diff --git a/.env.development.example b/.env.development.example
index 56c17128ce..380f10a446 100644
--- a/.env.development.example
+++ b/.env.development.example
@@ -53,4 +53,3 @@ DUSK_DRIVER_URL=http://selenium:4444
 BUNNY_API_KEY=
 # For asset uploads
 BUNNY_STORAGE_API_KEY=
-AVATAR_CDN_URL=
diff --git a/.env.windows-docker-desktop.example b/.env.windows-docker-desktop.example
index 626d76ff63..b067b4c5c0 100644
--- a/.env.windows-docker-desktop.example
+++ b/.env.windows-docker-desktop.example
@@ -11,4 +11,3 @@ REDIS_PASSWORD=coolify
 PUSHER_APP_ID=coolify
 PUSHER_APP_KEY=coolify
 PUSHER_APP_SECRET=coolify
-AVATAR_CDN_URL=
diff --git a/.github/workflows/sync-main-to-next.yml b/.github/workflows/sync-main-to-next.yml
index 595a21e799..b9b8b361f2 100644
--- a/.github/workflows/sync-main-to-next.yml
+++ b/.github/workflows/sync-main-to-next.yml
@@ -1,8 +1,8 @@
 name: Sync main to next
 
 on:
-  push:
-    branches: [main]
+  schedule:
+    - cron: '0 3 * * *'
   workflow_dispatch:
 
 permissions:
diff --git a/DESIGN.md b/DESIGN.md
index a7b26bb666..11048ad5d2 100644
--- a/DESIGN.md
+++ b/DESIGN.md
@@ -520,7 +520,10 @@ Do not restore the old full-width footer.
 Deferred fields in one Livewire component use one floating unsaved bar and one
 submit action. Do not add a separate “Save configuration” button to every
 card. Selectors that are safe to persist independently should use the existing
-instant-save pattern.
+instant-save pattern. When those requests share a component with a modal draft,
+pass the unsaved bar a `dirty` Alpine expression comparing that draft with its
+initial values, so unrelated saves do not hide pending changes. Mount modal save
+bars only while the modal is open to avoid inactive keyboard shortcuts.
 
 ---
 
@@ -567,6 +570,15 @@ that hide secondary columns before allowing horizontal overflow.
 
 ---
 
+### Domain rows on mobile
+
+Domain tables become compact summary cards below 600px. Keep the public URL on
+its own line, followed by a short routing summary such as `HTTP → HTTPS · Port
+80 · Noindex`. Put DNS status and the existing icon actions on the final row.
+Do not squeeze desktop label/value columns into a mobile card or move settings
+behind an overflow menu. Long domains wrap, and icon actions retain 40px touch
+targets.
+
 ## 8. Modals, confirmations, and toasts
 
 ### Modals
@@ -626,8 +638,9 @@ Current toast behavior:
 - Reicon status tile for success, info, warning, danger, or default;
 - title plus optional description;
 - dismiss and copy-details actions;
-- up to four stacked notifications;
+- normally up to four stacked notifications, without evicting persistent notices;
 - four-second dismissal, paused while hovered;
+- `persistent: true` disables automatic dismissal, including after hover; users close these notices with the dismiss button;
 - support for all six screen positions and sanitized custom HTML.
 
 Do not bring back the old oversized dark rectangle.
diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index 3feb5117d8..12ac569009 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -44,8 +44,6 @@ class StopApplication
                     $commands = [dockerStopCommand($timeout, $containerName, $server)];
                     if ($removeContainers) {
                         $commands[] = "docker rm -f $containerName";
-                    } else {
-                        array_unshift($commands, "docker update --restart=no $containerName");
                     }
 
                     instant_remote_process(command: $commands, server: $server, throwError: false);
@@ -78,5 +76,7 @@ class StopApplication
         $application->update($status);
 
         ServiceStatusChanged::dispatch($application->environment->project->team->id);
+
+        return null;
     }
 }
diff --git a/app/Actions/Application/StopApplicationPreview.php b/app/Actions/Application/StopApplicationPreview.php
index af5f3fc0f0..8bb3a3dc08 100644
--- a/app/Actions/Application/StopApplicationPreview.php
+++ b/app/Actions/Application/StopApplicationPreview.php
@@ -20,8 +20,6 @@ class StopApplicationPreview
             $commands = [dockerStopCommand($application->settings->stopGracePeriodSeconds(), $containerName, $server)];
             if ($removeContainer) {
                 $commands[] = "docker rm -f $containerName";
-            } else {
-                array_unshift($commands, "docker update --restart=no $containerName");
             }
             instant_remote_process($commands, $server, false);
         }
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index c7fbff37b5..cb1c517539 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -32,7 +32,11 @@ class StartDatabase
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
-        $database->resetRestartLimit();
+        $database->update([
+            'restart_count' => 0,
+            'last_restart_at' => null,
+            'last_restart_type' => null,
+        ]);
 
         $activity = activity()
             ->withProperties([
@@ -49,7 +53,6 @@ class StartDatabase
 
         if ($activity === null) {
             return 'Database start could not be queued because activity logging is disabled.';
-
         }
 
         DatabaseStartJob::dispatch(
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index f3c591acfc..d3c6fafc4d 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -32,7 +32,11 @@ class StopDatabase
             // Reset restart tracking when database is manually stopped
             $database->update(['status' => 'exited']);
             if ($resetRestartCount) {
-                $database->resetRestartLimit();
+                $database->update([
+                    'restart_count' => 0,
+                    'last_restart_at' => null,
+                    'last_restart_type' => null,
+                ]);
             }
 
             if ($dockerCleanup) {
@@ -58,8 +62,6 @@ class StopDatabase
         $commands = [dockerStopCommand($timeout, $containerName, $server)];
         if ($removeContainer) {
             $commands[] = "docker rm -f $containerName";
-        } else {
-            array_unshift($commands, "docker update --restart=no $containerName");
         }
         instant_remote_process(command: $commands, server: $server, throwError: false);
     }
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index be098e481c..c69bd1855f 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -5,7 +5,6 @@ namespace App\Actions\Docker;
 use App\Actions\Application\StopApplication;
 use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
-use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
@@ -249,9 +248,12 @@ class GetContainersStatus
 
                             $database->update($updateData);
 
-                            if ($database->trackRestartCount((int) $restartCount)) {
-                                StopDatabase::dispatch($database, false, false, false);
-                                $database->team()?->notify(new ApplicationRestartLimitReached($database));
+                            if ($restartCount > ($database->restart_count ?? 0)) {
+                                $database->update([
+                                    'restart_count' => (int) $restartCount,
+                                    'last_restart_at' => now(),
+                                    'last_restart_type' => 'crash',
+                                ]);
                             }
 
                             if ($isPublic) {
@@ -357,7 +359,9 @@ class GetContainersStatus
                 continue;
             }
 
-            if (! $exitedService->stoppedAfterRestartLimit()) {
+            if ($exitedService instanceof ServiceDatabase) {
+                $exitedService->update(['status' => 'exited']);
+            } elseif (! $exitedService->stoppedAfterRestartLimit()) {
                 $exitedService->update([
                     'status' => 'exited',
                     'restart_count' => 0,
@@ -424,9 +428,6 @@ class GetContainersStatus
         $notRunningDatabases = $databases->pluck('id')->diff($foundDatabases);
         foreach ($notRunningDatabases as $database) {
             $database = $databases->where('id', $database)->first();
-            if ($database->stoppedAfterRestartLimit()) {
-                continue;
-            }
             if (str($database->status)->startsWith('exited')) {
                 continue;
             }
@@ -442,7 +443,6 @@ class GetContainersStatus
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
-                'restart_limit_reached' => false,
             ]);
 
             // Stop proxy if database was public
@@ -582,7 +582,7 @@ class GetContainersStatus
             $restartCount = isset($this->serviceContainerRestartCounts)
                 ? ($this->serviceContainerRestartCounts->get($key)?->max() ?? 0)
                 : 0;
-            if ($subResource->trackRestartCount($restartCount)) {
+            if (! $subResource instanceof ServiceDatabase && $subResource->trackRestartCount($restartCount)) {
                 StopServiceApplication::dispatch($subResource, false, false);
                 $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
 
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 13371d1265..3dc5c98b3f 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -25,7 +25,6 @@ class StartService
         $service->saveComposeConfigs();
         $service->isConfigurationChanged(save: true);
         $service->applications()->get()->each->resetRestartLimit();
-        $service->databases()->get()->each->resetRestartLimit();
         $workdir = $service->workdir();
         // $commands[] = "cd {$workdir}";
         $commands[] = "echo 'Saved configuration files to {$workdir}.'";
diff --git a/app/Actions/Service/StopService.php b/app/Actions/Service/StopService.php
index 341687d0d2..52d9edda19 100644
--- a/app/Actions/Service/StopService.php
+++ b/app/Actions/Service/StopService.php
@@ -55,7 +55,6 @@ class StopService
             });
             $dbs->each(function ($database): void {
                 $database->update(['status' => 'exited']);
-                $database->resetRestartLimit();
             });
 
             if ($deleteConnectedNetworks) {
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index fa93a78807..1b53472656 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -22,15 +22,12 @@ class StopServiceApplication
         if ($removeContainer) {
             $commands = ["docker rm -f {$containerName}"];
         } else {
-            $commands = [
-                "docker update --restart=no {$containerName}",
-                "docker stop {$containerName}",
-            ];
+            $commands = ["docker stop {$containerName}"];
         }
         instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
         $serviceApplication->update(['status' => 'exited']);
-        if ($resetRestartCount) {
+        if ($resetRestartCount && $serviceApplication instanceof ServiceApplication) {
             $serviceApplication->resetRestartLimit();
         }
         ServiceStatusChanged::dispatch($service->environment->project->team->id);
diff --git a/app/Actions/Stripe/CreateCheckoutSession.php b/app/Actions/Stripe/CreateCheckoutSession.php
new file mode 100644
index 0000000000..42d14c0f25
--- /dev/null
+++ b/app/Actions/Stripe/CreateCheckoutSession.php
@@ -0,0 +1,221 @@
+<?php
+
+namespace App\Actions\Stripe;
+
+use App\Exceptions\CheckoutUnavailableException;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Log;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+use Throwable;
+
+class CreateCheckoutSession
+{
+    private const BLOCKING_SUBSCRIPTION_STATUSES = [
+        'active',
+        'incomplete',
+        'past_due',
+        'paused',
+        'trialing',
+        'unpaid',
+    ];
+
+    private const RECOVERABLE_SUBSCRIPTION_STATUSES = [
+        'incomplete',
+        'past_due',
+        'paused',
+        'unpaid',
+    ];
+
+    public function __construct(private ?StripeClient $stripe = null)
+    {
+        $this->stripe ??= app(StripeClient::class);
+    }
+
+    public static function lockKey(int $teamId): string
+    {
+        return "stripe-checkout:team:{$teamId}";
+    }
+
+    public function execute(Team $team, User $user, string $priceId): object
+    {
+        $lock = Cache::lock(self::lockKey($team->id), 30);
+
+        if (! $lock->get()) {
+            throw new CheckoutUnavailableException('A subscription checkout is already being created for this team.');
+        }
+
+        $previousMaxNetworkRetries = Stripe::getMaxNetworkRetries();
+        Stripe::setMaxNetworkRetries(2);
+
+        try {
+            return $this->createOrReuseSession($team, $user, $priceId);
+        } finally {
+            Stripe::setMaxNetworkRetries($previousMaxNetworkRetries);
+            $lock->release();
+        }
+    }
+
+    private function createOrReuseSession(Team $team, User $user, string $priceId): object
+    {
+        $subscription = Subscription::query()->firstOrNew(['team_id' => $team->id]);
+        $customerId = $subscription->stripe_customer_id;
+
+        if (! $customerId) {
+            $customer = $this->stripe->customers->create([
+                'email' => $user->email,
+                'metadata' => [
+                    'team_id' => $team->id,
+                ],
+            ], [
+                'idempotency_key' => "coolify-team-{$team->id}-customer",
+            ]);
+            $customerId = $customer->id;
+            $subscription->stripe_customer_id = $customerId;
+            $subscription->save();
+
+            Log::info('Stripe customer assigned for subscription checkout.', [
+                'team_id' => $team->id,
+                'stripe_customer_id' => $customerId,
+            ]);
+        }
+
+        $blockingSubscription = null;
+        foreach ($this->stripe->subscriptions->all([
+            'customer' => $customerId,
+            'limit' => 10,
+            'status' => 'all',
+        ])->autoPagingIterator() as $stripeSubscription) {
+            if (in_array($stripeSubscription->status, self::BLOCKING_SUBSCRIPTION_STATUSES, true)) {
+                $blockingSubscription = $stripeSubscription;
+                break;
+            }
+        }
+
+        $this->throwIfBlockingSubscription($team, $customerId, $blockingSubscription);
+
+        $sessions = $this->stripe->checkout->sessions->all([
+            'customer' => $customerId,
+            'limit' => 10,
+            'status' => 'open',
+        ]);
+        $subscriptionSessions = collect($sessions->data)->filter(
+            fn (object $session): bool => ($session->mode ?? null) === 'subscription'
+        );
+        $openSession = $subscriptionSessions->first(
+            fn (object $session): bool => ($session->status ?? null) === 'open'
+        );
+
+        if ($openSession) {
+            $lineItems = $this->stripe->checkout->sessions->allLineItems($openSession->id);
+            if (count($lineItems->data) === 1 && data_get($lineItems, 'data.0.price.id') === $priceId) {
+                Log::info('Reusing pending Stripe subscription checkout.', [
+                    'team_id' => $team->id,
+                    'stripe_customer_id' => $customerId,
+                    'stripe_checkout_session_id' => $openSession->id,
+                    'stripe_subscription_id' => $openSession->subscription ?? null,
+                ]);
+
+                return $openSession;
+            }
+
+            $this->stripe->checkout->sessions->expire($openSession->id);
+        }
+
+        $session = $this->stripe->checkout->sessions->create([
+            'allow_promotion_codes' => true,
+            'billing_address_collection' => 'required',
+            'client_reference_id' => $user->id.':'.$team->id,
+            'customer' => $customerId,
+            'customer_update' => [
+                'name' => 'auto',
+                'address' => 'auto',
+            ],
+            'line_items' => [[
+                'price' => $priceId,
+                'adjustable_quantity' => [
+                    'enabled' => true,
+                    'minimum' => 2,
+                ],
+                'quantity' => 2,
+            ]],
+            'tax_id_collection' => [
+                'enabled' => true,
+            ],
+            'automatic_tax' => [
+                'enabled' => true,
+            ],
+            'subscription_data' => [
+                'metadata' => [
+                    'user_id' => $user->id,
+                    'team_id' => $team->id,
+                ],
+            ],
+            'payment_method_collection' => 'if_required',
+            'mode' => 'subscription',
+            'expires_at' => now()->addMinutes(35)->timestamp,
+            'success_url' => route('dashboard', ['success' => true]),
+            'cancel_url' => route('subscription.index', ['cancelled' => true]),
+        ]);
+
+        Log::info('Stripe subscription checkout created.', [
+            'team_id' => $team->id,
+            'stripe_customer_id' => $customerId,
+            'stripe_checkout_session_id' => $session->id,
+            'stripe_subscription_id' => $session->subscription ?? null,
+        ]);
+
+        return $session;
+    }
+
+    private function throwIfBlockingSubscription(Team $team, string $customerId, ?object $blockingSubscription): void
+    {
+        if (! $blockingSubscription) {
+            return;
+        }
+
+        Log::warning('Stripe subscription checkout blocked by existing subscription.', [
+            'team_id' => $team->id,
+            'stripe_customer_id' => $customerId,
+            'stripe_subscription_id' => $blockingSubscription->id,
+            'stripe_subscription_status' => $blockingSubscription->status,
+        ]);
+
+        $portalUrl = in_array($blockingSubscription->status, self::RECOVERABLE_SUBSCRIPTION_STATUSES, true)
+            ? $this->billingPortalUrl($customerId)
+            : null;
+
+        throw new CheckoutUnavailableException(
+            $this->blockingSubscriptionMessage($blockingSubscription->status),
+            $portalUrl,
+        );
+    }
+
+    private function blockingSubscriptionMessage(string $status): string
+    {
+        return match ($status) {
+            'incomplete' => "This team's subscription payment is incomplete. Complete the payment in the billing portal.",
+            'past_due' => "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.",
+            'unpaid' => "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal.",
+            'paused' => "This team's subscription is paused. Resume it in the billing portal.",
+            default => 'Team already has an active subscription.',
+        };
+    }
+
+    private function billingPortalUrl(string $customerId): ?string
+    {
+        try {
+            $session = $this->stripe->billingPortal->sessions->create([
+                'customer' => $customerId,
+                'return_url' => route('subscription.show'),
+            ]);
+        } catch (Throwable) {
+            return null;
+        }
+
+        return is_string($session->url ?? null) ? $session->url : null;
+    }
+}
diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 8d4d017c81..79660c2490 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -5,6 +5,7 @@ namespace App\Console;
 use App\Jobs\ApiTokenExpirationWarningJob;
 use App\Jobs\CheckForUpdatesJob;
 use App\Jobs\CheckHelperImageJob;
+use App\Jobs\CheckMissingDatabaseBackupsJob;
 use App\Jobs\CheckTraefikVersionJob;
 use App\Jobs\CleanupInstanceStuffsJob;
 use App\Jobs\CleanupOrphanedPreviewContainersJob;
@@ -47,11 +48,13 @@ class Kernel extends ConsoleKernel
             ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
         $this->scheduleInstance->command('cleanup:stucked-resources')
-            ->daily()
+            ->dailyAt('03:17')
             ->onOneServer()
-            ->withoutOverlapping(60);
+            ->withoutOverlapping(60)
+            ->runInBackground();
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
+        $this->scheduleInstance->job(new CheckMissingDatabaseBackupsJob)->hourly()->onOneServer();
 
         if (isDev()) {
             // Instance Jobs
diff --git a/app/Exceptions/CheckoutUnavailableException.php b/app/Exceptions/CheckoutUnavailableException.php
new file mode 100644
index 0000000000..329941dbc6
--- /dev/null
+++ b/app/Exceptions/CheckoutUnavailableException.php
@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Exceptions;
+
+use Exception;
+use Throwable;
+
+class CheckoutUnavailableException extends Exception
+{
+    public function __construct(
+        string $message = '',
+        public readonly ?string $billingPortalUrl = null,
+        int $code = 0,
+        ?Throwable $previous = null,
+    ) {
+        parent::__construct($message, $code, $previous);
+    }
+}
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 727f34f801..246214986c 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -27,6 +27,7 @@ use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Validation\Rule;
@@ -1455,7 +1456,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $repository_url_parsed = Url::fromString($request->git_repository);
             $git_host = $repository_url_parsed->getHost();
@@ -1719,7 +1722,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $application->fqdn = $fqdn;
             $application->git_repository = str($gitRepository)->trim()->toString();
@@ -1950,7 +1955,9 @@ class ApplicationsController extends Controller
                 $request->offsetUnset('docker_compose_domains');
             }
             if ($dockerComposeDomainsJson->count() > 0) {
+                [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts($dockerComposeDomainsJson);
                 $application->docker_compose_domains = json_encode($dockerComposeDomainsJson);
+                $application->domain_port_overrides = $domainPortOverrides;
             }
             $application->fqdn = $fqdn;
             $application->private_key_id = $privateKey->id;
@@ -3369,7 +3376,12 @@ class ApplicationsController extends Controller
         }
 
         if ($dockerComposeDomainsJson->count() > 0) {
+            [$dockerComposeDomainsJson, $domainPortOverrides] = $this->normalizeDockerComposeDomainPorts(
+                $dockerComposeDomainsJson,
+                $application->domain_port_overrides,
+            );
             data_set($data, 'docker_compose_domains', json_encode($dockerComposeDomainsJson));
+            data_set($data, 'domain_port_overrides', $domainPortOverrides);
         }
         $requestHasNoindexDomains = $request->has('noindex_domains');
         data_forget($data, 'noindex_domains');
@@ -6108,4 +6120,28 @@ class ApplicationsController extends Controller
 
         return response()->json(['message' => 'Destination detached.']);
     }
+
+    /**
+     * @param  Collection<string, array{domain: ?string, redirect?: string}>  $domains
+     * @param  array<string, int|string>|null  $existingOverrides
+     * @return array{Collection<string, array{domain: ?string, redirect?: string}>, ?array<string, int>}
+     */
+    private function normalizeDockerComposeDomainPorts(Collection $domains, ?array $existingOverrides = null): array
+    {
+        $allDomains = $domains
+            ->pluck('domain')
+            ->filter()
+            ->implode(',');
+        $normalized = DomainPortOverrides::normalize($allDomains, $existingOverrides);
+
+        $domains = $domains->map(function (array $entry): array {
+            $entry['domain'] = collect(ValidationPatterns::applicationDomainList($entry['domain'] ?? null))
+                ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                ->implode(',');
+
+            return $entry;
+        });
+
+        return [$domains, $normalized['overrides']];
+    }
 }
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index aeb69ac8b4..881aa5a897 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -769,6 +769,7 @@ class DatabasesController extends Controller
                         'database_backup_retention_days_s3' => ['type' => 'integer', 'description' => 'Number of days to retain backups in S3'],
                         'database_backup_retention_max_storage_s3' => ['type' => 'number', 'description' => 'Max storage (GB) for S3 backups'],
                         'timeout' => ['type' => 'integer', 'description' => 'Backup job timeout in seconds (min: 60, max: 36000)', 'default' => 3600],
+                        'missing_backup_notification_days' => ['type' => 'integer', 'description' => 'Alert after this many days without an execution; 0 disables alerts', 'minimum' => 0, 'maximum' => 365, 'default' => 0],
                     ],
                 ),
             )
@@ -805,7 +806,7 @@ class DatabasesController extends Controller
     )]
     public function create_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -833,6 +834,7 @@ class DatabasesController extends Controller
             'database_backup_retention_days_s3' => 'integer|min:0',
             'database_backup_retention_max_storage_s3' => 'numeric|min:0',
             'timeout' => 'integer|min:60|max:36000',
+            'missing_backup_notification_days' => 'integer|min:0|max:365',
         ]);
 
         if ($validator->fails()) {
@@ -1025,6 +1027,7 @@ class DatabasesController extends Controller
                         'database_backup_retention_days_s3' => ['type' => 'integer', 'description' => 'Retention days of the backup in s3'],
                         'database_backup_retention_max_storage_s3' => ['type' => 'number', 'description' => 'Max storage of the backup in S3'],
                         'timeout' => ['type' => 'integer', 'description' => 'Backup job timeout in seconds (min: 60, max: 36000)', 'default' => 3600],
+                        'missing_backup_notification_days' => ['type' => 'integer', 'description' => 'Alert after this many days without an execution; 0 disables alerts', 'minimum' => 0, 'maximum' => 365],
                     ],
                 ),
             )
@@ -1054,7 +1057,7 @@ class DatabasesController extends Controller
     )]
     public function update_backup(Request $request)
     {
-        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout'];
+        $backupConfigFields = ['save_s3', 'enabled', 'dump_all', 'frequency', 'databases_to_backup', 'database_backup_retention_amount_locally', 'database_backup_retention_days_locally', 'database_backup_retention_max_storage_locally', 'database_backup_retention_amount_s3', 'database_backup_retention_days_s3', 'database_backup_retention_max_storage_s3', 's3_storage_uuid', 'timeout', 'missing_backup_notification_days'];
 
         $teamId = getTeamIdFromToken();
         if (is_null($teamId)) {
@@ -1080,6 +1083,7 @@ class DatabasesController extends Controller
             'database_backup_retention_days_s3' => 'integer|min:0',
             'database_backup_retention_max_storage_s3' => 'numeric|min:0',
             'timeout' => 'integer|min:60|max:36000',
+            'missing_backup_notification_days' => 'integer|min:0|max:365',
         ]);
         if ($validator->fails()) {
             return response()->json([
@@ -4885,6 +4889,8 @@ class DatabasesController extends Controller
                 'id',
                 'created_at',
                 'updated_at',
+                'last_execution_at',
+                'missing_backup_notification_sent_at',
             ])->fill([
                 'uuid' => new_public_id(),
                 'database_id' => $newDatabase->id,
diff --git a/app/Http/Controllers/Api/ServiceApplicationsController.php b/app/Http/Controllers/Api/ServiceApplicationsController.php
index e8446467de..5bf51bc027 100644
--- a/app/Http/Controllers/Api/ServiceApplicationsController.php
+++ b/app/Http/Controllers/Api/ServiceApplicationsController.php
@@ -9,6 +9,7 @@ use App\Actions\Service\UpdateServiceApplicationFromApi;
 use App\Http\Controllers\Controller;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Collection;
@@ -333,7 +334,7 @@ class ServiceApplicationsController extends Controller
         ];
 
         $validationRules = [
-            'url' => 'nullable|string',
+            'url' => ValidationPatterns::applicationDomainRules(),
             'noindex_domains' => 'sometimes|array|nullable',
             'noindex_domains.*' => 'string',
             'human_name' => 'nullable|string|max:255',
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 9bfcfd8539..1a199c07ec 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -386,7 +386,7 @@ class ServicesController extends Controller
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
-            'urls.*.url' => 'string|nullable',
+            'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
             'tags' => 'array|nullable',
@@ -602,7 +602,7 @@ class ServicesController extends Controller
                 'urls' => 'array|nullable',
                 'urls.*' => 'array:name,url',
                 'urls.*.name' => 'string|required',
-                'urls.*.url' => 'string|nullable',
+                'urls.*.url' => ValidationPatterns::applicationDomainRules(),
                 'force_domain_override' => 'boolean',
                 'is_container_label_escape_enabled' => 'boolean',
                 'tags' => 'array|nullable',
@@ -1187,7 +1187,7 @@ class ServicesController extends Controller
             'urls' => 'array|nullable',
             'urls.*' => 'array:name,url',
             'urls.*.name' => 'string|required',
-            'urls.*.url' => 'string|nullable',
+            'urls.*.url' => ValidationPatterns::applicationDomainRules(),
             'force_domain_override' => 'boolean',
             'is_container_label_escape_enabled' => 'boolean',
         ];
diff --git a/app/Http/Controllers/ProfileAvatarController.php b/app/Http/Controllers/ProfileAvatarController.php
index 2cf01400e8..f53cef7c51 100644
--- a/app/Http/Controllers/ProfileAvatarController.php
+++ b/app/Http/Controllers/ProfileAvatarController.php
@@ -14,7 +14,7 @@ class ProfileAvatarController extends Controller
 
         return response($contents, 200, [
             'Content-Type' => 'image/jpeg',
-            'Cache-Control' => 'private, max-age=300',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
         ]);
     }
 }
diff --git a/app/Http/Controllers/ProjectIconController.php b/app/Http/Controllers/ProjectIconController.php
index fb7ebc8860..d99e9166d0 100644
--- a/app/Http/Controllers/ProjectIconController.php
+++ b/app/Http/Controllers/ProjectIconController.php
@@ -15,6 +15,9 @@ class ProjectIconController extends Controller
 
         abort_if($contents === null, 404);
 
-        return response($contents)->header('Content-Type', 'image/jpeg');
+        return response($contents, 200, [
+            'Content-Type' => 'image/jpeg',
+            'Cache-Control' => 'private, max-age=31536000, immutable',
+        ]);
     }
 }
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index 28e92dcd49..c4fdc5fd5c 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -83,7 +83,10 @@ class Github extends Controller
                 }
             }
             if ($x_github_event === 'pull_request') {
-                $applications = $this->manualWebhookApplications($applications->where('git_branch', $base_branch), $full_name);
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $this->manualWebhookApplications($applications, $full_name);
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found for repo $full_name and branch '$base_branch'.");
                 }
@@ -334,7 +337,10 @@ class Github extends Controller
                 }
             }
             if ($x_github_event === 'pull_request') {
-                $applications = $applications->where('git_branch', $base_branch)->get();
+                if ($action !== 'closed') {
+                    $applications->where('git_branch', $base_branch);
+                }
+                $applications = $applications->get();
                 if ($applications->isEmpty()) {
                     return response("Nothing to do. No applications found with branch '$base_branch'.");
                 }
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 0887e7e864..19c0b750ec 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -2495,12 +2495,8 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
                 destination: $destination,
                 no_questions_asked: true,
             );
-            $this->application_deployment_queue->addLogEntry("Deployment to {$server->name}. Logs: ".route('project.application.deployment.show', [
-                'project_uuid' => data_get($this->application, 'environment.project.uuid'),
-                'application_uuid' => data_get($this->application, 'uuid'),
-                'deployment_uuid' => $deployment_uuid,
-                'environment_uuid' => data_get($this->application, 'environment.uuid'),
-            ]));
+            $deployment_url = base_url().'/project/'.data_get($this->application, 'environment.project.uuid').'/environment/'.data_get($this->application, 'environment.uuid').'/application/'.data_get($this->application, 'uuid')."/deployment/{$deployment_uuid}";
+            $this->application_deployment_queue->addLogEntry("Deployment to {$server->name}. Logs: {$deployment_url}");
         }
     }
 
diff --git a/app/Jobs/CheckMissingDatabaseBackupsJob.php b/app/Jobs/CheckMissingDatabaseBackupsJob.php
new file mode 100644
index 0000000000..06ba79a33f
--- /dev/null
+++ b/app/Jobs/CheckMissingDatabaseBackupsJob.php
@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Notifications\Database\BackupMissing;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class CheckMissingDatabaseBackupsJob implements ShouldBeEncrypted, ShouldBeUnique, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public function handle(): void
+    {
+        ScheduledDatabaseBackup::query()
+            ->with(['team', 'database', 'latest_log'])
+            ->where('enabled', true)
+            ->where('missing_backup_notification_days', '>', 0)
+            ->chunkById(100, function ($backups): void {
+                foreach ($backups as $backup) {
+                    $this->notifyIfMissing($backup);
+                }
+            });
+    }
+
+    private function notifyIfMissing(ScheduledDatabaseBackup $backup): void
+    {
+        $lastExecutionAt = $backup->last_execution_at ?? $backup->latest_log?->created_at;
+        $lastActivityAt = $lastExecutionAt ?? $backup->created_at;
+
+        if (! $lastActivityAt || $lastActivityAt->isAfter(now()->subDays($backup->missing_backup_notification_days))) {
+            return;
+        }
+
+        if ($backup->missing_backup_notification_sent_at?->greaterThanOrEqualTo($lastActivityAt)) {
+            return;
+        }
+
+        if (! $backup->team) {
+            Log::warning("Cannot send missing backup notification for backup {$backup->id}: team not found");
+
+            return;
+        }
+
+        if ($backup->team->getEnabledChannels('backup_failure') === []) {
+            return;
+        }
+
+        $backup->team->notify(new BackupMissing($backup, $lastExecutionAt));
+        $backup->forceFill(['missing_backup_notification_sent_at' => now()])->save();
+    }
+}
diff --git a/app/Jobs/CheckTraefikVersionForServerJob.php b/app/Jobs/CheckTraefikVersionForServerJob.php
index 054a739bc6..e56b93c9e5 100644
--- a/app/Jobs/CheckTraefikVersionForServerJob.php
+++ b/app/Jobs/CheckTraefikVersionForServerJob.php
@@ -2,6 +2,8 @@
 
 namespace App\Jobs;
 
