
-        ->assertSet('forceSaveDomains', true);
+        ->assertSet('forceSaveDomains', true)
+        ->assertSee('Use a different port?')
+        ->assertSee('Keep required port')
+        ->assertSee('Use this port anyway');
 
     $component
         ->call('confirmRemovePort')
@@ -564,6 +759,39 @@ it('hides dns message text when service domain dns status is ok', function () {
         ->assertDontSee('DNS points to 203.0.113.10');
 });
 
+it('polls a queued service dns check and notifies about success', function () {
+    $domain = 'https://api.example.com';
+    $this->apiApp->update([
+        'domain_dns_statuses' => [
+            $domain => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => null,
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Checking DNS...')
+        ->assertSee('wire:poll.2000ms="pollDnsChecks"', false);
+
+    $this->apiApp->update([
+        'domain_dns_statuses' => [
+            $domain => [
+                'status' => 'ok',
+                'message' => 'DNS looks correct.',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ],
+    ]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('domainRows', fn (array $rows): bool => collect($rows)->firstWhere('url', $domain)['dns_status'] === 'ok')
+        ->assertDispatched('success', 'DNS is configured correctly for api.example.com.');
+});
+
 it('forbids read-only users from checking service domain dns', function (string $action, array $parameters) {
     $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
 
@@ -623,3 +851,65 @@ it('updates search engine indexing from the service domains view', function () {
     expect(file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php')))
         ->not->toContain('<select');
 });
+
+it('keeps noindex domains when normalizing a custom service domain port', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com:8080',
+        'noindex_domains' => ['https://api.example.com:8080'],
+    ]);
+
+    expect($this->apiApp->refresh())
+        ->fqdn->toBe('https://api.example.com')
+        ->noindex_domains->toBe(['https://api.example.com'])
+        ->and($this->apiApp->domain_port_overrides)
+        ->toBe(['https://api.example.com' => 8080]);
+});
+
+it('shows an inherited internal port badge from the coolify service env port', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  api:\n    image: node:alpine\n    environment:\n      - SERVICE_FQDN_API_3000\n",
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 3000')
+        ->assertSee('Inherited from the Coolify service port', false)
+        ->assertDontSee('No internal port');
+});
+
+it('shows a custom internal port badge for a service domain override', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  api:\n    image: node:alpine\n    environment:\n      - SERVICE_FQDN_API_3000\n",
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->assertSee('Internal port 8080')
+        ->assertSee('Custom internal port for this domain', false)
+        ->assertDontSee('Internal port 3000');
+});
+
+it('does not show an internal port badge when the service has no env port', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertDontSee('No internal port')
+        ->assertDontSee('Internal port ')
+        ->assertDontSee('table-badge-danger', false);
+});
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index da730d97dd..9d5ac5a8a8 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -1,11 +1,16 @@
 <?php
 
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
 use App\Livewire\Project\Database\Import as DatabaseImport;
 use App\Livewire\Project\Service\Heading;
+use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -16,6 +21,7 @@ use App\Models\User;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -113,6 +119,14 @@ test('does not open service database backups route from another team', function
     ]));
 })->throws(NotFoundHttpException::class);
 
+test('does not open service import backup route from another team', function () {
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->otherService->uuid,
+    ]))->assertForbidden();
+});
+
 test('does not resolve service database import component from another team', function () {
     $component = app(DatabaseImport::class);
     $component->parameters = [
@@ -141,7 +155,7 @@ test('owner can still hydrate service heading with own service', function () {
         ->assertOk();
 });
 
-test('service database backup schedules use dedicated general retention and executions urls', function () {
+test('legacy service database backup detail urls redirect to unified backup views', function () {
     $backup = ScheduledDatabaseBackup::create([
         'team_id' => $this->teamA->id,
         'frequency' => 'daily',
@@ -156,51 +170,254 @@ test('service database backup schedules use dedicated general retention and exec
         'stack_service_uuid' => $this->ownServiceDatabase->uuid,
     ]);
     $generalUrl = $listUrl.'/'.$backup->uuid;
+    $parameters = [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ];
 
-    $this->get($listUrl)
-        ->assertOk()
-        ->assertSee('href="'.$generalUrl.'"', false);
+    $this->get($generalUrl)->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/s3')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/retention')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/danger')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/executions')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+});
 
-    $this->get($generalUrl)
-        ->assertOk()
-        ->assertSee('Frequency')
-        ->assertDontSee('S3 Enabled')
-        ->assertDontSee('Number of backups to keep')
-        ->assertDontSee('Cleanup Failed Backups')
-        ->assertDontSee('Delete Backups and Schedule');
+test('legacy service database backup list redirects to unified service backups', function () {
+    $legacyUrl = route('project.service.database.backups', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+    $centralBackupsUrl = route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]);
 
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
-        ->assertSee('S3 Storage')
-        ->assertDontSee('S3 Storage Retention')
-        ->assertDontSee('Local Backup Retention')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Cleanup Failed Backups');
+    $this->get($legacyUrl)->assertRedirect($centralBackupsUrl);
+});
 
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
-        ->assertSee('Local Backup Retention')
-        ->assertSee('S3 Storage Retention')
-        ->assertSee('Number of backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Cleanup Failed Backups');
+test('service backup schedules open in place from the unified view', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
 
-    $this->get($generalUrl.'/executions')
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
         ->assertOk()
-        ->assertSee('<h2 class="py-0">Executions</h2>', false)
-        ->assertDontSee('Executions <span', false)
-        ->assertSee('Cleanup Failed Backups')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Number of backups to keep');
+        ->assertSee("wire:click=\"openSchedule('{$backup->uuid}')\"", false);
+});
 
-    $this->get($generalUrl.'/danger')
+test('service database backup schedules open in the Livewire component', function () {
+    Queue::fake();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('openSchedule', $backup->uuid)
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('selectedDatabaseBackup.uuid', $backup->uuid)
+        ->assertSet('selectedVolumeBackup', null);
+});
+
+test('service database backups can be queued from the Livewire component', function () {
+    Queue::fake();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('backupNow', 'database', $backup->uuid)
+        ->assertDispatched('success', 'Backup queued.');
+
+    Queue::assertPushed(DatabaseBackupJob::class, fn (DatabaseBackupJob $job): bool => $job->backup->is($backup));
+});
+
+test('service storage backups can be queued from the Livewire component', function () {
+    Queue::fake();
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('backupNow', 'storage', $backup->uuid)
+        ->assertDispatched('success', 'Backup queued.');
+
+    Queue::assertPushed(VolumeBackupJob::class, fn (VolumeBackupJob $job): bool => $job->backup->is($backup));
+});
+
+test('service backup executions combine database execution history', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'coolify',
+        'size' => 2048,
+        'finished_at' => now(),
+    ]);
+
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
         ->assertOk()
-        ->assertSee('Danger Zone')
-        ->assertSee('Delete Scheduled Backup')
-        ->assertSee('Delete Backups and Schedule')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Number of backups to keep')
-        ->assertDontSee('Cleanup Failed Backups');
+        ->assertSee('own-db')
+        ->assertSee('Success')
+        ->assertSee('2 KB');
+
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))->assertSee("wire:click=\"openExecution('{$execution->uuid}')\"", false);
+});
+
+test('service import backup page selects from compatible databases', function () {
+    $secondDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'analytics-db',
+        'image' => 'mysql:8',
+        'custom_type' => 'mysql',
+    ]);
+    $importUrl = route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]);
+
+    $this->get($importUrl)
+        ->assertOk()
+        ->assertSee('Import Backup')
+        ->assertSee('own-db')
+        ->assertSee('analytics-db');
+
+    $this->get($importUrl.'/'.$secondDatabase->uuid)
+        ->assertOk()
+        ->assertSee('analytics-db')
+        ->assertSee('Start the database first');
+});
+
+test('service import backup redirects when exactly one compatible database exists', function () {
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))->assertRedirectToRoute('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+});
+
+test('service import backup excludes unsupported databases', function () {
+    $unsupportedDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'cache-db',
+        'image' => 'redis:7-alpine',
+        'custom_type' => 'redis',
+    ]);
+
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
+        ->assertRedirectToRoute('project.service.import-backup.database', [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+            'service_uuid' => $this->ownService->uuid,
+            'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+        ]);
+
+    $this->get(route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $unsupportedDatabase->uuid,
+    ]))->assertNotFound();
+});
+
+test('service import backup opens the selected compatible database', function () {
+    $secondDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'analytics-db',
+        'image' => 'mysql:8',
+        'custom_type' => 'mysql',
+    ]);
+
+    $this->get(route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $secondDatabase->uuid,
+    ]))
+        ->assertOk()
+        ->assertSee('analytics-db')
+        ->assertSee('Start the database first');
+});
+
+test('service import backup requires update authorization for the service and selected database', function () {
+    $member = User::factory()->create();
+    $member->teams()->attach($this->teamA, ['role' => 'member']);
+    $this->actingAs($member);
+
+    $parameters = [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ];
+
+    $this->get(route('project.service.import-backup', $parameters))->assertForbidden();
+    $this->get(route('project.service.import-backup.database', [
+        ...$parameters,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]))->assertForbidden();
+});
+
+test('legacy service database import redirects to the service import page with its database selected', function () {
+    $legacyUrl = route('project.service.database.import', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+    $selectedImportUrl = route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+
+    $this->get($legacyUrl)->assertRedirect($selectedImportUrl);
 });
 
 test('service storage backups page includes schedules from all compose databases', function () {
@@ -211,15 +428,15 @@ test('service storage backups page includes schedules from all compose databases
         'custom_type' => 'postgresql',
     ]);
 
-    foreach ([$this->ownServiceDatabase, $secondDatabase] as $database) {
-        ScheduledDatabaseBackup::create([
+    $backups = collect([$this->ownServiceDatabase, $secondDatabase])->map(function (ServiceDatabase $database) {
+        return ScheduledDatabaseBackup::create([
             'team_id' => $this->teamA->id,
             'description' => $database->name.' backup',
             'frequency' => 'daily',
             'database_id' => $database->id,
             'database_type' => $database->getMorphClass(),
         ]);
-    }
+    });
 
     $this->get(route('project.service.volume-backups.index', [
         'project_uuid' => $this->projectA->uuid,
@@ -230,10 +447,6 @@ test('service storage backups page includes schedules from all compose databases
         ->assertSee('>Database</span>', false)
         ->assertSee('own-db')
         ->assertSee('analytics-db')
-        ->assertSee(route('project.service.database.backups', [
-            'project_uuid' => $this->projectA->uuid,
-            'environment_uuid' => $this->environmentA->uuid,
-            'service_uuid' => $this->ownService->uuid,
-            'stack_service_uuid' => $this->ownServiceDatabase->uuid,
-        ]), false);
+        ->assertSee("wire:click=\"openSchedule('{$backups->first()->uuid}')\"", false)
+        ->assertSee("wire:click=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
 });
diff --git a/tests/Feature/ServiceTemplatePortCoverageTest.php b/tests/Feature/ServiceTemplatePortCoverageTest.php
new file mode 100644
index 0000000000..4cf832bea4
--- /dev/null
+++ b/tests/Feature/ServiceTemplatePortCoverageTest.php
@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * One-click templates that expose SERVICE_URL / SERVICE_FQDN without a _PORT
+ * suffix (WordPress-style) must declare `# port:` so getRequiredPort() can
+ * fall back for the badge and proxy.
+ */
+it('requires a template port for HTTP compose services that omit SERVICE_*_PORT', function () {
+    $templates = get_service_templates();
+    $missing = [];
+
+    foreach (glob(base_path('templates/compose/*.{yaml,yml}'), GLOB_BRACE) as $file) {
+        $name = pathinfo($file, PATHINFO_FILENAME);
+        if (! $templates->has($name)) {
+            continue;
+        }
+
+        $text = file_get_contents($file);
+        $declaresHttpUrlWithoutPort = false;
+        foreach (preg_split("/\r\n|\n|\r/", $text) as $line) {
+            $line = trim($line);
+            if (! preg_match('/^- SERVICE_(?:URL|FQDN)_([A-Z0-9_]+)$/', $line, $match)
+                && ! preg_match('/^SERVICE_(?:URL|FQDN)_([A-Z0-9_]+):/', $line, $match)) {
+                continue;
+            }
+            if (! preg_match('/_\d+$/', $match[1])) {
+                $declaresHttpUrlWithoutPort = true;
+                break;
+            }
+        }
+
+        if (! $declaresHttpUrlWithoutPort) {
+            continue;
+        }
+
+        $yamlPort = null;
+        if (preg_match('/^#\s*port:\s*(\d+)/m', $text, $portMatch)) {
+            $yamlPort = $portMatch[1];
+        }
+        $jsonPort = data_get($templates, "{$name}.port");
+
+        if (! $yamlPort || ! filled($jsonPort)) {
+            $missing[] = $name;
+        }
+    }
+
+    expect($missing)->toBeEmpty('HTTP templates without SERVICE_*_PORT need # port: and JSON port: '.implode(', ', $missing));
+});
diff --git a/tests/Feature/ServiceTemplatePortLookupTest.php b/tests/Feature/ServiceTemplatePortLookupTest.php
new file mode 100644
index 0000000000..1e228811dd
--- /dev/null
+++ b/tests/Feature/ServiceTemplatePortLookupTest.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Models\Service;
+use App\Models\ServiceApplication;
+
+it('resolves the wordpress template port from service_type even when the display name differs', function () {
+    expect(data_get(get_service_templates(), 'wordpress-without-database.port'))->toBe('80');
+
+    $service = new Service([
+        'name' => 'api-smoke-wp',
+        'service_type' => 'wordpress-without-database',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  wordpress:
+    image: wordpress:latest
+    environment:
+      - SERVICE_URL_WORDPRESS
+YAML,
+    ]);
+
+    expect($service->getRequiredPort())->toBe(80);
+
+    $app = new ServiceApplication(['name' => 'wordpress']);
+    $app->setRelation('service', $service);
+
+    expect($app->getRequiredPort())->toBe(80);
+});
diff --git a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
index 08ae87821a..affea0c895 100644
--- a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
+++ b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
@@ -36,11 +36,14 @@ it('returns each service template last updated timestamp from the generated bund
         ->toBe(CarbonImmutable::parse($templateTimestamp)->timezone(config('app.timezone'))->format('M j, Y H:i'));
 });
 