+use App\Enums\ProxyStatus;
+use App\Enums\ProxyTypes;
 use App\Events\ProxyStatusChangedUI;
 use App\Models\Server;
 use App\Notifications\Server\TraefikVersionOutdated;
@@ -33,8 +35,13 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
      */
     public function handle(): void
     {
+        $this->server->refresh();
         $this->clearOutdatedInfo();
 
+        if ($this->server->proxyType() !== ProxyTypes::TRAEFIK->value || $this->server->proxy->get('status') !== ProxyStatus::RUNNING->value) {
+            return;
+        }
+
         // Detect current version (makes SSH call)
         $currentVersion = getTraefikVersionFromDockerCompose($this->server);
 
@@ -116,7 +123,10 @@ class CheckTraefikVersionForServerJob implements ShouldBeEncrypted, ShouldQueue
 
     private function clearOutdatedInfo(): void
     {
-        $this->server->update(['traefik_outdated_info' => null]);
+        $this->server->update([
+            'detected_traefik_version' => null,
+            'traefik_outdated_info' => null,
+        ]);
     }
 
     /**
diff --git a/app/Jobs/CheckTraefikVersionJob.php b/app/Jobs/CheckTraefikVersionJob.php
index ac94aa23f5..0a9eeba005 100644
--- a/app/Jobs/CheckTraefikVersionJob.php
+++ b/app/Jobs/CheckTraefikVersionJob.php
@@ -19,6 +19,20 @@ class CheckTraefikVersionJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle(): void
     {
+        Server::query()
+            ->where(function ($query) {
+                $query->whereNull('proxy')
+                    ->orWhere('proxy->type', '!=', ProxyTypes::TRAEFIK->value);
+            })
+            ->where(function ($query) {
+                $query->whereNotNull('detected_traefik_version')
+                    ->orWhereNotNull('traefik_outdated_info');
+            })
+            ->update([
+                'detected_traefik_version' => null,
+                'traefik_outdated_info' => null,
+            ]);
+
         // Load versions from cached data
         $traefikVersions = get_traefik_versions();
 
diff --git a/app/Jobs/CleanupHelperContainersJob.php b/app/Jobs/CleanupHelperContainersJob.php
index f1635d6d4d..52b4064feb 100644
--- a/app/Jobs/CleanupHelperContainersJob.php
+++ b/app/Jobs/CleanupHelperContainersJob.php
@@ -19,6 +19,11 @@ class CleanupHelperContainersJob implements ShouldBeEncrypted, ShouldBeUnique, S
 
     public function __construct(public Server $server) {}
 
+    private static function helperContainersCommand(): string
+    {
+        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("(^|/)coollabsio/coolify-helper(:|@)")))\'';
+    }
+
     public function handle(): void
     {
         try {
@@ -36,7 +41,7 @@ class CleanupHelperContainersJob implements ShouldBeEncrypted, ShouldBeUnique, S
                 'active_deployment_uuids' => $activeDeployments,
             ]);
 
-            $containers = instant_remote_process_with_timeout(['docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image | contains("'.coolifyRegistryUrl().'/coollabsio/coolify-helper")))\''], $this->server, false);
+            $containers = instant_remote_process_with_timeout([self::helperContainersCommand()], $this->server, false);
             $helperContainers = collect(json_decode($containers));
 
             if ($helperContainers->count() > 0) {
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index 0e73ee41b2..ef83d19446 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -5,7 +5,6 @@ namespace App\Jobs;
 use App\Actions\Application\StopApplication;
 use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
-use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
@@ -483,7 +482,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             ])
             ->with([
                 'applications:id,service_id,status,last_online_at,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
-                'databases:id,service_id,status,last_online_at,is_public,name,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
+                'databases:id,service_id,status,last_online_at,is_public,name',
             ])
             ->get();
     }
@@ -506,8 +505,6 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             'restart_count',
             'last_restart_at',
             'last_restart_type',
-            'max_restart_count',
-            'restart_limit_reached',
         ];
 
         return collect([
@@ -675,7 +672,7 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             }
 
             $restartCount = $this->serviceContainerRestartCounts->get($key)?->max() ?? 0;
-            if ($subResource->trackRestartCount($restartCount)) {
+            if (! $subResource instanceof ServiceDatabase && $subResource->trackRestartCount($restartCount)) {
                 StopServiceApplication::dispatch($subResource, false, false);
                 $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
 
@@ -821,11 +818,12 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
             $database->status = $containerStatus;
             $database->save();
         }
-        if (is_numeric($restartCount) && $database->trackRestartCount((int) $restartCount)) {
-            StopDatabase::dispatch($database, false, false, false);
-            $database->team()?->notify(new ApplicationRestartLimitReached($database));
-
-            return;
+        if (is_numeric($restartCount) && $restartCount > ($database->restart_count ?? 0)) {
+            $database->update([
+                'restart_count' => (int) $restartCount,
+                'last_restart_at' => now(),
+                'last_restart_type' => 'crash',
+            ]);
         }
         if (! $this->isCompleteSnapshot()) {
             return;
@@ -883,16 +881,12 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {
-                if ($database->stoppedAfterRestartLimit()) {
-                    return;
-                }
                 if (! str($database->status)->startsWith('exited')) {
                     $database->update([
                         'status' => 'exited',
                         'restart_count' => 0,
                         'last_restart_at' => null,
                         'last_restart_type' => null,
-                        'restart_limit_reached' => false,
                     ]);
                 }
                 if ($database->is_public) {
@@ -918,9 +912,8 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
         // Batch update service databases
         if ($notFoundServiceDatabaseIds->isNotEmpty()) {
             ServiceDatabase::whereIn('id', $notFoundServiceDatabaseIds)
-                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
+                ->update(['status' => 'exited']);
         }
     }
 
diff --git a/app/Jobs/RegenerateSslCertJob.php b/app/Jobs/RegenerateSslCertJob.php
index 6f49cf30be..ed2d1c4546 100644
--- a/app/Jobs/RegenerateSslCertJob.php
+++ b/app/Jobs/RegenerateSslCertJob.php
@@ -66,7 +66,10 @@ class RegenerateSslCertJob implements ShouldBeEncrypted, ShouldQueue
                     caCert: $caCert->ssl_certificate,
                     caKey: $caCert->ssl_private_key,
                 );
-                $regenerated->push($certificate);
+                $resource = $certificate->database;
+                if ($resource) {
+                    $regenerated->push($resource);
+                }
             } catch (\Exception $e) {
                 Log::error('Failed to regenerate SSL certificate: '.$e->getMessage());
             }
diff --git a/app/Jobs/StripeProcessJob.php b/app/Jobs/StripeProcessJob.php
index 6ddbfe145c..0f56476e25 100644
--- a/app/Jobs/StripeProcessJob.php
+++ b/app/Jobs/StripeProcessJob.php
@@ -74,7 +74,7 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                     }
-                    Subscription::updateOrCreate(
+                    $subscription = Subscription::updateOrCreate(
                         ['team_id' => $teamId],
                         [
                             'stripe_subscription_id' => $subscriptionId,
@@ -83,6 +83,12 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                             'stripe_past_due' => false,
                         ]
                     );
+                    logger()->info('Stripe subscription checkout completed.', [
+                        'team_id' => $team->id,
+                        'stripe_customer_id' => $customerId,
+                        'stripe_checkout_session_id' => data_get($data, 'id'),
+                        'stripe_subscription_id' => $subscription->stripe_subscription_id,
+                    ]);
                     break;
                 case 'invoice.paid':
                     $customerId = data_get($data, 'customer');
@@ -218,7 +224,7 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                     }
-                    Subscription::updateOrCreate(
+                    $subscription = Subscription::firstOrCreate(
                         ['team_id' => $teamId],
                         [
                             'stripe_subscription_id' => $subscriptionId,
@@ -226,6 +232,11 @@ class StripeProcessJob implements ShouldBeEncrypted, ShouldQueue
                             'stripe_invoice_paid' => false,
                         ]
                     );
+                    if (! $subscription->stripe_subscription_id && $subscription->stripe_customer_id === $customerId) {
+                        $subscription->update(['stripe_subscription_id' => $subscriptionId]);
+                    } elseif ($subscription->stripe_customer_id !== $customerId) {
+                        throw new \RuntimeException("Stripe customer ID mismatch for team {$teamId}: stored {$subscription->stripe_customer_id}, event {$customerId}.");
+                    }
                     break;
                 case 'customer.subscription.updated':
                     $teamId = data_get($data, 'metadata.team_id');
diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index b567a71b7f..0b13c66609 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -73,6 +73,7 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         $filename = str($this->backup->targetType())->lower().'-'.str($this->backup->targetName())->slug().'-'.Carbon::now()->timestamp.'.tar.gz';
         $backupLocation = $backupDirectory.'/'.$filename;
         $this->execution->update(['filename' => $backupLocation]);
+        $streamToS3 = $this->backup->save_s3 && $this->backup->disable_local_backup;
 
         try {
             $source = $this->backup->sourcePath();
@@ -86,11 +87,17 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
             $compressorCommand = BackupCompression::compressorCommand($compressionCpuPercentage);
             $archiveScript = "compressor=\$({$compressorCommand}); tar -I \"\$compressor\" -cf - -C /volume .";
-            $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
-                .' -v '.escapeshellarg($source.':/volume:ro')
-                .' '.escapeshellarg($image)
-                .' sh -c '.escapeshellarg($archiveScript)
-                .' > '.escapeshellarg($backupLocation);
+            if ($streamToS3) {
+                $this->execution->update(['local_storage_deleted' => true]);
+                $archiveCommand = $this->streamToS3Command($archiveScript, $backupLocation, $source, $containerName, $image);
+                $this->execution->update(['s3_cleanup_pending' => true]);
+            } else {
+                $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
+                    .' -v '.escapeshellarg($source.':/volume:ro')
+                    .' '.escapeshellarg($image)
+                    .' sh -c '.escapeshellarg($archiveScript)
+                    .' > '.escapeshellarg($backupLocation);
+            }
 
             if ($this->backup->stop_during_backup) {
                 $containers = $this->containersUsingVolume($source, $server);
@@ -104,21 +111,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
 
-            instant_remote_process([
+            $archiveOutput = instant_remote_process(array_filter([
                 $verifySourceCommand,
-                'mkdir -p '.escapeshellarg($backupDirectory),
+                $streamToS3 ? null : 'mkdir -p '.escapeshellarg($backupDirectory),
                 $archiveCommand,
-            ], $server, timeout: $this->timeout, disableMultiplexing: true);
+            ]), $server, timeout: $this->timeout, disableMultiplexing: true);
             $this->execution->update([
                 'stop_container_ids' => null,
                 'stop_recovery_pending' => false,
             ]);
 
-            $size = (int) instant_remote_process(
-                ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
-                $server,
-                disableMultiplexing: true,
-            );
+            $size = $streamToS3
+                ? (int) str($archiveOutput)->trim()->afterLast("\n")->toString()
+                : (int) instant_remote_process(
+                    ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
+                    $server,
+                    disableMultiplexing: true,
+                );
 
             if ($size <= 0) {
                 throw new \RuntimeException('The storage backup archive is empty or was not created.');
@@ -127,9 +136,12 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $warning = null;
             $s3Uploaded = null;
             $s3CleanupPending = false;
-            $localStorageDeleted = false;
+            $localStorageDeleted = $streamToS3;
 
-            if ($this->backup->save_s3) {
+            if ($streamToS3) {
+                $s3Uploaded = true;
+                $this->execution->update(['s3_cleanup_pending' => false]);
+            } elseif ($this->backup->save_s3) {
                 $s3CleanupPending = true;
                 $this->execution->update(['s3_cleanup_pending' => true]);
 
@@ -181,13 +193,23 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             }
         } catch (Throwable $exception) {
             $recoveryError = $this->recoverIncompleteBackup($this->execution);
-            $archiveDeleted = false;
+            $archiveDeleted = $streamToS3;
 
-            try {
-                deleteBackupsLocally($backupLocation, $server, throwError: true);
-                $archiveDeleted = true;
-            } catch (Throwable $cleanupException) {
-                $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+            if ($streamToS3) {
+                $exception = new \RuntimeException(
+                    'S3-only streaming backup failed: '.$exception->getMessage()
+                    .'. The S3 destination may not support streaming uploads. Enable local backups to use the local archive upload method.',
+                    previous: $exception,
+                );
+            }
+
+            if (! $streamToS3) {
+                try {
+                    deleteBackupsLocally($backupLocation, $server, throwError: true);
+                    $archiveDeleted = true;
+                } catch (Throwable $cleanupException) {
+                    $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+                }
             }
 
             $s3CleanupPending = $this->execution->fresh()->s3_cleanup_pending;
@@ -195,7 +217,9 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
             $this->execution->update([
                 'status' => 'failed',
                 'message' => $exception->getMessage().$recoveryError,
-                'filename' => $archiveDeleted && ! $s3CleanupPending ? null : $backupLocation,
+                'filename' => $streamToS3
+                    ? ($s3CleanupPending ? $backupLocation : null)
+                    : ($archiveDeleted && ! $s3CleanupPending ? null : $backupLocation),
                 'local_storage_deleted' => $archiveDeleted,
             ]);
 
@@ -338,6 +362,34 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function streamToS3Command(string $archiveScript, string $backupLocation, string $source, string $containerName, string $image): string
+    {
+        $s3 = $this->backup->s3;
+
+        if (! $s3) {
+            $this->backup->update(['save_s3' => false, 's3_storage_id' => null]);
+
+            throw new \RuntimeException('The selected S3 storage no longer exists. S3 backup has been disabled.');
+        }
+
+        $s3->testConnection(shouldSave: true);
+        $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($s3->endpoint, $s3->trustedInternalHosts()))
+            ->map(fn (string $option): string => '--resolve '.escapeshellarg($option))
+            ->implode(' ');
+        $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
+        $destination = 'temporary/'.$s3->bucket.$backupLocation;
+        $streamScript = 'set -o pipefail; mc alias set'.$resolveOptions.' temporary '
+            .escapeshellarg($s3->endpoint).' '.escapeshellarg($s3->key).' '.escapeshellarg($s3->secret)
+            .' >/dev/null && ('.$archiveScript.' | mc pipe --quiet'.$resolveOptions.' '.escapeshellarg($destination).' >/dev/null)'
+            .' && mc stat --json'.$resolveOptions.' '.escapeshellarg($destination)
+            .' | sed -n '.escapeshellarg('s/.*"size":\([0-9][0-9]*\).*/\1/p');
+
+        return 'docker run --rm --name '.escapeshellarg($containerName)
+            .' -v '.escapeshellarg($source.':/volume:ro')
+            .' '.escapeshellarg($image)
+            .' sh -c '.escapeshellarg($streamScript);
+    }
+
     private function logCompressorInDevelopment(string $image, Server $server, int $compressionCpuPercentage): void
     {
         if (! isDev()) {
diff --git a/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php b/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
index 44dba0d5e8..6ecea8e96f 100644
--- a/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
+++ b/app/Livewire/Concerns/InteractsWithCloudflareDomainConnect.php
@@ -209,19 +209,20 @@ trait InteractsWithCloudflareDomainConnect
             }
         }
 
-        // Prefer instance public IPv6 when the destination IP is IPv4-only (and vice versa).
-        try {
-            $settings = instanceSettings();
-            $publicV4 = data_get($settings, 'public_ipv4');
-            $publicV6 = data_get($settings, 'public_ipv6');
-            if ($ipv4 === null && is_string($publicV4) && filter_var($publicV4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-                $ipv4 = $publicV4;
+        if ($this->usesInstanceNetworkAddressesForDnsHints()) {
+            try {
+                $settings = instanceSettings();
+                $publicV4 = data_get($settings, 'public_ipv4');
+                $publicV6 = data_get($settings, 'public_ipv6');
+                if ($ipv4 === null && is_string($publicV4) && filter_var($publicV4, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+                    $ipv4 = $publicV4;
+                }
+                if ($ipv6 === null && is_string($publicV6) && filter_var($publicV6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+                    $ipv6 = $publicV6;
+                }
+            } catch (\Throwable) {
+                //
             }
-            if ($ipv6 === null && is_string($publicV6) && filter_var($publicV6, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-                $ipv6 = $publicV6;
-            }
-        } catch (\Throwable) {
-            //
         }
 
         return [$ipv4, $ipv6];
@@ -253,5 +254,7 @@ trait InteractsWithCloudflareDomainConnect
         return null;
     }
 
+    abstract protected function usesInstanceNetworkAddressesForDnsHints(): bool;
+
     abstract protected function authorizeUpdateForDomainConnect(): void;
 }
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index 45e284c5dc..a9e1c0be28 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -27,12 +27,6 @@ class Advanced extends Component
     #[Validate(['boolean'])]
     public bool $isGitShallowCloneEnabled = false;
 
-    #[Validate(['boolean'])]
-    public bool $isPreviewDeploymentsEnabled = false;
-
-    #[Validate(['boolean'])]
-    public bool $isPrDeploymentsPublicEnabled = false;
-
     #[Validate(['boolean'])]
     public bool $isAutoDeployEnabled = true;
 
@@ -107,8 +101,6 @@ class Advanced extends Component
             $this->application->settings->is_git_submodules_enabled = $this->isGitSubmodulesEnabled;
             $this->application->settings->is_git_lfs_enabled = $this->isGitLfsEnabled;
             $this->application->settings->is_git_shallow_clone_enabled = $this->isGitShallowCloneEnabled;
-            $this->application->settings->is_preview_deployments_enabled = $this->isPreviewDeploymentsEnabled;
-            $this->application->settings->is_pr_deployments_public_enabled = $this->isPrDeploymentsPublicEnabled;
             $this->application->settings->is_auto_deploy_enabled = $this->isAutoDeployEnabled;
             $this->application->settings->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->application->settings->is_gpu_enabled = $this->isGpuEnabled;
@@ -136,8 +128,6 @@ class Advanced extends Component
             $this->isGitSubmodulesEnabled = $this->application->settings->is_git_submodules_enabled;
             $this->isGitLfsEnabled = $this->application->settings->is_git_lfs_enabled;
             $this->isGitShallowCloneEnabled = $this->application->settings->is_git_shallow_clone_enabled ?? false;
-            $this->isPreviewDeploymentsEnabled = $this->application->settings->is_preview_deployments_enabled;
-            $this->isPrDeploymentsPublicEnabled = $this->application->settings->is_pr_deployments_public_enabled ?? false;
             $this->isAutoDeployEnabled = $this->application->settings->is_auto_deploy_enabled;
             $this->isGpuEnabled = $this->application->settings->is_gpu_enabled;
             $this->gpuDriver = $this->application->settings->gpu_driver;
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 9f1e7fc176..906cc147a0 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -150,7 +150,15 @@ class Domains extends Component
 
     public function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
+
         $this->loadDomainState();
+
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && ($row['service'] ?? null) === ($editingRow['service'] ?? null));
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     public function pollDnsChecks(): void
@@ -227,7 +235,9 @@ class Domains extends Component
 
         $this->isCompose = $this->application->build_pack === 'dockercompose';
         $this->labelsAreWritable = $this->application->settings->is_container_label_readonly_enabled === false;
-        $this->redirect = $this->application->redirect ?? 'both';
+        if ($this->pendingAction !== 'redirect' || $this->isCompose) {
+            $this->redirect = $this->application->redirect ?? 'both';
+        }
         $this->isForceHttpsEnabled = $this->application->isForceHttpsEnabled();
 
         $settings = instanceSettings();
@@ -254,6 +264,9 @@ class Domains extends Component
         }
 
         $this->composeServices = [];
+        $pendingRedirect = $this->pendingRedirectService !== null
+            ? ($this->serviceRedirects[$this->serviceRedirectWireKey($this->pendingRedirectService)] ?? null)
+            : null;
         $this->serviceRedirects = [];
         if ($this->isCompose) {
             try {
@@ -290,7 +303,9 @@ class Domains extends Component
                 $serviceEntry = $domains[$serviceName] ?? null;
                 $storedRedirect = is_array($serviceEntry) ? ($serviceEntry['redirect'] ?? null) : null;
                 $this->serviceRedirects[$this->serviceRedirectWireKey($serviceName)] = $this->normalizeRedirect(
-                    is_string($storedRedirect) ? $storedRedirect : null
+                    $this->pendingAction === 'redirect' && $serviceName === $this->pendingRedirectService
+                        ? $pendingRedirect
+                        : (is_string($storedRedirect) ? $storedRedirect : null)
                 );
             }
         }
@@ -500,7 +515,7 @@ class Domains extends Component
     {
         $key = $this->domainDnsStatusKey($url, $service);
         $entry = $stored[$key] ?? null;
-        $port = $this->effectiveDomainInternalPort($url);
+        $port = $this->effectiveDomainInternalPort($url, $service);
 
         $row = [
             'url' => $url,
@@ -532,7 +547,7 @@ class Domains extends Component
     /**
      * @return array{internal_port: ?int, has_port_override: bool}
      */
-    protected function effectiveDomainInternalPort(string $url): array
+    protected function effectiveDomainInternalPort(string $url, ?string $service = null): array
     {
         $canonical = DomainPortOverrides::withoutPort($url);
         $overrides = $this->application->domain_port_overrides ?? [];
@@ -554,6 +569,21 @@ class Domains extends Component
             ];
         }
 
+        $composePort = dockerComposeServicePort($this->application->docker_compose_raw, $service);
+        if ($composePort !== null) {
+            return [
+                'internal_port' => $composePort,
+                'has_port_override' => false,
+            ];
+        }
+
+        if ($this->isCompose && $service !== null) {
+            return [
+                'internal_port' => null,
+                'has_port_override' => false,
+            ];
+        }
+
         if ($this->application->settings?->is_static) {
             return [
                 'internal_port' => 80,
@@ -598,7 +628,7 @@ class Domains extends Component
         return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
     }
 
-    protected function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    protected function shouldConfirmPort(?int $port, ?int $currentPort = null, ?string $serviceName = null): bool
     {
         if ($this->forceUseUnknownPort || $port === null) {
             return false;
@@ -607,7 +637,7 @@ class Domains extends Component
             return false;
         }
 
-        return $this->application->portRequiresConfirmation($port);
+        return $this->application->portRequiresConfirmation($port, $serviceName);
     }
 
     protected function openPortWarning(?int $port, string $action): void
@@ -653,6 +683,11 @@ class Domains extends Component
         $this->authorize('update', $this->application);
     }
 
+    protected function usesInstanceNetworkAddressesForDnsHints(): bool
+    {
+        return $this->application->destination?->server?->id === 0;
+    }
+
     public function checkAllDns(): void
     {
         $this->authorize('update', $this->application);
@@ -953,7 +988,13 @@ class Domains extends Component
             return;
         }
 
+        $this->authorize('update', $this->application);
+        $wasRedirect = $this->pendingAction === 'redirect';
         $this->pendingAction = null;
+        $this->pendingRedirectService = null;
+        if ($wasRedirect) {
+            $this->refreshDomains();
+        }
     }
 
     public function addDomain(): void
@@ -998,7 +1039,7 @@ class Domains extends Component
                 }
             }
 
-            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts), serviceName: $this->newDomainService)) {
                 $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
                 return;
@@ -1395,7 +1436,7 @@ class Domains extends Component
                 return;
             }
 
-            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl), $service)) {
                 $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
 
                 return;
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index 21296978f7..cba3f18b65 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -38,6 +38,7 @@ class PreviewDomains extends Component
 
     public function mount(): void
     {
+        $this->authorize('view', $this->preview->application);
         $this->refreshDomains();
         if ($this->preview->application->build_pack === 'dockercompose') {
             $this->newDomainService = $this->composeServices()[0] ?? null;
@@ -74,7 +75,7 @@ class PreviewDomains extends Component
 
             return;
         }
-        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts), serviceName: $this->newDomainService)) {
             $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
 
             return;
@@ -94,7 +95,7 @@ class PreviewDomains extends Component
             ? ($this->composeServices()[0] ?? null)
             : null;
         $this->forceUseUnknownPort = false;
-        $this->dispatch('close-modal');
+        $this->dispatch('close-preview-domain-add', previewId: $this->preview->id);
 
         try {
             $server = $this->preview->application->destination?->server;
@@ -149,6 +150,7 @@ class PreviewDomains extends Component
 
     public function startEdit(int $index): void
     {
+        $this->authorize('update', $this->preview->application);
         if (! isset($this->domainRows[$index])) {
             return;
         }
@@ -159,7 +161,8 @@ class PreviewDomains extends Component
         if (filled($savedPort)) {
             $this->editingDomainParts['port'] = (string) $savedPort;
         }
-        $this->dispatch('open-preview-domain-edit');
+        $this->resetErrorBag('editingDomainParts.host');
+        $this->dispatch('open-preview-domain-edit', previewId: $this->preview->id);
     }
 
     public function updateDomain(): void
@@ -173,7 +176,7 @@ class PreviewDomains extends Component
             return;
         }
         $oldUrl = $this->domainRows[$this->editingIndex]['url'];
-        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl), $this->domainRows[$this->editingIndex]['service'])) {
             $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
 
             return;
@@ -193,7 +196,7 @@ class PreviewDomains extends Component
             return;
         }
         $this->forceUseUnknownPort = false;
-        $this->dispatch('close-preview-domain-edit');
+        $this->dispatch('close-preview-domain-edit', previewId: $this->preview->id);
         $this->dispatch('success', 'Domain updated.');
         $this->checkDomainDns($index);
     }
@@ -229,6 +232,12 @@ class PreviewDomains extends Component
         if (! isset($this->domainRows[$index])) {
             return;
         }
+        if ($this->editingIndex === $index) {
+            $this->editingIndex = null;
+            $this->dispatch('close-preview-domain-edit', previewId: $this->preview->id);
+        } elseif ($this->editingIndex !== null && $this->editingIndex > $index) {
+            $this->editingIndex--;
+        }
         unset($this->domainRows[$index]);
         $this->domainRows = array_values($this->domainRows);
         if (! $this->persistDomains()) {
@@ -268,6 +277,7 @@ class PreviewDomains extends Component
 
     public function pollDnsChecks(): void
     {
+        $this->authorize('view', $this->preview->application);
         $checkingRows = collect($this->domainRows)
             ->where('dns_status', 'checking')
             ->values();
@@ -321,6 +331,7 @@ class PreviewDomains extends Component
 
     private function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
         $this->preview->refresh();
         $statuses = $this->preview->domain_dns_statuses ?? [];
         $rows = [];
@@ -336,6 +347,11 @@ class PreviewDomains extends Component
             }
         }
         $this->domainRows = $rows;
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && $row['service'] === $editingRow['service']);
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     private function persistDomains(): bool
@@ -349,13 +365,16 @@ class PreviewDomains extends Component
 
                 return false;
             }
-            $domains = collect($composeServices)
-                ->mapWithKeys(fn (string $service): array => [$service => ['domain' => '']])
-                ->all();
+            $existingDomains = json_decode($this->preview->docker_compose_domains ?: '[]', true) ?: [];
+            $domains = [];
+            foreach ($composeServices as $service) {
+                $domains[$service] = is_array($existingDomains[$service] ?? null) ? $existingDomains[$service] : [];
+                $domains[$service]['domain'] = '';
+            }
             $validRows = collect($this->domainRows)
                 ->filter(fn (array $row): bool => in_array($row['service'] ?? null, $composeServices, true));
             foreach ($validRows->groupBy('service') as $service => $rows) {
-                $domains[$service] = ['domain' => $rows->pluck('url')->implode(',')];
+                $domains[$service]['domain'] = $rows->pluck('url')->implode(',');
             }
             $this->preview->docker_compose_domains = json_encode($domains);
             $this->preview->fqdn = $validRows->pluck('url')->implode(',') ?: null;
@@ -439,11 +458,23 @@ class PreviewDomains extends Component
     private function makeRow(string $url, ?string $service, array $statuses = []): array
     {
         $status = $statuses[$this->statusKey($url, $service)] ?? [];
-        $port = $this->effectiveDomainInternalPort($url);
+        $port = $this->effectiveDomainInternalPort($url, $service);
+        $redirect = 'both';
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null) {
+            $usesPreviewRedirect = (int) $this->preview->application->compose_parsing_version >= 3;
+            $domains = json_decode(($usesPreviewRedirect
+                ? $this->preview->docker_compose_domains
+                : $this->preview->application->docker_compose_domains) ?: '[]', true) ?: [];
+            $storedRedirect = $usesPreviewRedirect
+                ? ($domains[$service]['redirect'] ?? null)
+                : data_get($domains, "$service.redirect");
+            $redirect = in_array($storedRedirect, ['www', 'non-www', 'both'], true) ? $storedRedirect : 'both';
+        }
 
         return [
             'url' => $url,
             'service' => $service,
+            'redirect' => $redirect,
             'internal_port' => $port['internal_port'],
             'has_port_override' => $port['has_port_override'],
             'dns_status' => $status['status'] ?? 'pending',
@@ -478,7 +509,7 @@ class PreviewDomains extends Component
         return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
     }
 