-it('uses a valid local icon or the default icon for every service', function () {
+it('returns local, CDN, and default logo fallbacks for every service', function () {
     $services = (new Select)->loadServices()['services'];
 
     expect($services['opnform']['logo'])->toBe(asset('svgs/opnform.svg'))
-        ->and($services['pydio-cells']['logo'])->toBe(asset('svgs/default.webp'));
+        ->and($services['pydio-cells']['logo'])->toBe(asset('svgs/cells.svg'))
+        ->and($services['pydio-cells']['logo_cdn_url'])
+        ->toBe('https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/svgs/cells.svg')
+        ->and($services['pydio-cells']['logo_default_url'])->toBe(asset('svgs/default.webp'));
 });
 
 it('crops wide database wordmarks to their icon artwork', function () {
@@ -127,6 +130,22 @@ it('renders the service templates last updated hint placeholder', function () {
     $view->assertSee('@keydown.escape.stop="closeCategoryFilter(true)"', false);
 });
 
+it('renders the local, CDN, and default service logo fallback chain', function () {
+    View::share('errors', new ViewErrorBag);
+
+    $view = $this->view('livewire.project.new.select', [
+        'current_step' => 'type',
+        'environments' => collect(),
+    ]);
+
+    $view->assertSee('service.logo_cdn_url', false);
+    $view->assertSee('service.logo_default_url', false);
+
+    expect(file_get_contents(resource_path('views/livewire/global-search.blade.php')))
+        ->toContain('item.logo_cdn_url')
+        ->toContain('item.logo_default_url');
+});
+
 it('keeps service template keys for service selection and docs links', function () {
     $services = collect((new Select)->loadServices()['services']);
     $denoKv = $services->firstWhere('id', 'denoKV');
diff --git a/tests/Feature/StableNestedLivewireKeysTest.php b/tests/Feature/StableNestedLivewireKeysTest.php
new file mode 100644
index 0000000000..c9b90bca99
--- /dev/null
+++ b/tests/Feature/StableNestedLivewireKeysTest.php
@@ -0,0 +1,64 @@
+<?php
+
+it('does not key nested Livewire components by mutable list positions', function () {
+    $postgresView = file_get_contents(resource_path('views/livewire/project/database/postgresql/general.blade.php'));
+    $proxyView = file_get_contents(resource_path('views/livewire/server/proxy/dynamic-configurations.blade.php'));
+
+    expect($postgresView)
+        ->toContain(':wire:key="\'init-script-\'.md5($script[\'filename\'])"')
+        ->not->toContain(':wire:key="$script[\'index\']"');
+
+    expect($proxyView)
+        ->toContain('wire:key="proxy-navbar-{{ $fileName }}"')
+        ->not->toContain('wire:key="{{ $fileName }}-{{ $loop->index }}"');
+});
+
+it('saves reindexed PostgreSQL scripts by their original stable identity', function () {
+    $editor = file_get_contents(app_path('Livewire/Project/Database/InitScript.php'));
+    $parent = file_get_contents(app_path('Livewire/Project/Database/Postgresql/General.php'));
+
+    expect($editor)
+        ->toContain('public string $originalFilename;')
+        ->toContain("dispatch('save_init_script', \$this->script, \$this->originalFilename)");
+
+    expect($parent)
+        ->toContain('public function save_init_script($script, string $originalFilename)')
+        ->toContain("firstWhere('filename', \$originalFilename)");
+});
+
+it('keeps editable and refreshed list row keys independent of their positions', function () {
+    $applicationDomains = file_get_contents(resource_path('views/livewire/project/application/partials/domain-row.blade.php'));
+    $serviceDomains = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+    $scheduledJobs = file_get_contents(resource_path('views/livewire/settings/scheduled-jobs.blade.php'));
+
+    expect($applicationDomains)
+        ->not->toContain('wire:key="domain-row-{{ $index }}-')
+        ->toContain('wire:key="domain-row-{{ md5(');
+
+    expect($serviceDomains)
+        ->not->toContain('-{{ $index }}-')
+        ->toContain('wire:key="svc-domain-{{ $row[\'service_application_id\'] ?? \'x\' }}-{{ md5(');
+
+    expect($scheduledJobs)
+        ->not->toContain('wire:key="run-{{ $loop->index }}"')
+        ->not->toContain('wire:key="skip-{{ $loop->index }}"')
+        ->toContain('wire:key="run-{{ md5(serialize($run)) }}"')
+        ->toContain('wire:key="skip-{{ md5(serialize($skip)) }}"');
+});
+
+it('keys nested Livewire status components rendered inside navigation loops', function () {
+    $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
+
+    expect($sidebar)
+        ->toContain(':key="\'application-server-status-\'.$application->uuid"');
+});
+
+it('keys rolling log lines by content occurrence instead of list position', function () {
+    $logs = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+
+    expect($logs)
+        ->toContain('$lineOccurrences = [];')
+        ->toContain('$lineFingerprint = md5($line);')
+        ->toContain('wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}"')
+        ->not->toContain("'line-' . \$index");
+});
diff --git a/tests/Feature/StandardTableComponentsTest.php b/tests/Feature/StandardTableComponentsTest.php
index 9741268bc7..30437c05b5 100644
--- a/tests/Feature/StandardTableComponentsTest.php
+++ b/tests/Feature/StandardTableComponentsTest.php
@@ -3,6 +3,12 @@
 use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\File;
 
+it('contains wide data tables without overflowing their layout', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)->toContain(".data-table {\n    min-width: 0;\n    max-width: 100%;\n    overflow-x: auto;");
+});
+
 it('renders the standard table toolbar controls', function () {
     $html = Blade::render(<<<'BLADE'
         <x-table.toolbar>
diff --git a/tests/Feature/TablePaginationLoadingTest.php b/tests/Feature/TablePaginationLoadingTest.php
index 49bb974001..62142ffe57 100644
--- a/tests/Feature/TablePaginationLoadingTest.php
+++ b/tests/Feature/TablePaginationLoadingTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\Gate;
 
 it('renders the shared page size selector', function () {
     $html = Blade::render('<x-page-size-select model="perPage" livewire storage-key="tests.page-size" />');
@@ -30,6 +31,18 @@ it('renders the shared page size selector', function () {
         ->toContain('max="100"');
 });
 
+it('disables page size controls when the gate denies access', function () {
+    Gate::define('view-audit-log-test', fn (): bool => false);
+
+    $html = Blade::render(<<<'BLADE'
+        <x-page-size-select model="perPage" livewire
+            canGate="view-audit-log-test" :canResource="new stdClass" />
+    BLADE);
+
+    expect($html)->toMatch('/<button[^>]*aria-label="Items per page"[^>]*\sdisabled(?:[=\s>])/')
+        ->toMatch('/<input[^>]*aria-label="Custom items per page"[^>]*\sdisabled(?:[=\s>])/');
+});
+
 it('positions table dropdown panels outside overflowing containers', function () {
     $html = Blade::render(<<<'BLADE'
         <x-table.dropdown>
diff --git a/tests/Feature/Team/TeamDeletionTest.php b/tests/Feature/Team/TeamDeletionTest.php
index 1c11d13802..e449a55639 100644
--- a/tests/Feature/Team/TeamDeletionTest.php
+++ b/tests/Feature/Team/TeamDeletionTest.php
@@ -59,6 +59,65 @@ test('the danger zone resource list can be refreshed', function () {
         ->assertSuccessful();
 });
 
+test('unused private keys do not block team deletion', function () {
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->teamToDelete->id,
+        'description' => 'Created by Coolify',
+    ]);
+
+    expect($this->teamToDelete->isEmpty())->toBeTrue();
+
+    app(DeleteTeam::class)->handle($this->teamToDelete, $this->owner);
+
+    expect(Team::find($this->teamToDelete->id))->toBeNull()
+        ->and(PrivateKey::find($privateKey->id))->toBeNull();
+});
+
+test('system-wide git sources do not block team deletion', function () {
+    Team::forceCreate([
+        'id' => 0,
+        'name' => 'Root Team',
+        'personal_team' => false,
+    ]);
+
+    $githubApp = GithubApp::forceCreate([
+        'name' => 'System-wide GitHub source',
+        'team_id' => $this->teamToDelete->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+        'is_system_wide' => true,
+    ]);
+    $gitlabApp = GitlabApp::forceCreate([
+        'name' => 'System-wide GitLab source',
+        'team_id' => $this->teamToDelete->id,
+        'api_url' => 'https://gitlab.com/api/v4',
+        'html_url' => 'https://gitlab.com',
+        'is_public' => false,
+        'is_system_wide' => true,
+    ]);
+
+    expect($this->teamToDelete->isEmpty())->toBeTrue();
+
+    app(DeleteTeam::class)->handle($this->teamToDelete, $this->owner);
+
+    expect(Team::find($this->teamToDelete->id))->toBeNull()
+        ->and($githubApp->refresh()->team_id)->toBe(0)
+        ->and($gitlabApp->refresh()->team_id)->toBe(0);
+});
+
+test('the danger zone names and links blocking resource types', function () {
+    Project::factory()->count(2)->create(['team_id' => $this->teamToDelete->id]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->teamToDelete]);
+
+    Livewire::test(DangerZone::class)
+        ->assertSee('This team still owns:')
+        ->assertSee('2 projects')
+        ->assertSeeHtml('href="'.route('project.index').'"');
+});
+
 test('a team with a running application cannot be deleted', function () {
     $server = Server::factory()->create(['team_id' => $this->teamToDelete->id]);
     $destination = StandaloneDocker::query()->where('server_id', $server->id)->firstOrFail();
diff --git a/tests/Feature/TeamScopedDestinationTest.php b/tests/Feature/TeamScopedDestinationTest.php
index 3088fb4db3..be4ee0e4c8 100644
--- a/tests/Feature/TeamScopedDestinationTest.php
+++ b/tests/Feature/TeamScopedDestinationTest.php
@@ -275,6 +275,23 @@ describe('StandaloneDocker/SwarmDocker ownedByCurrentTeam scope', function () {
 });
 
 describe('Destination/Show team scope', function () {
+    test('deleting a destination redirects without rendering the deleted destination', function () {
+        $destination = SwarmDocker::create([
+            'uuid' => fake()->uuid(),
+            'name' => 'swarm-a-'.fake()->unique()->word(),
+            'network' => 'swarm-a-'.fake()->unique()->word(),
+            'server_id' => $this->serverA->id,
+        ]);
+
+        $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $destination->uuid])
+            ->call('delete')
+            ->assertRedirect(route('destination.index'));
+
+        expect($component->effects)
+            ->toHaveKey('redirectUsingNavigate', true);
+        expect($destination->fresh())->toBeNull();
+    });
+
     test('mount with other team destination UUID redirects to index', function () {
         $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destinationB->uuid]);
 
diff --git a/tests/Feature/TerminalContainerListTest.php b/tests/Feature/TerminalContainerListTest.php
new file mode 100644
index 0000000000..ec64da51c9
--- /dev/null
+++ b/tests/Feature/TerminalContainerListTest.php
@@ -0,0 +1,39 @@
+<?php
+
+use App\Livewire\Terminal\Index;
+use App\Models\Server;
+use Illuminate\Support\Collection;
+
+function terminalServer(string $uuid, string $name, array $containers): Server
+{
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->forceFill(['uuid' => $uuid, 'name' => $name]);
+    $server->shouldReceive('isFunctional')->once()->andReturnTrue();
+    $server->shouldReceive('loadAllContainers')->once()->andReturn(collect($containers));
+
+    return $server;
+}
+
+it('keeps containers with the same name on different servers as distinct terminal targets', function () {
+    $component = new Index;
+    $component->servers = new Collection([
+        terminalServer('pulse-uuid', 'Pulse', [
+            ['Names' => 'coolify-proxy', 'State' => 'running'],
+            ['Names' => 'coolify-sentinel', 'State' => 'running'],
+        ]),
+        terminalServer('forge-uuid', 'Forge', [
+            ['Names' => 'coolify-proxy', 'State' => 'running'],
+            ['Names' => 'coolify-sentinel', 'State' => 'running'],
+        ]),
+    ]);
+
+    $component->loadContainers();
+
+    expect($component->containers)->toHaveCount(4)
+        ->and(collect($component->containers)->pluck('uuid')->all())->toBe([
+            'pulse-uuid:coolify-proxy',
+            'forge-uuid:coolify-proxy',
+            'pulse-uuid:coolify-sentinel',
+            'forge-uuid:coolify-sentinel',
+        ]);
+});
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
index 9068683f69..3dad5423e5 100644
--- a/tests/Feature/TraefikVersionStateTest.php
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -35,6 +35,126 @@ it('ignores stale minor upgrade information for the detected Traefik version', f
     expect($component->getNewerTraefikBranchAvailableProperty())->toBeNull();
 });
 