-    private function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    private function shouldConfirmPort(?int $port, ?int $currentPort = null, ?string $serviceName = null): bool
     {
         if ($this->forceUseUnknownPort || $port === null) {
             return false;
@@ -487,7 +518,7 @@ class PreviewDomains extends Component
             return false;
         }
 
-        return $this->preview->application->portRequiresConfirmation($port);
+        return $this->preview->application->portRequiresConfirmation($port, $serviceName);
     }
 
     private function openPortWarning(?int $port, string $action): void
@@ -500,7 +531,7 @@ class PreviewDomains extends Component
     /**
      * @return array{internal_port: ?int, has_port_override: bool}
      */
-    private function effectiveDomainInternalPort(string $url): array
+    private function effectiveDomainInternalPort(string $url, ?string $service = null): array
     {
         $canonical = DomainPortOverrides::withoutPort($url);
         $overrides = $this->preview->domain_port_overrides ?? [];
@@ -522,6 +553,21 @@ class PreviewDomains extends Component
             ];
         }
 
+        $composePort = dockerComposeServicePort($this->preview->application->docker_compose_raw, $service);
+        if ($composePort !== null) {
+            return [
+                'internal_port' => $composePort,
+                'has_port_override' => false,
+            ];
+        }
+
+        if ($this->preview->application->build_pack === 'dockercompose' && $service !== null) {
+            return [
+                'internal_port' => null,
+                'has_port_override' => false,
+            ];
+        }
+
         if ($this->preview->application->settings?->is_static) {
             return [
                 'internal_port' => 80,
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index 14d9bcdb8d..46681d5d57 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -19,6 +19,10 @@ class Previews extends Component
 
     public Application $application;
 
+    public bool $isPreviewDeploymentsEnabled = false;
+
+    public bool $isPrDeploymentsPublicEnabled = false;
+
     public string $deployment_uuid;
 
     public array $parameters;
@@ -41,11 +45,29 @@ class Previews extends Component
 
     public function mount()
     {
+        $this->isPreviewDeploymentsEnabled = $this->application->settings->is_preview_deployments_enabled;
+        $this->isPrDeploymentsPublicEnabled = $this->application->settings->is_pr_deployments_public_enabled ?? false;
         $this->pull_requests = collect();
         $this->parameters = get_route_parameters();
         $this->syncDockerTags();
     }
 
+    public function savePreviewSettings(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->validate([
+            'isPreviewDeploymentsEnabled' => 'boolean',
+            'isPrDeploymentsPublicEnabled' => 'boolean',
+        ]);
+
+        $this->application->settings->is_preview_deployments_enabled = $this->isPreviewDeploymentsEnabled;
+        $this->application->settings->is_pr_deployments_public_enabled = $this->isPrDeploymentsPublicEnabled;
+        $this->application->settings->save();
+
+        $this->dispatch('success', 'Settings saved.');
+        $this->dispatch('configurationChanged');
+    }
+
     private function syncDockerTags(): void
     {
         $this->previewDockerTags = [];
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 1d223b6967..d938ebde8d 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -85,6 +85,9 @@ class BackupEdit extends Component
     #[Validate(['required', 'int', 'min:60', 'max:36000'])]
     public int|string $timeout = 3600;
 
+    #[Validate(['required', 'integer', 'min:0', 'max:365'])]
+    public int $missingBackupNotificationDays = 0;
+
     public function getListeners(): array
     {
         // Keep "Backup Now" in sync when the database starts/stops without a full page refresh.
@@ -152,6 +155,7 @@ class BackupEdit extends Component
             $this->backup->databases_to_backup = $this->databasesToBackup;
             $this->backup->dump_all = $this->dumpAll;
             $this->backup->timeout = $this->timeout;
+            $this->backup->missing_backup_notification_days = $this->missingBackupNotificationDays;
             $this->customValidate();
             $this->backup->save();
         } else {
@@ -170,6 +174,7 @@ class BackupEdit extends Component
             $this->databasesToBackup = $this->backup->databases_to_backup;
             $this->dumpAll = $this->backup->dump_all;
             $this->timeout = $this->backup->timeout;
+            $this->missingBackupNotificationDays = $this->backup->missing_backup_notification_days;
         }
     }
 
@@ -245,6 +250,14 @@ class BackupEdit extends Component
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
+            $database = $this->backup->database->refresh();
+            $this->status = $database->status;
+            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+                $this->dispatch('error', 'The database must be running to start a backup.');
+
+                return;
+            }
+
             DatabaseBackupJob::dispatch($this->backup);
             $database = $this->backup->database;
             auditLog('ui.database.backup_started', [
diff --git a/app/Livewire/Project/Database/BackupNow.php b/app/Livewire/Project/Database/BackupNow.php
index e45c797d1e..39a1960119 100644
--- a/app/Livewire/Project/Database/BackupNow.php
+++ b/app/Livewire/Project/Database/BackupNow.php
@@ -17,6 +17,13 @@ class BackupNow extends Component
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
+            $database = $this->backup->database->refresh();
+            if ($database->id !== 0 && ! str($database->status)->startsWith('running')) {
+                $this->dispatch('error', 'The database must be running to start a backup.');
+
+                return;
+            }
+
             DatabaseBackupJob::dispatch($this->backup);
             $database = $this->backup->database;
             auditLog('ui.database.backup_started', [
diff --git a/app/Livewire/Project/Database/CreateScheduledBackup.php b/app/Livewire/Project/Database/CreateScheduledBackup.php
index b4236b215a..96d2ac7aaf 100644
--- a/app/Livewire/Project/Database/CreateScheduledBackup.php
+++ b/app/Livewire/Project/Database/CreateScheduledBackup.php
@@ -85,11 +85,10 @@ class CreateScheduledBackup extends Component
             $databaseBackup = ScheduledDatabaseBackup::create($payload);
             if ($database->getMorphClass() === ServiceDatabase::class) {
                 $service = $database->service;
-                $this->redirectRoute('project.service.database.backup.show', [
+                $this->redirectRoute('project.service.volume-backups.index', [
                     'project_uuid' => $service->project()->uuid,
                     'environment_uuid' => $service->environment->uuid,
                     'service_uuid' => $service->uuid,
-                    'stack_service_uuid' => $database->uuid,
                     'backup_uuid' => $databaseBackup->uuid,
                 ], navigate: true);
             } else {
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
index 87f24fb1da..6d7fb97f68 100644
--- a/app/Livewire/Project/Service/BackupExecutions.php
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -9,16 +9,21 @@ use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
+use Illuminate\Database\Query\Builder;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class BackupExecutions extends Component
 {
     use AuthorizesRequests;
+    use WithPagination;
 
     public Service $service;
 
+    public int $perPage = 10;
+
     public bool $executionModalOpen = false;
 
     public ?array $selectedExecution = null;
@@ -40,10 +45,18 @@ class BackupExecutions extends Component
         $this->authorize('view', $this->service);
     }
 
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+        $this->resetPage('executionsPage');
+    }
+
     public function openExecution(string $executionUuid): void
     {
-        $this->selectedExecution = $this->executions()->firstWhere('uuid', $executionUuid);
-        abort_unless($this->selectedExecution, 404);
+        $this->authorize('view', $this->service);
+        $execution = $this->executionQuery($executionUuid)->first();
+        abort_unless($execution, 404);
+        $this->selectedExecution = $this->formatExecutions(collect([$execution]))->first();
         $this->executionModalOpen = true;
     }
 
@@ -55,70 +68,89 @@ class BackupExecutions extends Component
 
     public function render(): View
     {
+        $this->authorize('view', $this->service);
+        $executions = $this->executionQuery()->paginate($this->perPage, pageName: 'executionsPage');
+        if ($executions->currentPage() > $executions->lastPage()) {
+            $this->setPage($executions->lastPage(), 'executionsPage');
+            $executions = $this->executionQuery()->paginate($this->perPage, pageName: 'executionsPage');
+        }
+        $executions->setCollection($this->formatExecutions($executions->getCollection()));
+
         return view('livewire.project.service.backup-executions', [
-            'executions' => $this->executions(),
+            'executions' => $executions,
         ]);
     }
 
-    private function executions(): Collection
+    private function executionQuery(?string $uuid = null): Builder
     {
         $databaseScheduleIds = ScheduledDatabaseBackup::query()
             ->where('database_type', (new ServiceDatabase)->getMorphClass())
             ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
-            ->pluck('id');
+            ->select('id');
+        $volumeScheduleIds = ScheduledVolumeBackup::query()
+            ->forService($this->service)
+            ->select('id');
 
         $databaseExecutions = ScheduledDatabaseBackupExecution::query()
-            ->with('scheduledDatabaseBackup.database')
+            ->select('id', 'uuid', 'created_at')
+            ->selectRaw("'database' as type")
             ->whereIn('scheduled_database_backup_id', $databaseScheduleIds)
-            ->latest()
-            ->limit(100)
-            ->get()
-            ->map(fn (ScheduledDatabaseBackupExecution $execution): array => [
-                'id' => 'database:'.$execution->id,
+            ->when($uuid !== null, fn ($query) => $query->where('uuid', $uuid));
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->select('id', 'uuid', 'created_at')
+            ->selectRaw("'storage' as type")
+            ->whereIn('scheduled_volume_backup_id', $volumeScheduleIds)
+            ->when($uuid !== null, fn ($query) => $query->where('uuid', $uuid));
+
+        return $databaseExecutions->toBase()
+            ->unionAll($volumeExecutions->toBase())
+            ->orderByDesc('created_at')
+            ->orderByDesc('id')
+            ->orderBy('type');
+    }
+
+    private function formatExecutions(Collection $rows): Collection
+    {
+        $databaseExecutions = ScheduledDatabaseBackupExecution::query()
+            ->with(['scheduledDatabaseBackup.database', 'scheduledDatabaseBackup.s3'])
+            ->whereIn('id', $rows->where('type', 'database')->pluck('id'))
+            ->get()->keyBy('id');
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->with(['scheduledVolumeBackup.backupable.resource', 's3'])
+            ->whereIn('id', $rows->where('type', 'storage')->pluck('id'))
+            ->get()->keyBy('id');
+
+        return $rows->map(function (object $row) use ($databaseExecutions, $volumeExecutions): array {
+            $isDatabase = $row->type === 'database';
+            $execution = $isDatabase ? $databaseExecutions->get($row->id) : $volumeExecutions->get($row->id);
+            $schedule = $isDatabase ? $execution->scheduledDatabaseBackup : $execution->scheduledVolumeBackup;
+            $storage = $isDatabase ? ($schedule->save_s3 ? $schedule->s3 : null) : $execution->s3;
+            if ($storage?->team_id !== currentTeam()->id) {
+                $storage = null;
+            }
+            $storageLabel = $storage ? $storage->name.' (bucket: '.$storage->bucket.')' : 'Unavailable';
+            if ($isDatabase && ! $schedule->save_s3) {
+                $storageLabel = 'Not configured';
+            } elseif (! $isDatabase && ! $execution->s3_storage_id && ! $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
+                $storageLabel = 'No destination recorded';
+            }
+
+            return [
+                'id' => $row->type.':'.$execution->id,
                 'uuid' => $execution->uuid,
-                'target' => $execution->scheduledDatabaseBackup->database->human_name ?: $execution->scheduledDatabaseBackup->database->name,
-                'type' => 'Database',
-                'schedule' => $execution->scheduledDatabaseBackup->frequency,
+                'target' => $isDatabase ? ($schedule->database->human_name ?: $schedule->database->name) : $schedule->targetName(),
+                'type' => $isDatabase ? 'Database' : $schedule->targetType(),
+                'schedule' => $schedule->frequency,
+                's3_tooltip' => ($isDatabase ? 'Current schedule S3 storage: ' : 'S3 storage: ').$storageLabel,
                 'status' => $execution->status,
                 'started_at' => $execution->created_at,
                 'size' => $execution->size,
                 'message' => $execution->message,
                 'filename' => $execution->filename,
                 'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
-                    ? route('download.backup', $execution->id)
+                    ? route($isDatabase ? 'download.backup' : 'download.volume-backup', $execution->id)
                     : null,
-            ]);
-
-        $volumeSchedules = ScheduledVolumeBackup::query()
-            ->with('backupable.resource')
-            ->forService($this->service)
-            ->get()
-            ->keyBy('id');
-        $volumeExecutions = ScheduledVolumeBackupExecution::query()
-            ->whereIn('scheduled_volume_backup_id', $volumeSchedules->keys())
-            ->latest()
-            ->limit(100)
-            ->get()
-            ->map(function (ScheduledVolumeBackupExecution $execution) use ($volumeSchedules): array {
-                $schedule = $volumeSchedules->get($execution->scheduled_volume_backup_id);
-
-                return [
-                    'id' => 'storage:'.$execution->id,
-                    'uuid' => $execution->uuid,
-                    'target' => $schedule->targetName(),
-                    'type' => $schedule->targetType(),
-                    'schedule' => $schedule->frequency,
-                    'status' => $execution->status,
-                    'started_at' => $execution->created_at,
-                    'size' => $execution->size,
-                    'message' => $execution->message,
-                    'filename' => $execution->filename,
-                    'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
-                        ? route('download.volume-backup', $execution->id)
-                        : null,
-                ];
-            });
-
-        return $databaseExecutions->concat($volumeExecutions)->sortByDesc('started_at')->values();
+            ];
+        });
     }
 }
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index d5254e093a..b4f76d12d9 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -129,9 +129,17 @@ class Domains extends Component
 
     public function refreshDomains(): void
     {
+        $editingRow = $this->editingIndex !== null ? ($this->domainRows[$this->editingIndex] ?? null) : null;
+
         $this->service->refresh();
         $this->service->load(['applications', 'server']);
         $this->loadDomainState();
+
+        if ($editingRow !== null) {
+            $index = collect($this->domainRows)->search(fn (array $row): bool => $row['url'] === $editingRow['url']
+                && (int) $row['service_application_id'] === (int) $editingRow['service_application_id']);
+            $this->editingIndex = $index === false ? null : (int) $index;
+        }
     }
 
     public function pollDnsChecks(): void
@@ -239,9 +247,14 @@ class Domains extends Component
             ])
             ->all();
 
+        $pendingRedirect = $this->serviceRedirects[$this->pendingRedirectServiceApplicationId] ?? null;
         $this->serviceRedirects = [];
         foreach ($this->service->applications as $app) {
-            $this->serviceRedirects[$app->id] = $this->normalizeRedirect($app->redirect ?? null);
+            $this->serviceRedirects[$app->id] = $this->normalizeRedirect(
+                $this->pendingAction === 'redirect' && $app->id === $this->pendingRedirectServiceApplicationId
+                    ? $pendingRedirect
+                    : $app->redirect
+            );
         }
 
         if ($this->newServiceApplicationId === null && count($this->serviceApps) > 0) {
@@ -459,6 +472,11 @@ class Domains extends Component
         $this->authorize('update', $this->service);
     }
 
+    protected function usesInstanceNetworkAddressesForDnsHints(): bool
+    {
+        return $this->service->server?->id === 0;
+    }
+
     public function checkAllDns(): void
     {
         $this->authorize('update', $this->service);
@@ -919,6 +937,7 @@ class Domains extends Component
         }
 
         $toAdd = collect();
+        $portOverrides = $app->domain_port_overrides ?? [];
         foreach ($current as $url) {
             $counterpart = $this->wwwCounterpartUrl($url, forRedirectPairing: true);
             if ($counterpart === null) {
@@ -935,6 +954,11 @@ class Domains extends Component
                 continue;
             }
 
+            $port = $this->effectiveDomainInternalPort($url, $app);
+            if ($port['has_port_override']) {
+                $portOverrides[DomainPortOverrides::withoutPort($counterpart)] = $port['internal_port'];
+            }
+
             $knownHosts[$hostKey] = true;
             $toAdd->push($counterpart);
         }
@@ -943,12 +967,13 @@ class Domains extends Component
             return true;
         }
 
+        $app->domain_port_overrides = $portOverrides ?: null;
         $merged = $current->merge($toAdd)->unique()->values();
         $this->pendingAction = 'redirect';
         $this->pendingRedirectServiceApplicationId = $app->id;
 
-        // Skip DNS: pairing for redirects must still be configured even when DNS is not ready.
-        if (! $this->saveDomainListForApp($app, $merged)) {
+        // Counterparts inherit an existing port, so only domain conflicts need confirmation.
+        if (! $this->saveDomainListForApp($app, $merged, checkPorts: false)) {
             return false;
         }
 
@@ -975,11 +1000,24 @@ class Domains extends Component
             return;
         }
 
+        if ($this->pendingAction === 'redirect' && $this->pendingRedirectServiceApplicationId) {
+            $this->setServiceRedirect($this->pendingRedirectServiceApplicationId);
+
+            return;
+        }
+
         $this->addDomain();
     }
 
     public function cancelRemovePort(): void
     {
+        $this->authorize('update', $this->service);
+
+        if ($this->pendingAction === 'redirect' && $this->pendingRedirectServiceApplicationId) {
+            $app = $this->findServiceApp($this->pendingRedirectServiceApplicationId);
+            $this->serviceRedirects[$this->pendingRedirectServiceApplicationId] = $this->normalizeRedirect($app?->redirect);
+        }
+        $this->pendingRedirectServiceApplicationId = null;
         $this->showPortWarningModal = false;
         $this->forceSaveDomains = false;
         $this->forceRemovePort = false;
@@ -1416,6 +1454,7 @@ class Domains extends Component
         ServiceApplication $app,
         Collection $domains,
         bool $checkConflicts = true,
+        bool $checkPorts = true,
     ): bool {
         $domainString = $domains->filter()->unique()->implode(',');
         $domainString = $domainString === '' ? null : ValidationPatterns::normalizeApplicationDomains($domainString);
@@ -1442,7 +1481,7 @@ class Domains extends Component
             }
         }
 
-        if (! $this->forceRemovePort) {
+        if ($checkPorts && ! $this->forceRemovePort) {
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null && $domainString) {
                 $previousFqdn = $app->getOriginal('fqdn');
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index d6ab2ac151..cd209f6ae9 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -308,10 +308,10 @@ class FileStorage extends Component
     {
         return view('livewire.project.service.file-storage', [
             'directoryDeletionCheckboxes' => [
-                ['id' => 'permanently_delete', 'label' => 'The selected directory and all its contents will be permantely deleted form the server.'],
+                ['id' => 'permanently_delete', 'label' => 'The selected directory and all its contents will be permanently deleted from the server.'],
             ],
             'fileDeletionCheckboxes' => [
-                ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted form the server.'],
+                ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted from the server.'],
             ],
             'hostFileDeletionCheckboxes' => [
                 ['id' => 'permanently_delete', 'label' => 'Only the mount configuration will be removed. The host file will not be deleted.'],
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index 7980e07056..3b8ca7af19 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -307,36 +307,48 @@ class Index extends Component
 
     public function instantSave()
     {
+        $this->authorize('update', $this->serviceDatabase);
         try {
-            $this->authorize('update', $this->serviceDatabase);
-            if ($this->isPublic && ! $this->publicPort) {
-                $this->dispatch('error', 'Public port is required.');
-                $this->isPublic = false;
-
-                return;
-            }
-            $this->syncDatabaseData(true);
-            if ($this->serviceDatabase->is_public) {
-                if (! str($this->serviceDatabase->status)->startsWith('running')) {
-                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+            if ($this->isPublic) {
+                if (! $this->publicPort) {
+                    $this->dispatch('error', 'Public port is required.');
                     $this->isPublic = false;
-                    $this->serviceDatabase->is_public = false;
 
                     return;
                 }
+                if (! str($this->serviceDatabase->status)->startsWith('running')) {
+                    $this->dispatch('error', 'Database must be started to be publicly accessible.');
+                    $this->isPublic = false;
+
+                    return;
+                }
+                $this->persistPublicAccess();
                 StartDatabaseProxy::run($this->serviceDatabase);
                 $this->db_url_public = $this->serviceDatabase->getServiceDatabaseUrl();
                 $this->dispatch('success', 'Database is now publicly accessible.');
             } else {
+                $this->persistPublicAccess();
                 StopDatabaseProxy::run($this->serviceDatabase);
                 $this->db_url_public = null;
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
         } catch (\Throwable $e) {
+            $this->isPublic = ! $this->isPublic;
+            $this->persistPublicAccess();
+
             return handleError($e, $this);
         }
     }
 
+    private function persistPublicAccess(): void
+    {
+        $this->serviceDatabase->update([
+            'is_public' => $this->isPublic,
+            'public_port' => $this->publicPort ?: null,
+            'public_port_timeout' => $this->publicPortTimeout ?: null,
+        ]);
+    }
+
     public function submitDatabase()
     {
         try {
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index e856d1373a..600b8b9047 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -11,6 +11,7 @@ use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Url;
 use Livewire\Component;
 
 class Index extends Component
@@ -23,6 +24,9 @@ class Index extends Component
 
     public string $search = '';
 
+    #[Url(as: 'backup_uuid', except: '')]
+    public string $backupUuid = '';
+
     public bool $scheduleModalOpen = false;
 
     public ?ScheduledDatabaseBackup $selectedDatabaseBackup = null;
@@ -38,6 +42,7 @@ class Index extends Component
         return [
             'refreshVolumeBackups' => '$refresh',
             'modalClosed' => 'closeScheduleModal',
+            "echo-private:team.{$teamId},ServiceChecked" => '$refresh',
             "echo-private:team.{$teamId},BackupCreated" => '$refresh',
         ];
     }
@@ -49,10 +54,14 @@ class Index extends Component
         $this->parameters = get_route_parameters();
         $this->search = request()->string('search')->toString();
 
+        if ($this->backupUuid !== '') {
+            $this->openSchedule($this->backupUuid);
+        }
     }
 
     public function openSchedule(string $backupUuid): void
     {
+        $this->authorize('update', $this->service);
         $this->loadSelectedSchedule($backupUuid);
         $this->s3s = currentTeam()->s3s;
         $this->scheduleModalOpen = true;
@@ -60,6 +69,7 @@ class Index extends Component
 
     public function closeScheduleModal(): void
     {
+        $this->backupUuid = '';
         $this->scheduleModalOpen = false;
         $this->selectedDatabaseBackup = null;
         $this->selectedVolumeBackup = null;
@@ -72,6 +82,12 @@ class Index extends Component
                 $this->loadSelectedSchedule($backupUuid);
                 abort_unless($this->selectedDatabaseBackup, 404);
                 $this->authorize('manageBackups', $this->selectedDatabaseBackup->database);
+                if (! str($this->selectedDatabaseBackup->database->status)->startsWith('running')) {
+                    $this->selectedDatabaseBackup = null;
+                    $this->dispatch('error', 'The database must be running to start a backup.');
+
+                    return;
+                }
                 DatabaseBackupJob::dispatch($this->selectedDatabaseBackup);
             } else {
                 abort_unless($type === 'storage', 404);
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index ea8394c1b1..47080cd86b 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -818,19 +818,21 @@ class All extends Component
     {
         $isMember = auth()->user()?->isMember();
 
-        return $variables->map(function ($item) use ($isMember) {
-            if ($isMember) {
-                return "$item->key=(Hidden, only admins can view)";
-            }
-            if ($item->is_shown_once) {
-                return "$item->key=(Locked Secret, delete and add again to change)";
-            }
-            if ($item->is_multiline) {
-                return "$item->key=(Multiline environment variable, edit in normal view)";
-            }
+        return $variables
+            ->reject(fn ($item): bool => $this->isProtectedEnvironmentVariable($item->key))
+            ->map(function ($item) use ($isMember) {
+                if ($isMember) {
+                    return "$item->key=(Hidden, only admins can view)";
+                }
+                if ($item->is_shown_once) {
+                    return "$item->key=(Locked Secret, delete and add again to change)";
+                }
+                if ($item->is_multiline) {
+                    return "$item->key=(Multiline environment variable, edit in normal view)";
+                }
 
-            return "$item->key=$item->value";
-        })->join("\n");
+                return "$item->key=$item->value";
+            })->join("\n");
     }
 
     public function switch()
@@ -908,8 +910,7 @@ class All extends Component
         $deletedCount = $this->deleteRemovedVariables(false, $variables);
         if ($deletedCount > 0) {
             $changesMade = true;
-        } elseif ($deletedCount === 0 && $this->resource->environment_variables()->whereNotIn('key', array_keys($variables))->exists()) {
-            // If we tried to delete but couldn't (due to Docker Compose), mark as error
+        } elseif ($deletedCount < 0) {
             $errorOccurred = true;
         }
 
@@ -926,8 +927,7 @@ class All extends Component
             $deletedPreviewCount = $this->deleteRemovedVariables(true, $previewVariables);
             if ($deletedPreviewCount > 0) {
                 $changesMade = true;
-            } elseif ($deletedPreviewCount === 0 && $this->resource->environment_variables_preview()->whereNotIn('key', array_keys($previewVariables))->exists()) {
-                // If we tried to delete but couldn't (due to Docker Compose), mark as error
+            } elseif ($deletedPreviewCount < 0) {
                 $errorOccurred = true;
             }
 
@@ -988,6 +988,12 @@ class All extends Component
         // Get all environment variables that will be deleted
         $variablesToDelete = $this->resource->$method()->whereNotIn('key', array_keys($variables))->get();
 
+        // Generated Compose variables are managed by Coolify and must survive a bulk
+        // replacement even when they are omitted from the pasted environment file.
+        $variablesToDelete = $variablesToDelete->reject(
+            fn (EnvironmentVariable $environmentVariable): bool => $this->isProtectedEnvironmentVariable($environmentVariable->key)
+        );
+
         // If there are no variables to delete, return 0
         if ($variablesToDelete->isEmpty()) {
             return 0;
@@ -1001,13 +1007,13 @@ class All extends Component
                 if ($isUsed) {
                     $this->dispatch('error', "Cannot delete environment variable '{$envVar->key}' <br><br>Please remove it from the Docker Compose file first.");
 
-                    return 0;
+                    return -1;
                 }
             }
         }
 
         // If we get here, no variables are used in Docker Compose, so we can delete them
-        $this->resource->$method()->whereNotIn('key', array_keys($variables))->delete();
+        $this->resource->$method()->whereKey($variablesToDelete->modelKeys())->delete();
 
         return $variablesToDelete->count();
     }
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index f170a0a6f0..717007bc04 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -102,7 +102,7 @@ class Add extends Component
         }
     }
 
-    private function saveScheduledTask(): mixed
+    private function saveScheduledTask(): void
     {
         try {
             $task = new ScheduledTask;
@@ -128,7 +128,7 @@ class Add extends Component
             $this->dispatch('refreshTasks');
             $this->dispatch('success', 'Scheduled task added.');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index ef7b36ff72..86023628e2 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -147,7 +147,11 @@ class VolumeBackups extends Component
         }
 
         $this->resetErrorBag('s3StorageId');
-        $this->backup?->update(['s3_storage_id' => $this->s3StorageId]);
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
         $this->dispatch('success', 'S3 storage updated.');
     }
 
@@ -163,11 +167,11 @@ class VolumeBackups extends Component
 
         $this->saveToS3 = ! $this->saveToS3;
         $this->disableLocalBackup = $this->saveToS3 && $this->disableLocalBackup;
-        $this->backup?->update([
-            'save_s3' => $this->saveToS3,
-            'disable_local_backup' => $this->disableLocalBackup,
-            's3_storage_id' => $this->s3StorageId,
-        ]);
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
         $this->dispatch('success', $this->saveToS3 ? 'S3 backups enabled.' : 'S3 backups disabled.');
     }
 
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 68cb52a926..296fd4da5d 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -106,6 +106,8 @@ class Proxy extends Component
         try {
             $this->authorize('update', $this->server);
             $this->server->proxy = null;
+            $this->server->detected_traefik_version = null;
+            $this->server->traefik_outdated_info = null;
             $this->server->save();
 
             $this->dispatch('reloadWindow');
diff --git a/app/Livewire/Server/Resources.php b/app/Livewire/Server/Resources.php
index 9ea87161d8..5d0d2538bd 100644
--- a/app/Livewire/Server/Resources.php
+++ b/app/Livewire/Server/Resources.php
@@ -5,11 +5,29 @@ namespace App\Livewire\Server;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Livewire\Component;
+use Livewire\WithPagination;
 
 class Resources extends Component
 {
     use AuthorizesRequests;
+    use WithPagination;
+
+    public int $perPage = 10;
+
+    public string $search = '';
+
+    public function updatedSearch(): void
+    {
+        $this->resetPage();
+    }
+
+    public function updatedPerPage(): void
+    {
+        $this->perPage = max(1, min(100, $this->perPage));
+        $this->resetPage();
+    }
 
     public ?Server $server = null;
 
@@ -93,6 +111,10 @@ class Resources extends Component
     public function loadManagedContainers()
     {
         try {
+            if ($this->activeTab !== 'managed') {
+                $this->search = '';
+                $this->resetPage();
+            }
             $this->activeTab = 'managed';
             $this->server->refresh();
         } catch (\Throwable $e) {
@@ -102,6 +124,10 @@ class Resources extends Component
 
     public function loadUnmanagedContainers()
     {
+        if ($this->activeTab !== 'unmanaged') {
+            $this->search = '';
+            $this->resetPage();
+        }
         $this->activeTab = 'unmanaged';
         try {
             $this->unmanagedContainers = $this->server->loadUnmanagedContainers()->toArray();
@@ -125,6 +151,29 @@ class Resources extends Component
 
     public function render()
     {
-        return view('livewire.server.resources');
+        $resources = $this->activeTab === 'managed'
+            ? $this->server->definedResources()->sortBy('name', SORT_NATURAL)
+            : collect($this->unmanagedContainers)->sortBy('Names', SORT_NATURAL);
+        $search = trim($this->search);
+        if ($search !== '') {
+            $nameKey = $this->activeTab === 'managed' ? 'name' : 'Names';
+            $resources = $resources->filter(fn ($resource) => str((string) data_get($resource, $nameKey))
+                ->contains($search, ignoreCase: true));
+        }
+        $this->perPage = max(1, min(100, $this->perPage));
+        $lastPage = max(1, (int) ceil($resources->count() / $this->perPage));
+        $page = max(1, min((int) $this->getPage(), $lastPage));
+        if ($page !== $this->getPage()) {
+            $this->setPage($page);
+        }
+
+        return view('livewire.server.resources', [
+            'resources' => new LengthAwarePaginator(
+                $resources->forPage($page, $this->perPage)->values(),
+                $resources->count(),
+                $this->perPage,
+                $page,
+            ),
+        ]);
     }
 }
diff --git a/app/Livewire/Server/Sentinel/Logs.php b/app/Livewire/Server/Sentinel/Logs.php
index 1190cd59a1..49739ac6dd 100644
--- a/app/Livewire/Server/Sentinel/Logs.php
+++ b/app/Livewire/Server/Sentinel/Logs.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Server\Sentinel;
 