+it('does not offer the Traefik branch already configured on a running proxy', function () {
+    Cache::put('coolify:versions:all', [
+        'traefik' => [
+            'v3.7' => '3.7.8',
+            'v3.6' => '3.6.23',
+        ],
+    ]);
+
+    $server = Server::factory()->make([
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->proxySettings = <<<'YAML'
+services:
+  traefik:
+    image: 'traefik:v3.7'
+YAML;
+
+    expect($component->getNewerTraefikBranchAvailableProperty())->toBeNull();
+});
+
+it('still offers a newer Traefik branch than the configured image', function () {
+    Cache::put('coolify:versions:all', [
+        'traefik' => [
+            'v3.7' => '3.7.8',
+            'v3.6' => '3.6.23',
+        ],
+    ]);
+
+    $server = Server::factory()->make([
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->proxySettings = 'services:'.PHP_EOL.'  traefik:'.PHP_EOL.'    image: traefik:v3.6';
+
+    expect($component->getNewerTraefikBranchAvailableProperty())->toBe('v3.7');
+});
+
+it('clears the stale minor warning after the configured branch is applied', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+            'last_saved_proxy_configuration' => <<<'YAML'
+services:
+  traefik:
+    image: traefik:v3.7
+YAML,
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->mount();
+
+    expect($server->refresh()->traefik_outdated_info)->toBeNull();
+});
+
+it('preserves a newer Traefik warning stored after the warning was inspected', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+    $component->proxySettings = 'services:'.PHP_EOL.'  traefik:'.PHP_EOL.'    image: traefik:v3.7';
+
+    $newerWarning = [
+        'current' => '3.7.8',
+        'latest' => '3.8.1',
+        'type' => 'minor_upgrade',
+        'upgrade_target' => 'v3.8',
+    ];
+    Server::query()->whereKey($server->id)->update(['traefik_outdated_info' => $newerWarning]);
+
+    $method = new ReflectionMethod($component, 'clearAppliedTraefikBranchWarning');
+    $method->invoke($component);
+
+    expect($server->refresh()->traefik_outdated_info)->toBe($newerWarning);
+});
+
 it('does not mark stale Traefik outdated information as a current warning', function () {
     $server = Server::factory()->make([
         'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index b4f78d9e0a..519b323f6b 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -6,7 +6,9 @@ use App\Jobs\VolumeBackupJob;
 use App\Jobs\VolumeBackupRecoveryJob;
 use App\Livewire\Project\Application\Backup\Create as CreateScheduledVolumeBackup;
 use App\Livewire\Project\Service\FileStorage;
-use App\Livewire\Project\Shared\Storages\Show;
+use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
+use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
+use App\Livewire\Project\Shared\Storages\All;
 use App\Livewire\Project\Shared\Storages\VolumeBackups;
 use App\Models\Application;
 use App\Models\Environment;
@@ -20,10 +22,12 @@ use App\Models\ScheduledVolumeBackup;
 use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
+use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
@@ -42,6 +46,14 @@ use Symfony\Component\HttpKernel\Exception\HttpException;
 
 uses(RefreshDatabase::class);
 
+it('types service backup S3 storage state as a nullable Eloquent collection', function () {
+    $property = new ReflectionProperty(ServiceVolumeBackupIndex::class, 's3s');
+
+    expect($property->getType()?->getName())->toBe(Collection::class)
+        ->and($property->getType()?->allowsNull())->toBeTrue()
+        ->and($property->getDefaultValue())->toBeNull();
+});
+
 it('provides the volume backup domain classes and relationship', function () {
     expect(class_exists(ScheduledVolumeBackup::class))->toBeTrue()
         ->and(class_exists(ScheduledVolumeBackupExecution::class))->toBeTrue()
@@ -187,6 +199,45 @@ it('creates a scheduled backup with a preselected volume from the shared modal',
         ->and($backup->s3_storage_id)->toBeNull();
 });
 
+it('shows readable service storage backup target labels', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application] = createVolumeBackupApplication($team);
+    $service = Service::factory()->create([
+        'environment_id' => $application->environment_id,
+        'destination_id' => $application->destination_id,
+        'destination_type' => $application->destination_type,
+    ]);
+    $resource = ServiceApplication::create([
+        'uuid' => new_public_id(),
+        'name' => 'directus',
+        'service_id' => $service->id,
+    ]);
+    LocalPersistentVolume::create([
+        'name' => $service->uuid.'_directus-templates',
+        'mount_path' => '/directus/templates',
+        'resource_id' => $resource->id,
+        'resource_type' => $resource->getMorphClass(),
+    ]);
+    LocalFileVolume::unguarded(fn () => LocalFileVolume::withoutEvents(fn () => LocalFileVolume::create([
+        'uuid' => new_public_id(),
+        'fs_path' => './uploads',
+        'mount_path' => '/directus/uploads',
+        'is_directory' => true,
+        'is_based_on_git' => false,
+        'is_preview_suffix_enabled' => true,
+        'resource_id' => $resource->id,
+        'resource_type' => $resource->getMorphClass(),
+    ])));
+
+    Livewire::test(CreateServiceVolumeBackup::class, ['service' => $service])
+        ->assertSet('targets.0.name', 'directus-templates')
+        ->assertSet('targets.0.type', 'Directus')
+        ->assertSet('targets.1.name', './uploads (directory)')
+        ->assertSet('targets.1.type', 'Directus')
+        ->assertSee('Directus: directus-templates');
+});
+
 it('handles scheduled backup persistence failures', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
@@ -432,11 +483,8 @@ it('shows the configure backup modal trigger inside the volume card instead of i
     signInForVolumeBackups($this, $team);
     [$application, $volume] = createVolumeBackupApplication($team);
 
-    $component = Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])
-        ->set('isReadOnly', true)
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->set("forms.{$volume->id}.isReadOnly", true)
         ->assertSee('Backup')
         ->assertDontSee('Backups made while the application is writing');
 
@@ -446,6 +494,7 @@ it('shows the configure backup modal trigger inside the volume card instead of i
     expect($html)
         ->toContain('Configure Volume Backup')
         ->toContain('data-table-row')
+        ->not->toContain('wire:submit="submit('.$volume->id.')"')
         ->toContain('Backup');
 });
 
@@ -461,10 +510,10 @@ it('only shows the backup enabled badge for an enabled volume backup', function
         'enabled' => false,
     ]);
 
-    $component = Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])->assertDontSee('table-badge-success', false);
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->assertDontSee('Volume backup is enabled');
+
+    expect($component->get("volumeBackupMeta.{$volume->id}.enabled"))->toBeFalse();
 
     $backup->update(['enabled' => true]);
 
@@ -477,17 +526,10 @@ it('only shows the backup enabled badge for an enabled volume backup', function
 
     $component
         ->dispatch('refreshVolumeBackups')
-        ->assertSee('table-badge-success', false)
         ->assertSee('Volume backup is enabled')
         ->assertSee('href="'.$backupUrl.'"', false);
 
-    Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-        'isFirst' => false,
-    ])
-        ->assertSee('table-badge-success', false)
-        ->assertSee('Volume backup is enabled');
+    expect($component->get("volumeBackupMeta.{$volume->id}.url"))->toBe($backupUrl);
 });
 
 it('links the backup enabled badge to a filtered backup list when the application has multiple schedules', function () {
@@ -513,11 +555,7 @@ it('links the backup enabled badge to a filtered backup list when the applicatio
         'search' => $volume->name,
     ]);
 
-    Livewire::test(Show::class, [
-        'storage' => $volume,
-        'resource' => $application,
-    ])
-        ->assertSee('table-badge-success', false)
+    Livewire::test(All::class, ['resource' => $application])
         ->assertSee('Volume backup is enabled')
         ->assertSee('href="'.$backupUrl.'"', false);
 });
diff --git a/tests/Unit/Api/LogEndpointHelpersTest.php b/tests/Unit/Api/LogEndpointHelpersTest.php
index a899669d67..c4173bd699 100644
--- a/tests/Unit/Api/LogEndpointHelpersTest.php
+++ b/tests/Unit/Api/LogEndpointHelpersTest.php
@@ -94,6 +94,18 @@ it('filters service sub containers in PHP instead of using user input in shell f
         ->toBe(['first', 'third']);
 });
 
+it('filters service containers when another Docker label contains commas', function () {
+    $containers = collect([
+        [
+            'ID' => 'app',
+            'Labels' => 'traefik.http.routers.app.rule=Host(`one.example.com`,`two.example.com`),coolify.name=app-service-uuid',
+        ],
+    ]);
+
+    expect(filterServiceSubContainersByName($containers, 'app-service-uuid')->pluck('ID')->all())
+        ->toBe(['app']);
+});
+
 it('does not interpolate the requested service name into the docker ps shell command', function () {
     $source = file_get_contents(__DIR__.'/../../../bootstrap/helpers/docker.php');
 
diff --git a/tests/Unit/ApplicationDeploymentContainerNamingTest.php b/tests/Unit/ApplicationDeploymentContainerNamingTest.php
new file mode 100644
index 0000000000..b7b63ae544
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentContainerNamingTest.php
@@ -0,0 +1,58 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use Illuminate\Support\Collection;
+
+function containerNamingJob(Application $application, int $pullRequestId = 0): array
+{
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $reflection->getProperty('application')->setValue($job, $application);
+    $reflection->getProperty('pull_request_id')->setValue($job, $pullRequestId);
+
+    return [$job, $reflection];
+}
+
+function applicationWithContainerNaming(string $customName = 'shadowuw'): Application
+{
+    $application = new Application;
+    $application->forceFill(['uuid' => 'application-uuid']);
+    $application->setRelation('settings', new ApplicationSetting([
+        'custom_internal_name' => $customName,
+        'is_consistent_container_name_enabled' => true,
+    ]));
+
+    return $application;
+}
+
+it('uses the custom container name when consistent naming is enabled', function () {
+    $application = applicationWithContainerNaming();
+
+    [$job, $reflection] = containerNamingJob($application);
+
+    expect($reflection->getMethod('resolveContainerName')->invoke($job))->toBe('shadowuw');
+});
+
+it('adds the pull request suffix to a custom container name', function () {
+    $application = applicationWithContainerNaming();
+
+    [$job, $reflection] = containerNamingJob($application, 42);
+
+    expect($reflection->getMethod('resolveContainerName')->invoke($job))->toBe('shadowuw-pr-42');
+});
+
+it('includes old generated containers when cleaning up a consistent deployment', function () {
+    $application = applicationWithContainerNaming();
+    [$job, $reflection] = containerNamingJob($application);
+    $reflection->getProperty('container_name')->setValue($job, 'shadowuw');
+
+    $containers = new Collection([
+        ['Names' => 'application-uuid-192238854305'],
+        ['Names' => 'shadowuw'],
+    ]);
+
+    expect($reflection->getMethod('containerNamesToRemove')->invoke($job, $containers)->all())
+        ->toBe(['application-uuid-192238854305', 'shadowuw']);
+});
diff --git a/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php b/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php
new file mode 100644
index 0000000000..f6684718e3
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableCoolifyUrlDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function coolifyVariablesForFqdn(string $fqdn, string $composeParsingVersion = '3'): string
+{
+    $team = Team::create([
+        'name' => 'Coolify Url Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Coolify Url Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'fqdn' => $fqdn,
+    ]);
+
+    // The created hook resets this, so it has to be set afterwards.
+    $application->compose_parsing_version = $composeParsingVersion;
+    $application->save();
+
+    $job = new TestableCoolifyUrlDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application->fresh(),
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('set_coolify_variables')->invoke($job);
+
+    return $reflection->getProperty('coolify_variables')->getValue($job);
+}
+
+it('keeps every domain intact when an application has multiple domains', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com,https://b.example.com');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com,https://b.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com,b.example.com'");
+});
+
+it('strips the port from every domain when an application has multiple domains', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com:8080,https://b.example.com:9000');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com,https://b.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com,b.example.com'");
+});
+
+it('keeps every domain intact on the legacy compose parsing version', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com,https://b.example.com', '2');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='a.example.com,b.example.com'")
+        ->toContain("COOLIFY_FQDN='https://a.example.com,https://b.example.com'");
+});
+
+it('still resolves a single domain', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com'");
+});
diff --git a/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php b/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
new file mode 100644
index 0000000000..234f216bd2
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
@@ -0,0 +1,98 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Symfony\Component\Yaml\Yaml;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableCustomDockerOptionsDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function generateComposeServiceWithCustomDockerOptions(string $customDockerOptions): array
+{
+    $team = Team::create([
+        'name' => 'Custom Docker Options Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Custom Docker Options Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockerimage',
+        'custom_docker_run_options' => $customDockerOptions,
+        'custom_network_aliases' => json_encode(['custom-alias'], JSON_THROW_ON_ERROR),
+    ]);
+    $application->settings()->update([
+        'is_consistent_container_name_enabled' => true,
+        'custom_internal_name' => 'custom-internal-name',
+    ]);
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+    $queue->status = 'queued';
+    $queue->shouldReceive('refresh')->once()->andReturnSelf();
+
+    $application = $application->fresh();
+    $job = new TestableCustomDockerOptionsDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application,
+        'application_deployment_queue' => $queue,
+        'destination' => $destination,
+        'server' => $server,
+        'mainServer' => $server,
+        'pull_request_id' => 0,
+        'container_name' => 'custom-internal-name',
+        'production_image_name' => 'example/app:latest',
+        'deployment_uuid' => 'deployment-uuid',
+        'workdir' => '/artifacts/custom-docker-options-app',
+        'configuration_dir' => '/data/coolify/applications/test',
+        'saved_outputs' => new Collection,
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('generate_compose_file')->invoke($job);
+    $compose = Yaml::parse($reflection->getProperty('docker_compose')->getValue($job));
+
+    return $compose['services'][$application->uuid];
+}
+
+it('applies an entrypoint when consistent naming and a custom internal name are configured', function () {
+    expect(generateComposeServiceWithCustomDockerOptions('--entrypoint "/bin/echo hello world"'))
+        ->toHaveKey('entrypoint', '/bin/echo hello world')
+        ->toHaveKey('container_name', 'custom-internal-name');
+});
+
+it('preserves custom network aliases when a static IP is configured', function () {
+    $service = generateComposeServiceWithCustomDockerOptions('--ip 10.0.0.25 --ip6 2001:db8::25');
+    $network = $service['networks'][array_key_first($service['networks'])];
+
+    expect($network)
+        ->toHaveKey('ipv4_address', '10.0.0.25')
+        ->toHaveKey('ipv6_address', '2001:db8::25')
+        ->toHaveKey('aliases')
+        ->and($network['aliases'])->toContain('custom-alias');
+});
diff --git a/tests/Unit/ApplicationDeploymentRemoteSecretValueTest.php b/tests/Unit/ApplicationDeploymentRemoteSecretValueTest.php
new file mode 100644
index 0000000000..12329be7df
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentRemoteSecretValueTest.php
@@ -0,0 +1,14 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+
+it('quotes JSON remote secrets so compose treats their contents literally', function (string $value, string $expected) {
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $method = new ReflectionMethod(ApplicationDeploymentJob::class, 'format_remote_secret_value');
+
+    expect($method->invoke($job, $value))->toBe($expected);
+})->with([
+    'object containing a variable reference' => ['{"password":"$ecret"}', '\'{"password":"$ecret"}\''],
+    'array containing a comment marker' => ['["value # not a comment"]', '\'["value # not a comment"]\''],
+    'object containing an apostrophe' => ['{"password":"it\'s $ecret"}', '"{\\"password\\":\\"it\'s $$ecret\\"}"'],
+]);
diff --git a/tests/Unit/ApplicationDeploymentStopGracePeriodTest.php b/tests/Unit/ApplicationDeploymentStopGracePeriodTest.php
new file mode 100644
index 0000000000..4aa45c0431
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentStopGracePeriodTest.php
@@ -0,0 +1,85 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Collection;
+use Symfony\Component\Yaml\Yaml;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableStopGracePeriodDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function generateComposeServiceWithStopGracePeriod(?int $stopGracePeriod): array
+{
+    $team = Team::create([
+        'name' => 'Stop Grace Period Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Stop Grace Period Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+    ]);
+    $application->settings()->update(['stop_grace_period' => $stopGracePeriod]);
+
+    $queue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+    $queue->status = 'queued';
+    $queue->shouldReceive('refresh')->once()->andReturnSelf();
+
+    $job = new TestableStopGracePeriodDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application->fresh(),
+        'application_deployment_queue' => $queue,
+        'destination' => $destination,
+        'server' => $server,
+        'mainServer' => $server,
+        'pull_request_id' => 0,
+        'container_name' => 'stop-grace-period-app',
+        'production_image_name' => 'example/app:latest',
+        'deployment_uuid' => 'deployment-uuid',
+        'workdir' => '/artifacts/stop-grace-period-app',
+        'configuration_dir' => '/data/coolify/applications/test',
+        'saved_outputs' => new Collection,
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('generate_compose_file')->invoke($job);
+    $compose = Yaml::parse($reflection->getProperty('docker_compose')->getValue($job));
+
+    return $compose['services']['stop-grace-period-app'];
+}
+
+it('adds an explicitly configured stop grace period to generated compose services', function () {
+    expect(generateComposeServiceWithStopGracePeriod(700))
+        ->toHaveKey('stop_grace_period', '700s');
+});
+
+it('omits the stop grace period from generated compose services when it is not configured', function () {
+    expect(generateComposeServiceWithStopGracePeriod(null))
+        ->not->toHaveKey('stop_grace_period');
+});
diff --git a/tests/Unit/ApplicationGitCommitLinkTest.php b/tests/Unit/ApplicationGitCommitLinkTest.php
new file mode 100644
index 0000000000..e1a15e7149
--- /dev/null
+++ b/tests/Unit/ApplicationGitCommitLinkTest.php
@@ -0,0 +1,28 @@
+<?php
+
+use App\Models\Application;
+
+it('generates commit links for direct repository remotes', function (string $repository, string $expected) {
+    $application = new Application;
+    $application->setRelation('source', null);
+    $application->git_repository = $repository;
+
+    expect($application->gitCommitLink('1234567890abcdef'))->toBe($expected);
+})->with([
+    'HTTPS remote' => [
+        'https://github.com/coollabsio/coolify.git',
+        'https://github.com/coollabsio/coolify/commit/1234567890abcdef',
+    ],
+    'SSH remote' => [
+        'git@github.com:coollabsio/coolify.git',
+        'https://github.com/coollabsio/coolify/commit/1234567890abcdef',
+    ],
+    'SSH URL' => [
+        'ssh://git@gitlab.com/coollabsio/coolify.git',
+        'https://gitlab.com/coollabsio/coolify/commit/1234567890abcdef',
+    ],
+    'Bitbucket HTTPS remote' => [
+        'https://bitbucket.org/coollabsio/coolify.git',
+        'https://bitbucket.org/coollabsio/coolify/commits/1234567890abcdef',
+    ],
+]);
diff --git a/tests/Unit/ContainerStatusAggregatorTest.php b/tests/Unit/ContainerStatusAggregatorTest.php
index 71425a21cb..0a40206ac7 100644
--- a/tests/Unit/ContainerStatusAggregatorTest.php
+++ b/tests/Unit/ContainerStatusAggregatorTest.php
@@ -70,12 +70,12 @@ describe('aggregateFromStrings', function () {
         expect($result)->toBe('running:unknown');
     });
 
-    test('returns degraded:unhealthy for crash loop (exited with restart count)', function () {
+    test('returns exited for an exited container with a restart count', function () {
         $statuses = collect(['exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 5);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('returns exited for exited containers without restart count', function () {
@@ -214,12 +214,12 @@ describe('aggregateFromStrings', function () {
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('prioritizes crash loop over running containers', function () {
+    test('returns exited when all containers are exited with restart counts', function () {
         $statuses = collect(['exited', 'exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 3);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('prioritizes mixed state over healthy running', function () {
@@ -238,12 +238,12 @@ describe('aggregateFromStrings', function () {
         expect($result)->toBe('starting:unknown');
     });
 
-    test('prioritizes running over paused/exited when no starting', function () {
+    test('returns degraded for mixed running and exited containers', function () {
         $statuses = collect(['running:healthy', 'paused', 'exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses);
 
-        expect($result)->toBe('running:healthy');
+        expect($result)->toBe('degraded:unhealthy');
     });
 
     test('prioritizes dead over paused/starting/exited', function () {
@@ -357,7 +357,7 @@ describe('aggregateFromContainers', function () {
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('returns degraded:unhealthy for crash loop (exited with restart count)', function () {
+    test('returns exited for an exited container object with a restart count', function () {
         $containers = collect([
             (object) [
                 'State' => (object) [
@@ -368,7 +368,7 @@ describe('aggregateFromContainers', function () {
 
         $result = $this->aggregator->aggregateFromContainers($containers, maxRestartCount: 5);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('returns exited for exited containers without restart count', function () {
@@ -501,7 +501,7 @@ describe('state priority enforcement', function () {
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('crash loop has third highest priority', function () {
+    test('mixed running and exited containers are degraded before paused or starting states', function () {
         $statuses = collect([
             'exited',
             'running:healthy',
@@ -602,31 +602,29 @@ describe('maxRestartCount validation', function () {
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 0);
 
-        // Zero is valid default - no crash loop detection
         expect($result)->toBe('exited');
     });
 
-    test('positive maxRestartCount works correctly', function () {
+    test('positive maxRestartCount does not override an exited state', function () {
         $statuses = collect(['exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 5);
 
-        // Positive value enables crash loop detection
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
-    test('crash loop detection still functions after validation', function () {
+    test('exited state is preserved for any positive restart count', function () {
         $statuses = collect(['exited']);
 
         // Test with various positive restart counts
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 1))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
 
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 100))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
 
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 999))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
     });
 
     test('default maxRestartCount parameter works', function () {
diff --git a/tests/Unit/DatabaseStartActionResolvedCredentialsTest.php b/tests/Unit/DatabaseStartActionResolvedCredentialsTest.php
new file mode 100644
index 0000000000..7ee295e34f
--- /dev/null
+++ b/tests/Unit/DatabaseStartActionResolvedCredentialsTest.php
@@ -0,0 +1,83 @@
+<?php
+
+it('reuses resolved environment credentials in database startup integrations', function (string $action, array $expected, array $unexpected) {
+    $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
+
+    expect($source)->toContain(...$expected)
+        ->not->toContain(...$unexpected);
+})->with([
+    'clickhouse' => [
+        'StartClickhouse',
+        ['$this->resolvedClickhouseUser', '$this->resolvedClickhousePassword'],
+        ['$this->database->clickhouse_admin_user, \'--password\'', '$this->database->clickhouse_admin_password, \'--query\''],
+    ],
+    'dragonfly' => [
+        'StartDragonfly',
+        ['$this->resolvedRedisPassword'],
+        ['$this->database->dragonfly_password, \'ping\'', 'requirepass {$this->database->dragonfly_password}'],
+    ],
+    'keydb' => [
+        'StartKeydb',
+        ['$this->resolvedRedisPassword'],
+        ['$this->database->keydb_password, \'ping\'', 'requirepass {$this->database->keydb_password}'],
+    ],
+    'mongodb' => [
+        'StartMongodb',
+        ['$this->resolvedMongoDatabase', '$this->resolvedMongoUsername', '$this->resolvedMongoPassword'],
+        ['json_encode($this->database->mongo_initdb_database', 'json_encode($this->database->mongo_initdb_root_username', 'json_encode($this->database->mongo_initdb_root_password'],
+    ],
+    'mysql' => [
+        'StartMysql',
+        ['$this->resolvedMysqlRootPassword'],
+        ['-p{$this->database->mysql_root_password}'],
+    ],
+    'postgresql' => [
+        'StartPostgresql',
+        ['$this->resolvedPostgresUser', '$this->resolvedPostgresDatabase'],
+        ['$this->database->postgres_user, \'-d\'', '$this->database->postgres_db, \'-c\''],
+    ],
+]);
+
+it('runs database start commands without persisting them through remote process', function (string $action) {
+    $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
+
+    expect($source)
+        ->toContain('ExecutesDatabaseStartCommands')
+        ->toContain('executeDatabaseStartCommands(')
+        ->not->toContain('return remote_process(');
+})->with([
+    'StartClickhouse',
+    'StartDragonfly',
+    'StartKeydb',
+    'StartMariadb',
+    'StartMongodb',
+    'StartMysql',
+    'StartPostgresql',
+    'StartRedis',
+]);
+
+it('queues database starts with identifiers instead of generated commands', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartDatabase.php');
+
+    expect($source)
+        ->toContain('DatabaseStartJob::dispatch(')
+        ->not->toContain('StartPostgresql::run(')
+        ->not->toContain('StartRedis::run(');
+});
+
+it('keeps raw secret values separate from compose environment formatting', function (string $action, array $rawAssignments) {
+    $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
+
+    expect($source)
+        ->toContain('$rawValue = (string) $this->database->resolveSecretManagerEnvironmentVariableValue($env);')
+        ->toContain('$resolvedValue = (string) $this->database->formatEnvironmentVariableValue($env, $rawValue);')
+        ->toContain('$environment_variables->push($env->key.\'=\'.$resolvedValue);')
+        ->toContain(...$rawAssignments);
+})->with([
+    'clickhouse' => ['StartClickhouse', ['$this->resolvedClickhouseUser = $rawValue;', '$this->resolvedClickhousePassword = $rawValue;']],
+    'dragonfly' => ['StartDragonfly', ['$this->resolvedRedisPassword = $rawValue;', 'escapeshellarg($this->resolvedRedisPassword)']],
+    'keydb' => ['StartKeydb', ['$this->resolvedRedisPassword = $rawValue;', 'escapeshellarg($this->resolvedRedisPassword)']],
+    'mongodb' => ['StartMongodb', ['$this->resolvedMongoUsername = $rawValue;', '$this->resolvedMongoPassword = $rawValue;', '$this->resolvedMongoDatabase = $rawValue;', 'json_encode($this->resolvedMongoPassword']],
+    'mysql' => ['StartMysql', ['$this->resolvedMysqlRootPassword = $rawValue;']],
+    'postgresql' => ['StartPostgresql', ['$this->resolvedPostgresUser = $rawValue;', '$this->resolvedPostgresDatabase = $rawValue;']],
+]);
diff --git a/tests/Unit/DatabaseStartJobTest.php b/tests/Unit/DatabaseStartJobTest.php
new file mode 100644
index 0000000000..e6333ea769
--- /dev/null
+++ b/tests/Unit/DatabaseStartJobTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Events\DatabaseStatusChanged;
+use App\Jobs\DatabaseStartJob;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+it('broadcasts failed database starts to the initiating user even when the activity is missing', function () {
+    Event::fake([DatabaseStatusChanged::class]);
+
+    $job = new DatabaseStartJob(
+        databaseClass: 'MissingDatabase',
+        databaseId: 123,
+        teamId: 456,
+        activityId: 789,
+        userId: 42,
+    );
+
+    $job->failed(new RuntimeException('Database start failed.'));
+
+    Event::assertDispatched(
+        DatabaseStatusChanged::class,
+        fn (DatabaseStatusChanged $event): bool => $event->userId === 42,
+    );
+});
+
+it('targets normal database start status changes to the initiating user', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Jobs/DatabaseStartJob.php');
+
+    expect($source)
+        ->toContain('event(new DatabaseStatusChanged($this->userId));')
+        ->not->toContain('event(new DatabaseStatusChanged($database));');
+});
diff --git a/tests/Unit/DevHelperScriptTest.php b/tests/Unit/DevHelperScriptTest.php
new file mode 100644
index 0000000000..eee1803826
--- /dev/null
+++ b/tests/Unit/DevHelperScriptTest.php
@@ -0,0 +1,19 @@
+<?php
+
+it('provides a local helper build and deployment workflow', function () {
+    $script = dirname(__DIR__, 2).'/scripts/dev-helper';
+
+    expect($script)->toBeFile()
+        ->and(is_executable($script))->toBeTrue();
+
+    exec('bash -n '.escapeshellarg($script), $output, $exitCode);
+
+    expect($exitCode)->toBe(0)
+        ->and(file_get_contents($script))
+        ->toContain('build)')
+        ->toContain('use)')
+        ->toContain('verify)')
+        ->toContain('deploy)')
+        ->toContain('reset)')
+        ->toContain('test)');
+});
diff --git a/tests/Unit/DockerCliPackagingTest.php b/tests/Unit/DockerCliPackagingTest.php
new file mode 100644
index 0000000000..71fa7078e1
--- /dev/null
+++ b/tests/Unit/DockerCliPackagingTest.php
@@ -0,0 +1,12 @@
+<?php
+
+it('installs the current Docker CLI in the Coolify helper image', function () {
+    $dockerfile = file_get_contents(dirname(__DIR__, 2).'/docker/coolify-helper/Dockerfile');
+    expect($dockerfile)
+        ->toContain('ARG DOCKER_VERSION=29.7.2')
+        ->toContain('ARG DOCKER_COMPOSE_VERSION=5.5.0')
+        ->toContain('ARG DOCKER_BUILDX_VERSION=0.36.1')
+        ->toContain('https://download.docker.com/linux/static/stable/x86_64/docker-${DOCKER_VERSION}.tgz')
+        ->toContain('https://download.docker.com/linux/static/stable/aarch64/docker-${DOCKER_VERSION}.tgz')
+        ->toMatch('/chmod \+x [^\n]*\/usr\/bin\/docker/');
+});
diff --git a/tests/Unit/DockerComposeLabelParsingTest.php b/tests/Unit/DockerComposeLabelParsingTest.php
index a2a3c08833..7f3c18c1eb 100644
--- a/tests/Unit/DockerComposeLabelParsingTest.php
+++ b/tests/Unit/DockerComposeLabelParsingTest.php
@@ -29,6 +29,14 @@ it('ensures label parsing converts array values to strings', function () {
         ->toContain('$removedLabel = (string) collect($removedLabel)->first();');
 });
 