+use App\Actions\Server\StartSentinel;
 use App\Models\Server;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\View\View;
@@ -29,6 +30,35 @@ class Logs extends Component
         $this->authorize('viewSentinel', $this->server);
     }
 
+    public function enableSentinel(): void
+    {
+        $this->authorize('manageSentinel', $this->server);
+
+        try {
+            $this->server->refresh();
+            if ($this->server->isBuildServer()) {
+                $this->dispatch('error', 'Sentinel cannot be enabled on build servers.');
+
+                return;
+            }
+            if ($this->server->isSwarm()) {
+                $this->dispatch('error', 'Sentinel cannot be enabled on Swarm servers.');
+
+                return;
+            }
+            if ($this->server->isSentinelEnabled()) {
+                return;
+            }
+
+            StartSentinel::run($this->server, true);
+            $this->server->refresh();
+            $this->dispatch('refreshServerShow');
+            $this->dispatch('success', 'Sentinel has been enabled.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function render(): View
     {
         return view('livewire.server.sentinel.logs');
diff --git a/app/Livewire/Settings/Advanced.php b/app/Livewire/Settings/Advanced.php
index 38a2f85a73..4bb89c9f08 100644
--- a/app/Livewire/Settings/Advanced.php
+++ b/app/Livewire/Settings/Advanced.php
@@ -56,6 +56,8 @@ class Advanced extends Component
 
     public string $avatar_storage = 'local';
 
+    public ?string $image_cdn_url = null;
+
     public array $avatar_storage_options = [];
 
     public function rules()
@@ -75,6 +77,7 @@ class Advanced extends Component
             'webhook_allowed_internal_hosts' => 'nullable|string',
             'webhook_allow_localhost' => 'boolean',
             'domain_connect_private_key' => 'nullable|string',
+            'image_cdn_url' => 'nullable|url|max:255',
         ];
     }
 
@@ -102,6 +105,7 @@ class Advanced extends Component
         $this->avatar_storage = $this->settings->avatar_storage_type === 's3' && $this->settings->avatar_s3_storage_id
             ? 's3:'.$this->settings->avatar_s3_storage_id
             : 'local';
+        $this->image_cdn_url = $this->settings->image_cdn_url;
         $this->avatar_storage_options = [
             ['value' => 'local', 'label' => 'Local storage'],
             ...S3Storage::query()
@@ -216,6 +220,7 @@ class Advanced extends Component
             $this->settings->is_mcp_server_enabled = $this->is_mcp_server_enabled;
             $this->settings->webhook_allowed_internal_hosts = $webhookAllowedInternalHosts ?? $this->settings->webhook_allowed_internal_hosts ?? [];
             $this->settings->webhook_allow_localhost = $this->webhook_allow_localhost;
+            $this->settings->image_cdn_url = filled($this->image_cdn_url) ? rtrim($this->image_cdn_url, '/') : null;
             $this->saveAvatarStorageSetting();
             $this->settings->save();
             $this->dispatch('success', 'Settings updated!');
diff --git a/app/Livewire/Subscription/Index.php b/app/Livewire/Subscription/Index.php
index 022f6fdeed..31f2e9141d 100644
--- a/app/Livewire/Subscription/Index.php
+++ b/app/Livewire/Subscription/Index.php
@@ -2,8 +2,11 @@
 
 namespace App\Livewire\Subscription;
 
+use App\Actions\Stripe\UpdateSubscriptionQuantity;
+use App\Jobs\ServerLimitCheckJob;
 use App\Models\InstanceSettings;
 use App\Providers\RouteServiceProvider;
+use Illuminate\Support\Facades\Cache;
 use Livewire\Component;
 use Stripe\StripeClient;
 
@@ -49,12 +52,19 @@ class Index extends Component
         return redirect($session->url);
     }
 
-    public function getStripeStatus()
+    public function getStripeStatus(): mixed
     {
+        $team = currentTeam();
+        $user = auth()->user();
+        abort_unless($team && $user?->isAdminOfTeam($team->id), 403);
+
         try {
-            $subscription = currentTeam()->subscription;
+            $subscription = $team->subscription()->first();
+            if (! $subscription?->stripe_customer_id) {
+                return null;
+            }
             $stripe = app(StripeClient::class);
-            $customer = $stripe->customers->retrieve(currentTeam()->subscription->stripe_customer_id);
+            $customer = $stripe->customers->retrieve($subscription->stripe_customer_id);
             if ($customer) {
                 $subscriptions = $stripe->subscriptions->all(['customer' => $customer->id]);
                 $currentTeam = currentTeam()->id ?? null;
@@ -65,6 +75,26 @@ class Index extends Component
                         $subscription->update([
                             'stripe_subscription_id' => $foundSubscription->id,
                         ]);
+                        if ($status === 'active') {
+                            $subscription->update([
+                                'stripe_invoice_paid' => true,
+                                'stripe_past_due' => false,
+                                'stripe_plan_id' => data_get($foundSubscription, 'items.data.0.price.id'),
+                                'stripe_cancel_at_period_end' => data_get($foundSubscription, 'cancel_at_period_end', false),
+                            ]);
+                            if (str(data_get($foundSubscription, 'items.data.0.price.lookup_key'))->contains('dynamic')) {
+                                $quantity = max(
+                                    UpdateSubscriptionQuantity::MIN_SERVER_LIMIT,
+                                    min((int) data_get($foundSubscription, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT)
+                                );
+                                $team->update(['custom_server_limit' => $quantity]);
+                                ServerLimitCheckJob::dispatch($team);
+                            }
+                            $team->unsetRelation('subscription');
+                            Cache::forget('user:'.$user->id.':team:'.$team->id);
+
+                            return redirect()->route('subscription.show');
+                        }
                         if ($status === 'unpaid') {
                             $this->isUnpaid = true;
                         }
@@ -82,6 +112,8 @@ class Index extends Component
         } finally {
             $this->loading = false;
         }
+
+        return null;
     }
 
     public function render()
diff --git a/app/Livewire/Subscription/PricingPlans.php b/app/Livewire/Subscription/PricingPlans.php
index 65966aea5f..e53c5c677b 100644
--- a/app/Livewire/Subscription/PricingPlans.php
+++ b/app/Livewire/Subscription/PricingPlans.php
@@ -2,22 +2,28 @@
 
 namespace App\Livewire\Subscription;
 
-use Illuminate\Support\Facades\Auth;
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
 use Livewire\Component;
-use Stripe\Checkout\Session;
-use Stripe\Stripe;
+use RuntimeException;
+use Stripe\Exception\ApiErrorException;
 
 class PricingPlans extends Component
 {
-    public function subscribeStripe($type)
+    public function subscribeStripe(string $type): mixed
     {
-        if (currentTeam()->subscription?->stripe_invoice_paid) {
-            $this->dispatch('error', 'Team already has an active subscription.');
+        $team = currentTeam();
+        $user = auth()->user();
 
-            return;
+        if (! $team || ! $user?->isAdminOfTeam($team->id)) {
+            abort(403);
         }
 
-        Stripe::setApiKey(config('subscription.stripe_api_key'));
+        if ($team->subscription?->stripe_invoice_paid) {
+            $this->dispatch('error', 'Team already has an active subscription.');
+
+            return null;
+        }
 
         $priceId = match ($type) {
             'dynamic-monthly' => config('subscription.stripe_price_id_dynamic_monthly'),
@@ -28,48 +34,29 @@ class PricingPlans extends Component
         if (! $priceId) {
             $this->dispatch('error', 'Price ID not found! Please contact the administrator.');
 
-            return;
+            return null;
         }
-        $payload = [
-            'allow_promotion_codes' => true,
-            'billing_address_collection' => 'required',
-            'client_reference_id' => Auth::id().':'.currentTeam()->id,
-            'line_items' => [[
-                'price' => $priceId,
-                'adjustable_quantity' => [
-                    'enabled' => true,
-                    'minimum' => 2,
-                ],
-                'quantity' => 2,
-            ]],
-            'tax_id_collection' => [
-                'enabled' => true,
-            ],
-            'automatic_tax' => [
-                'enabled' => true,
-            ],
-            'subscription_data' => [
-                'metadata' => [
-                    'user_id' => Auth::id(),
-                    'team_id' => currentTeam()->id,
-                ],
-            ],
-            'payment_method_collection' => 'if_required',
-            'mode' => 'subscription',
-            'success_url' => route('dashboard', ['success' => true]),
-            'cancel_url' => route('subscription.index', ['cancelled' => true]),
-        ];
+        try {
+            $session = app(CreateCheckoutSession::class)->execute($team, $user, $priceId);
+        } catch (ApiErrorException $exception) {
+            report($exception);
+            $this->dispatch('error', 'Unable to confirm checkout with Stripe. Please try again shortly.');
 
-        $customer = currentTeam()->subscription?->stripe_customer_id ?? null;
-        if ($customer) {
-            $payload['customer'] = $customer;
-            $payload['customer_update'] = [
-                'name' => 'auto',
-            ];
-        } else {
-            $payload['customer_email'] = Auth::user()->email;
+            return null;
+        } catch (CheckoutUnavailableException $exception) {
+            $message = $exception->getMessage();
+            if ($exception->billingPortalUrl) {
+                $message .= ' <a href="'.e($exception->billingPortalUrl).'" target="_blank" rel="noopener noreferrer" class="underline">Open billing portal</a>';
+            }
+            $this->dispatch('error', $message);
+
+            return null;
+        } catch (RuntimeException $exception) {
+            report($exception);
+            $this->dispatch('error', 'Unable to start checkout. Please try again shortly.');
+
+            return null;
         }
-        $session = Session::create($payload);
 
         return redirect($session->url, 303);
     }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index e7c2c1d90e..6737e57986 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Enums\ApplicationDeploymentStatus;
+use App\Enums\BuildPackTypes;
 use App\Services\ConfigurationGenerator;
 use App\Services\DeploymentConfiguration\ApplicationConfigurationSnapshot;
 use App\Services\DeploymentConfiguration\ConfigurationDiff;
@@ -292,9 +293,11 @@ class Application extends BaseModel
                 if ($application->fqdn === '') {
                     $application->fqdn = null;
                 }
-                $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
-                $application->fqdn = $normalized['fqdn'];
-                $application->domain_port_overrides = $normalized['overrides'];
+                if ($application->build_pack !== BuildPackTypes::DOCKERCOMPOSE->value || filled($application->fqdn)) {
+                    $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
+                    $application->fqdn = $normalized['fqdn'];
+                    $application->domain_port_overrides = $normalized['overrides'];
+                }
                 $payload['fqdn'] = $application->fqdn;
                 $application->syncNoindexDomains();
             }
@@ -623,32 +626,6 @@ class Application extends BaseModel
             && $this->restart_limit_reached === true;
     }
 
-    public function taskLink($task_uuid)
-    {
-        if (data_get($this, 'environment.project.uuid')) {
-            $route = route('project.application.scheduled-tasks', [
-                'project_uuid' => data_get($this, 'environment.project.uuid'),
-                'environment_uuid' => data_get($this, 'environment.uuid'),
-                'application_uuid' => data_get($this, 'uuid'),
-                'task_uuid' => $task_uuid,
-            ]);
-            $settings = instanceSettings();
-            if (data_get($settings, 'fqdn')) {
-                $url = Url::fromString($route);
-                $url = $url->withPort(null);
-                $fqdn = data_get($settings, 'fqdn');
-                $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                $url = $url->withHost($fqdn);
-
-                return $url->__toString();
-            }
-
-            return $route;
-        }
-
-        return null;
-    }
-
     public function settings()
     {
         return $this->hasOne(ApplicationSetting::class);
@@ -742,7 +719,7 @@ class Application extends BaseModel
         );
     }
 
-    public function gitCommitLink($link): string
+    public function gitCommitLink($link): ?string
     {
         if (! is_null(data_get($this, 'source.html_url')) && ! is_null(data_get($this, 'git_repository')) && ! is_null(data_get($this, 'git_branch'))) {
             if (str($this->source->html_url)->contains('bitbucket')) {
@@ -759,6 +736,10 @@ class Application extends BaseModel
             $git_repository = 'https://'.parse_url($git_repository, PHP_URL_HOST).parse_url($git_repository, PHP_URL_PATH);
         }
 
+        if (! filter_var($git_repository, FILTER_VALIDATE_URL)) {
+            return null;
+        }
+
         $url = Url::fromString(Str::replaceEnd('.git', '', $git_repository));
         $url = $url->withUserInfo('');
         $commitPath = str($git_repository)->contains('bitbucket') ? 'commits' : 'commit';
@@ -985,12 +966,16 @@ class Application extends BaseModel
     }
 
     /**
-     * Ports the container is expected to listen on: Ports Exposes plus ports already used by application domains.
+     * Ports declared by the selected Compose service, or exposed and previously used application ports.
      *
      * @return list<int>
      */
-    public function availableInternalPorts(): array
+    public function availableInternalPorts(?string $serviceName = null): array
     {
+        if ($this->build_pack === 'dockercompose') {
+            return dockerComposeServicePorts($this->docker_compose_raw, $serviceName);
+        }
+
         $ports = collect($this->settings?->is_static ? [80] : $this->ports_exposes_array)
             ->filter(fn (mixed $port): bool => is_numeric($port) && (int) $port > 0)
             ->map(fn (mixed $port): int => (int) $port);
@@ -1015,13 +1000,13 @@ class Application extends BaseModel
         return $ports->unique()->sort()->values()->all();
     }
 
-    public function portRequiresConfirmation(?int $port): bool
+    public function portRequiresConfirmation(?int $port, ?string $serviceName = null): bool
     {
         if ($port === null || $port <= 0) {
             return false;
         }
 
-        return ! in_array($port, $this->availableInternalPorts(), true);
+        return ! in_array($port, $this->availableInternalPorts($serviceName), true);
     }
 
     public function detectPortFromEnvironment(?bool $isPreview = false): ?int
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 02f3e7ed50..1e7d8282a5 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -57,6 +57,7 @@ class InstanceSettings extends Model
         'webhook_allow_localhost',
         'avatar_storage_type',
         'avatar_s3_storage_id',
+        'image_cdn_url',
         'is_dashboard_force_https_enabled',
     ];
 
diff --git a/app/Models/ScheduledDatabaseBackup.php b/app/Models/ScheduledDatabaseBackup.php
index e41c793c86..7a26658e4f 100644
--- a/app/Models/ScheduledDatabaseBackup.php
+++ b/app/Models/ScheduledDatabaseBackup.php
@@ -14,6 +14,9 @@ class ScheduledDatabaseBackup extends BaseModel
             'dump_all' => 'boolean',
             'database_backup_retention_max_storage_locally' => 'float',
             'database_backup_retention_max_storage_s3' => 'float',
+            'missing_backup_notification_days' => 'integer',
+            'missing_backup_notification_sent_at' => 'datetime',
+            'last_execution_at' => 'datetime',
         ];
     }
 
@@ -37,6 +40,7 @@ class ScheduledDatabaseBackup extends BaseModel
         'database_backup_retention_max_storage_s3',
         'timeout',
         'disable_local_backup',
+        'missing_backup_notification_days',
     ];
 
     public static function ownedByCurrentTeam()
diff --git a/app/Models/ScheduledDatabaseBackupExecution.php b/app/Models/ScheduledDatabaseBackupExecution.php
index 8c5de1e8b1..1a479772cf 100644
--- a/app/Models/ScheduledDatabaseBackupExecution.php
+++ b/app/Models/ScheduledDatabaseBackupExecution.php
@@ -6,6 +6,13 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class ScheduledDatabaseBackupExecution extends BaseModel
 {
+    protected static function booted(): void
+    {
+        static::created(function (ScheduledDatabaseBackupExecution $execution): void {
+            $execution->scheduledDatabaseBackup()->update(['last_execution_at' => $execution->created_at ?? now()]);
+        });
+    }
+
     protected $fillable = [
         'uuid',
         'scheduled_database_backup_id',
diff --git a/app/Models/ScheduledTaskExecution.php b/app/Models/ScheduledTaskExecution.php
index 1e26c7be3f..8f496fc1e6 100644
--- a/app/Models/ScheduledTaskExecution.php
+++ b/app/Models/ScheduledTaskExecution.php
@@ -39,7 +39,7 @@ class ScheduledTaskExecution extends BaseModel
             'started_at' => 'datetime',
             'finished_at' => 'datetime',
             'retry_count' => 'integer',
-            'duration' => 'decimal:2',
+            'duration' => 'float',
         ];
     }
 
diff --git a/app/Models/Server.php b/app/Models/Server.php
index b6e1b92d99..9cc91d40d4 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -1813,6 +1813,8 @@ $siteAddress {
             $this->proxy->set('last_saved_proxy_configuration', null);
             $this->proxy->set('last_saved_settings', null);
             $this->proxy->set('last_applied_settings', null);
+            $this->detected_traefik_version = null;
+            $this->traefik_outdated_info = null;
             $this->save();
             if ($this->proxySet()) {
                 if ($async) {
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 11756f3c7e..2f1a0264c2 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -18,7 +18,6 @@ use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Storage;
 use OpenApi\Attributes as OA;
 use Spatie\Activitylog\Models\Activity;
-use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
 
 #[OA\Schema(
@@ -1466,32 +1465,6 @@ class Service extends BaseModel
         return null;
     }
 
-    public function taskLink($task_uuid)
-    {
-        if (data_get($this, 'environment.project.uuid')) {
-            $route = route('project.service.scheduled-tasks', [
-                'project_uuid' => data_get($this, 'environment.project.uuid'),
-                'environment_uuid' => data_get($this, 'environment.uuid'),
-                'service_uuid' => data_get($this, 'uuid'),
-                'task_uuid' => $task_uuid,
-            ]);
-            $settings = InstanceSettings::get();
-            if (data_get($settings, 'fqdn')) {
-                $url = Url::fromString($route);
-                $url = $url->withPort(null);
-                $fqdn = data_get($settings, 'fqdn');
-                $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                $url = $url->withHost($fqdn);
-
-                return $url->__toString();
-            }
-
-            return $route;
-        }
-
-        return null;
-    }
-
     public function documentation()
     {
         $services = get_service_templates();
@@ -1507,7 +1480,10 @@ class Service extends BaseModel
     {
         try {
             $services = get_service_templates();
-            $serviceName = $this->service_type ?: str($this->name)->beforeLast('-')->value();
+            if (blank($this->service_type)) {
+                return null;
+            }
+            $serviceName = $this->service_type;
             $service = data_get($services, $serviceName, []);
             $port = data_get($service, 'port');
 
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index cf0faef5bd..cba18c1f23 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -201,7 +201,7 @@ class ServiceApplication extends BaseModel
     }
 
     /**
-     * Return the public URLs with their persisted internal port overrides.
+     * Return editable URLs with persisted overrides or legacy embedded ports.
      */
     protected function url(): Attribute
     {
@@ -220,7 +220,7 @@ class ServiceApplication extends BaseModel
                         $port = $overrides[$canonical] ?? null;
 
                         if ($port === null) {
-                            return $canonical;
+                            return $url;
                         }
 
                         $parts = DomainUrlParts::split($canonical);
@@ -366,7 +366,7 @@ class ServiceApplication extends BaseModel
             }
 
             $dockerCompose = Yaml::parse($dockerComposeRaw);
-            $serviceConfig = data_get($dockerCompose, "services.{$this->name}");
+            $serviceConfig = $dockerCompose['services'][$this->name] ?? null;
             if (! $serviceConfig) {
                 return $this->service->getRequiredPort();
             }
@@ -417,9 +417,21 @@ class ServiceApplication extends BaseModel
                 return $portFound;
             }
 
+            $composePort = firstDockerComposeServicePort($serviceConfig);
+            if ($composePort !== null) {
+                return $composePort;
+            }
+
             // HTTP-facing compose services that only declare SERVICE_URL/FQDN (no _PORT
             // suffix), such as WordPress, inherit the one-click template `# port:`.
             if ($declaresHttpUrl) {
+                if (blank($this->service->service_type)) {
+                    $savedPort = $this->getSavedLegacyRoutingPort($serviceConfig);
+                    if ($savedPort !== null) {
+                        return $savedPort;
+                    }
+                }
+
                 return $this->service->getRequiredPort();
             }
 
@@ -428,4 +440,52 @@ class ServiceApplication extends BaseModel
             return null;
         }
     }
+
+    /**
+     * Preserve only an unambiguous upstream from this legacy container's saved labels.
+     */
+    private function getSavedLegacyRoutingPort(array $serviceConfig): ?int
+    {
+        $savedCompose = Yaml::parse($this->service->docker_compose ?? '');
+        $savedService = $savedCompose['services'][$this->name] ?? null;
+        $image = $serviceConfig['image'] ?? null;
+        if (! is_string($image) || $image === '' || ($savedService['image'] ?? null) !== $image) {
+            return null;
+        }
+
+        $labels = $savedService['labels'] ?? [];
+        if (! is_array($labels)) {
+            return null;
+        }
+
+        $ports = [];
+        foreach ($labels as $key => $value) {
+            if (is_int($key)) {
+                if (! is_string($value)) {
+                    return null;
+                }
+                [$key, $value] = array_pad(explode('=', $value, 2), 2, null);
+            }
+
+            if (preg_match('/^traefik\.http\.services\.[^.]+\.loadbalancer\.server\.port$/', $key)) {
+                $port = $value;
+            } elseif (preg_match('/^caddy(?:_\d+)?\..*reverse_proxy$/', $key)) {
+                if (! is_string($value) || ! preg_match('/^\{\{upstreams ([0-9]+)\}\}$/', $value, $matches)) {
+                    return null;
+                }
+                $port = $matches[1];
+            } else {
+                continue;
+            }
+
+            if ((! is_string($port) && ! is_int($port)) || ! preg_match('/^[0-9]+$/', (string) $port) || (int) $port < 1 || (int) $port > 65535) {
+                return null;
+            }
+            $ports[] = (int) $port;
+        }
+
+        $ports = array_values(array_unique($ports));
+
+        return count($ports) === 1 ? $ports[0] : null;
+    }
 }
diff --git a/app/Models/ServiceDatabase.php b/app/Models/ServiceDatabase.php
index c932791a78..603d11a7f3 100644
--- a/app/Models/ServiceDatabase.php
+++ b/app/Models/ServiceDatabase.php
@@ -2,13 +2,12 @@
 
 namespace App\Models;
 
-use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ServiceDatabase extends BaseModel
 {
-    use HasFactory, HasRestartLimit, SoftDeletes;
+    use HasFactory, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index a627d00aa6..6265345ee9 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,12 +14,10 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneClickhouse extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected array $auditExclude = ['last_online_at'];
 
-
     protected $fillable = [
         'uuid',
         'name',
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 8371bd0493..da4804dd2d 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,9 +14,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneDragonfly extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
-
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index bbe55a4f5a..f4dbaec210 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,9 +14,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneKeydb extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
-
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index d35509ce99..c923b489bd 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -16,9 +15,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMariadb extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
-
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index faf54e0e71..70b108087a 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,9 +14,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMongodb extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
-
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 5a1ecb8425..6a08a4dc45 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,9 +14,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneMysql extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
-
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index e91539d55b..f8dc5c0caa 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,9 +14,7 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandalonePostgresql extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
-
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 674f7867fd..3bfcc5434e 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -6,7 +6,6 @@ use App\Traits\Auditable;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use App\Traits\HasSecretManager;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -15,12 +14,10 @@ use Illuminate\Database\Eloquent\SoftDeletes;
 
 class StandaloneRedis extends BaseModel
 {
-
-    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
+    use Auditable, ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, HasSecretManager, SoftDeletes;
 
     protected array $auditExclude = ['last_online_at'];
 
-
     protected $fillable = [
         'uuid',
         'name',
diff --git a/app/Notifications/ApiTokenExpiringNotification.php b/app/Notifications/ApiTokenExpiringNotification.php
index 451dd312a1..01f58af7ec 100644
--- a/app/Notifications/ApiTokenExpiringNotification.php
+++ b/app/Notifications/ApiTokenExpiringNotification.php
@@ -21,7 +21,7 @@ class ApiTokenExpiringNotification extends CustomEmailNotification
         $this->onQueue('high');
         $this->tokenName = $token->name;
         $this->expiresAt = $token->expires_at?->format('Y-m-d H:i:s') ?? '';
-        $this->manageUrl = route('security.api-tokens');
+        $this->manageUrl = base_url().'/security/api-tokens';
     }
 
     public function via(object $notifiable): array
@@ -100,4 +100,16 @@ class ApiTokenExpiringNotification extends CustomEmailNotification
             color: SlackMessage::warningColor(),
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "API token '{$this->tokenName}' expires on {$this->expiresAt}. Rotate this token before it expires to avoid API outages.",
+            'event' => 'api_token_expiring',
+            'token_name' => $this->tokenName,
+            'expires_at' => $this->expiresAt,
+            'url' => $this->manageUrl,
+        ];
+    }
 }
diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
index 687fd30867..de9de1f981 100644
--- a/app/Notifications/Application/RestartLimitReached.php
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -2,8 +2,11 @@
 
 namespace App\Notifications\Application;
 
+use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\BaseModel;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
@@ -49,14 +52,19 @@ class RestartLimitReached extends CustomEmailNotification
         if (str($this->fqdn)->explode(',')->count() > 1) {
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
-        $service = data_get($resource, 'service');
-        $this->resource_url = match (true) {
-            method_exists($this->resource, 'link') => $this->resource->link(),
-            $resource instanceof ApplicationPreview => $resource->application->link(),
-            is_object($service) && method_exists($service, 'link') => $service->link(),
-            default => null,
+        $this->resource_url = $this->resolveResourceUrl($resource);
+    }
+
+    private function resolveResourceUrl(BaseModel $resource): string
+    {
+        [$type, $uuid] = match (true) {
+            $resource instanceof Application => ['application', $resource->uuid],
+            $resource instanceof ApplicationPreview => ['application', $resource->application->uuid],
+            $resource instanceof ServiceApplication, $resource instanceof ServiceDatabase => ['service', $resource->service->uuid],
+            default => ['database', $resource->uuid],
         };
-        $this->resource_url ??= base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}";
+
+        return base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/{$type}/{$uuid}";
     }
 
     public function via(object $notifiable): array
diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index 4f311bf681..118ad4269c 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -9,6 +9,7 @@ use App\Notifications\Application\RestartLimitReached;
 use App\Notifications\Application\StatusChanged;
 use App\Notifications\Container\ContainerRestarted;
 use App\Notifications\Database\BackupFailed;
+use App\Notifications\Database\BackupMissing;
 use App\Notifications\Database\BackupSuccess;
 use App\Notifications\ScheduledTask\TaskFailed;
 use App\Notifications\ScheduledTask\TaskSuccess;
@@ -17,6 +18,7 @@ use App\Notifications\Server\DockerCleanupSuccess;
 use App\Notifications\Server\HighDiskUsage;
 use App\Notifications\Server\Reachable;
 use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\TraefikVersionOutdated;
 use App\Notifications\Server\Unreachable;
 
 class TelegramChannel
@@ -39,7 +41,8 @@ class TelegramChannel
             RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id,
 
             BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
-            BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
+            BackupFailed::class,
+            BackupMissing::class => $settings->telegram_notifications_backup_failure_thread_id,
 
             TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
             TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
@@ -50,7 +53,7 @@ class TelegramChannel
             Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
             Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
             ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
-
+            TraefikVersionOutdated::class => $settings->telegram_notifications_traefik_outdated_thread_id,
             default => null,
         };
 
diff --git a/app/Notifications/Database/BackupMissing.php b/app/Notifications/Database/BackupMissing.php
new file mode 100644
index 0000000000..d7f127ce3c
--- /dev/null
+++ b/app/Notifications/Database/BackupMissing.php
@@ -0,0 +1,83 @@
+<?php
+
+namespace App\Notifications\Database;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Notifications\CustomEmailNotification;
+use App\Notifications\Dto\DiscordMessage;
+use App\Notifications\Dto\PushoverMessage;
+use App\Notifications\Dto\SlackMessage;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Carbon;
+
+class BackupMissing extends CustomEmailNotification
+{
+    public string $databaseName;
+
+    public function __construct(public ScheduledDatabaseBackup $backup, public ?Carbon $lastExecutionAt)
+    {
+        $this->onQueue('high');
+        $this->databaseName = $backup->database?->name ?? $backup->description ?? $backup->uuid;
+    }
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable->getEnabledChannels('backup_failure');
+    }
+
+    public function toMail(): MailMessage
+    {
+        return (new MailMessage)
+            ->subject("Coolify: [ACTION REQUIRED] No recent backup for {$this->databaseName}")
+            ->view('emails.backup-missing', $this->messageData());
+    }
+
+    public function toDiscord(): DiscordMessage
+    {
+        return new DiscordMessage(
+            title: ':warning: Scheduled database backup missing',
+            description: $this->description(),
+            color: DiscordMessage::errorColor(),
+            isCritical: true,
+        );
+    }
+
+    public function toTelegram(): array
+    {
+        return ['message' => 'Coolify: '.$this->description()];
+    }
+
+    public function toPushover(): PushoverMessage
+    {
+        return new PushoverMessage(title: 'Scheduled database backup missing', level: 'error', message: $this->description());
+    }
+
+    public function toSlack(): SlackMessage
+    {
+        return new SlackMessage(title: 'Scheduled database backup missing', description: $this->description(), color: SlackMessage::errorColor());
+    }
+
+    public function toWebhook(): array
+    {
+        return array_merge($this->messageData(), [
+            'success' => false,
+            'message' => 'Scheduled database backup missing',
+            'event' => 'backup_missing',
+            'backup_uuid' => $this->backup->uuid,
+        ]);
+    }
+
+    private function description(): string
+    {
+        return "The enabled backup schedule for {$this->databaseName} has produced no executions in the last {$this->backup->missing_backup_notification_days} day(s).";
+    }
+
+    private function messageData(): array
+    {
+        return [
+            'database_name' => $this->databaseName,
+            'days' => $this->backup->missing_backup_notification_days,
+            'last_execution_at' => $this->lastExecutionAt?->toDateTimeString(),
+        ];
+    }
+}
diff --git a/app/Notifications/Internal/GeneralNotification.php b/app/Notifications/Internal/GeneralNotification.php
index 1d23672100..52e986ed6e 100644
--- a/app/Notifications/Internal/GeneralNotification.php
+++ b/app/Notifications/Internal/GeneralNotification.php
@@ -58,4 +58,14 @@ class GeneralNotification extends Notification implements ShouldQueue
             color: SlackMessage::infoColor(),
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => true,
+            'message' => $this->message,
+            'event' => 'general',
+            'url' => base_url(),
+        ];
+    }
 }
diff --git a/app/Notifications/Notification.php b/app/Notifications/Notification.php
deleted file mode 100644
index d37716a8b4..0000000000
--- a/app/Notifications/Notification.php
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-
-namespace Illuminate\Notifications;
-
-use App\Notifications\Channels\SendsEmail;
-use App\Notifications\Dto\DiscordMessage;
-use App\Notifications\Dto\PushoverMessage;
-use App\Notifications\Dto\SlackMessage;
-use Illuminate\Notifications\Messages\MailMessage;
-
-interface Notification
-{
-    public function toMail(SendsEmail $notifiable): MailMessage;
-
-    public function toPushover(): PushoverMessage;
-
-    public function toDiscord(): DiscordMessage;
-
-    public function toSlack(): SlackMessage;
-
-    public function toTelegram();
-}
diff --git a/app/Notifications/ScheduledTask/TaskFailed.php b/app/Notifications/ScheduledTask/TaskFailed.php
index bd060112ae..2ca3874ba0 100644
--- a/app/Notifications/ScheduledTask/TaskFailed.php
+++ b/app/Notifications/ScheduledTask/TaskFailed.php
@@ -2,6 +2,7 @@
 
 namespace App\Notifications\ScheduledTask;
 
+use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
@@ -16,10 +17,10 @@ class TaskFailed extends CustomEmailNotification
     public function __construct(public ScheduledTask $task, public string $output)
     {
         $this->onQueue('high');
-        if ($task->application) {
-            $this->url = $task->application->taskLink($task->uuid);
-        } elseif ($task->service) {
-            $this->url = $task->service->taskLink($task->uuid);
+        $resource = $task->application ?? $task->service;
+        if ($resource) {
+            $type = $resource instanceof Application ? 'application' : 'service';
+            $this->url = base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/{$type}/{$resource->uuid}/tasks/{$task->uuid}";
         }
     }
 
diff --git a/app/Notifications/ScheduledTask/TaskSuccess.php b/app/Notifications/ScheduledTask/TaskSuccess.php
index 58c959bd8d..2978eaed32 100644
--- a/app/Notifications/ScheduledTask/TaskSuccess.php
+++ b/app/Notifications/ScheduledTask/TaskSuccess.php
@@ -2,6 +2,7 @@
 
 namespace App\Notifications\ScheduledTask;
 
+use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
@@ -16,10 +17,10 @@ class TaskSuccess extends CustomEmailNotification
     public function __construct(public ScheduledTask $task, public string $output)
     {
         $this->onQueue('high');
-        if ($task->application) {
-            $this->url = $task->application->taskLink($task->uuid);
-        } elseif ($task->service) {
-            $this->url = $task->service->taskLink($task->uuid);
+        $resource = $task->application ?? $task->service;
+        if ($resource) {
+            $type = $resource instanceof Application ? 'application' : 'service';
+            $this->url = base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/{$type}/{$resource->uuid}/tasks/{$task->uuid}";
         }
     }
 
diff --git a/app/Notifications/Server/ForceDisabled.php b/app/Notifications/Server/ForceDisabled.php
index 4b56f5860b..2d2ebabaf0 100644
--- a/app/Notifications/Server/ForceDisabled.php
+++ b/app/Notifications/Server/ForceDisabled.php
@@ -74,4 +74,16 @@ class ForceDisabled extends CustomEmailNotification
             color: SlackMessage::errorColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "Server ({$this->server->name}) disabled because it is not paid! All automations and integrations are stopped.",
+            'event' => 'server_force_disabled',
+            'server_name' => $this->server->name,
+            'server_uuid' => $this->server->uuid,
+            'url' => base_url().'/server/'.$this->server->uuid,
+        ];
+    }
 }
diff --git a/app/Notifications/Server/ForceEnabled.php b/app/Notifications/Server/ForceEnabled.php
index 36dad3c60f..61022d36b5 100644
--- a/app/Notifications/Server/ForceEnabled.php
+++ b/app/Notifications/Server/ForceEnabled.php
@@ -65,4 +65,16 @@ class ForceEnabled extends CustomEmailNotification
             color: SlackMessage::successColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => true,
+            'message' => "Server ({$this->server->name}) enabled again!",
+            'event' => 'server_force_enabled',
+            'server_name' => $this->server->name,
+            'server_uuid' => $this->server->uuid,
+            'url' => base_url().'/server/'.$this->server->uuid,
+        ];
+    }
 }
diff --git a/app/Notifications/Server/HetznerDeletionFailed.php b/app/Notifications/Server/HetznerDeletionFailed.php
index bb452b054b..6c2712b68d 100644
--- a/app/Notifications/Server/HetznerDeletionFailed.php
+++ b/app/Notifications/Server/HetznerDeletionFailed.php
@@ -17,8 +17,7 @@ class HetznerDeletionFailed extends CustomEmailNotification
 
     public function via(object $notifiable): array
     {
-
-        return $notifiable->getEnabledChannels('hetzner_deletion_failed');
+        return $notifiable->getEnabledChannels('hetzner_deletion_failure');
     }
 
     public function toMail(): MailMessage
@@ -66,4 +65,16 @@ class HetznerDeletionFailed extends CustomEmailNotification
             color: SlackMessage::errorColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        return [
+            'success' => false,
+            'message' => "[ACTION REQUIRED] Failed to delete Hetzner server #{$this->hetznerServerId} from Hetzner Cloud. The server has been removed from Coolify, but may still exist in your Hetzner Cloud account.",
+            'event' => 'hetzner_deletion_failed',
+            'hetzner_server_id' => $this->hetznerServerId,
+            'error' => $this->errorMessage,
+            'url' => base_url().'/servers',
+        ];
+    }
 }
diff --git a/app/Notifications/SslExpirationNotification.php b/app/Notifications/SslExpirationNotification.php
index 78e1e8be9c..8d2a5e3952 100644
--- a/app/Notifications/SslExpirationNotification.php
+++ b/app/Notifications/SslExpirationNotification.php
@@ -7,7 +7,6 @@ use App\Notifications\Dto\PushoverMessage;
 use App\Notifications\Dto\SlackMessage;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Collection;
-use Spatie\Url\Url;
 
 class SslExpirationNotification extends CustomEmailNotification
 {
@@ -19,39 +18,9 @@ class SslExpirationNotification extends CustomEmailNotification
     {
         $this->onQueue('high');
         $this->resources = collect($resources);
-
-        // Collect URLs for each resource
-        $this->resources->each(function ($resource) {
-            if (data_get($resource, 'environment.project.uuid')) {
-                $routeName = match ($resource->type()) {
-                    'application' => 'project.application.configuration',
-                    'database' => 'project.database.configuration',
-                    'service' => 'project.service.configuration',
-                    default => null
-                };
-
-                if ($routeName) {
-                    $route = route($routeName, [
-                        'project_uuid' => data_get($resource, 'environment.project.uuid'),
-                        'environment_uuid' => data_get($resource, 'environment.uuid'),
-                        $resource->type().'_uuid' => data_get($resource, 'uuid'),
-                    ]);
-
-                    $settings = instanceSettings();
-                    if (data_get($settings, 'fqdn')) {
-                        $url = Url::fromString($route);
-                        $url = $url->withPort(null);
-                        $fqdn = data_get($settings, 'fqdn');
-                        $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                        $url = $url->withHost($fqdn);
-
-                        $this->urls[$resource->name] = $url->__toString();
-                    } else {
-                        $this->urls[$resource->name] = $route;
-                    }
-                }
-            }
-        });
+        $this->urls = $this->resources->mapWithKeys(fn ($resource) => [
+            $resource->name => base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/database/{$resource->uuid}",
+        ])->all();
     }
 
     public function via(object $notifiable): array
@@ -148,4 +117,18 @@ class SslExpirationNotification extends CustomEmailNotification
             color: SlackMessage::warningColor()
         );
     }
+
+    public function toWebhook(): array
+    {
+        $resourceNames = $this->resources->pluck('name');
+
+        return [
+            'success' => false,
+            'message' => "SSL certificates have been renewed for: {$resourceNames->join(', ')}. These resources need to be redeployed manually for the new SSL certificates to take effect.",
+            'event' => 'ssl_certificate_renewal',
+            'resources' => $resourceNames->values()->all(),
+            'urls' => $this->urls,
+            'url' => base_url(),
+        ];
+    }
 }
diff --git a/app/Support/DatabaseBackupFileValidator.php b/app/Support/DatabaseBackupFileValidator.php
index 84e629fe1a..2c1de948ba 100644
--- a/app/Support/DatabaseBackupFileValidator.php
+++ b/app/Support/DatabaseBackupFileValidator.php
@@ -90,11 +90,8 @@ class DatabaseBackupFileValidator
 
     public static function containsPostgresqlProgramExecution(string $sql): bool
     {
-        $requireStatementBoundary = true;
-
         if (str_starts_with($sql, 'PGDMP')) {
-            $sql = preg_replace('/[\x00-\x08\x0B\x0C\x0E-\x1F]+/', "\n", $sql) ?? $sql;
-            $requireStatementBoundary = false;
+            return false;
         }
 
         $withoutComments = self::stripSqlComments($sql);
@@ -103,9 +100,7 @@ class DatabaseBackupFileValidator
             return true;
         }
 
-        $copyPrefix = $requireStatementBoundary ? '(?:^|;)\s*' : '\b';
-
-        return preg_match('/'.$copyPrefix.'copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
+        return preg_match('/(?:^|;)\s*copy\b[^;]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
     }
 
     private static function extensionFor(string $name): ?string
diff --git a/app/Traits/HasNoindexDomains.php b/app/Traits/HasNoindexDomains.php
index 7afe0d4f25..f3858cc61d 100644
--- a/app/Traits/HasNoindexDomains.php
+++ b/app/Traits/HasNoindexDomains.php
@@ -58,7 +58,16 @@ trait HasNoindexDomains
 
     private function currentDomains(): Collection
     {
-        return collect(ValidationPatterns::applicationDomainList($this->fqdn))
+        $domains = collect(ValidationPatterns::applicationDomainList($this->fqdn));
+        $composeDomains = json_decode((string) ($this->getAttributes()['docker_compose_domains'] ?? null), true);
+
+        if (is_array($composeDomains)) {
+            foreach ($composeDomains as $entry) {
+                $domains->push(...ValidationPatterns::applicationDomainList(composeDomainEntryString($entry)));
+            }
+        }
+
+        return $domains
             ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain));
     }
 
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index f80fccafb2..613a104e0e 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -601,6 +601,57 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
+function firstDockerComposeServicePort(mixed $service): ?int
+{
+    $portDefinitions = collect(data_get($service, 'expose', []))
+        ->merge(data_get($service, 'ports', []));
+
+    foreach ($portDefinitions as $definition) {
+        $protocol = is_array($definition)
+            ? data_get($definition, 'protocol', 'tcp')
+            : (str_contains((string) $definition, '/') ? str((string) $definition)->afterLast('/')->value() : 'tcp');
+        if ($protocol !== 'tcp') {
+            continue;
+        }
+
+        $port = is_array($definition)
+            ? data_get($definition, 'target')
+            : str((string) $definition)->before('/')->afterLast(':')->value();
+
+        if (is_numeric($port) && (int) $port >= 1 && (int) $port <= 65535) {
+            return (int) $port;
+        }
+    }
+
+    return null;
+}
+
+function dockerComposeServicePort(?string $compose, ?string $serviceName): ?int
+{
+    return dockerComposeServicePorts($compose, $serviceName)[0] ?? null;
+}
+
+function dockerComposeServicePorts(?string $compose, ?string $serviceName): array
+{
+    if (blank($compose) || blank($serviceName)) {
+        return [];
+    }
+
+    try {
+        $services = data_get(Yaml::parse($compose), 'services', []);
+    } catch (Throwable) {
+        return [];
+    }
+
+    $service = is_array($services) ? ($services[$serviceName] ?? []) : [];
+
+    return collect(data_get($service, 'expose', []))
+        ->merge(data_get($service, 'ports', []))
+        ->map(fn ($definition) => firstDockerComposeServicePort(['expose' => [$definition]]))
+        ->filter(fn ($port) => $port !== null)
+        ->unique()->values()->all();
+}
+
 function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
 {
     $labels = collect([]);
diff --git a/bootstrap/helpers/domains.php b/bootstrap/helpers/domains.php
index 4e4ad73e6f..28ff41b3df 100644
--- a/bootstrap/helpers/domains.php
+++ b/bootstrap/helpers/domains.php
@@ -443,6 +443,26 @@ function getComposeServiceDomainString(array|Collection $domains, string $servic
     return $matches[0]['domain'];
 }
 
+/**
+ * Determine whether a compose service already has a domain-map entry, including
+ * an explicitly empty entry left when a user removes its generated domain.
+ *
+ * @param  array<string, mixed>|Collection<string, mixed>  $domains
+ */
+function hasComposeServiceDomainEntry(array|Collection $domains, string $serviceName): bool
+{
+    $normalized = normalizeComposeServiceName($serviceName);
+
+    foreach (collect($domains)->keys() as $key) {
+        $key = (string) $key;
+        if ($key === $serviceName || normalizeComposeServiceName($key) === $normalized) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 function composeDomainEntryString(mixed $entry): ?string
 {
     if (is_object($entry)) {
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index f65b626984..e50b852eca 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -525,8 +525,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 $originalServiceName = findComposeServiceName($normalizedServiceName, array_keys($services));
                 if ($originalServiceName !== null) {
                     $domains = json_decode(data_get($resource, 'docker_compose_domains') ?: '[]', true) ?: [];
-                    $domainExists = getComposeServiceDomainString($domains, $originalServiceName);
-                    if (is_null($domainExists)) {
+                    if (! hasComposeServiceDomainEntry($domains, $originalServiceName)) {
                         $serviceNameForDomain = str($parsed['service_name'])->replace('_', '-')->value();
                         $domainValue = generateUrl(server: $server, random: "$serviceNameForDomain-$uuid");
                         if ($value && get_class($value) === Stringable::class && $value->startsWith('/')) {
@@ -648,12 +647,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         // Only add domain if the service exists
                         if ($composeServiceName !== null) {
                             $domains = json_decode(data_get($resource, 'docker_compose_domains') ?: '[]', true) ?: [];
-                            $domainExists = getComposeServiceDomainString($domains, $composeServiceName);
-
                             // Update domain using URL with port if applicable
                             $domainValue = $port ? $urlWithPort : $url;
 
-                            if (is_null($domainExists)) {
+                            if (! hasComposeServiceDomainEntry($domains, $composeServiceName)) {
                                 $resource->docker_compose_domains = json_encode(putComposeServiceDomain(
                                     $domains,
                                     $composeServiceName,
@@ -1357,8 +1354,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $domainPortOverrides = $isPullRequest
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
-            $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
-            $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
+            $onlyPort = firstDockerComposeServicePort($service);
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1565,7 +1561,6 @@ function serviceParser(Service $resource): Collection
     $envComments = extractYamlEnvironmentComments($compose);
 
     $server = data_get($resource, 'server');
-    $allServices = get_service_templates();
 
     try {
         $yaml = Yaml::parse($compose);
@@ -1698,22 +1693,7 @@ function serviceParser(Service $resource): Collection
 
         $containerName = "$serviceName-{$resource->uuid}";
 
-        if ($serviceName === 'registry') {
-            $tempServiceName = 'docker-registry';
-        } else {
-            $tempServiceName = $serviceName;
-        }
-        if (str(data_get($service, 'image'))->contains('glitchtip')) {
-            $tempServiceName = 'glitchtip';
-        }
-        if ($serviceName === 'supabase-kong') {
-            $tempServiceName = 'supabase';
-        }
-        $serviceDefinition = data_get($allServices, $tempServiceName);
-        $predefinedPort = data_get($serviceDefinition, 'port');
-        if ($serviceName === 'plausible') {
-            $predefinedPort = '8000';
-        }
+        $predefinedPort = $resource->getRequiredPort();
 
         if ($migratedApp || $migratedDb) {
             // Use the already determined migrated service
@@ -2083,22 +2063,7 @@ function serviceParser(Service $resource): Collection
 
         $containerName = "$serviceName-{$resource->uuid}";
 
-        if ($serviceName === 'registry') {
-            $tempServiceName = 'docker-registry';
-        } else {
-            $tempServiceName = $serviceName;
-        }
-        if (str(data_get($service, 'image'))->contains('glitchtip')) {
-            $tempServiceName = 'glitchtip';
-        }
-        if ($serviceName === 'supabase-kong') {
-            $tempServiceName = 'supabase';
-        }
-        $serviceDefinition = data_get($allServices, $tempServiceName);
-        $predefinedPort = data_get($serviceDefinition, 'port');
-        if ($serviceName === 'plausible') {
-            $predefinedPort = '8000';
-        }
+        $predefinedPort = $resource->getRequiredPort();
 
         if ($migratedApp || $migratedDb) {
             // Use the already determined migrated service
@@ -2641,7 +2606,7 @@ function serviceParser(Service $resource): Collection
                 ? data_get($originalResource, 'redirect')
                 : 'both';
             $onlyPort = $originalResource instanceof ServiceApplication
-                ? ($originalResource->getRequiredPort() ?? $predefinedPort)
+                ? $originalResource->getRequiredPort()
                 : $predefinedPort;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
@@ -2676,7 +2641,7 @@ function serviceParser(Service $resource): Collection
                             service_name: $serviceName,
                             image: $image,
                             onlyPort: $onlyPort,
-                            predefinedPort: $predefinedPort,
+                            predefinedPort: $onlyPort,
                             domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
@@ -2709,7 +2674,7 @@ function serviceParser(Service $resource): Collection
                     service_name: $serviceName,
                     image: $image,
                     onlyPort: $onlyPort,
-                    predefinedPort: $predefinedPort,
+                    predefinedPort: $onlyPort,
                     domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 1112e9442b..44ceb603b9 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -860,7 +860,7 @@ function s3_image_url(?int $storageId, ?string $path, int $version): ?string
         return null;
     }
 
-    $baseUrl = config('constants.coolify.avatar_cdn_url') ?: $storage->awsUrl();
+    $baseUrl = instanceSettings()->image_cdn_url ?: $storage->awsUrl();
 
     return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
 }
@@ -2486,7 +2486,6 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
             } catch (Exception $e) {
                 throw new RuntimeException($e->getMessage());
             }
-            $allServices = get_service_templates();
             $topLevelVolumes = collect(data_get($yaml, 'volumes', []));
             $topLevelNetworks = collect(data_get($yaml, 'networks', []));
             $topLevelConfigs = collect(data_get($yaml, 'configs', []));
@@ -2512,25 +2511,8 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                 }
                 $topLevelVolumes = collect($tempTopLevelVolumes);
             }
-            $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $allServices, $envComments) {
-                // Workarounds for beta users.
-                if ($serviceName === 'registry') {
-                    $tempServiceName = 'docker-registry';
-                } else {
-                    $tempServiceName = $serviceName;
-                }
-                if (str(data_get($service, 'image'))->contains('glitchtip')) {
-                    $tempServiceName = 'glitchtip';
-                }
-                if ($serviceName === 'supabase-kong') {
-                    $tempServiceName = 'supabase';
-                }
-                $serviceDefinition = data_get($allServices, $tempServiceName);
-                $predefinedPort = data_get($serviceDefinition, 'port');
-                if ($serviceName === 'plausible') {
-                    $predefinedPort = '8000';
-                }
-                // End of workarounds for beta users.
+            $services = collect($services)->map(function ($service, $serviceName) use ($topLevelVolumes, $topLevelNetworks, $definedNetwork, $isNew, $generatedServiceFQDNS, $resource, $envComments) {
+                $predefinedPort = $resource->getRequiredPort();
                 $serviceVolumes = collect(data_get($service, 'volumes', []));
                 $servicePorts = collect(data_get($service, 'ports', []));
                 $serviceNetworks = collect(data_get($service, 'networks', []));
@@ -3107,7 +3089,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             ? ($savedService->domain_port_overrides ?? [])
                             : [];
                         $onlyPort = $savedService instanceof ServiceApplication
-                            ? ($savedService->getRequiredPort() ?? $predefinedPort)
+                            ? $savedService->getRequiredPort()
                             : $predefinedPort;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($resource->server->proxyType()) {
@@ -3139,7 +3121,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
                                         onlyPort: $onlyPort,
-                                        predefinedPort: $predefinedPort,
+                                        predefinedPort: $onlyPort,
                                         noindex_domains: $noindexDomains,
                                         redirect_direction: $redirectDirection,
                                         domainPortOverrides: $domainPortOverrides,
@@ -3172,7 +3154,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
                                 onlyPort: $onlyPort,
-                                predefinedPort: $predefinedPort,
+                                predefinedPort: $onlyPort,
                                 noindex_domains: $noindexDomains,
                                 redirect_direction: $redirectDirection,
                                 domainPortOverrides: $domainPortOverrides,
@@ -3915,8 +3897,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $domainPortOverrides = $pull_request_id === 0
                             ? ($resource->domain_port_overrides ?? [])
                             : ($preview?->domain_port_overrides ?? []);
-                        $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
-                        $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
+                        $onlyPort = firstDockerComposeServicePort($service);
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
diff --git a/bootstrap/helpers/sudo.php b/bootstrap/helpers/sudo.php
index 397efc387c..98dbe3af7a 100644
--- a/bootstrap/helpers/sudo.php
+++ b/bootstrap/helpers/sudo.php
@@ -59,13 +59,18 @@ function parseCommandsByLineForSudo(Collection $commands, Server $server): array
             return $line;
         }
 
+        // Negation belongs to the shell, before the elevated command.
+        if (preg_match('/^\s*!\s+/', $line)) {
+            return preg_replace('/^(\s*(?:!\s+)+)/', '$1sudo ', $line);
+        }
+
         // Check all keywords with word boundary matching
         // Match keyword followed by space, semicolon, or end of line
         foreach ($bashKeywords as $keyword) {
             if (preg_match('/^'.preg_quote($keyword, '/').'(\s|;|$)/', $trimmedLine)) {
-                // Special handling for 'if' - insert sudo after 'if '
+                // Keep any shell negation before sudo in the condition.
                 if ($keyword === 'if') {
-                    return preg_replace('/^(\s*)if\s+/', '$1if sudo ', $line);
+                    return preg_replace('/^(\s*if\s+(?:!\s+)*)/', '$1sudo ', $line);
                 }
 
                 return $line;
diff --git a/config/constants.php b/config/constants.php
index 457a8a1ff8..1e6d40b7b6 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,9 +2,9 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.15',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.18',
         'helper_version' => '1.0.16',
-        'realtime_version' => '1.0.18',
+        'realtime_version' => '1.0.19',
         'railpack_version' => '0.23.0',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
@@ -14,7 +14,6 @@ return [
         'realtime_image' => env('REALTIME_IMAGE', env('REGISTRY_URL', 'docker.io').'/coollabsio/coolify-realtime'),
         'is_windows_docker_desktop' => env('IS_WINDOWS_DOCKER_DESKTOP', false),
         'cdn_url' => env('CDN_URL', 'https://cdn.coollabs.io'),
-        'avatar_cdn_url' => env('AVATAR_CDN_URL'),
         'versions_url' => env('VERSIONS_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/versions.json'),
         'upgrade_script_url' => env('UPGRADE_SCRIPT_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/upgrade.sh'),
         'releases_url' => env('RELEASES_URL', 'https://cdn.coollabs.io/coolify/releases.json'),
diff --git a/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php b/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
new file mode 100644
index 0000000000..fe7c1e6292
--- /dev/null
+++ b/database/migrations/2026_08_20_150000_add_missing_backup_notification_fields_to_scheduled_database_backups_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('scheduled_database_backups', function (Blueprint $table) {
+            $table->unsignedInteger('missing_backup_notification_days')->default(0);
+            $table->timestamp('missing_backup_notification_sent_at')->nullable();
+            $table->timestamp('last_execution_at')->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('scheduled_database_backups', function (Blueprint $table) {
+            $table->dropColumn([
+                'missing_backup_notification_days',
+                'missing_backup_notification_sent_at',
+                'last_execution_at',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php b/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php
new file mode 100644
index 0000000000..710578fd92
--- /dev/null
+++ b/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php
@@ -0,0 +1,56 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    private const STANDALONE_DATABASE_TABLES = [
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+    ];
+
+    public function up(): void
+    {
+        foreach (self::STANDALONE_DATABASE_TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+            });
+        }
+
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+
+    public function down(): void
+    {
+        foreach (self::STANDALONE_DATABASE_TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->integer('max_restart_count')->default(10);
+                $table->boolean('restart_limit_reached')->default(false);
+            });
+        }
+
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+};
diff --git a/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php b/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php
new file mode 100644
index 0000000000..1c898dd5da
--- /dev/null
+++ b/database/migrations/2026_09_04_191011_add_image_cdn_url_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->string('image_cdn_url')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('image_cdn_url');
+        });
+    }
+};
diff --git a/database/seeders/TeamSeeder.php b/database/seeders/TeamSeeder.php
index 67c5ec4897..08426044c6 100644
--- a/database/seeders/TeamSeeder.php
+++ b/database/seeders/TeamSeeder.php
@@ -10,14 +10,14 @@ class TeamSeeder extends Seeder
 {
     public function run(): void
     {
-        $normal_user_in_root_team = User::find(1);
+        $normal_user_in_root_team = User::where('email', 'test2@example.com')->firstOrFail();
         $root_user_personal_team = Team::find(0);
         $root_user_personal_team->description = 'The root team';
         $root_user_personal_team->save();
 
         $normal_user_in_root_team->teams()->attach($root_user_personal_team);
-        $normal_user_not_in_root_team = User::find(2);
-        $normal_user_in_root_team_personal_team = Team::find(1);
+        $normal_user_not_in_root_team = User::where('email', 'test3@example.com')->firstOrFail();
+        $normal_user_in_root_team_personal_team = $normal_user_in_root_team->teams()->where('personal_team', true)->wherePivot('role', 'owner')->firstOrFail();
         $normal_user_not_in_root_team->teams()->attach($normal_user_in_root_team_personal_team, ['role' => 'admin']);
     }
 }
diff --git a/database/seeders/UserSeeder.php b/database/seeders/UserSeeder.php
index 19d3aa42e8..9f237dc3b5 100644
--- a/database/seeders/UserSeeder.php
+++ b/database/seeders/UserSeeder.php
@@ -22,5 +22,6 @@ class UserSeeder extends Seeder
             'name' => 'Normal User (not in root team)',
             'email' => 'test3@example.com',
         ]);
+
     }
 }
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index ebf12379d5..d611fc69f7 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.19'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index cc266e5562..6a52a0126a 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -97,7 +97,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.19'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/docker/coolify-realtime/terminal-server.js b/docker/coolify-realtime/terminal-server.js
index b72574c8d0..09f5bd5e12 100755
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@@ -8,6 +8,7 @@ import {
     extractSshArgs,
     extractTargetHost,
     extractTimeout,
+    getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     sanitizeSshArgs,
@@ -401,7 +402,7 @@ async function handleCommand(ws, command, userId) {
         cols: 80,
         rows: 30,
         cwd: process.env.HOME,
-        env: {},
+        env: getTerminalProcessEnv(),
     };
 
     // NOTE: - Initiates a process within the Terminal container
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index c6865f1800..c2762f1d85 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -1,5 +1,13 @@
 export const MAX_TERMINAL_SESSION_TIMEOUT_SECONDS = 8 * 60 * 60;
 
+const DEFAULT_TERMINAL_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+
+export function getTerminalProcessEnv(environment = process.env) {
+    return {
+        PATH: environment.PATH || DEFAULT_TERMINAL_PATH,
+    };
+}
+
 export function getTerminalSessionTimeout() {
     return MAX_TERMINAL_SESSION_TIMEOUT_SECONDS;
 }
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index 7af98be898..e9acda3270 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -4,6 +4,7 @@ import {
     MAX_TERMINAL_SESSION_TIMEOUT_SECONDS,
     extractSshArgs,
     extractTargetHost,
+    getTerminalProcessEnv,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
@@ -11,6 +12,32 @@ import {
     validateSshArgs,
 } from './terminal-utils.js';
 
+test('getTerminalProcessEnv preserves the PATH needed by SSH proxy commands', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '/usr/local/bin:/usr/bin:/bin',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/bin:/usr/bin:/bin',
+    });
+});
+
+test('getTerminalProcessEnv uses the default PATH when PATH is absent', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    });
+});
+
+test('getTerminalProcessEnv uses the default PATH when PATH is empty', () => {
+    assert.deepEqual(getTerminalProcessEnv({
+        PATH: '',
+        APP_KEY: 'must-not-be-inherited',
+    }), {
+        PATH: '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    });
+});
+
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
     const sshArgs = extractSshArgs(
         "timeout 3600 ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ServerAliveInterval=20 -o ConnectTimeout=10 'root'@'10.0.0.5' 'bash -se' << \\\\$abc\necho hi\nabc"
diff --git a/docker/development/etc/nginx/conf.d/custom.conf b/docker/development/etc/nginx/conf.d/custom.conf
index f26dc30495..4672e3de55 100644
--- a/docker/development/etc/nginx/conf.d/custom.conf
+++ b/docker/development/etc/nginx/conf.d/custom.conf
@@ -2,3 +2,9 @@
 