+it('falls back to the template port for service application proxy labels', function () {
+    $sharedFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/shared.php');
+
+    expect($sharedFile)->toContain(
+        '? ($savedService->getRequiredPort() ?? $predefinedPort)'
+    );
+});
+
 it('verifies label parsing array check occurs before preg_match', function () {
     // Read the parseDockerComposeFile function from shared.php
     $sharedFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/shared.php');
diff --git a/tests/Unit/DockerImagePreviewTagResolutionTest.php b/tests/Unit/DockerImagePreviewTagResolutionTest.php
index 17f7d7b9b4..bb9a2c09dd 100644
--- a/tests/Unit/DockerImagePreviewTagResolutionTest.php
+++ b/tests/Unit/DockerImagePreviewTagResolutionTest.php
@@ -27,6 +27,102 @@ it('prefers the preview specific docker image tag for preview deployments', func
     expect($method->invoke($job))->toBe('pr_42');
 });
 
+it('prefers the selected tag for docker image rollback deployments', function () {
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 0);
+
+    $rollbackProperty = $reflection->getProperty('rollback');
+    $rollbackProperty->setAccessible(true);
+    $rollbackProperty->setValue($job, true);
+
+    $commitProperty = $reflection->getProperty('commit');
+    $commitProperty->setAccessible(true);
+    $commitProperty->setValue($job, 'e487515a098c8d4f69c74712f1d0cc86e483e890');
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, new Application([
+        'docker_registry_image_tag' => '6de68657a0e794e163ea2275c54c293a93fe065a',
+    ]));
+
+    $previewTagProperty = $reflection->getProperty('dockerImagePreviewTag');
+    $previewTagProperty->setAccessible(true);
+    $previewTagProperty->setValue($job, null);
+
+    $method = $reflection->getMethod('resolveDockerImageTag');
+    $method->setAccessible(true);
+
+    expect($method->invoke($job))->toBe('e487515a098c8d4f69c74712f1d0cc86e483e890');
+});
+
+it('falls back to the application docker image tag for rollbacks without a selected tag', function () {
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 0);
+
+    $rollbackProperty = $reflection->getProperty('rollback');
+    $rollbackProperty->setAccessible(true);
+    $rollbackProperty->setValue($job, true);
+
+    $commitProperty = $reflection->getProperty('commit');
+    $commitProperty->setAccessible(true);
+    $commitProperty->setValue($job, '');
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, new Application([
+        'docker_registry_image_tag' => 'stable',
+    ]));
+
+    $previewTagProperty = $reflection->getProperty('dockerImagePreviewTag');
+    $previewTagProperty->setAccessible(true);
+    $previewTagProperty->setValue($job, null);
+
+    $method = $reflection->getMethod('resolveDockerImageTag');
+    $method->setAccessible(true);
+
+    expect($method->invoke($job))->toBe('stable');
+});
+
+it('falls back to latest for rollbacks without selected or configured tags', function () {
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $job = $reflection->newInstanceWithoutConstructor();
+
+    $pullRequestProperty = $reflection->getProperty('pull_request_id');
+    $pullRequestProperty->setAccessible(true);
+    $pullRequestProperty->setValue($job, 0);
+
+    $rollbackProperty = $reflection->getProperty('rollback');
+    $rollbackProperty->setAccessible(true);
+    $rollbackProperty->setValue($job, true);
+
+    $commitProperty = $reflection->getProperty('commit');
+    $commitProperty->setAccessible(true);
+    $commitProperty->setValue($job, '');
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $applicationProperty->setValue($job, new Application([
+        'docker_registry_image_tag' => '',
+    ]));
+
+    $previewTagProperty = $reflection->getProperty('dockerImagePreviewTag');
+    $previewTagProperty->setAccessible(true);
+    $previewTagProperty->setValue($job, null);
+
+    $method = $reflection->getMethod('resolveDockerImageTag');
+    $method->setAccessible(true);
+
+    expect($method->invoke($job))->toBe('latest');
+});
+
 it('falls back to the application docker image tag for non preview deployments', function () {
     $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
     $job = $reflection->newInstanceWithoutConstructor();
@@ -35,6 +131,10 @@ it('falls back to the application docker image tag for non preview deployments',
     $pullRequestProperty->setAccessible(true);
     $pullRequestProperty->setValue($job, 0);
 
+    $rollbackProperty = $reflection->getProperty('rollback');
+    $rollbackProperty->setAccessible(true);
+    $rollbackProperty->setValue($job, false);
+
     $applicationProperty = $reflection->getProperty('application');
     $applicationProperty->setAccessible(true);
     $applicationProperty->setValue($job, new Application([
@@ -59,6 +159,10 @@ it('falls back to latest when neither preview nor application tags are set', fun
     $pullRequestProperty->setAccessible(true);
     $pullRequestProperty->setValue($job, 7);
 
+    $rollbackProperty = $reflection->getProperty('rollback');
+    $rollbackProperty->setAccessible(true);
+    $rollbackProperty->setValue($job, false);
+
     $applicationProperty = $reflection->getProperty('application');
     $applicationProperty->setAccessible(true);
     $applicationProperty->setValue($job, new Application([
diff --git a/tests/Unit/DockerNetworkInjectionTest.php b/tests/Unit/DockerNetworkInjectionTest.php
index b3ca4ac60f..9427aa87d9 100644
--- a/tests/Unit/DockerNetworkInjectionTest.php
+++ b/tests/Unit/DockerNetworkInjectionTest.php
@@ -27,6 +27,14 @@ it('StandaloneDocker accepts valid network names', function (string $network) {
     'alphanumeric' => 'network123',
 ]);
 
+it('creates standalone destinations with a bridge network', function () {
+    $model = new StandaloneDocker;
+    $model->network = 'test-network';
+
+    expect($model->networkCreateCommand())
+        ->toBe("docker network inspect 'test-network' >/dev/null 2>&1 || docker network create --attachable 'test-network' >/dev/null");
+});
+
 it('SwarmDocker rejects network names with shell metacharacters', function (string $network) {
     $model = new SwarmDocker;
     $model->network = $network;
diff --git a/tests/Unit/DockerRemoveWithTimeoutTest.php b/tests/Unit/DockerRemoveWithTimeoutTest.php
index a3b9f15dc5..1f09ae06cb 100644
--- a/tests/Unit/DockerRemoveWithTimeoutTest.php
+++ b/tests/Unit/DockerRemoveWithTimeoutTest.php
@@ -58,6 +58,124 @@ it('escapes container names in bounded removal commands', function () {
     rmdir($directory);
 });
 
+it('succeeds when the container was already removed', function () {
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    mkdir($directory);
+    file_put_contents($directory.'/docker', "#!/bin/sh\necho 'Error response from daemon: No such container: container-name' >&2\nexit 1\n");
+    chmod($directory.'/docker', 0755);
+
+    $process = new Process(['/bin/sh', '-c', dockerRemoveCommandWithTimeout('container-name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+    ]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeTrue();
+
+    unlink($directory.'/docker');
+    rmdir($directory);
+});
+
+it('reports a timeout when timeout output also says the container is missing', function () {
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    mkdir($directory);
+    file_put_contents($directory.'/timeout', "#!/bin/sh\necho 'Error response from daemon: No such container: container-name'\nexit 124\n");
+    chmod($directory.'/timeout', 0755);
+
+    $process = new Process(['/bin/sh', '-c', dockerRemoveCommandWithTimeout('container-name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+    ]);
+    $process->run();
+
+    expect($process->getExitCode())->toBe(124)
+        ->and($process->getOutput())->toContain('__COOLIFY_CONTAINER_REMOVE_TIMEOUT__');
+
+    unlink($directory.'/timeout');
+    rmdir($directory);
+});
+
+it('fails when Docker cannot remove an existing container', function () {
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    mkdir($directory);
+    file_put_contents($directory.'/docker', "#!/bin/sh\necho 'Error response from daemon: removal already in progress' >&2\nexit 1\n");
+    chmod($directory.'/docker', 0755);
+
+    $process = new Process(['/bin/sh', '-c', dockerRemoveCommandWithTimeout('container-name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+    ]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeFalse()
+        ->and($process->getErrorOutput())->toContain('removal already in progress');
+
+    unlink($directory.'/docker');
+    rmdir($directory);
+});
+
+it('makes regular container removal idempotent without hiding other failures', function () {
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    mkdir($directory);
+    file_put_contents($directory.'/docker', "#!/bin/sh\necho \"\$DOCKER_ERROR\" >&2\nexit 1\n");
+    chmod($directory.'/docker', 0755);
+
+    $missingContainer = new Process(['/bin/sh', '-c', dockerRemoveCommand('container name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+        'DOCKER_ERROR' => 'Error response from daemon: No such container: container name',
+    ]);
+    $missingContainer->run();
+    $realFailure = new Process(['/bin/sh', '-c', dockerRemoveCommand('container name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+        'DOCKER_ERROR' => 'Error response from daemon: removal already in progress',
+    ]);
+    $realFailure->run();
+
+    expect($missingContainer->isSuccessful())->toBeTrue()
+        ->and($realFailure->isSuccessful())->toBeFalse();
+
+    unlink($directory.'/docker');
+    rmdir($directory);
+});
+
+it('makes network removal idempotent without hiding other failures', function () {
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    mkdir($directory);
+    file_put_contents($directory.'/docker', "#!/bin/sh\necho \"\$DOCKER_ERROR\" >&2\nexit 1\n");
+    chmod($directory.'/docker', 0755);
+
+    $missingNetwork = new Process(['/bin/sh', '-c', dockerNetworkRemoveCommand('network name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+        'DOCKER_ERROR' => 'Error response from daemon: network network name not found',
+    ]);
+    $missingNetwork->run();
+    $realFailure = new Process(['/bin/sh', '-c', dockerNetworkRemoveCommand('network name')], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+        'DOCKER_ERROR' => 'Error response from daemon: network has active endpoints',
+    ]);
+    $realFailure->run();
+
+    expect($missingNetwork->isSuccessful())->toBeTrue()
+        ->and($realFailure->isSuccessful())->toBeFalse();
+
+    unlink($directory.'/docker');
+    rmdir($directory);
+});
+
+it('uses idempotent commands in strict cleanup paths', function () {
+    $root = dirname(__DIR__, 2);
+
+    expect(file_get_contents($root.'/app/Jobs/DatabaseBackupJob.php'))
+        ->toContain('dockerRemoveCommand("backup-of-{$this->backup_log_uuid}")')
+        ->and(file_get_contents($root.'/app/Actions/Database/StopDatabaseProxy.php'))
+        ->toContain('dockerRemoveCommand("{$uuid}-proxy")')
+        ->and(file_get_contents($root.'/app/Actions/Destination/RemoveStandaloneDockerNetwork.php'))
+        ->toContain('dockerNetworkRemoveCommand($destination->network)')
+        ->and(file_get_contents($root.'/app/Livewire/Destination/Show.php'))
+        ->toContain('dockerNetworkRemoveCommand($this->destination->network)')
+        ->and(file_get_contents($root.'/app/Listeners/ProxyStatusChangedNotification.php'))
+        ->toContain("dockerRemoveCommand('coolify-proxy')")
+        ->and(file_get_contents($root.'/app/Actions/Application/StopApplicationOneServer.php'))
+        ->toContain('dockerRemoveCommand($containerName)');
+});
+
 it('configures deferred removal attempts to outlive the shell timeout', function () {
     $job = new RemoveContainerJob(123, 'container-name');
 
diff --git a/tests/Unit/DomainPortOverridesTest.php b/tests/Unit/DomainPortOverridesTest.php
new file mode 100644
index 0000000000..42345e5dfd
--- /dev/null
+++ b/tests/Unit/DomainPortOverridesTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Support\DomainPortOverrides;
+
+it('copies the source port override to an automatically paired domain', function (string $source, string $counterpart) {
+    $result = DomainPortOverrides::normalize(
+        "$source,$counterpart",
+        [$source => 8080],
+    );
+
+    expect($result['overrides'])->toBe([
+        $source => 8080,
+        $counterpart => 8080,
+    ]);
+})->with([
+    'www redirect' => ['https://example.com', 'https://www.example.com'],
+    'non-www redirect' => ['https://www.example.com', 'https://example.com'],
+]);
+
+it('keeps an explicit override on the paired domain', function (string $source, string $counterpart) {
+    $result = DomainPortOverrides::normalize(
+        "$source,$counterpart",
+        [
+            $source => 8080,
+            $counterpart => 9090,
+        ],
+    );
+
+    expect($result['overrides'])->toBe([
+        $source => 8080,
+        $counterpart => 9090,
+    ]);
+})->with([
+    'www redirect' => ['https://example.com', 'https://www.example.com'],
+    'non-www redirect' => ['https://www.example.com', 'https://example.com'],
+]);
diff --git a/tests/Unit/ExecutorServiceTemplateTest.php b/tests/Unit/ExecutorServiceTemplateTest.php
new file mode 100644
index 0000000000..7e3d0ce50c
--- /dev/null
+++ b/tests/Unit/ExecutorServiceTemplateTest.php
@@ -0,0 +1,49 @@
+<?php
+
+it('includes an Executor one-click service template', function () {
+    $templatePath = __DIR__.'/../../templates/compose/executor.yaml';
+
+    expect($templatePath)->toBeFile();
+
+    $compose = file_get_contents($templatePath);
+
+    expect($compose)
+        ->toContain('ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}')
+        ->toContain('SERVICE_URL_EXECUTOR_4788')
+        ->toContain('EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}')
+        ->toContain('executor-data:/data')
+        ->toContain('http://127.0.0.1:${process.env.PORT||4788}/api/health');
+
+    foreach (['service-templates.json', 'service-templates-latest.json'] as $templateFile) {
+        $templateCatalogPath = __DIR__."/../../templates/{$templateFile}";
+        $templateCatalog = file_get_contents($templateCatalogPath);
+
+        if ($templateCatalog === false) {
+            throw new RuntimeException("Unable to read service template catalog at {$templateCatalogPath}.");
+        }
+
+        $templates = json_decode(
+            $templateCatalog,
+            associative: true,
+            flags: JSON_THROW_ON_ERROR,
+        );
+
+        expect($templates)->toHaveKey('executor');
+        expect($templates['executor']['port'] ?? null)->toBe('4788');
+        expect($templates['executor']['logo'] ?? null)->toBe('svgs/executor.png');
+        expect($templates['executor']['category'] ?? null)->toBe('development');
+
+        $generatedCompose = base64_decode($templates['executor']['compose'], strict: true);
+
+        expect($generatedCompose)
+            ->toContain('ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}')
+            ->toContain('http://127.0.0.1:${process.env.PORT||4788}/api/health')
+            ->toContain($templateFile === 'service-templates.json'
+                ? 'EXECUTOR_WEB_BASE_URL=${SERVICE_FQDN_EXECUTOR_4788}'
+                : 'EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}');
+    }
+});
+
+it('ships the Executor service icon from the public path used by the service picker', function () {
+    expect(__DIR__.'/../../public/svgs/executor.png')->toBeFile();
+});
diff --git a/tests/Unit/FqdnLabelsNoindexTest.php b/tests/Unit/FqdnLabelsNoindexTest.php
index 332d548989..49e9a6e8f1 100644
--- a/tests/Unit/FqdnLabelsNoindexTest.php
+++ b/tests/Unit/FqdnLabelsNoindexTest.php
@@ -232,3 +232,55 @@ describe('Caddy noindex header', function () {
         )->all())->toBeEmpty();
     });
 });
+
+test('fqdnLabelsForCaddy routes each portless domain to its override port', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://one.example.com', 'https://two.example.com']),
+        onlyPort: 80,
+        is_force_https_enabled: true,
+        domainPortOverrides: [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://one.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1=https://two.example.com')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('caddy_0=https://one.example.com:3000')
+        ->not->toContain('caddy_1=https://two.example.com:8080');
+});
+
+test('fqdnLabelsForCaddy uses onlyPort when a portless domain has no override', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://plain.example.com']),
+        onlyPort: 4000,
+        is_force_https_enabled: true,
+        domainPortOverrides: [],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://plain.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}');
+});
+
+test('fqdnLabelsForCaddy keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://legacy.example.com:9090']),
+        onlyPort: 80,
+        is_force_https_enabled: true,
+        domainPortOverrides: [],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://legacy.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
diff --git a/tests/Unit/Livewire/Database/S3RestoreTest.php b/tests/Unit/Livewire/Database/S3RestoreTest.php
index 77695a8d76..e961f1317c 100644
--- a/tests/Unit/Livewire/Database/S3RestoreTest.php
+++ b/tests/Unit/Livewire/Database/S3RestoreTest.php
@@ -16,6 +16,76 @@ function importFormWithResource(string $modelClass): ImportForm
     return $component;
 }
 
+/**
+ * @return list<string>
+ */
+function invokedPostgresRestoreClients(string $contents, bool $gzip = false): array
+{
+    $binDir = sys_get_temp_dir().'/coolify-pg-restore-'.bin2hex(random_bytes(8));
+    mkdir($binDir);
+
+    try {
+        $logFile = $binDir.'/invoked.log';
+        file_put_contents($logFile, '');
+
+        foreach (['pg_restore', 'psql'] as $tool) {
+            $stub = <<<SH
+#!/bin/sh
+printf '%s\\n' '{$tool}' >> '{$logFile}'
+if [ ! -t 0 ]; then
+    cat >/dev/null
+fi
+exit 0
+SH;
+            $path = $binDir.'/'.$tool;
+            file_put_contents($path, $stub);
+            chmod($path, 0755);
+        }
+
+        $dumpPath = $binDir.'/backup.dump';
+        $payload = $gzip ? gzencode($contents) : $contents;
+        expect($payload)->not->toBeFalse();
+        file_put_contents($dumpPath, $payload);
+
+        $component = importFormWithResource('App\Models\StandalonePostgresql');
+        $component->dumpAll = true;
+        $component->postgresqlRestoreCommand = ':';
+
+        $process = proc_open(
+            ['sh', '-c', $component->buildRestoreCommand($dumpPath)],
+            [
+                0 => ['pipe', 'r'],
+                1 => ['pipe', 'w'],
+                2 => ['pipe', 'w'],
+            ],
+            $pipes,
+            $binDir,
+            [
+                'PATH' => $binDir.PATH_SEPARATOR.(getenv('PATH') ?: '/usr/bin:/bin'),
+                'POSTGRES_USER' => 'postgres',
+                'POSTGRES_DB' => 'app',
+            ]
+        );
+
+        expect($process)->not->toBeFalse();
+
+        fclose($pipes[0]);
+        stream_get_contents($pipes[1]);
+        stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+
+        expect(proc_close($process))->toBe(0);
+
+        return array_values(array_filter(explode("\n", trim((string) file_get_contents($logFile)))));
+    } finally {
+        foreach (glob($binDir.'/*') ?: [] as $file) {
+            unlink($file);
+        }
+        rmdir($binDir);
+    }
+}
+
 test('buildRestoreCommand handles PostgreSQL without dumpAll', function () {
     $component = importFormWithResource('App\Models\StandalonePostgresql');
     $component->dumpAll = false;
@@ -38,6 +108,27 @@ test('buildRestoreCommand handles PostgreSQL with dumpAll', function () {
     expect($result)->toContain('psql -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}');
 });
 
+test('buildRestoreCommand dump-all PostgreSQL restore is pg_restore for PGDMP otherwise psql', function () {
+    $component = importFormWithResource('App\Models\StandalonePostgresql');
+    $component->dumpAll = true;
+    $component->postgresqlRestoreCommand = 'psql -U ${POSTGRES_USER} -c "cleanup"';
+
+    $escapedTmpPath = escapeshellarg('/tmp/test.dump');
+
+    expect($component->buildRestoreCommand('/tmp/test.dump'))->toBe(
+        'psql -U ${POSTGRES_USER} -c "cleanup" && if [ "$({ gunzip -cf '.$escapedTmpPath.' 2>/dev/null || cat '.$escapedTmpPath.'; } | head -c 5)" = \'PGDMP\' ]; then pg_restore -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}} '.$escapedTmpPath.'; else (gunzip -cf '.$escapedTmpPath.' 2>/dev/null || cat '.$escapedTmpPath.') | psql -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}; fi'
+    );
+});
+
+test('dump-all PostgreSQL restore selects the client for the dump format', function (string $contents, bool $gzip, string $client) {
+    expect(invokedPostgresRestoreClients($contents, $gzip))->toBe([$client]);
+})->with([
+    'custom archive' => ['PGDMP'.str_repeat("\0", 16), false, 'pg_restore'],
+    'gzip custom archive' => ['PGDMP'.str_repeat("\0", 16), true, 'pg_restore'],
+    'plain SQL' => ["-- PostgreSQL database dump\nSELECT 1;\n", false, 'psql'],
+    'gzip SQL' => ["-- PostgreSQL database dump\nSELECT 1;\n", true, 'psql'],
+]);
+
 test('buildRestoreCommand handles MySQL without dumpAll', function () {
     $component = importFormWithResource('App\Models\StandaloneMysql');
     $component->dumpAll = false;
diff --git a/tests/Unit/LivewireInternalRedirectTest.php b/tests/Unit/LivewireInternalRedirectTest.php
new file mode 100644
index 0000000000..7dc19a81b8
--- /dev/null
+++ b/tests/Unit/LivewireInternalRedirectTest.php
@@ -0,0 +1,43 @@
+<?php
+
+it('uses Livewire navigation after deleting or converting page resources', function (string $path, array $redirects) {
+    $contents = file_get_contents(dirname(__DIR__, 2).'/'.$path);
+
+    foreach ($redirects as $redirect) {
+        expect($contents)->toContain($redirect);
+    }
+})->with([
+    'S3 storage' => [
+        'app/Livewire/Storage/Show.php',
+        ["redirectRoute(\$this, 'storage.index')"],
+    ],
+    'database backup schedule' => [
+        'app/Livewire/Project/Database/BackupEdit.php',
+        [
+            "redirectRoute(\$this, 'project.service.database.backups'",
+            "redirectRoute(\$this, 'project.database.backup.index'",
+        ],
+    ],
+    'scheduled task' => [
+        'app/Livewire/Project/Shared/ScheduledTask/Show.php',
+        [
+            "redirectRoute(\$this, 'project.application.scheduled-tasks.show'",
+            "redirectRoute(\$this, 'project.service.scheduled-tasks.show'",
+        ],
+    ],
+    'GitHub source' => [
+        'app/Livewire/Source/Github/Change.php',
+        ["redirectRoute(\$this, 'source.all')"],
+    ],
+    'GitLab source' => [
+        'app/Livewire/Source/Gitlab/Change.php',
+        ["redirectRoute(\$this, 'source.all')"],
+    ],
+    'service resources' => [
+        'app/Livewire/Project/Service/Index.php',
+        [
+            "return redirectRoute(\$this, 'project.service.configuration', \$this->parameters);",
+            "return redirectRoute(\$this, 'project.service.configuration', \$redirectParams);",
+        ],
+    ],
+]);
diff --git a/tests/Unit/LivewireSyncDataAuthorizationTest.php b/tests/Unit/LivewireSyncDataAuthorizationTest.php
new file mode 100644
index 0000000000..7ac6136d5c
--- /dev/null
+++ b/tests/Unit/LivewireSyncDataAuthorizationTest.php
@@ -0,0 +1,196 @@
+<?php
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\ConstFetch;
+use PhpParser\Node\Expr\MethodCall;
+use PhpParser\Node\Identifier;
+use PhpParser\Node\Stmt\ClassMethod;
+use PhpParser\Node\Stmt\If_;
+use PhpParser\Node\Stmt\Return_;
+use PhpParser\Node\Stmt\TryCatch;
+use PhpParser\NodeFinder;
+use PhpParser\ParserFactory;
+
+/** @return list<array{path: string, method: ClassMethod}> */
+function livewireSyncDataMethods(string $directory): array
+{
+    $methods = [];
+    $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory));
+    $parser = (new ParserFactory)->createForNewestSupportedVersion();
+    $finder = new NodeFinder;
+
+    foreach ($iterator as $file) {
+        if (! $file->isFile() || $file->getExtension() !== 'php') {
+            continue;
+        }
+        $path = $file->getPathname();
+        $contents = file_get_contents($path);
+        if ($contents === false) {
+            continue;
+        }
+        foreach ($finder->findInstanceOf($parser->parse($contents) ?? [], ClassMethod::class) as $method) {
+            if (preg_match('/^sync(Data|DatabaseData|ApplicationData)/', $method->name->toString())) {
+                $methods[] = ['path' => $path, 'method' => $method];
+            }
+        }
+    }
+
+    usort($methods, fn (array $a, array $b): int => [$a['path'], $a['method']->name->toString()] <=> [$b['path'], $b['method']->name->toString()]);
+
+    return $methods;
+}
+
+function livewireMethodCallName(MethodCall $call): ?string
+{
+    return $call->name instanceof Identifier ? $call->name->toString() : null;
+}
+
+function livewireIsWriteSyncCall(MethodCall $call, string $syncMethod): bool
+{
+    if (livewireMethodCallName($call) !== $syncMethod) {
+        return false;
+    }
+    foreach ($call->args as $position => $argument) {
+        if (($position === 0 || $argument->name?->toString() === 'toModel') && $argument->value instanceof ConstFetch && $argument->value->name->toLowerString() === 'true') {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+/** @param list<Node\Stmt> $statements @param list<int> $unauthorizedLines */
+function livewireScanStatements(array $statements, string $syncMethod, bool $authorized, array &$unauthorizedLines): bool
+{
+    foreach ($statements as $statement) {
+        $authorized = livewireScanNode($statement, $syncMethod, $authorized, $unauthorizedLines);
+    }
+
+    return $authorized;
+}
+
+/** @param list<int> $unauthorizedLines */
+function livewireScanNode(mixed $node, string $syncMethod, bool $authorized, array &$unauthorizedLines): bool
+{
+    if (! $node instanceof Node && ! is_array($node)) {
+        return $authorized;
+    }
+    if (is_array($node)) {
+        return livewireScanStatements($node, $syncMethod, $authorized, $unauthorizedLines);
+    }
+    if ($node instanceof TryCatch) {
+        $tryAuthorized = livewireScanStatements($node->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        $allCatchesTerminate = $node->catches !== [];
+        foreach ($node->catches as $catch) {
+            livewireScanStatements($catch->stmts, $syncMethod, $authorized, $unauthorizedLines);
+            $allCatchesTerminate = $allCatchesTerminate && collect($catch->stmts)->contains(fn (Node\Stmt $statement): bool => $statement instanceof Return_);
+        }
+        if ($node->finally !== null) {
+            livewireScanStatements($node->finally->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+
+        return $allCatchesTerminate ? $tryAuthorized : $authorized;
+    }
+    if ($node instanceof If_) {
+        livewireScanNode($node->cond, $syncMethod, $authorized, $unauthorizedLines);
+        livewireScanStatements($node->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        foreach ($node->elseifs as $elseif) {
+            livewireScanNode($elseif->cond, $syncMethod, $authorized, $unauthorizedLines);
+            livewireScanStatements($elseif->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+        if ($node->else !== null) {
+            livewireScanStatements($node->else->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+
+        return $authorized;
+    }
+    if ($node instanceof MethodCall) {
+        $name = livewireMethodCallName($node);
+        if ($name === 'authorize') {
+            return true;
+        }
+        if (livewireIsWriteSyncCall($node, $syncMethod) && ! $authorized) {
+            $unauthorizedLines[] = $node->getStartLine();
+        }
+    }
+    foreach ($node->getSubNodeNames() as $name) {
+        $authorized = livewireScanNode($node->{$name}, $syncMethod, $authorized, $unauthorizedLines);
+    }
+
+    return $authorized;
+}
+
+/** @return list<int> */
+function livewireUnauthorizedSyncWriteLines(ClassMethod $method, string $syncMethod): array
+{
+    $lines = [];
+    livewireScanStatements($method->stmts ?? [], $syncMethod, false, $lines);
+
+    return $lines;
+}
+
+function livewireMethodFromSource(string $source, string $method): ClassMethod
+{
+    $nodes = (new ParserFactory)->createForNewestSupportedVersion()->parse($source) ?? [];
+
+    return (new NodeFinder)->findFirst($nodes, fn (Node $node): bool => $node instanceof ClassMethod && $node->name->toString() === $method);
+}
+
+it('keeps every Livewire syncData helper private', function () {
+    $violations = [];
+    foreach (livewireSyncDataMethods(dirname(__DIR__, 2).'/app/Livewire') as $syncMethod) {
+        if (! $syncMethod['method']->isPrivate()) {
+            $relative = str_replace(dirname(__DIR__, 2).'/', '', $syncMethod['path']);
+            $violations[] = "{$relative}::{$syncMethod['method']->name}() is not private";
+        }
+    }
+    expect($violations)->toBeEmpty("Livewire syncData helpers must be private:\n".implode("\n", $violations));
+});
+
+it('discovers files that only define syncApplicationData helpers', function () {
+    $directory = sys_get_temp_dir().'/livewire-sync-'.uniqid();
+    mkdir($directory);
+    file_put_contents($directory.'/Example.php', '<?php class Example { private function syncApplicationData(bool $toModel = false) {} }');
+
+    $methods = livewireSyncDataMethods($directory);
+
+    unlink($directory.'/Example.php');
+    rmdir($directory);
+
+    expect($methods)->toHaveCount(1)
+        ->and($methods[0]['method']->name->toString())->toBe('syncApplicationData');
+});
+
+it('detects named write arguments and does not carry authorization into catch paths', function () {
+    $method = livewireMethodFromSource(<<<'PHP'
+        <?php
+        class Example {
+            public function instantSave() {
+                try {
+                    $this->authorize('update', $this->resource);
+                    $this->syncData(toModel: true);
+                } catch (Throwable $exception) {
+                    $this->syncData(toModel: true);
+                }
+            }
+        }
+        PHP, 'instantSave');
+
+    expect(livewireUnauthorizedSyncWriteLines($method, 'syncData'))->toHaveCount(1);
+});
+
+it('authorizes before every syncData write call', function () {
+    $violations = [];
+    $root = dirname(__DIR__, 2);
+    foreach (livewireSyncDataMethods($root.'/app/Livewire') as $syncMethod) {
+        $contents = file_get_contents($syncMethod['path']);
+        $nodes = (new ParserFactory)->createForNewestSupportedVersion()->parse($contents) ?? [];
+        foreach ((new NodeFinder)->findInstanceOf($nodes, ClassMethod::class) as $caller) {
+            foreach (livewireUnauthorizedSyncWriteLines($caller, $syncMethod['method']->name->toString()) as $line) {
+                $relative = str_replace($root.'/', '', $syncMethod['path']);
+                $violations[] = "{$relative}:{$line}::{$caller->name}() calls {$syncMethod['method']->name}(true) without prior authorization";
+            }
+        }
+    }
+    expect($violations)->toBeEmpty("Missing authorization before syncData write calls:\n".implode("\n", array_unique($violations)));
+});
diff --git a/tests/Unit/ObsidianLiveSyncServiceTemplateTest.php b/tests/Unit/ObsidianLiveSyncServiceTemplateTest.php
new file mode 100644
index 0000000000..52545be009
--- /dev/null
+++ b/tests/Unit/ObsidianLiveSyncServiceTemplateTest.php
@@ -0,0 +1,24 @@
+<?php
+
+it('includes an Obsidian LiveSync one-click service template', function () {
+    $templatePath = __DIR__.'/../../templates/compose/obsidian-livesync.yaml';
+
+    expect($templatePath)->toBeFile();
+
+    $compose = file_get_contents($templatePath);
+
+    expect($compose)
+        ->toContain('image: couchdb:3.4.2')
+        ->toContain('SERVICE_FQDN_COUCHDB_5984')
+        ->toContain('COUCHDB_USER=${SERVICE_USER_COUCHDB}')
+        ->toContain('COUCHDB_PASSWORD=${SERVICE_PASSWORD_64_COUCHDB}')
+        ->toContain('MAX_DOCUMENT_SIZE=${MAX_DOCUMENT_SIZE:-52428800}')
+        ->toContain('MAX_HTTP_REQUEST_SIZE=${MAX_HTTP_REQUEST_SIZE:-67108864}')
+        ->toContain('source: ./local.ini')
+        ->toContain('couchdb-data:/opt/couchdb/data')
+        ->toContain('http://localhost:5984/_up');
+});
+
+it('ships the Obsidian LiveSync service icon', function () {
+    expect(__DIR__.'/../../svgs/obsidian-livesync.svg')->toBeFile();
+});
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 659d233122..293c9422e9 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.10'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.10')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.15'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.15')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
@@ -77,6 +77,7 @@ it('prevents the stable helper workflow from publishing an existing version', fu
     $workflow = file_get_contents(dirname(__DIR__, 2).'/.github/workflows/coolify-helper.yml');
 