 # Disable access logs
 access_log off;
+
+# Allow request headers up to 32k (nginx default is 8k). Large JWT cookies can push the
+# Cookie header past 8k, and nginx would then reject the request with a bare 400
+# before it reaches the application.
+client_header_buffer_size 8k;
+large_client_header_buffers 8 32k;
diff --git a/docker/production/etc/nginx/conf.d/custom.conf b/docker/production/etc/nginx/conf.d/custom.conf
index f26dc30495..4672e3de55 100644
--- a/docker/production/etc/nginx/conf.d/custom.conf
+++ b/docker/production/etc/nginx/conf.d/custom.conf
@@ -2,3 +2,9 @@
 
 # Disable access logs
 access_log off;
+
+# Allow request headers up to 32k (nginx default is 8k). Large JWT cookies can push the
+# Cookie header past 8k, and nginx would then reject the request with a bare 400
+# before it reaches the application.
+client_header_buffer_size 8k;
+large_client_header_buffers 8 32k;
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 455918fdc0..97ab3b3a6a 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.15"
+            "version": "4.3.18"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/resources/css/app.css b/resources/css/app.css
index 9400d2aad0..b5219badf2 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -2576,7 +2576,7 @@ input[type="search"]::-webkit-search-results-decoration {
 }
 
 .service-backup-table-grid {
-    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 7.5rem;
+    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 12.5rem;
     width: 100%;
 }
 
@@ -2728,7 +2728,10 @@ input[type="search"]::-webkit-search-results-decoration {
     }
 
     .volumes-col-backup {
-        align-items: flex-start;
+        flex-direction: row;
+        align-items: center;
+        justify-content: flex-start;
+        gap: 0.5rem;
     }
 
     .volumes-cell-actions {
@@ -4448,3 +4451,122 @@ a.command-palette-item:focus-visible {
 .dark .command-palette-arch-badge {
     color: #fcd34d;
 }
+
+/* Service domains prioritize public addresses; configuration lives in settings. */
+#service-domains-section,
+.domains-overview-container {
+    container: service-domains / inline-size;
+}
+
+.service-domains-overview-grid {
+    grid-template-columns: minmax(0, 1fr) 7.25rem 7.5rem 5.5rem 6.5rem 8rem 6.5rem;
+    column-gap: 0.75rem;
+}
+
+.data-table-row.service-domains-overview-grid {
+    padding-block: 0.5rem;
+}
+
+.service-domain-detail {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    min-width: 0;
+    font-size: 12px;
+}
+
+.service-domains-overview-grid > span:not(:first-child):not(:last-child) {
+    text-align: center;
+}
+
+.service-domain-detail-label {
+    display: none;
+}
+
+.service-domain-mobile-summary {
+    display: none;
+}
+
+.service-domains-https .listbox-trigger {
+    min-width: 7rem;
+}
+
+@container service-domains (max-width: 980px) {
+    .data-table-header.service-domains-overview-grid {
+        display: none;
+    }
+
+    .data-table-row.service-domains-overview-grid {
+        grid-template-columns: repeat(2, minmax(0, 1fr));
+        gap: 0.75rem;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child {
+        grid-column: 1 / -1;
+    }
+
+    .service-domain-detail {
+        justify-content: space-between;
+        gap: 0.5rem;
+    }
+
+    .service-domain-detail-label {
+        display: inline;
+        color: var(--coollabs-fg-dim);
+    }
+}
+
+@container service-domains (max-width: 600px) {
+    .data-table-row.service-domains-overview-grid {
+        grid-template-columns: minmax(0, 1fr) auto;
+        gap: 0.625rem 0.75rem;
+        padding: 0.875rem;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child {
+        grid-column: 1 / -1;
+    }
+
+    .data-table-row.service-domains-overview-grid > :first-child a,
+    .data-table-row.service-domains-overview-grid > :first-child span[title] {
+        overflow: visible;
+        white-space: normal;
+        overflow-wrap: anywhere;
+        line-height: 1.35;
+    }
+
+    .service-domain-detail,
+    .domains-service-desktop {
+        display: none;
+    }
+
+    .service-domain-mobile-summary {
+        display: flex;
+        grid-column: 1 / -1;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: 0.375rem 0.75rem;
+        color: var(--coollabs-fg-dim);
+        font-size: 12px;
+        line-height: 1.25rem;
+    }
+
+    .service-domain-mobile-summary > span:not(:last-child)::after {
+        margin-left: 0.75rem;
+        color: var(--coollabs-line);
+        content: "·";
+    }
+
+    .service-domain-dns {
+        justify-self: start;
+    }
+
+    .service-domain-actions {
+        justify-self: end;
+    }
+
+    .service-domain-actions .icon-button {
+        width: 2.5rem;
+        height: 2.5rem;
+    }
+}
diff --git a/resources/views/components/application/restart-limit-warning.blade.php b/resources/views/components/application/restart-limit-warning.blade.php
index 3d08c803d5..5a35623fc4 100644
--- a/resources/views/components/application/restart-limit-warning.blade.php
+++ b/resources/views/components/application/restart-limit-warning.blade.php
@@ -1,6 +1,6 @@
 @props(['application'])
 
-@if ($application->stoppedAfterRestartLimit())
+@if (method_exists($application, 'stoppedAfterRestartLimit') && $application->stoppedAfterRestartLimit())
     @php($restartLimit = method_exists($application, 'restartLimitMaximum') ? $application->restartLimitMaximum() : ($application->max_restart_count ?? 0))
     @php($displayRestartCount = max($application->restart_count ?? 0, $restartLimit))
     <x-status-badge
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index d04a5f57e5..4c572596d6 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -123,7 +123,8 @@
         {{ $attributes->whereStartsWith('x-model') }}
         {{ $attributes->whereStartsWith('x-effect') }}
         @if ($preserveValue) wire:ignore @endif
-        @click.outside="open = false" @keydown.escape="open = false" @resize.window="open && positionPanel()">
+        @click.outside="open = false" @keydown.escape="open = false" @resize.window="open && positionPanel()"
+        @scroll.window.capture="open && positionPanel()">
         <button x-ref="trigger" id="{{ $triggerId }}" type="button" class="listbox-trigger" @click="toggle()"
             @disabled($disabled) {{ $attributes->whereStartsWith('x-bind:disabled') }} aria-haspopup="listbox"
             :aria-expanded="open" @if ($tooltip) :title="current" @endif>
@@ -134,33 +135,35 @@
             </svg>
         </button>
         @if ($portal)
-            <div id="{{ $panelId }}" class="listbox-panel"
-                style="position: fixed; z-index: 9999; visibility: hidden" x-show="open"
-                x-cloak :style="{ visibility: positioned ? 'visible' : 'hidden' }"
-                x-transition:enter="transition ease-out duration-100"
-                x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
-                x-transition:enter-end="opacity-100 translate-y-0 scale-100"
-                x-transition:leave="transition ease-in duration-75"
-                x-transition:leave-start="opacity-100 translate-y-0 scale-100"
-                x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
-                x-effect="if (open) requestAnimationFrame(() => positionPanel($el))" role="listbox">
-                <div x-show="options.length === 0"
-                    class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
-                    {{ $emptyText }}
+            <template x-teleport="body">
+                <div id="{{ $panelId }}" class="listbox-panel"
+                    style="position: fixed; z-index: 9999; visibility: hidden" x-show="open"
+                    x-cloak :style="{ visibility: positioned ? 'visible' : 'hidden' }"
+                    x-transition:enter="transition ease-out duration-100"
+                    x-transition:enter-start="opacity-0 -translate-y-1 scale-[0.98]"
+                    x-transition:enter-end="opacity-100 translate-y-0 scale-100"
+                    x-transition:leave="transition ease-in duration-75"
+                    x-transition:leave-start="opacity-100 translate-y-0 scale-100"
+                    x-transition:leave-end="opacity-0 -translate-y-1 scale-[0.98]"
+                    x-effect="if (open) requestAnimationFrame(() => positionPanel($el))" role="listbox">
+                    <div x-show="options.length === 0"
+                        class="px-3 py-2 text-[13px] text-neutral-500 dark:text-fg-dim">
+                        {{ $emptyText }}
+                    </div>
+                    <template x-for="option in options" :key="String(option.value)">
+                        <button type="button" class="listbox-option" role="option"
+                            :class="{ 'listbox-option-disabled': option.disabled }"
+                            :aria-selected="String(option.value) === String(value)" @click="choose(option)">
+                            <span class="truncate" x-text="option.label"></span>
+                            <svg x-show="String(option.value) === String(value)" xmlns="http://www.w3.org/2000/svg"
+                                fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor"
+                                class="size-3.5 shrink-0">
+                                <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
+                            </svg>
+                        </button>
+                    </template>
                 </div>
-                <template x-for="option in options" :key="String(option.value)">
-                    <button type="button" class="listbox-option" role="option"
-                        :class="{ 'listbox-option-disabled': option.disabled }"
-                        :aria-selected="String(option.value) === String(value)" @click="choose(option)">
-                        <span class="truncate" x-text="option.label"></span>
-                        <svg x-show="String(option.value) === String(value)" xmlns="http://www.w3.org/2000/svg"
-                            fill="none" viewBox="0 0 24 24" stroke-width="2.5" stroke="currentColor"
-                            class="size-3.5 shrink-0">
-                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                        </svg>
-                    </button>
-                </template>
-            </div>
+            </template>
         @else
             <div x-ref="panel" class="listbox-panel" x-show="open" x-cloak
                 x-transition:enter="transition ease-out duration-100"
diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index 588032e039..144a1a9f9a 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -15,10 +15,6 @@
     'isLarge' => false,
 ])
 
-@php
-    $modalId = 'modal-' . uniqid();
-@endphp
-
 <div x-data="{ modalOpen: @if ($wireOpen) $wire.entangle(@js($wireOpen)) @else false @endif }"
     x-init="$watch('modalOpen', value => { if (!value) { $wire.dispatch('modalClosed') } })"
     :class="{ 'z-40': modalOpen }" @keydown.window.escape="modalOpen=false"
@@ -48,7 +44,7 @@
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
             <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-2 sm:items-center sm:p-4">
-                <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
                     x-transition:enter="ease-out duration-100"
                     x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
                     x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
diff --git a/resources/views/components/shared-variables/editor.blade.php b/resources/views/components/shared-variables/editor.blade.php
index 810b7f69cf..c2c85a3e4e 100644
--- a/resources/views/components/shared-variables/editor.blade.php
+++ b/resources/views/components/shared-variables/editor.blade.php
@@ -5,6 +5,7 @@
     'title',
     'view',
     'variablesLabel',
+    'readOnlyKeys' => [],
 ])
 
 @php
@@ -105,15 +106,32 @@
                     <div class="data-table-header env-table-grid-shared order-[-1]">
                         <span>Name</span>
                         <span>Scope</span>
-                        <span>Comment</span>
+                        <span>{{ count($readOnlyKeys) ? 'Value / comment' : 'Comment' }}</span>
                         <span class="text-center">Multiline</span>
                         <span></span>
                     </div>
                     @foreach ($variables as $env)
-                        <livewire:project.shared.environment-variable.show
-                            wire:key="shared-variable-{{ $type }}-{{ $env->id }}" :env="$env"
-                            :type="$type" :tableAlphabeticalOrder="$alphabeticalPositions[$env->id]"
-                            :tableCreationOrder="$loop->index" />
+                        @if (in_array($env->key, $readOnlyKeys))
+                            <div wire:key="shared-variable-{{ $type }}-{{ $env->id }}" class="env-table-item"
+                                :style="`order: ${sharedSort === 'alphabetical' ? {{ $alphabeticalPositions[$env->id] }} : {{ $loop->index }}}`"
+                                x-show="@js(mb_strtolower($env->key . ' ' . ($env->comment ?? '') . ' ' . $type)).includes(sharedSearch.trim().toLowerCase())">
+                                <div class="data-table-row env-table-grid-shared">
+                                    <div class="min-w-0">
+                                        <div class="env-key-label truncate font-mono text-[13px]" title="{{ $env->key }}">{{ $env->key }}</div>
+                                        <div class="text-[11px] text-neutral-500 dark:text-fg-dim">Built-in · Read-only</div>
+                                    </div>
+                                    <span class="env-type-desktop text-[13px] text-neutral-500 dark:text-fg-dim">{{ str($type)->headline() }}</span>
+                                    <span class="min-w-0 truncate font-mono text-[13px]" title="{{ $env->value }}">{{ $env->value }}</span>
+                                    <span class="data-table-cell-dash">-</span>
+                                    <span class="justify-self-end text-neutral-400 dark:text-fg-faint" title="Built-in variable, managed by Coolify"><x-reicon name="lock" class="size-3.5" /></span>
+                                </div>
+                            </div>
+                        @else
+                            <livewire:project.shared.environment-variable.show
+                                wire:key="shared-variable-{{ $type }}-{{ $env->id }}" :env="$env"
+                                :type="$type" :tableAlphabeticalOrder="$alphabeticalPositions[$env->id]"
+                                :tableCreationOrder="$loop->index" />
+                        @endif
                     @endforeach
                     <div
                         class="order-[9999] flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
@@ -122,6 +140,14 @@
                 </div>
             @endif
         @else
+            @if ($variables->whereIn('key', $readOnlyKeys)->isNotEmpty())
+                <div class="border-b border-neutral-200 p-4 dark:border-white/[0.08]">
+                    <div class="mb-2 text-[12px] text-neutral-500 dark:text-fg-dim">Built-in · Read-only</div>
+                    @foreach ($variables->whereIn('key', $readOnlyKeys)->sortBy('key') as $env)
+                        <div class="break-all font-mono text-[13px]">{{ $env->key }}={{ $env->value }}</div>
+                    @endforeach
+                </div>
+            @endif
             <form wire:submit="submit" class="p-4">
                 <x-unsaved-bar action="submit" />
                 <x-forms.textarea canGate="update" :canResource="$resource" rows="20"
diff --git a/resources/views/components/toast.blade.php b/resources/views/components/toast.blade.php
index 8c3eef13ef..7de075a2ba 100644
--- a/resources/views/components/toast.blade.php
+++ b/resources/views/components/toast.blade.php
@@ -8,6 +8,7 @@
                     description: options.description ?? '',
                     position: options.position ?? 'bottom-right',
                     html: options.html ?? '',
+                    persistent: options.persistent ?? false,
                 },
             }));
         } catch (error) {
@@ -29,14 +30,19 @@
                     type: event.detail.type,
                     html: event.detail.html ? window.sanitizeHTML(event.detail.html) : '',
                     timeout: null,
+                    persistent: event.detail.persistent === true,
                     copied: false,
                     copiedTimeout: null,
                 };
 
                 this.toasts.unshift(toast);
                 if (this.toasts.length > 4) {
-                    const removed = this.toasts.pop();
-                    clearTimeout(removed?.timeout);
+                    const index = this.toasts.findLastIndex(item => !item.persistent);
+                    if (index !== -1) {
+                        const [removed] = this.toasts.splice(index, 1);
+                        clearTimeout(removed.timeout);
+                        clearTimeout(removed.copiedTimeout);
+                    }
                 }
 
                 this.$nextTick(() => {
@@ -49,6 +55,7 @@
             },
             scheduleToast(toast, delay = 2000) {
                 clearTimeout(toast.timeout);
+                if (toast.persistent) return;
                 toast.timeout = setTimeout(() => this.removeToast(toast.id), delay);
             },
             pauseToast(toast) {
diff --git a/resources/views/components/unsaved-bar.blade.php b/resources/views/components/unsaved-bar.blade.php
index 8d029c2fb3..cbc137e07b 100644
--- a/resources/views/components/unsaved-bar.blade.php
+++ b/resources/views/components/unsaved-bar.blade.php
@@ -5,6 +5,8 @@
     // appears when those fields differ from the last server snapshot — not on
     // incidental component state (e.g. $wire.set from x-init, display-only props).
     'targets' => null,
+    // Optional Alpine expression for drafts that survive unrelated server requests.
+    'dirty' => null,
 ])
 
 {{-- Floating "unsaved changes" pill (bottom center). Reveals itself via
@@ -40,7 +42,8 @@
         window.visualViewport?.removeEventListener('scroll', this.updateKeyboardInset);
         window.removeEventListener('resize', this.updateKeyboardInset);
     },
-}" x-bind:style="`--keyboard-inset: ${keyboardInset}px`" wire:dirty.class="is-dirty"
+}" x-bind:style="`--keyboard-inset: ${keyboardInset}px`"
+    @if ($dirty) x-bind:class="{ 'is-dirty': {{ $dirty }} }" @else wire:dirty.class="is-dirty" @endif
     wire:loading.class="is-saving"
     @keydown.enter.window="
         if ($el.classList.contains('is-dirty') &&
diff --git a/resources/views/emails/backup-missing.blade.php b/resources/views/emails/backup-missing.blade.php
new file mode 100644
index 0000000000..69728c26f3
--- /dev/null
+++ b/resources/views/emails/backup-missing.blade.php
@@ -0,0 +1,7 @@
+The enabled backup schedule for {{ $database_name }} has produced no executions in the last {{ $days }} day(s).
+
+@if ($last_execution_at)
+The last execution was at {{ $last_execution_at }}.
+@else
+This schedule has never produced an execution.
+@endif
diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 693c332d95..938b08f4cc 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -212,17 +212,11 @@
         </x-banner>
     @endif
     @if (request()->query->get('success'))
-        <x-banner>
-            <div class="flex items-center gap-2">
-                <svg class="w-5 h-5 text-green-500 shrink-0" fill="currentColor" viewBox="0 0 20 20">
-                    <path fill-rule="evenodd"
-                        d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z"
-                        clip-rule="evenodd" />
-                </svg>
-                <span><span class="font-bold text-green-500">Welcome onboard!</span> Your subscription has been
-                    activated. It could take a few seconds before it's fully active.</span>
-            </div>
-        </x-banner>
+        <span x-init="$nextTick(() => window.toast('Welcome onboard!', {
+            type: 'success',
+            description: 'Your subscription has been activated. It could take a few seconds before it is fully active.',
+            persistent: true,
+        }))"></span>
     @endif
     @if (currentTeam()->subscriptionPastOverDue())
         <x-banner :closable=false>
diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index 429689ce7b..c6113808c5 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -55,7 +55,7 @@
 
         @if ($application->git_based())
             <x-application.settings-section id="advanced-deployment-section" title="Deployment"
-                helper="Automatic deployments and pull request previews.">
+                helper="Automatic deployments from Git webhooks.">
                 <div class="grid w-full gap-4 sm:grid-cols-2">
                     <x-forms.listbox id="isAutoDeployEnabled" label="Auto deploy" onChange="instantSave"
                         helper="Automatically deploy new commits based on Git webhooks."
@@ -63,18 +63,6 @@
                             ['value' => true, 'label' => 'Deploy on push (webhooks)'],
                             ['value' => false, 'label' => 'Manual deployments only'],
                         ]" :disabled="! $canUpdate" />
-                    <x-forms.listbox id="isPreviewDeploymentsEnabled" label="Preview deployments" onChange="instantSave"
-                        helper="Automatically deploy Preview Deployments for all opened PRs.<br><br>Closing a PR deletes its Preview Deployment."
-                        :options="[
-                            ['value' => false, 'label' => 'Disabled'],
-                            ['value' => true, 'label' => 'Deploy opened pull requests'],
-                        ]" :disabled="! $canUpdate" />
-                    <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="instantSave"
-                        helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
-                        :options="[
-                            ['value' => false, 'label' => 'Repository members only'],
-                            ['value' => true, 'label' => 'Public (fork PRs allowed)'],
-                        ]" :disabled="! $canUpdate || ! $isPreviewDeploymentsEnabled" />
                 </div>
             </x-application.settings-section>
 
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index b80085b9d5..93edafde59 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -6,26 +6,31 @@
     $composeDomainGroups = collect($domainRows)
         ->groupBy(fn ($row) => $row['service'] ?? '__unknown')
         ->filter(fn ($rows) => $rows->contains(fn ($row) => ! ($row['is_suggested'] ?? false)));
-    $helperText = $isCompose
-        ? 'Manage domains for every service in this Docker Compose application.'
-        : 'Manage domains for this application.';
     $hasHttpsDomains = collect($domainRows)->contains(
         fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
     );
 @endphp
 
-<div class="flex flex-col gap-4"
+<div id="application-domains-section" class="domains-overview-container flex flex-col gap-4"
     x-data="{
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: @js($editingService ?? ''),
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.modalOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal && !$wire.showDomainConflictModal;
+        },
         openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
             this.editingServiceLabel = $wire.editingService || '';
             this.modalOpen = true;
-            this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
+            this.$nextTick(() => document.getElementById('editingDomainParts-host')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
+            this.editingDomainBaseline = null;
             this.editingServiceLabel = '';
         },
         matchesDomainSearch(value) {
@@ -40,56 +45,29 @@
     @if ($hasDnsChecksInProgress)
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
-    <x-application.settings-section id="domains-section" title="Domains">
-        @can('update', $application)
-            <x-slot:actions>
-                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
-                    <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
-                </x-forms.button>
-            </x-slot:actions>
-        @endcan
+    @if ($labelsAreWritable)
+        <x-callout type="warning" title="Domains managed via labels" class="mb-4">
+            Container label readonly mode is disabled. Domains must be set in the Labels section on the General page.
+        </x-callout>
+    @endif
 
-        @if ($labelsAreWritable)
-            <x-callout type="warning" title="Domains managed via labels" class="mb-4">
-                Container label readonly mode is disabled. Domains must be set in the Labels section on the General page.
-            </x-callout>
-        @endif
+    @if ($isCompose && count($composeServices) === 0)
+        <x-callout type="info" title="No services">
+            No non-database services found in the Docker Compose file. Domains can only be assigned to application
+            services.
+        </x-callout>
+    @endif
 
-        @if ($isCompose && count($composeServices) === 0)
-            <x-callout type="info" title="No services">
-                No non-database services found in the Docker Compose file. Domains can only be assigned to application
-                services.
-            </x-callout>
-        @endif
-
-        @cannot('update', $application)
-            <x-callout type="danger" title="Insufficient permissions">
-                You don't have permission to manage domains. Contact your team administrator for access.
-            </x-callout>
-        @endcannot
-
-        <p class="text-sm text-neutral-500 dark:text-fg-dim">
-            {{ $helperText }}
-        </p>
-
-        @if ($hasHttpsDomains && ! $labelsAreWritable)
-            <div class="mt-4 max-w-md">
-                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
-                    onChange="updateForceHttps"
-                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
-                    :options="[
-                        ['value' => true, 'label' => 'Enabled'],
-                        ['value' => false, 'label' => 'Disabled'],
-                    ]" :disabled="! auth()->user()->can('update', $application)" />
-            </div>
-        @endif
-
-    </x-application.settings-section>
+    @cannot('update', $application)
+        <x-callout type="danger" title="Insufficient permissions">
+            You don't have permission to manage domains. Contact your team administrator for access.
+        </x-callout>
+    @endcannot
 
     {{-- Toolbar --}}
-    <div class="mt-2 flex flex-wrap items-center gap-2">
+    <div class="flex flex-wrap items-center gap-2">
         <div class="min-w-0 flex-1">
+            <h2 id="domains-section">Domains</h2>
             <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
                 {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
                 @if ($suggestedCount > 0)
@@ -98,7 +76,7 @@
             </p>
         </div>
         <div class="ml-auto flex flex-wrap items-center gap-2">
-            @if ($isCompose && $composeDomainGroups->isNotEmpty())
+            @if ($hasRows)
                 <div class="relative w-full sm:w-64">
                     <x-reicon name="search"
                         class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
@@ -107,6 +85,10 @@
                 </div>
             @endif
             @can('update', $application)
+                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
+                    <x-reicon name="refresh" class="size-3.5" />
+                    Check all DNS
+                </x-forms.button>
                 <div class="relative shrink-0">
                     @include('livewire.project.shared.cloudflare-autoconfigure')
                 </div>
@@ -118,7 +100,7 @@
                                 <button type="button"
                                     class="button button-highlighted">
                                     <x-reicon name="plus" class="size-3.5" />
-                                    Add
+                                    Add domain
                                 </button>
                             </x-slot:content>
                             <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
@@ -168,20 +150,46 @@
         </div>
     </div>
 
+    @if ($hasHttpsDomains && ! $labelsAreWritable)
+        <div class="flex flex-wrap items-center justify-end gap-2 service-domains-https">
+            <label for="isForceHttpsEnabled-trigger" class="mb-0! text-[12px]!">Redirect HTTP to HTTPS</label>
+            <x-helper helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL." />
+            <div class="w-28 shrink-0">
+                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled"
+                    onChange="updateForceHttps" portal
+                    :options="[
+                        ['value' => true, 'label' => 'Enabled'],
+                        ['value' => false, 'label' => 'Disabled'],
+                    ]" :disabled="! auth()->user()->can('update', $application)" />
+            </div>
+        </div>
+    @endif
+
     {{-- Table / empty --}}
     <div id="domains-table-section"
         class="application-settings-section-body mt-1 scroll-mt-28 {{ $hasRows ? 'is-flush' : '' }} w-full">
+        @if ($hasRows)
+            <div class="data-table-header service-domains-overview-grid">
+                <span>Domain</span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
+            </div>
+        @endif
         @if ($isCompose && count($composeServices) === 0 && ! $hasRows)
             <x-empty size="sm" title="No services available"
                 description="No non-database services found in the Docker Compose file."
                 icon-name="globe" />
         @elseif ($isCompose && $composeDomainGroups->isEmpty())
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above. Choose which service receives it."
+                description="Add your first domain with the Add domain button above. Choose which service receives it."
                 icon-name="globe" />
         @elseif (! $hasRows)
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above, or generate one with the server wildcard domain."
+                description="Add your first domain with the Add domain button above, or generate one with the server wildcard domain."
                 icon-name="globe" />
         @elseif ($isCompose)
             @php
@@ -213,36 +221,10 @@
                             <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">
                                 {{ $serviceName }}
                             </span>
-                            <div class="flex shrink-0 items-center gap-2">
-                                <span class="hidden text-xs text-neutral-500 sm:inline dark:text-fg-dim">Direction</span>
-                                @if (auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                                    <x-forms.listbox id="domain-direction-service-{{ $redirectWireKey }}" :wire="false"
-                                        :value="$serviceRedirects[$redirectWireKey] ?? 'both'" preserveValue
-                                        onChange="updateServiceRedirect" :onChangeArgs="[$serviceName]" portal :options="[
-                                            ['value' => 'both', 'label' => 'Allow www & non-www'],
-                                            ['value' => 'www', 'label' => 'Redirect to www'],
-                                            ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                                        ]" />
-                                @else
-                                    <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                                        {{ match ($serviceRedirects[$redirectWireKey] ?? 'both') {
-                                            'www' => 'Redirect to www',
-                                            'non-www' => 'Redirect to non-www',
-                                            default => 'Allow both',
-                                        } }}
-                                    </span>
-                                @endif
-                            </div>
                         </div>
 
-                        <div wire:key="application-compose-domain-rows-{{ $redirectWireKey }}-{{ md5(serialize($rows->all())) }}"
+                        <div wire:key="application-compose-domain-rows-{{ $redirectWireKey }}"
                             class="data-table w-full">
-                            <div class="data-table-header domains-table-grid-service">
-                                <span>Domain</span>
-                                <span>DNS Check</span>
-                                <span class="whitespace-nowrap">Search engine indexing</span>
-                                <span></span>
-                            </div>
                             @foreach ($rows as $row)
                                 @php
                                     $index = collect($domainRows)->search(
@@ -256,9 +238,7 @@
                                     'row' => $row,
                                     'application' => $application,
                                     'labelsAreWritable' => $labelsAreWritable,
-                                    'isCompose' => false,
-                                    'showDirectionControl' => false,
-                                    'domainGridClass' => 'domains-table-grid-service',
+                                    'isCompose' => true,
                                 ])
                             @endforeach
                         </div>
@@ -273,13 +253,6 @@
             </div>
         @else
             <div class="data-table w-full">
-                <div class="data-table-header domains-table-grid">
-                    <span>Domain</span>
-                    <span>DNS Check</span>
-                    <span class="whitespace-nowrap">Search engine indexing</span>
-                    <span>Direction</span>
-                    <span></span>
-                </div>
                 @foreach ($domainRows as $index => $row)
                     @include('livewire.project.application.partials.domain-row', [
                         'index' => $index,
@@ -290,10 +263,15 @@
                     ])
                 @endforeach
             </div>
+            <div x-cloak x-show="domainSearch.trim() && !hasDomainSearchResults(@js(collect($domainRows)->pluck('url')->values()))"
+                class="px-4 py-8">
+                <x-empty size="sm" title="No domains found"
+                    description="No domain matches your search." icon-name="search" />
+            </div>
         @endif
     </div>
 
-    {{-- Edit domain modal: open/close is Alpine-only; server runs only on Save / Continue. --}}
+    {{-- One dialog for address edits and automatically saved domain settings. --}}
     <div class="relative h-auto w-auto" :class="{ 'z-40': modalOpen }"
         @keydown.window.escape="if (modalOpen) { closeEditDomain() }">
         <template x-teleport="body">
@@ -315,7 +293,7 @@
                         class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden lg:w-auto lg:min-w-2xl lg:max-w-4xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header class="flex-nowrap!">
-                            <h3 class="min-w-0 flex-1 truncate">Edit domain</h3>
+                            <h3 class="min-w-0 flex-1 truncate">Domain settings</h3>
                             <button type="button" @click="closeEditDomain()"
                                 class="icon-button shrink-0" aria-label="Close">
                                 <x-reicon name="x" class="size-4" />
@@ -324,6 +302,10 @@
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
                             <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                                <template x-if="modalOpen">
+                                    <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges"
+                                        targets="updateDomain,confirmUpdateDomainDespiteDns" />
+                                </template>
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service</label>
@@ -344,19 +326,47 @@
                                     </x-callout>
                                 @endif
 