     expect($workflow)
+        ->toContain('workflow_dispatch:')
         ->toContain('check-version:')
         ->toContain('needs: check-version')
         ->toContain('VERSION="${BASE_VERSION}"')
diff --git a/tests/Unit/PushServerUpdateJobReturnTypesTest.php b/tests/Unit/PushServerUpdateJobReturnTypesTest.php
new file mode 100644
index 0000000000..763d456b98
--- /dev/null
+++ b/tests/Unit/PushServerUpdateJobReturnTypesTest.php
@@ -0,0 +1,9 @@
+<?php
+
+use App\Jobs\PushServerUpdateJob;
+
+test('database status update declares a void return type', function () {
+    $method = new ReflectionMethod(PushServerUpdateJob::class, 'updateDatabaseStatus');
+
+    expect($method->getReturnType()?->getName())->toBe('void');
+});
diff --git a/tests/Unit/RemoteSecretReferencesTest.php b/tests/Unit/RemoteSecretReferencesTest.php
new file mode 100644
index 0000000000..c56a836370
--- /dev/null
+++ b/tests/Unit/RemoteSecretReferencesTest.php
@@ -0,0 +1,47 @@
+<?php
+
+use App\Support\RemoteSecretReferences;
+
+test('detects references only for the vault namespace', function () {
+    expect(RemoteSecretReferences::containsReference('{{vault.DB_PASSWORD}}'))->toBeTrue()
+        ->and(RemoteSecretReferences::containsReference('{{doppler.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{infisical.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{ vault.KEY }}'))->toBeTrue()
+        ->and(RemoteSecretReferences::containsReference('pre-{{vault.KEY}}-post'))->toBeTrue();
+});
+
+test('ignores the secret namespace, shared variables, and plain values', function () {
+    expect(RemoteSecretReferences::containsReference('{{secret.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{team.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('{{project.KEY}}'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('plain'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference('$OTHER_VAR'))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference(null))->toBeFalse()
+        ->and(RemoteSecretReferences::containsReference(''))->toBeFalse();
+});
+
+test('extracts unique referenced keys in order', function () {
+    $value = 'a={{vault.A}} ignored={{doppler.B}} again={{vault.A}}';
+
+    expect(RemoteSecretReferences::referencedKeys($value))->toBe(['A']);
+});
+
+test('handles padded reference syntax consistently', function () {
+    expect(RemoteSecretReferences::referencedKeys('{{ vault.A }}'))->toBe(['A'])
+        ->and(RemoteSecretReferences::substitute('{{ vault.A }} {{ vault.MISSING }}', ['A' => 'value-a']))
+        ->toBe('value-a {{ vault.MISSING }}')
+        ->and(RemoteSecretReferences::missingKeys('{{ vault.A }} {{ vault.MISSING }}', ['A' => 'value-a']))
+        ->toBe(['MISSING']);
+});
+
+test('substitutes references and leaves unknown keys untouched', function () {
+    $secrets = ['A' => 'value-a'];
+
+    expect(RemoteSecretReferences::substitute('x={{vault.A}} y={{vault.MISSING}}', $secrets))
+        ->toBe('x=value-a y={{vault.MISSING}}');
+});
+
+test('reports missing keys', function () {
+    expect(RemoteSecretReferences::missingKeys('{{vault.A}}-{{vault.B}}', ['A' => '1']))->toBe(['B'])
+        ->and(RemoteSecretReferences::missingKeys('{{vault.A}}', ['A' => '1']))->toBe([]);
+});
diff --git a/tests/Unit/RemovedContainerStoppedNotificationTest.php b/tests/Unit/RemovedContainerStoppedNotificationTest.php
new file mode 100644
index 0000000000..016801c69d
--- /dev/null
+++ b/tests/Unit/RemovedContainerStoppedNotificationTest.php
@@ -0,0 +1,11 @@
+<?php
+
+it('does not keep the unreliable generic stopped container notification path', function () {
+    $statusAction = file_get_contents(__DIR__.'/../../app/Actions/Docker/GetContainersStatus.php');
+    $telegramChannel = file_get_contents(__DIR__.'/../../app/Notifications/Channels/TelegramChannel.php');
+
+    expect($statusAction)->not->toContain('ContainerStopped')
+        ->and($telegramChannel)->not->toContain('ContainerStopped')
+        ->and(file_exists(__DIR__.'/../../app/Notifications/Container/ContainerStopped.php'))->toBeFalse()
+        ->and(file_exists(__DIR__.'/../../resources/views/emails/container-stopped.blade.php'))->toBeFalse();
+});
diff --git a/tests/Unit/RestartCountTrackerTest.php b/tests/Unit/RestartCountTrackerTest.php
new file mode 100644
index 0000000000..3004ffa16a
--- /dev/null
+++ b/tests/Unit/RestartCountTrackerTest.php
@@ -0,0 +1,95 @@
+<?php
+
+use App\Services\RestartCountTracker;
+
+it('starts a new generation when an active container restart count drops', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 0,
+        maxRestartCount: 2,
+        newGenerationConfirmed: true,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 0,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => false,
+        'new_generation' => true,
+    ]);
+});
+
+it('evaluates the restart limit immediately in a new generation', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 3,
+        maxRestartCount: 2,
+        newGenerationConfirmed: true,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 3,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => true,
+        'new_generation' => true,
+    ]);
+});
+
+it('does not reset the generation without explicit confirmation', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 0,
+        maxRestartCount: 2,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 11,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => false,
+        'new_generation' => false,
+    ]);
+});
+
+it('preserves the previous count when an active payload omits the container with the previous maximum', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 3,
+        maxRestartCount: 20,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 11,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => false,
+        'new_generation' => false,
+    ]);
+});
+
+it('detects a normal threshold crossing', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 1,
+        observedRestartCount: 2,
+        maxRestartCount: 2,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 2,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => true,
+        'new_generation' => false,
+    ]);
+});
+
+it('detects a limit that is enabled below the current observed restart count', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 17,
+        observedRestartCount: 17,
+        maxRestartCount: 10,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 17,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => true,
+        'new_generation' => false,
+    ]);
+});
diff --git a/tests/Unit/SanitizeLogsForExportTest.php b/tests/Unit/SanitizeLogsForExportTest.php
index 285230ea4a..88c5950896 100644
--- a/tests/Unit/SanitizeLogsForExportTest.php
+++ b/tests/Unit/SanitizeLogsForExportTest.php
@@ -108,14 +108,14 @@ it('removes GitHub tokens', function () {
         'gho_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'gho_ OAuth token',
         'ghu_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'ghu_ user-to-server token',
         'ghs_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'ghs_ server-to-server token',
+        'ghs_eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiIxMjM0NTY3OCIsInN1YiI6Imluc3RhbGxhdGlvbi10b2tlbiJ9.signature-with_dots-and-hyphens' => 'ghs_ stateless server-to-server token',
         'ghr_aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789' => 'ghr_ refresh token',
     ];
 
     foreach ($testCases as $token => $description) {
         $input = "Token: {$token}";
         $result = sanitizeLogsForExport($input);
-        expect($result)->not->toContain($token, "Failed to redact {$description}");
-        expect($result)->toContain(REDACTED);
+        expect($result)->toBe('Token: '.REDACTED, "Failed to redact {$description}");
     }
 });
 
diff --git a/tests/Unit/SecretManagerLayoutConsistencyTest.php b/tests/Unit/SecretManagerLayoutConsistencyTest.php
new file mode 100644
index 0000000000..82d7f82c34
--- /dev/null
+++ b/tests/Unit/SecretManagerLayoutConsistencyTest.php
@@ -0,0 +1,15 @@
+<?php
+
+it('shows environment variables before the optional secret manager for every resource type', function (string $view, string $resource) {
+    $source = file_get_contents(__DIR__."/../../resources/views/livewire/project/{$view}/configuration.blade.php");
+    $environmentVariables = '<livewire:project.shared.environment-variable.all :resource="$'.$resource.'" />';
+    $secretManager = '<livewire:project.shared.secret-manager-links :resource="$'.$resource.'" />';
+
+    expect($source)
+        ->toContain($environmentVariables, $secretManager)
+        ->and(strpos($source, $environmentVariables))->toBeLessThan(strpos($source, $secretManager));
+})->with([
+    'application' => ['application', 'application'],
+    'database' => ['database', 'database'],
+    'service' => ['service', 'service'],
+]);
diff --git a/tests/Unit/ServiceRequiredPortTest.php b/tests/Unit/ServiceRequiredPortTest.php
index 6ef5bf0305..f6a7d76382 100644
--- a/tests/Unit/ServiceRequiredPortTest.php
+++ b/tests/Unit/ServiceRequiredPortTest.php
@@ -198,6 +198,47 @@ YAML;
     expect($result)->toBe(3000);
 });
 