-                                <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
-                                    @if ($editDomainDnsFailed)
-                                        <x-forms.button type="button" isError
-                                            wire:click="confirmUpdateDomainDespiteDns">
-                                            Continue
-                                        </x-forms.button>
-                                    @else
-                                        <x-forms.button type="submit" wire:target="updateDomain" isHighlighted>
-                                            Save
-                                        </x-forms.button>
-                                    @endif
-                                </div>
+                                @if ($editDomainDnsFailed)
+                                    <x-forms.button type="button" isError wire:click="confirmUpdateDomainDespiteDns">Continue</x-forms.button>
+                                @endif
                             </form>
+                            @php
+                                $editingRow = $editingIndex !== null ? ($domainRows[$editingIndex] ?? null) : null;
+                            @endphp
+                            @if ($editingRow && ! $labelsAreWritable)
+                                @can('update', $application)
+                                    @php
+                                        $editingKey = hash('sha256', $editingRow['url'].'|'.($editingRow['service'] ?? ''));
+                                        $editingRedirectKey = $isCompose ? $this->serviceRedirectWireKey($editingRow['service']) : null;
+                                        $editingRedirectProperty = $isCompose ? 'serviceRedirects.'.$editingRedirectKey : 'redirect';
+                                    @endphp
+                                    <div wire:key="editing-application-domain-settings-{{ $editingKey }}"
+                                        class="mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                        <p class="sm:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">Indexing and redirect changes save automatically.</p>
+                                        <x-forms.listbox id="application-domain-indexing-{{ $editingKey }}"
+                                            label="Search engine indexing" :wire="false" preserveValue
+                                            :value="$application->isDomainNoindexed($editingRow['url']) ? 'noindex' : 'index'"
+                                            onChange="toggleNoindexDomain" :onChangeArgs="[$editingRow['url']]" portal
+                                            :options="[
+                                                ['value' => 'index', 'label' => 'Indexable'],
+                                                ['value' => 'noindex', 'label' => 'Noindex'],
+                                            ]" />
+                                        <x-forms.listbox id="application-domain-direction-{{ $editingKey }}"
+                                            label="www redirect" :wire="false" preserveValue
+                                            :value="$isCompose ? ($serviceRedirects[$editingRedirectKey] ?? 'both') : $redirect"
+                                            :x-effect="'value = $wire.get('.json_encode($editingRedirectProperty).')'"
+                                            :helper="$isCompose ? 'Applies to all domains for this Compose service.' : 'Applies to all domains for this application.'"
+                                            :onChange="$isCompose ? 'updateServiceRedirect' : 'updateRedirect'"
+                                            :onChangeArgs="$isCompose ? [$editingRow['service']] : []" portal
+                                            :options="[
+                                                ['value' => 'both', 'label' => 'No redirect'],
+                                                ['value' => 'www', 'label' => 'Redirect to www'],
+                                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                            ]" />
+                                    </div>
+                                @endcan
+                            @endif
+
                         </div>
                     </div>
                 </div>
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 06d07d9ffe..f01f19ce30 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -34,6 +34,9 @@
                     <x-status-summary :status="$application->status" />
                     <x-applications.links :application="$application" compact />
                 </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    <x-application.restart-limit-warning :application="$application" />
+                </div>
             </div>
         </div>
 
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index cf8970d814..bcacb44dc5 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -7,49 +7,35 @@
         default => 'neutral',
     };
     $dnsLabel = match ($row['dns_status']) {
-        'ok' => 'DNS OK',
+        'ok' => 'DNS matches',
         'failed' => 'DNS mismatch',
         'skipped' => 'DNS skipped',
         'checking' => 'Checking DNS...',
-        'pending' => 'DNS pending',
+        'pending' => 'Not checked',
         default => 'DNS unknown',
     };
-    $gridClass = $domainGridClass ?? (($isCompose ?? false) ? 'domains-table-grid-compose' : 'domains-table-grid');
-    $domainParts = $isSuggested ? null : parse_url($row['url']);
+    $gridClass = 'service-domains-overview-grid';
+    $publicUrl = getFqdnWithoutPort($row['url']);
+    $domainParts = $isSuggested ? null : parse_url($publicUrl);
     $faviconUrl = is_array($domainParts) && isset($domainParts['scheme'], $domainParts['host'])
-        ? $domainParts['scheme'].'://'.$domainParts['host'].(isset($domainParts['port']) ? ':'.$domainParts['port'] : '').'/favicon.ico'
+        ? $domainParts['scheme'].'://'.$domainParts['host'].'/favicon.ico'
         : null;
-    $redirectPairKey = function (string $url): string {
-        $parts = parse_url($url);
-        if (! is_array($parts) || ! isset($parts['host'])) {
-            return $url;
-        }
-
-        $host = preg_replace('/^www\./i', '', $parts['host']);
-
-        return strtolower(($parts['scheme'] ?? '').'://'.$host.':'.($parts['port'] ?? '').($parts['path'] ?? ''));
-    };
-    $pairKey = $redirectPairKey($row['url']);
-    $firstPairRowIndex = collect($domainRows)
-        ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
-        ->filter(fn ($item) => ($item['service'] ?? null) === ($row['service'] ?? null))
-        ->filter(fn ($item) => $redirectPairKey($item['url']) === $pairKey)
-        ->keys()
-        ->first();
-    $showDirection = ($showDirectionControl ?? true) && ! $isSuggested && $firstPairRowIndex === $index;
+    $rowDirection = $isCompose
+        ? ($serviceRedirects[$this->serviceRedirectWireKey($row['service'])] ?? 'both')
+        : $redirect;
+    $isNoindexed = $application->isDomainNoindexed($row['url']);
     $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
 @endphp
 
 <div wire:key="domain-row-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
-    class="env-table-item">
+    x-show="matchesDomainSearch(@js(($row['service'] ?? '').' '.$row['url']))" class="env-table-item">
     <div @class([
         'data-table-row',
         $gridClass,
         'domains-row-suggested' => $isSuggested,
-        'domains-row-without-direction' => ! $showDirection,
     ])>
         <div class="flex min-w-0 flex-col gap-1">
-            <div class="flex min-w-0 flex-wrap items-center gap-2">
+            <div class="flex min-w-0 items-center gap-2">
                 @if ($isSuggested)
                     <span
                         class="min-w-0 text-[13px] text-black sm:truncate dark:text-white"
@@ -69,29 +55,15 @@
                                 class="invisible absolute inset-0 size-4 rounded-sm" />
                         </span>
                     @endif
-                    <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                        class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                        title="{{ $row['url'] }}">
-                        {{ $row['url'] }}
+                    <a href="{{ $publicUrl }}" target="_blank" rel="noopener noreferrer"
+                        class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                        title="{{ $publicUrl }}">
+                        {{ $publicUrl }}
                     </a>
-                    @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                        <span class="table-badge shrink-0"
-                            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
-                            Internal port {{ $row['internal_port'] }}
-                        </span>
-                    @else
-                        <span class="table-badge table-badge-danger shrink-0"
-                            title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
-                            No internal port
-                        </span>
-                    @endif
                 @endif
                 @if ($isSuggested && ! empty($row['suggestion_label']))
                     <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
                 @endif
-                @if ($isCompose ?? false)
-                    <span class="domains-service-mobile table-badge shrink-0">{{ $row['service'] ?? '-' }}</span>
-                @endif
             </div>
             @if ($isSuggested && filled($row['dns_message']))
                 <p class="text-[12px] leading-4 text-amber-700 sm:truncate dark:text-amber-400/90"
@@ -101,14 +73,47 @@
             @endif
         </div>
 
-        @if ($isCompose ?? false)
-            <div class="domains-service-desktop min-w-0 truncate text-[13px] text-neutral-500 dark:text-fg-dim"
-                title="{{ $row['service'] ?? '' }}">
-                {{ $row['service'] ?? '-' }}
-            </div>
-        @endif
+        <div class="service-domain-detail" title="Protocol redirect">
+            <span class="service-domain-detail-label">Protocol redirect</span>
+            <span>{{ str_starts_with($row['url'], 'https://') && $isForceHttpsEnabled ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+        </div>
+        <div class="service-domain-detail" title="Domain redirect">
+            <span class="service-domain-detail-label">Domain redirect</span>
+            <span>{{ match ($rowDirection) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+        </div>
+        <div class="service-domain-detail"
+            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the application or Compose service port' }}">
+            <span class="service-domain-detail-label">Internal port</span>
+            @if (filled($row['internal_port'] ?? null))
+                <span aria-label="Internal port {{ $row['internal_port'] }}">{{ $row['internal_port'] }}</span>
+            @else
+                <span role="img" aria-label="No internal port" title="No internal port. Set Ports Exposes or a per-domain internal port so the proxy can route this domain." class="text-red-500 dark:text-red-400">
+                    <x-reicon name="alert-triangle" class="size-4" />
+                </span>
+            @endif
+        </div>
+        <div class="service-domain-detail">
+            <span class="service-domain-detail-label">Search indexing</span>
+            <span role="img" aria-label="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}"
+                title="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}">
+                <x-reicon :name="$isNoindexed ? 'x' : 'check'" class="size-4" />
+            </span>
+        </div>
 
-        <div class="flex min-w-0 items-center">
+        <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+            @if (str_starts_with($row['url'], 'https://') && $isForceHttpsEnabled)
+                <span>HTTP → HTTPS</span>
+            @endif
+            @if (in_array($rowDirection, ['www', 'non-www'], true))
+                <span>{{ $rowDirection === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+            @elseif (! str_starts_with($row['url'], 'https://') || ! $isForceHttpsEnabled)
+                <span>No redirects</span>
+            @endif
+            <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+            <span>{{ $isNoindexed ? 'Noindex' : 'Indexable' }}</span>
+        </div>
+
+        <div class="service-domain-dns flex min-w-0 items-center">
             @if ($row['dns_status'] === 'failed')
                 <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
                     title="View DNS records to fix" class="cursor-pointer hover:bg-neutral-200 dark:hover:bg-white/[0.1]" />
@@ -118,56 +123,7 @@
             @endif
         </div>
 
-        <div class="min-w-0" title="Search engine indexing">
-            @unless ($isSuggested)
-                <span class="domains-mobile-label">Search engine indexing</span>
-            @endunless
-            @if ($isSuggested)
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">-</span>
-            @elseif (auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                <x-forms.listbox id="domain-indexing-{{ $index }}" :wire="false"
-                    preserveValue
-                    :value="$application->isDomainNoindexed($row['url']) ? 'noindex' : 'index'"
-                    onChange="toggleNoindexDomain" :onChangeArgs="[$row['url']]" portal :options="[
-                        ['value' => 'index', 'label' => 'Indexable'],
-                        ['value' => 'noindex', 'label' => 'Noindex'],
-                    ]" />
-            @else
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                    {{ $application->isDomainNoindexed($row['url']) ? 'Noindex' : 'Indexable' }}
-                </span>
-            @endif
-        </div>
-
-        @if ($showDirectionControl ?? true)
-        <div class="min-w-0" title="Direction">
-            @php
-                $rowDirection = $domainDirection ?? $redirect;
-                $directionLabel = match ($rowDirection) {
-                    'www' => 'Redirect to www',
-                    'non-www' => 'Redirect to non-www',
-                    default => 'Allow both',
-                };
-            @endphp
-            @if ($showDirection)
-                <span class="domains-mobile-label">Direction</span>
-            @endif
-            @if ($showDirection && auth()->user()?->can('update', $application) && ! $labelsAreWritable)
-                <x-forms.listbox id="domain-direction-{{ $index }}" :wire="false" :value="$rowDirection"
-                    preserveValue
-                    :onChange="$isCompose ? 'updateServiceRedirect' : 'updateRedirect'"
-                    :onChangeArgs="$isCompose ? [$row['service']] : []" portal :options="[
-                        ['value' => 'both', 'label' => 'Allow www & non-www'],
-                        ['value' => 'www', 'label' => 'Redirect to www'],
-                        ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                    ]" />
-            @elseif ($showDirection)
-                <span class="text-[13px] text-neutral-500 dark:text-fg-dim">{{ $directionLabel }}</span>
-            @endif
-        </div>
-        @endif
-
-        <div class="flex items-center justify-end gap-1">
+        <div class="service-domain-actions flex items-center justify-end gap-1">
             @can('update', $application)
                 <button type="button" wire:click="checkDomainDns({{ $index }})"
                     wire:loading.attr="disabled"
@@ -193,7 +149,7 @@
                     @else
                         <button type="button" wire:click="startEdit({{ $index }})"
                             class="icon-button shrink-0"
-                            title="Edit domain" aria-label="Edit domain">
+                            title="Domain settings" aria-label="Settings for {{ $publicUrl }}">
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                         <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?" buttonTitle="Remove"
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
index 2a131e43cd..69e18a2e5c 100644
--- a/resources/views/livewire/project/application/preview-domains.blade.php
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -1,26 +1,48 @@
-<div class="flex flex-col gap-3" x-data="{ editOpen: false }"
-    @open-preview-domain-edit.window="editOpen = true"
-    @close-preview-domain-edit.window="editOpen = false">
+<div class="domains-overview-container flex flex-col gap-3" x-data="{
+        editOpen: false,
+        domainSearch: '',
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.editOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal;
+        },
+        openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
+            this.editOpen = true;
+            this.$nextTick(() => this.$refs.editForm.querySelector('input[required]')?.focus());
+        },
+        closeEditDomain() { this.editOpen = false; this.editingDomainBaseline = null; },
+        matchesDomainSearch(value) { return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase()); },
+    }"
+    @open-preview-domain-edit.window="if ($event.detail.previewId === {{ $preview->id }}) openEditDomain()"
+    @close-preview-domain-edit.window="if ($event.detail.previewId === {{ $preview->id }}) closeEditDomain()"
+    @keydown.escape.window="if (editOpen && !$wire.showPortWarningModal) closeEditDomain()">
     @if (collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking'))
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
     <div class="flex flex-wrap items-center gap-2">
-        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+        <p class="min-w-0 flex-1 truncate text-[13px] text-neutral-500 dark:text-fg-dim">
             {{ count($domainRows) }} domain{{ count($domainRows) === 1 ? '' : 's' }}
         </p>
+        @if (count($domainRows) > 0)
+            <input type="search" x-model="domainSearch" aria-label="Search preview domains"
+                class="input h-8! w-full sm:w-64!" placeholder="Search services or domains" />
+        @endif
         @can('update', $preview->application)
             @if (count($domainRows) > 0)
                 <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
                     <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
+                    Check all DNS
                 </x-forms.button>
             @endif
             <x-modal-input title="Add domain" :closeOutside="false" :wireIgnore="false"
-                canGate="update" :canResource="$preview->application">
+                canGate="update" :canResource="$preview->application"
+                @close-preview-domain-add.window="if ($event.detail.previewId === {{ $preview->id }}) modalOpen = false">
                 <x-slot:content>
                     <button type="button" class="button button-highlighted">
                         <x-reicon name="plus" class="size-3.5" />
-                        Add
+                        Add domain
                     </button>
                 </x-slot:content>
                 <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
@@ -46,113 +68,170 @@
         </div>
     @else
         <div class="application-settings-section-body is-flush overflow-visible">
-            <div class="data-table-header domains-table-grid-service">
+            <div class="data-table-header service-domains-overview-grid">
                 <span>Domain</span>
-                <span>DNS check</span>
-                <span></span>
-                <span></span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
             </div>
-            @foreach ($domainRows as $index => $row)
-                @php
-                    $dnsType = match ($row['dns_status']) {
-                        'ok' => 'success',
-                        'failed' => 'error',
-                        'skipped' => 'warning',
-                        default => 'neutral',
-                    };
-                    $dnsLabel = match ($row['dns_status']) {
-                        'ok' => 'DNS OK',
-                        'failed' => 'DNS mismatch',
-                        'skipped' => 'DNS skipped',
-                        default => 'DNS pending',
-                    };
-                    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
-                @endphp
-                <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" class="env-table-item">
-                    <div class="data-table-row domains-table-grid-service">
-                        <div class="flex min-w-0 flex-col gap-1">
-                            <div class="flex min-w-0 flex-wrap items-center gap-2">
-                                <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
-                                <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                                    class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                                    title="{{ $row['url'] }}">{{ $row['url'] }}</a>
-                                @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                                    <span class="table-badge shrink-0"
-                                        title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
-                                        Internal port {{ $row['internal_port'] }}
-                                    </span>
+            @foreach (collect($domainRows)->groupBy(fn ($row) => $row['service'] ?? '', preserveKeys: true) as $serviceName => $rows)
+                @if ($isCompose)
+                    <div wire:key="preview-domain-service-{{ md5($serviceName) }}"
+                        x-show="matchesDomainSearch(@js($serviceName.' '.$rows->pluck('url')->implode(' ')))"
+                        class="border-b border-neutral-200 bg-neutral-50 px-4 py-3 text-sm font-medium dark:border-white/10 dark:bg-white/[0.04]">{{ $serviceName }}</div>
+                @endif
+                @foreach ($rows as $index => $row)
+                    @php
+                        $dnsType = match ($row['dns_status']) {
+                            'ok' => 'success',
+                            'failed' => 'error',
+                            'skipped' => 'warning',
+                            default => 'neutral',
+                        };
+                        $dnsLabel = match ($row['dns_status']) {
+                            'ok' => 'DNS matches',
+                            'failed' => 'DNS mismatch',
+                            'skipped' => 'DNS skipped',
+                            'checking' => 'Checking DNS...',
+                            'pending' => 'Not checked',
+                            default => 'DNS unknown',
+                        };
+                        $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+                    @endphp
+                    <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" x-show="matchesDomainSearch(@js(($row['service'] ?? '').' '.$row['url']))" class="env-table-item">
+                        <div class="data-table-row service-domains-overview-grid">
+                            <div class="flex min-w-0 flex-col gap-1">
+                                <div class="flex min-w-0 items-center gap-2">
+                                    <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
+                                    <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank" rel="noopener noreferrer"
+                                        class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                        title="{{ getFqdnWithoutPort($row['url']) }}">{{ getFqdnWithoutPort($row['url']) }}</a>
+                                </div>
+                            </div>
+                            <div class="service-domain-detail" title="Protocol redirect">
+                                <span class="service-domain-detail-label">Protocol redirect</span>
+                                <span>{{ str_starts_with($row['url'], 'https://') && $preview->application->isForceHttpsEnabled() ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+                            </div>
+                            <div class="service-domain-detail" title="Domain redirect">
+                                <span class="service-domain-detail-label">Domain redirect</span>
+                                <span>{{ match (($row['redirect'] ?? 'both')) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+                            </div>
+                            <div class="service-domain-detail"
+                                title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the application or Compose service port' }}">
+                                <span class="service-domain-detail-label">Internal port</span>
+                                @if (filled($row['internal_port'] ?? null))
+                                    <span aria-label="Internal port {{ $row['internal_port'] }}">{{ $row['internal_port'] }}</span>
                                 @else
-                                    <span class="table-badge table-badge-danger shrink-0"
-                                        title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
-                                        No internal port
+                                    <span role="img" aria-label="No internal port" title="No internal port. Set Ports Exposes or a per-domain internal port so the proxy can route this domain." class="text-red-500 dark:text-red-400">
+                                        <x-reicon name="alert-triangle" class="size-4" />
                                     </span>
                                 @endif
-                                @if (filled($row['service']))
-                                    <span class="table-badge shrink-0">{{ $row['service'] }}</span>
-                                @endif
                             </div>
-                        </div>
-                        <div class="flex min-w-0 items-center">
-                            <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
-                        </div>
-                        <div class="hidden"></div>
-                        <div class="flex items-center justify-end gap-1">
-                            @can('update', $preview->application)
-                                <button type="button" wire:click="checkDomainDns({{ $index }})"
-                                    wire:loading.attr="disabled"
-                                    wire:target="checkDomainDns({{ $index }}),checkAllDns"
-                                    class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
-                                    <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
-                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
-                                    <x-loading-on-button wire:loading.delay
-                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
-                                </button>
-                                <button type="button" wire:click="startEdit({{ $index }})"
-                                    class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
-                                    <x-reicon name="settings" class="size-3.5" />
-                                </button>
-                                <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
-                                    buttonTitle="Remove" isErrorButton
-                                    submitAction="removeDomainByKey({{ $domainKey }})"
-                                    :actions="[
-                                        'This domain will be removed from the preview deployment.',
-                                        'Redeploy the preview to apply proxy changes.',
-                                    ]"
-                                    :confirmWithPassword="false" :confirmWithText="false"
-                                    step2ButtonText="Remove domain">
-                                    <x-slot:trigger>
-                                        <button type="button"
-                                            class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
-                                            title="Remove domain" aria-label="Remove domain">
-                                            <x-reicon name="trash" class="size-3.5" />
-                                        </button>
-                                    </x-slot:trigger>
-                                </x-modal-confirmation>
-                            @endcan
+                            <div class="service-domain-detail">
+                                <span class="service-domain-detail-label">Search indexing</span>
+                                <span role="img" aria-label="Search indexing blocked"
+                                    title="Search indexing blocked">
+                                    <x-reicon name="x" class="size-4" />
+                                </span>
+                            </div>
+
+                            <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+                                @if (str_starts_with($row['url'], 'https://') && $preview->application->isForceHttpsEnabled())
+                                    <span>HTTP → HTTPS</span>
+                                @endif
+                                @if (in_array($row['redirect'] ?? 'both', ['www', 'non-www'], true))
+                                    <span>{{ ($row['redirect'] ?? 'both') === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+                                @elseif (! str_starts_with($row['url'], 'https://') || ! $preview->application->isForceHttpsEnabled())
+                                    <span>No redirects</span>
+                                @endif
+                                <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+                                <span>Noindex</span>
+                            </div>
+
+                            <div class="service-domain-dns flex min-w-0 items-center">
+                                <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
+                            </div>
+                            <div class="service-domain-actions flex items-center justify-end gap-1">
+                                @can('update', $preview->application)
+                                    <button type="button" wire:click="checkDomainDns({{ $index }})"
+                                        wire:loading.attr="disabled"
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns"
+                                        class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
+                                        <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
+                                            wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                        <x-loading-on-button wire:loading.delay
+                                            wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                    </button>
+                                    <button type="button" wire:click="startEdit({{ $index }})"
+                                        class="icon-button shrink-0" title="Domain settings" aria-label="Settings for {{ getFqdnWithoutPort($row['url']) }}">
+                                        <x-reicon name="settings" class="size-3.5" />
+                                    </button>
+                                    <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
+                                        buttonTitle="Remove" isErrorButton
+                                        submitAction="removeDomainByKey({{ $domainKey }})"
+                                        :actions="[
+                                            'This domain will be removed from the preview deployment.',
+                                            'Redeploy the preview to apply proxy changes.',
+                                        ]"
+                                        :confirmWithPassword="false" :confirmWithText="false"
+                                        step2ButtonText="Remove domain">
+                                        <x-slot:trigger>
+                                            <button type="button"
+                                                class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
+                                                title="Remove domain" aria-label="Remove domain">
+                                                <x-reicon name="trash" class="size-3.5" />
+                                            </button>
+                                        </x-slot:trigger>
+                                    </x-modal-confirmation>
+                                @endcan
+                            </div>
                         </div>
                     </div>
-                </div>
+                @endforeach
             @endforeach
+            <div x-cloak x-show="domainSearch.trim() && !@js(collect($domainRows)->map(fn ($row) => ($row['service'] ?? '').' '.$row['url'])->values()).some(value => matchesDomainSearch(value))" class="px-4 py-8">
+                <x-empty size="sm" title="No domains found" description="No service or domain matches your search." icon-name="search" />
+            </div>
         </div>
     @endif
 
     <template x-teleport="body">
         <div x-show="editOpen" x-cloak class="fixed inset-0 z-99 overflow-y-auto">
-            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="editOpen = false"></div>
+            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="closeEditDomain()"></div>
             <div class="relative flex min-h-full items-center justify-center p-4">
                 <div x-show="editOpen" x-trap.inert.noscroll="editOpen"
-                    class="application-settings-form application-settings-section relative w-full max-w-3xl">
+                    data-preview-domain-dialog class="application-settings-form application-settings-section relative w-full max-w-3xl">
                     <header>
-                        <h3>Edit domain</h3>
-                        <button type="button" @click="editOpen = false" class="icon-button" aria-label="Close">
+                        <h3>Domain settings</h3>
+                        <button type="button" @click="closeEditDomain()" class="icon-button" aria-label="Close">
                             <x-reicon name="x" class="size-4" />
                         </button>
                     </header>
                     <div class="application-settings-section-body">
-                        <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                        <form x-ref="editForm" wire:submit="updateDomain" class="flex flex-col gap-4">
+                            <template x-if="editOpen">
+                                <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges" targets="updateDomain,confirmUseUnknownPort" />
+                            </template>
+                            @if ($editingIndex !== null && filled($domainRows[$editingIndex]['service'] ?? null))
+                                <x-forms.input label="Service" :value="$domainRows[$editingIndex]['service']" readonly />
+                            @endif
                             <x-forms.domain-input id="editingDomainParts" />
-                            <div class="flex justify-end">
-                                <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                            <div class="grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                <x-forms.listbox id="preview-domain-indexing-{{ $preview->id }}" label="Search engine indexing"
+                                    :wire="false" value="noindex" disabled
+                                    helper="Preview deployments are always excluded from search indexing."
+                                    :options="[['value' => 'noindex', 'label' => 'Noindex']]" />
+                                <x-forms.listbox id="preview-domain-direction-{{ $preview->id }}" label="www redirect"
+                                    :wire="false" :value="$editingIndex !== null ? ($domainRows[$editingIndex]['redirect'] ?? 'both') : 'both'" disabled
+                                    helper="Read-only preview routing configuration."
+                                    :options="[
+                                        ['value' => 'both', 'label' => 'No redirect'],
+                                        ['value' => 'www', 'label' => 'Redirect to www'],
+                                        ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                    ]" />
                             </div>
                         </form>
                     </div>
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index ac616b84a3..b85d769af3 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -1,4 +1,27 @@
 <div class="flex flex-col gap-6">
+    @if ($application->git_based())
+        @php
+            $canUpdate = auth()->user()->can('update', $application);
+        @endphp
+        <x-application.settings-section id="preview-settings-section" title="Preview settings"
+            helper="Automatic pull request deployments and who can trigger them.">
+            <div class="grid w-full gap-4 sm:grid-cols-2">
+                <x-forms.listbox id="isPreviewDeploymentsEnabled" label="Preview deployments" onChange="savePreviewSettings"
+                    helper="Automatically deploy Preview Deployments for all opened PRs.<br><br>Closing a PR deletes its Preview Deployment."
+                    :options="[
+                        ['value' => false, 'label' => 'Disabled'],
+                        ['value' => true, 'label' => 'Deploy opened pull requests'],
+                    ]" :disabled="! $canUpdate" />
+                <x-forms.listbox id="isPrDeploymentsPublicEnabled" label="PR deployment access" onChange="savePreviewSettings"
+                    helper="When public, anyone can trigger PR deployments. Otherwise fork PRs are blocked and only repository owners, members, and collaborators can trigger them."
+                    :options="[
+                        ['value' => false, 'label' => 'Repository members only'],
+                        ['value' => true, 'label' => 'Public (fork PRs allowed)'],
+                    ]" :disabled="! $canUpdate || ! $isPreviewDeploymentsEnabled" />
+            </div>
+        </x-application.settings-section>
+    @endif
+
     <livewire:project.application.preview.form :application="$application" />
 
     @if (count($application->additional_servers) > 0)
diff --git a/resources/views/livewire/project/database/backup-edit/general.blade.php b/resources/views/livewire/project/database/backup-edit/general.blade.php
index caabf249ac..08c64b1171 100644
--- a/resources/views/livewire/project/database/backup-edit/general.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/general.blade.php
@@ -19,9 +19,9 @@
                         Disable backup
                     </x-forms.button>
                 @endif
-                @if (str($status)->startsWith('running'))
-                    <x-forms.button type="button" wire:click="backupNow">Back up now</x-forms.button>
-                @endif
+                <x-forms.button type="button" wire:click="backupNow"
+                    :disabled="! str($status)->startsWith('running')"
+                    :tooltip="! str($status)->startsWith('running') ? 'The database must be running to start a backup.' : null">Back up now</x-forms.button>
             </div>
         </div>
 
@@ -91,6 +91,9 @@
                     required />
                 <x-forms.input label="Timeout" id="timeout" type="number" min="60"
                     helper="Maximum backup runtime in seconds." required />
+                <x-forms.input label="Missing backup alert after" id="missingBackupNotificationDays" type="number"
+                    min="0" max="365" suffix="days" canGate="manageBackups" :canResource="$backup->database"
+                    helper="Notify through backup failure channels after this many days without an execution. Use 0 to disable." required />
             </div>
         </div>
     </section>
diff --git a/resources/views/livewire/project/database/backup-edit/s3.blade.php b/resources/views/livewire/project/database/backup-edit/s3.blade.php
index 180ff0a169..a06792bb09 100644
--- a/resources/views/livewire/project/database/backup-edit/s3.blade.php
+++ b/resources/views/livewire/project/database/backup-edit/s3.blade.php
@@ -35,12 +35,12 @@
                 @endif
             </div>
             <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" :required="$saveS3"
+                <x-forms.listbox id="s3StorageId" label="S3 storage" portal :required="$saveS3"
                     :options="$availableS3Storages->map(fn ($s3) => [
                         'value' => $s3->id,
                         'label' => $s3->name,
                     ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy" :disabled="! $saveS3"
+                <x-forms.listbox id="disableLocalBackup" label="Local copy" portal :disabled="! $saveS3"
                     :options="[
                         ['value' => false, 'label' => 'Keep local backup'],
                         ['value' => true, 'label' => 'Delete after S3 upload'],
diff --git a/resources/views/livewire/project/database/backup-now.blade.php b/resources/views/livewire/project/database/backup-now.blade.php
index e5b1daf8d8..6e91428573 100644
--- a/resources/views/livewire/project/database/backup-now.blade.php
+++ b/resources/views/livewire/project/database/backup-now.blade.php
@@ -1 +1,3 @@
-<x-forms.button wire:click='backupNow'>Backup Now</x-forms.button>
+<x-forms.button wire:click="backupNow"
+    :disabled="! str($backup->database->status)->startsWith('running')"
+    :tooltip="! str($backup->database->status)->startsWith('running') ? 'The database must be running to start a backup.' : null">Back up now</x-forms.button>
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
index b5c2057cfd..ee992b9a47 100644
--- a/resources/views/livewire/project/service/backup-executions.blade.php
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -21,11 +21,17 @@
 