+it('falls back to the one-click template port when SERVICE_URL has no port suffix', function () {
+    $yaml = <<<'YAML'
+services:
+  wordpress:
+    environment:
+      - SERVICE_URL_WORDPRESS
+      - WORDPRESS_DB_HOST=mysql
+YAML;
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->docker_compose_raw = $yaml;
+    $service->shouldReceive('getRequiredPort')->andReturn(80);
+
+    $app = Mockery::mock(ServiceApplication::class)->makePartial();
+    $app->name = 'wordpress';
+    $app->shouldReceive('getAttribute')->with('service')->andReturn($service);
+    $app->service = $service;
+
+    expect($app->getRequiredPort())->toBe(80);
+});
+
+it('does not apply the template port to a container without SERVICE_URL or SERVICE_FQDN', function () {
+    $yaml = <<<'YAML'
+services:
+  mysql:
+    environment:
+      - MYSQL_DATABASE=wordpress
+YAML;
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->docker_compose_raw = $yaml;
+    $service->shouldReceive('getRequiredPort')->andReturn(80);
+
+    $app = Mockery::mock(ServiceApplication::class)->makePartial();
+    $app->name = 'mysql';
+    $app->shouldReceive('getAttribute')->with('service')->andReturn($service);
+    $app->service = $service;
+
+    expect($app->getRequiredPort())->toBeNull();
+});
+
 it('returns null for map-style environment without port', function () {
     $yaml = <<<'YAML'
 services:
diff --git a/tests/Unit/StartSentinelEndpointFallbackTest.php b/tests/Unit/StartSentinelEndpointFallbackTest.php
index 8da3459b89..20422b2abe 100644
--- a/tests/Unit/StartSentinelEndpointFallbackTest.php
+++ b/tests/Unit/StartSentinelEndpointFallbackTest.php
@@ -15,3 +15,9 @@ test('sentinel startup regenerates an empty endpoint from instance settings', fu
         ->and($component)
         ->toContain('$this->sentinelCustomUrl = $this->server->settings->sentinel_custom_url;');
 });
+
+test('sentinel startup allows legacy metrics migrations to finish before health checks fail', function () {
+    $action = file_get_contents(dirname(__DIR__, 2).'/app/Actions/Server/StartSentinel.php');
+
+    expect($action)->toContain('--health-start-period 120s');
+});
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index a924381bb9..35b6052dd3 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -10,8 +10,7 @@ it('persists exited status for every full application stop path', function () {
     $action = file_get_contents(__DIR__.'/../../app/Actions/Application/StopApplication.php');
 
     expect($action)
-        ->toContain("\$status = ['status' => 'exited'];")
-        ->toContain('$application->update($status);')
+        ->toMatch('/\$status\s*=\s*\[\s*\'status\'\s*=>\s*\'exited\',.*?\];.*?\$application->update\(\$status\);/s')
         ->not->toMatch('/docker stack rm .*?return;/s');
 });
 
@@ -19,8 +18,10 @@ it('persists exited status for all children when stopping a service', function (
     $action = file_get_contents(__DIR__.'/../../app/Actions/Service/StopService.php');
 
     expect($action)
-        ->toContain("\$applications->each->update(['status' => 'exited']);")
-        ->toContain("\$dbs->each->update(['status' => 'exited']);");
+        ->toContain("\$application->update(['status' => 'exited']);")
+        ->toContain('$application->resetRestartLimit();')
+        ->toContain("\$database->update(['status' => 'exited']);")
+        ->toContain('$database->resetRestartLimit();');
 });
 
 it('persists exited status when stopping an individual service resource', function () {
@@ -28,6 +29,8 @@ it('persists exited status when stopping an individual service resource', functi
 
     expect($action)
         ->toContain("\$serviceApplication->update(['status' => 'exited']);")
+        ->toContain('$commands = ["docker rm -f {$containerName}"];')
+        ->toContain('throwError: ! $removeContainer')
         ->toContain('ServiceStatusChanged::dispatch($service->environment->project->team->id);');
 });
 
diff --git a/tests/Unit/StopDatabaseTypesTest.php b/tests/Unit/StopDatabaseTypesTest.php
new file mode 100644
index 0000000000..0295b0c956
--- /dev/null
+++ b/tests/Unit/StopDatabaseTypesTest.php
@@ -0,0 +1,12 @@
+<?php
+
+use App\Actions\Database\StopDatabase;
+use App\Models\BaseModel;
+
+it('declares strict method types', function () {
+    $handle = new ReflectionMethod(StopDatabase::class, 'handle');
+    $stopContainer = new ReflectionMethod(StopDatabase::class, 'stopContainer');
+
+    expect($handle->getReturnType()?->getName())->toBe('string')
+        ->and($stopContainer->getParameters()[0]->getType()?->getName())->toBe(BaseModel::class);
+});
diff --git a/tests/Unit/TraefikServiceNameSegmentTest.php b/tests/Unit/TraefikServiceNameSegmentTest.php
index ef882961e0..2a639d76d6 100644
--- a/tests/Unit/TraefikServiceNameSegmentTest.php
+++ b/tests/Unit/TraefikServiceNameSegmentTest.php
@@ -107,3 +107,49 @@ test('application labels keep redirect capture groups single escaped before comp
     expect($labels)
         ->toContain('traefik.http.middlewares.0-application-uuid-to-www.redirectregex.replacement=${1}://www.${2}');
 });
+
+test('fqdnLabelsForTraefik routes each portless domain to its override port', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://one.example.com', 'https://two.example.com']),
+        onlyPort: 80,
+        domainPortOverrides: [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`one.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-appuuid.rule=Host(`two.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-appuuid.loadbalancer.server.port=8080')
+        ->not->toContain('Host(`one.example.com:3000`)')
+        ->not->toContain('Host(`two.example.com:8080`)');
+});
+
+test('fqdnLabelsForTraefik uses onlyPort when a portless domain has no override', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://plain.example.com']),
+        onlyPort: 4000,
+        domainPortOverrides: [],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`plain.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=4000');
+});
+
+test('fqdnLabelsForTraefik keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://legacy.example.com:9090']),
+        onlyPort: 80,
+        domainPortOverrides: [],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`legacy.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=9090');
+});
diff --git a/tests/Unit/ValidationPatternsTest.php b/tests/Unit/ValidationPatternsTest.php
index cfcceac381..21145c5e7f 100644
--- a/tests/Unit/ValidationPatternsTest.php
+++ b/tests/Unit/ValidationPatternsTest.php
@@ -161,6 +161,33 @@ KEY',
     'empty' => '',
 ]);
 
+it('accepts shell-safe keys for sourced build-time env files', function (string $key) {
+    expect(ValidationPatterns::validatedShellEnvironmentVariableKey($key))->toBe($key);
+})->with([
+    'letters' => 'APP_ENV',
+    'leading underscore' => '_TOKEN',
+    'digits after first character' => 'NODE_VERSION_20',
+]);
+
+it('rejects keys that bash would interpret when sourcing a build-time env file', function (string $key) {
+    expect(fn () => ValidationPatterns::validatedShellEnvironmentVariableKey($key))
+        ->toThrow(InvalidArgumentException::class);
+})->with([
+    'command substitution' => 'X$(id)',
+    'dot notation' => 'X.VALUE',
+    'command substitution with arguments' => 'X$(docker run --rm -v /:/mnt alpine true)',
+]);
+
+it('makes unsafe environment variable keys safe to show in logs', function () {
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey('APP_ENV'))->toBe('APP_ENV');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey("X\nid"))->toBe('X\\nid');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey("X\e[2Jid\x7F"))->toBe('X\\x1B[2Jid\\x7F');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey(''))->toBe('(empty)');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey(str_repeat('A', 100)))
+        ->toEndWith('...')
+        ->toBe(str_repeat('A', 80).'...');
+});
+
 it('generates environment variable key rules with correct defaults', function () {
     $rules = ValidationPatterns::environmentVariableKeyRules();
 
@@ -191,3 +218,23 @@ it('normalizes application domain scheme and host without lowercasing path query
 it('validates application domains with underscores in the hostname', function () {
     expect(ValidationPatterns::validateApplicationDomains('https://myapp_service.example.com'))->toBeEmpty();
 });
+
+it('rejects single-label application hostnames but allows IP addresses', function () {
+    expect(ValidationPatterns::validateApplicationDomains('https://aaa'))->not->toBeEmpty()
+        ->and(ValidationPatterns::validateApplicationDomains('https://localhost'))->not->toBeEmpty()
+        ->and(ValidationPatterns::validateApplicationDomains('http://192.0.2.10:8000'))->toBeEmpty();
+});
+
+it('rejects application domain ports outside the valid TCP range', function (string $domain) {
+    expect(ValidationPatterns::validateApplicationDomains($domain))->not->toBeEmpty();
+})->with([
+    'zero' => 'https://example.com:0',
+    'above maximum' => 'https://example.com:65536',
+]);
+
+it('accepts application domain ports at the TCP range boundaries', function (string $domain) {
+    expect(ValidationPatterns::validateApplicationDomains($domain))->toBeEmpty();
+})->with([
+    'minimum' => 'https://example.com:1',
+    'maximum' => 'https://example.com:65535',
+]);
diff --git a/tests/Unit/VaultServiceTemplateTest.php b/tests/Unit/VaultServiceTemplateTest.php
new file mode 100644
index 0000000000..c758a78e9e
--- /dev/null
+++ b/tests/Unit/VaultServiceTemplateTest.php
@@ -0,0 +1,38 @@
+<?php
+
+it('includes a HashiCorp Vault one-click service template', function () {
+    $templatePath = __DIR__.'/../../templates/compose/vault.yaml';
+
+    expect($templatePath)->toBeFile();
+
+    $compose = file_get_contents($templatePath);
+
+    expect($compose)
+        ->toContain('hashicorp/vault:${VAULT_VERSION:-latest}')
+        ->toContain('SERVICE_URL_VAULT_8200')
+        ->toContain('VAULT_API_ADDR=${SERVICE_URL_VAULT_8200}')
+        ->toContain('"disable_mlock":true')
+        ->toContain('"storage":{"file":{"path":"/vault/file"}}')
+        ->toContain('vault-data:/vault/file')
+        ->toContain('/v1/sys/health?standbyok=true&sealedcode=200&uninitcode=200');
+
+    foreach (['service-templates.json', 'service-templates-latest.json'] as $templateFile) {
+        $templates = json_decode(
+            file_get_contents(__DIR__."/../../templates/{$templateFile}"),
+            associative: true,
+            flags: JSON_THROW_ON_ERROR,
+        );
+
+        expect($templates)->toHaveKey('vault');
+        expect($templates['vault']['port'] ?? null)->toBe('8200');
+        expect($templates['vault']['category'] ?? null)->toBe('security');
+
+        $generatedCompose = base64_decode($templates['vault']['compose'], strict: true);
+
+        expect($generatedCompose)
+            ->toContain('hashicorp/vault:${VAULT_VERSION:-latest}')
+            ->toContain($templateFile === 'service-templates.json'
+                ? 'VAULT_API_ADDR=${SERVICE_FQDN_VAULT_8200}'
+                : 'VAULT_API_ADDR=${SERVICE_URL_VAULT_8200}');
+    }
+});
diff --git a/tests/v4/Browser/LivewireRequestFailurePreviewTest.php b/tests/v4/Browser/LivewireRequestFailurePreviewTest.php
new file mode 100644
index 0000000000..f89893bc9f
--- /dev/null
+++ b/tests/v4/Browser/LivewireRequestFailurePreviewTest.php
@@ -0,0 +1,48 @@
+<?php
+
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Host-side browser runs have no phpredis; keep maintenance checks off Redis.
+    config()->set('app.maintenance.store', 'array');
+    seedBrowserInstanceSettings();
+    createBrowserRootUser();
+});
+
+it('suppresses proxy error responses and shows a toast', function () {
+    $page = visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login')
+        ->assertSee('Welcome to Coolify');
+
+    // Boarding redirects every other path; finish it so the preview page loads.
+    // User::currentTeam() caches the team, so flush after the update.
+    Team::query()->update(['show_boarding' => false]);
+    Cache::flush();
+
+    $page->navigate('/__livewire-request-failure')
+        ->assertSee('Livewire request failure preview')
+        ->click('502')
+        ->assertSee('Action could not be completed')
+        ->assertSee('Coolify did not receive a response. Please try again.')
+        ->assertSee('Livewire request failure preview')
+        ->assertDontSee('cloudflare proxy error')
+        ->screenshot(filename: 'livewire-request-failure-toast');
+});
+
+it('shows the preview page without a toast before any failure', function () {
+    $page = visit('/__livewire-request-failure');
+
+    $page->assertSee('Livewire request failure preview')
+        ->assertDontSee('Action could not be completed')
+        ->screenshot(filename: 'livewire-request-failure-initial');
+
+    // layouts.simple must render Livewire's styles, or wire:loading spinners leak.
+    $spinnerDisplay = $page->script('getComputedStyle(document.querySelector("[wire\\\\:loading]")).display');
+    expect($spinnerDisplay)->toBe('none');
+});
diff --git a/tests/v4/Feature/DangerDeleteResourceTest.php b/tests/v4/Feature/DangerDeleteResourceTest.php
index 4a275ad484..655aec85fe 100644
--- a/tests/v4/Feature/DangerDeleteResourceTest.php
+++ b/tests/v4/Feature/DangerDeleteResourceTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\DeleteResourceJob;
 use App\Livewire\Project\Shared\Danger;
 use App\Models\Application;
 use App\Models\Environment;
@@ -7,6 +8,7 @@ use App\Models\InstanceSettings;
 use App\Models\OauthIdentity;
 use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
@@ -62,13 +64,28 @@ test('delete returns error string when password is incorrect', function () {
     expect(Application::find($this->application->id))->not->toBeNull();
 });
 
-test('delete succeeds with correct password and redirects', function () {
-    Livewire::test(Danger::class, ['resource' => $this->application])
-        ->call('delete', 'test-password')
-        ->assertHasNoErrors();
+test('delete redirects before dispatching resource cleanup after the response', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
 
-    // Resource should be soft-deleted
-    expect(Application::find($this->application->id))->toBeNull();
+    $component = Livewire::test(Danger::class, ['resource' => $service])
+        ->set('projectUuid', $this->project->uuid)
+        ->set('environmentUuid', $this->environment->uuid)
+        ->call('delete', 'test-password')
+        ->assertHasNoErrors()
+        ->assertRedirectToRoute('project.resource.index', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ]);
+
+    expect($component->effects)->toHaveKey('redirectUsingNavigate', true);
+
+    expect(Service::find($service->id))->not->toBeNull();
+    Queue::assertPushed(DeleteResourceJob::class, fn (DeleteResourceJob $job) => $job->resource->is($service));
 });
 
 test('delete succeeds without password for an oauth user', function () {
diff --git a/versions.json b/versions.json
index 440ad36160..455918fdc0 100644
--- a/versions.json
+++ b/versions.json
@@ -1,16 +1,16 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.10"
+            "version": "4.3.15"
         },
         "nightly": {
             "version": "4.4-rc.1"
         },
         "helper": {
-            "version": "1.0.15"
+            "version": "1.0.16"
         },
         "realtime": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
             "version": "0.0.22"