     <x-application.settings-section title="Executions"
         helper="Review backup runs across every database and storage target in this service." flush>
+        @if ($executions->total() > 10)
+            <x-slot:actions>
+                <x-page-size-select model="perPage" livewire />
+            </x-slot:actions>
+        @endif
         @if ($executions->isEmpty())
             <x-empty size="sm" title="No backup executions"
                 description="Execution history appears here after a backup schedule runs." icon-name="browser-terminal" />
         @else
-            <div class="data-table w-full overflow-x-auto">
+            <div class="data-table relative w-full overflow-x-auto">
+                <x-table.loading target="previousPage,nextPage,setPage,perPage" text="Loading executions..." />
                 <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
                     <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
                 </div>
@@ -42,7 +48,13 @@
                         wire:click="openExecution('{{ $execution['uuid'] }}')"
                         wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
                         class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
-                        <span class="truncate font-medium text-neutral-950 dark:text-fg" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                        <span class="flex min-w-0 items-center gap-2 font-medium text-neutral-950 dark:text-fg">
+                            <span class="truncate" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                            <span tabindex="0" data-tooltip="{{ $execution['s3_tooltip'] }}"
+                                aria-label="{{ $execution['s3_tooltip'] }}" class="shrink-0 text-neutral-500 dark:text-fg-dim">
+                                <x-reicon name="cloud" class="size-3.5" aria-hidden="true" />
+                            </span>
+                        </span>
                         <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
                         <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
                         <span>{{ $execution['started_at']->diffForHumans() }}</span>
@@ -58,6 +70,12 @@
                         </span>
                     </div>
                 @endforeach
+                @if ($executions->hasPages())
+                    <x-table-pagination :from="$executions->firstItem()" :to="$executions->lastItem()"
+                        :total="$executions->total()" :current-page="$executions->currentPage()" :last-page="$executions->lastPage()"
+                        wire-target="previousPage,nextPage,setPage,perPage"
+                        previous-action="previousPage('executionsPage')" next-action="nextPage('executionsPage')" />
+                @endif
             </div>
         @endif
     </x-application.settings-section>
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index a02d5ae758..1f2bc6f5f1 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -15,18 +15,26 @@
     })->values();
 @endphp
 
-<div class="flex flex-col gap-4"
+<div id="service-domains-section" class="flex flex-col gap-4"
     x-data="{
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: '',
+        editingDomainBaseline: null,
+        get hasAddressChanges() {
+            return this.modalOpen && this.editingDomainBaseline !== null
+                && JSON.stringify($wire.editingDomainParts) !== this.editingDomainBaseline
+                && !$wire.showPortWarningModal && !$wire.showDomainConflictModal;
+        },
         openEditDomain() {
+            this.editingDomainBaseline = JSON.stringify($wire.editingDomainParts);
             this.editingServiceLabel = $wire.serviceApps.find(app => app.id === $wire.editingServiceApplicationId)?.name || '';
             this.modalOpen = true;
-            this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
+            this.$nextTick(() => document.getElementById('editingDomainParts-host')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
+            this.editingDomainBaseline = null;
             this.editingServiceLabel = '';
         },
         matchesDomainSearch(value) {
@@ -41,37 +49,23 @@
     @if ($hasDnsChecksInProgress)
         <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
     @endif
-    <x-application.settings-section id="service-domains-section" title="Domains">
-        @can('update', $service)
-            <x-slot:actions>
-                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled"
-                    wire:target="checkAllDns,checkDomainDns">
-                    <x-reicon name="refresh" class="size-3.5" />
-                    Recheck DNS
-                </x-forms.button>
-            </x-slot:actions>
-        @endcan
-
-        @cannot('update', $service)
-            <x-callout type="danger" title="Insufficient permissions">
-                You don't have permission to manage domains. Contact your team administrator for access.
-            </x-callout>
-        @endcannot
-
-        <p class="text-sm text-neutral-500 dark:text-fg-dim">
-            Manage domains and www/non-www redirects for applications in this stack.
-        </p>
-
-    </x-application.settings-section>
+    @cannot('update', $service)
+        <x-callout type="danger" title="Insufficient permissions">
+            You don't have permission to manage domains. Contact your team administrator for access.
+        </x-callout>
+    @endcannot
 
     {{-- Toolbar --}}
     <div class="mt-2 flex flex-wrap items-center gap-2">
-        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
-            {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }}
-            @if ($suggestedCount > 0)
-                · {{ $suggestedCount }} not added
-            @endif
-        </p>
+        <div class="min-w-0 flex-1">
+            <h3>Domains</h3>
+            <p class="text-[13px] text-neutral-500 dark:text-fg-dim">
+                {{ $configuredCount }} domain{{ $configuredCount === 1 ? '' : 's' }} across {{ $domainGroups->count() }} service{{ $domainGroups->count() === 1 ? '' : 's' }}
+                @if ($suggestedCount > 0)
+                    · {{ $suggestedCount }} not added
+                @endif
+            </p>
+        </div>
         <div class="ml-auto flex flex-wrap items-center gap-2">
             @if ($domainGroups->isNotEmpty())
                 <div class="relative w-full sm:w-64">
@@ -82,6 +76,13 @@
                 </div>
             @endif
             @can('update', $service)
+                @if ($configuredCount > 0)
+                    <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled"
+                        wire:target="checkAllDns,checkDomainDns">
+                        <x-reicon name="refresh" class="size-3.5" />
+                        Check all DNS
+                    </x-forms.button>
+                @endif
                 @if ($serviceAppCount > 0)
                     <div class="relative shrink-0">
                         @include('livewire.project.shared.cloudflare-autoconfigure')
@@ -92,12 +93,12 @@
                             <button type="button"
                                 class="button button-highlighted">
                                 <x-reicon name="plus" class="size-3.5" />
-                                Add
+                                Add domain
                             </button>
                         </x-slot:content>
                         <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                             {{-- Always show which service receives the domain --}}
-                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required
+                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required portal
                                 helper="Domain will be assigned to this compose service application."
                                 :options="collect($serviceApps)->map(fn ($app) => [
                                     'value' => $app['id'],
@@ -153,12 +154,21 @@
     @elseif (! $hasRows)
         <div class="application-settings-section-body mt-1 w-full scroll-mt-28">
             <x-empty size="sm" title="No domains configured"
-                description="Add your first domain with the + Add button above. Choose which service application receives it."
+                description="Add your first domain with the Add domain button above. Choose which service application receives it."
                 icon-name="globe" />
         </div>
     @else
         <div wire:key="service-domains-list"
             class="application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overflow-visible">
+            <div class="data-table-header service-domains-overview-grid">
+                <span>Domain</span>
+                <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+                <span class="text-right">Actions</span>
+            </div>
             @foreach ($domainGroups as $appId => $rows)
                 @php
                     $app = collect($serviceApps)->firstWhere('id', (int) $appId);
@@ -173,12 +183,13 @@
                     <div class="flex w-full flex-wrap items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
                         @if ($hasHttpsDomains)
-                            <div class="w-full sm:w-72">
+                            <div class="flex w-full items-center gap-2 sm:w-auto service-domains-https">
+                                <label for="service-force-https-{{ $appId }}-trigger" class="mb-0! whitespace-nowrap text-[12px]!">Redirect HTTP to HTTPS</label>
+                                <x-helper helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL." />
                                 <x-forms.listbox canGate="update" :canResource="$service" id="forceHttpsRedirects.{{ $appId }}"
-                                    htmlId="service-force-https-{{ $appId }}"
-                                    label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
+                                    htmlId="service-force-https-{{ $appId }}" preserveValue
+                                    onChange="updateForceHttps"
                                     :onChangeArgs="[(int) $appId]"
-                                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
                                     :options="[
                                         ['value' => true, 'label' => 'Enabled'],
                                         ['value' => false, 'label' => 'Disabled'],
@@ -187,13 +198,13 @@
                         @endif
                     </div>
 
-                    <div wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}">
+                    <div wire:key="service-domain-rows-{{ $appId }}">
                         @include('livewire.project.service.partials.domain-table', [
                             'rows' => $rows,
                             'domainRows' => $domainRows,
                             'service' => $service,
                             'showServiceColumn' => false,
-                            'showHeader' => true,
+                            'showHeader' => false,
                         ])
                     </div>
                 </section>
@@ -207,7 +218,7 @@
         </div>
     @endif
 
-    {{-- Edit domain modal: open/close is Alpine-only; server runs only on Save / Continue. --}}
+    {{-- One dialog for the address and domain settings. --}}
     <div class="relative h-auto w-auto" :class="{ 'z-40': modalOpen }"
         @keydown.window.escape="if (modalOpen) { closeEditDomain() }">
         <template x-teleport="body">
@@ -229,7 +240,7 @@
                         class="application-settings-form application-settings-section relative flex max-h-[calc(100dvh-2rem)] w-full flex-col overflow-hidden lg:w-auto lg:min-w-2xl lg:max-w-4xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header class="flex-nowrap!">
-                            <h3 class="min-w-0 flex-1 truncate">Edit domain</h3>
+                            <h3 class="min-w-0 flex-1 truncate">Domain settings</h3>
                             <button type="button" @click="closeEditDomain()" class="icon-button shrink-0"
                                 aria-label="Close">
                                 <x-reicon name="x" class="size-4" />
@@ -238,6 +249,10 @@
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
                             <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                                <template x-if="modalOpen">
+                                    <x-unsaved-bar action="updateDomain" dirty="hasAddressChanges"
+                                        targets="updateDomain,confirmUpdateDomainDespiteDns" />
+                                </template>
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service application</label>
@@ -261,19 +276,50 @@
                                     </x-callout>
                                 @endif
 
-                                <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
-                                    @if ($editDomainDnsFailed)
-                                        <x-forms.button type="button" isError
-                                            wire:click="confirmUpdateDomainDespiteDns">
+                                @if ($editDomainDnsFailed)
+                                    <div class="flex justify-end">
+                                        <x-forms.button type="button" isError wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
-                                    @else
-                                        <x-forms.button type="submit" wire:target="updateDomain" isHighlighted>
-                                            Save
-                                        </x-forms.button>
-                                    @endif
-                                </div>
+                                    </div>
+                                @endif
                             </form>
+                            @php
+                                $editingRow = $editingIndex !== null ? ($domainRows[$editingIndex] ?? null) : null;
+                            @endphp
+                            @if ($editingRow)
+                                @can('update', $service)
+                                    @php
+                                        $editingAppId = (int) $editingRow['service_application_id'];
+                                        $editingDomainKey = hash('sha256', $editingRow['url'].'|'.$editingAppId);
+                                        $editingNoindex = $service->applications->firstWhere('id', $editingAppId)?->isDomainNoindexed($editingRow['url']);
+                                    @endphp
+                                    <div wire:key="editing-domain-settings-{{ $editingDomainKey }}"
+                                        class="mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2 dark:border-white/10">
+                                        <p class="sm:col-span-2 text-[12px] text-neutral-500 dark:text-fg-dim">Indexing and redirect changes save automatically.</p>
+                                        <x-forms.listbox id="service-domain-indexing-{{ $editingAppId }}-{{ $editingDomainKey }}"
+                                            label="Search engine indexing" :wire="false" preserveValue
+                                            :value="$editingNoindex ? 'noindex' : 'index'"
+                                            onChange="toggleNoindexDomain"
+                                            :onChangeArgs="[$editingAppId, $editingRow['url']]" portal
+                                            :options="[
+                                                ['value' => 'index', 'label' => 'Indexable'],
+                                                ['value' => 'noindex', 'label' => 'Noindex'],
+                                            ]" />
+                                        <x-forms.listbox id="service-domain-direction-{{ $editingAppId }}-{{ $editingDomainKey }}"
+                                            label="www redirect" :wire="false" :value="$serviceRedirects[$editingAppId] ?? 'both'" preserveValue
+                                            x-effect="value = $wire.serviceRedirects[{{ $editingAppId }}] ?? 'both'"
+                                            helper="Applies to all domains for this service application."
+                                            onChange="updateServiceRedirect" :onChangeArgs="[$editingAppId]" portal
+                                            :options="[
+                                                ['value' => 'both', 'label' => 'No redirect'],
+                                                ['value' => 'www', 'label' => 'Redirect to www'],
+                                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
+                                            ]" />
+                                    </div>
+                                @endcan
+                            @endif
+
                         </div>
                     </div>
                 </div>
@@ -311,7 +357,8 @@
 
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button type="button"
-                                    @click="modalOpen = false; $wire.call('cancelRemovePort')">
+                                    wire:click="cancelRemovePort"
+                                    @click="modalOpen = false">
                                     Keep required port
                                 </x-forms.button>
                                 <x-forms.button type="button" wire:click="confirmRemovePort"
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 7604d7d0cc..8c6531f3bc 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -42,6 +42,13 @@
         ));
 
         $serviceStatus = str($service->status ?? 'exited');
+        $selectedResourceUuid = data_get($parameters, 'stack_service_uuid');
+        $selectedResource = $selectedResourceUuid
+            ? $service->applications->firstWhere('uuid', $selectedResourceUuid)
+                ?? $service->databases->firstWhere('uuid', $selectedResourceUuid)
+            : null;
+        $displayStatus = $selectedResource?->status ?? $service->status;
+        $selectedResourceStatus = str($selectedResource?->status ?? '');
         $environmentVariablesUrl = route('project.service.environment-variables', [
             'project_uuid' => $service->environment->project->uuid,
             'environment_uuid' => $service->environment->uuid,
@@ -68,6 +75,11 @@
                     <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
                     <x-services.links :service="$service" compact />
                 </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    @if ($selectedResource)
+                        <x-application.restart-limit-warning :application="$selectedResource" />
+                    @endif
+                </div>
             </div>
         </div>
 
@@ -127,10 +139,29 @@
                     </x-split-action>
                 @endcan
             @else
-                <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
-                    class="mb-3 inline-flex" aria-label="Open required environment variables">
-                    <x-status-badge status="Required variables missing" type="error" />
-                </a>
+                @can('deploy', $service)
+                    <div id="service-mobile-actions" class="relative mb-3"
+                        x-data="{ open: false }" @click.outside="open = false"
+                        @keydown.escape.window="open = false">
+                        <button type="button" class="button w-full justify-between" @click="open = !open"
+                            :aria-expanded="open" aria-haspopup="menu">
+                            <span>Actions</span>
+                            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
+                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
+                            </span>
+                        </button>
+
+                        <div x-cloak x-show="open" x-transition.origin.top.left
+                            class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
+                            <div class="listbox-option cursor-default! justify-start! gap-2.5! text-neutral-400! dark:text-fg-faint!"
+                                role="menuitem" aria-disabled="true">
+                                <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                <span>Deploy (<a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
+                                        class="cursor-pointer underline underline-offset-2">missing required env vars</a>)</span>
+                            </div>
+                        </div>
+                    </div>
+                @endcan
             @endif
 
         </div>
@@ -198,10 +229,26 @@
                             </x-split-action>
                         @endcan
                     @else
-                        <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
-                            aria-label="Open required environment variables">
-                            <x-status-badge status="Required variables missing" type="error" />
-                        </a>
+                        @can('deploy', $service)
+                            <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
+                                x-effect="$dispatch('resource-actions-toggled', { open })"
+                                @click.outside="open = false" @keydown.escape.window="open = false">
+                                <button type="button" class="button button-highlighted" @click="open = !open"
+                                    :aria-expanded="open" aria-haspopup="menu">
+                                    Actions
+                                    <x-reicon name="chevron-down" class="size-3 opacity-55" />
+                                </button>
+                                <div x-cloak x-show="open" x-transition.origin.top.right
+                                    class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="menu">
+                                    <div class="listbox-option cursor-default! justify-start! gap-2.5! text-neutral-400! dark:text-fg-faint!"
+                                        role="menuitem" aria-disabled="true">
+                                        <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                        <span>Deploy (<a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
+                                                class="cursor-pointer underline underline-offset-2">missing required env vars</a>)</span>
+                                    </div>
+                                </div>
+                            </div>
+                        @endcan
                     @endif
                 </div>
             </div>
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index 444d1bfd28..5b4c0d1e11 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -1,7 +1,7 @@
 @php
     $showServiceColumn = $showServiceColumn ?? false;
     $showHeader = $showHeader ?? true;
-    $gridClass = $showServiceColumn ? 'domains-table-grid-compose' : 'domains-table-grid';
+    $gridClass = 'service-domains-overview-grid';
 @endphp
 
 <div class="data-table w-full">
@@ -11,10 +11,12 @@
             @if ($showServiceColumn)
                 <span>Service</span>
             @endif
-            <span>DNS Check</span>
-            <span class="whitespace-nowrap">Search engine indexing</span>
-            <span>Direction</span>
-            <span></span>
+            <span>Protocol redirect</span>
+                <span>Domain redirect</span>
+                <span>Internal port</span>
+                <span>Search indexing</span>
+                <span>DNS status</span>
+            <span class="text-right">Actions</span>
         </div>
     @endif
     @foreach ($rows as $row)
@@ -32,35 +34,28 @@
                 default => 'neutral',
             };
             $dnsLabel = match ($row['dns_status']) {
-                'ok' => 'DNS OK',
+                'ok' => 'DNS matches',
                 'failed' => 'DNS mismatch',
                 'skipped' => 'DNS skipped',
                 'checking' => 'Checking DNS...',
-                'pending' => 'DNS pending',
+                'pending' => 'Not checked',
                 default => 'DNS unknown',
             };
             $serviceLabel = filled($row['service_name'] ?? null)
                 ? \Illuminate\Support\Str::headline($row['service_name'])
                 : '-';
-            $domainParts = $isSuggested ? null : parse_url($row['url']);
+            $publicUrl = getFqdnWithoutPort($row['url']);
+            $domainParts = $isSuggested ? null : parse_url($publicUrl);
+            $isNoindexed = $service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']);
+            $rowDirection = $serviceRedirects[$row['service_application_id']] ?? 'both';
+            $directionLabel = match ($rowDirection) {
+                'www' => 'Redirect to www',
+                'non-www' => 'Redirect to non-www',
+                default => 'Both www and non-www',
+            };
             $faviconUrl = is_array($domainParts) && isset($domainParts['scheme'], $domainParts['host'])
                 ? $domainParts['scheme'].'://'.$domainParts['host'].(isset($domainParts['port']) ? ':'.$domainParts['port'] : '').'/favicon.ico'
                 : null;
-            $redirectPairKey = function (string $url): string {
-                $parts = parse_url($url);
-                if (! is_array($parts) || ! isset($parts['host'])) {
-                    return $url;
-                }
-
-                $host = preg_replace('/^www\./i', '', $parts['host']);
-
-                return strtolower(($parts['scheme'] ?? '').'://'.$host.':'.($parts['port'] ?? '').($parts['path'] ?? ''));
-            };
-            $pairKey = $redirectPairKey($row['url']);
-            $firstPairRowUrl = collect($rows)
-                ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
-                ->first(fn ($item) => $redirectPairKey($item['url']) === $pairKey)['url'] ?? null;
-            $showDirection = ! $isSuggested && $firstPairRowUrl === $row['url'];
             $domainKey = hash('sha256', $row['url'].'|'.($row['service_application_id'] ?? ''));
         @endphp
 
@@ -70,10 +65,9 @@
                 'data-table-row',
                 $gridClass,
                 'domains-row-suggested' => $isSuggested,
-                'domains-row-without-direction' => ! $showDirection,
             ])>
                 <div class="flex min-w-0 flex-col gap-1">
-                    <div class="flex min-w-0 flex-wrap items-center gap-2">
+                    <div class="flex min-w-0 items-center gap-2">
                         @if ($isSuggested)
                             <span
                                 class="min-w-0 text-[13px] text-black sm:truncate dark:text-white"
@@ -93,17 +87,11 @@
                                         class="invisible absolute inset-0 size-4 rounded-sm" />
                                 </span>
                             @endif
-                            <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
-                                class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
-                                title="{{ $row['url'] }}">
-                                {{ $row['url'] }}
+                            <a href="{{ $publicUrl }}" target="_blank" rel="noopener noreferrer"
+                                class="min-w-0 flex-1 truncate text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs [overflow-wrap:anywhere] dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                title="{{ $publicUrl }}">
+                                {{ $publicUrl }}
                             </a>
-                            @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
-                                <span class="table-badge shrink-0"
-                                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
-                                    Internal port {{ $row['internal_port'] }}
-                                </span>
-                            @endif
                         @endif
                         @if ($isSuggested && ! empty($row['suggestion_label']))
                             <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
@@ -124,7 +112,41 @@
                     </div>
                 @endif
 
-                <div class="flex min-w-0 items-center">
+                <div class="service-domain-detail" title="Protocol redirect">
+                    <span class="service-domain-detail-label">Protocol redirect</span>
+                    <span>{{ str_starts_with($row['url'], 'https://') && ($forceHttpsRedirects[$row['service_application_id']] ?? true) ? 'HTTP → HTTPS' : 'Disabled' }}</span>
+                </div>
+                <div class="service-domain-detail" title="{{ $directionLabel }}">
+                    <span class="service-domain-detail-label">Domain redirect</span>
+                    <span>{{ match ($rowDirection) { 'www' => 'non-www → www', 'non-www' => 'www → non-www', default => 'Disabled' } }}</span>
+                </div>
+                <div class="service-domain-detail"
+                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
+                    <span class="service-domain-detail-label">Internal port</span>
+                    <span @if (filled($row['internal_port'] ?? null)) aria-label="Internal port {{ $row['internal_port'] }}" @endif>{{ $row['internal_port'] ?? '—' }}</span>
+                </div>
+                <div class="service-domain-detail">
+                    <span class="service-domain-detail-label">Search indexing</span>
+                    <span role="img" aria-label="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}"
+                        title="{{ $isNoindexed ? 'Search indexing blocked' : 'Search indexing allowed' }}">
+                        <x-reicon :name="$isNoindexed ? 'x' : 'check'" class="size-4" />
+                    </span>
+                </div>
+
+                <div class="service-domain-mobile-summary" aria-label="Domain routing summary">
+                    @if (str_starts_with($row['url'], 'https://') && ($forceHttpsRedirects[$row['service_application_id']] ?? true))
+                        <span>HTTP → HTTPS</span>
+                    @endif
+                    @if (in_array($rowDirection, ['www', 'non-www'], true))
+                        <span>{{ $rowDirection === 'www' ? 'non-www → www' : 'www → non-www' }}</span>
+                    @elseif (! str_starts_with($row['url'], 'https://') || ! ($forceHttpsRedirects[$row['service_application_id']] ?? true))
+                        <span>No redirects</span>
+                    @endif
+                    <span>Port {{ $row['internal_port'] ?? 'missing' }}</span>
+                    <span>{{ $isNoindexed ? 'Noindex' : 'Indexable' }}</span>
+                </div>
+
+                <div class="service-domain-dns flex min-w-0 items-center">
                     @if ($row['dns_status'] === 'failed')
                         <x-status-badge as="button" @click="$dispatch('open-dns-records-modal')" :status="$dnsLabel" :type="$dnsType"
                             title="View DNS records to fix" class="cursor-pointer hover:bg-neutral-200 dark:hover:bg-white/[0.1]" />
@@ -134,55 +156,7 @@
                     @endif
                 </div>
 
-                <div class="min-w-0">
-                    @unless ($isSuggested)
-                        <span class="domains-mobile-label">Search engine indexing</span>
-                    @endunless
-                    @if ($isSuggested)
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">-</span>
-                    @elseif (auth()->user()?->can('update', $service))
-                        <x-forms.listbox id="service-domain-indexing-{{ $row['service_application_id'] }}-{{ $index }}"
-                            :wire="false"
-                            preserveValue
-                            :value="$service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']) ? 'noindex' : 'index'"
-                            onChange="toggleNoindexDomain"
-                            :onChangeArgs="[(int) $row['service_application_id'], $row['url']]" portal :options="[
-                                ['value' => 'index', 'label' => 'Indexable'],
-                                ['value' => 'noindex', 'label' => 'Noindex'],
-                            ]" />
-                    @else
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">
-                            {{ $service->applications->firstWhere('id', $row['service_application_id'])?->isDomainNoindexed($row['url']) ? 'Noindex' : 'Indexable' }}
-                        </span>
-                    @endif
-                </div>
-
-                <div class="min-w-0">
-                    @php
-                        $rowDirection = $serviceRedirects[$row['service_application_id']] ?? 'both';
-                        $directionLabel = match ($rowDirection) {
-                            'www' => 'Redirect to www',
-                            'non-www' => 'Redirect to non-www',
-                            default => 'Allow both',
-                        };
-                    @endphp
-                    @if ($showDirection)
-                        <span class="domains-mobile-label">Direction</span>
-                    @endif
-                    @if ($showDirection && auth()->user()?->can('update', $service))
-                        <x-forms.listbox id="service-domain-direction-{{ $row['service_application_id'] }}-{{ $index }}"
-                            :wire="false" :value="$rowDirection" preserveValue onChange="updateServiceRedirect"
-                            :onChangeArgs="[(int) $row['service_application_id']]" portal :options="[
-                                ['value' => 'both', 'label' => 'Allow www & non-www'],
-                                ['value' => 'www', 'label' => 'Redirect to www'],
-                                ['value' => 'non-www', 'label' => 'Redirect to non-www'],
-                            ]" />
-                    @elseif ($showDirection)
-                        <span class="text-[13px] text-neutral-500 dark:text-fg-dim">{{ $directionLabel }}</span>
-                    @endif
-                </div>
-
-                <div class="flex items-center justify-end gap-1">
+                <div class="service-domain-actions flex items-center justify-end gap-1">
                     @can('update', $service)
                         <button type="button" wire:click="checkDomainDns({{ $index }})"
                             wire:loading.attr="disabled"
@@ -209,8 +183,8 @@
                                 </x-forms.button>
                             @endif
                         @else
-                            <button type="button" wire:click="startEdit({{ $index }})"
-                                class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
+                            <button type="button" class="icon-button shrink-0" title="Domain settings" aria-label="Settings for {{ $publicUrl }}"
+                                wire:click="startEdit({{ $index }})" wire:loading.attr="disabled" wire:target="startEdit">
                                 <x-reicon name="settings" class="size-3.5" />
                             </button>
                             <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index f69d3f0db2..9ac25ec39d 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -240,7 +240,7 @@
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
-                    <div class="min-w-[59rem]">
+                    <div class="min-w-[64rem]">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
@@ -268,6 +268,8 @@
                                 default => 'neutral',
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
+                            $databaseS3 = $databaseBackup->s3?->team_id === currentTeam()->id ? $databaseBackup->s3 : null;
+                            $databaseS3Tooltip = ! $databaseBackup->save_s3 ? 'S3 storage: Not configured' : ($databaseS3 ? 'S3 storage: '.$databaseS3->name.' (bucket: '.$databaseS3->bucket.')' : 'S3 storage: Unavailable');
                         @endphp
                         <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
@@ -282,14 +284,19 @@
                             <span>{{ $databaseBackup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
                             <span>
-                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'success' : 'error') : 'neutral'" />
+                                <x-status-badge :status="$databaseBackup->save_s3 ? ($databaseS3 ? 'Configured' : 'Unavailable') : 'Not set'"
+                                    :type="$databaseBackup->save_s3 ? ($databaseS3 ? 'success' : 'error') : 'neutral'"
+                                    :data-tooltip="$databaseS3Tooltip" :aria-label="$databaseS3Tooltip" tabindex="0" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
-                            <span class="flex justify-end">
+                            <span class="flex justify-end gap-2" x-on:keydown.enter.stop>
                                 <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    :disabled="! str($databaseBackup->database->status)->startsWith('running')"
+                                    :tooltip="! str($databaseBackup->database->status)->startsWith('running') ? 'The database must be running to start a backup.' : null"
                                     wire:click.stop="backupNow('database', '{{ $databaseBackup->uuid }}')"
                                     wire:target="backupNow('database', '{{ $databaseBackup->uuid }}')">Back up now</x-forms.button>
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="openSchedule('{{ $databaseBackup->uuid }}')">Settings</x-forms.button>
                             </span>
                         </div>
                     @endforeach
@@ -297,6 +304,8 @@
                     @foreach ($backups as $backup)
                         @php
                             $latestExecution = $backup->latestExecution;
+                            $volumeS3 = $backup->s3?->team_id === currentTeam()->id ? $backup->s3 : null;
+                            $volumeS3Tooltip = ! $backup->save_s3 ? 'S3 storage: Not configured' : ($volumeS3 ? 'S3 storage: '.$volumeS3->name.' (bucket: '.$volumeS3->bucket.')' : 'S3 storage: Unavailable');
                             $status = $latestExecution?->status;
                             $statusLabel = match ($status) {
                                 'running' => 'In progress',
@@ -324,17 +333,20 @@
                             <span>{{ $backup->targetType() }}</span>
                             <span>{{ $backup->frequency }}</span>
                             <span><x-status-badge :status="$statusLabel" :type="$statusType" /></span>
-                            <span title="{{ $backup->save_s3 ? ($backup->s3?->name ?? 'S3 storage unavailable') : 'S3 storage is not configured' }}">
-                                <x-status-badge :status="$backup->save_s3 ? ($backup->s3 ? 'Configured' : 'Unavailable') : 'Not set'"
-                                    :type="$backup->save_s3 ? ($backup->s3 ? 'success' : 'error') : 'neutral'" />
+                            <span>
+                                <x-status-badge :status="$backup->save_s3 ? ($volumeS3 ? 'Configured' : 'Unavailable') : 'Not set'"
+                                    :type="$backup->save_s3 ? ($volumeS3 ? 'success' : 'error') : 'neutral'"
+                                    :data-tooltip="$volumeS3Tooltip" :aria-label="$volumeS3Tooltip" tabindex="0" />
                             </span>
                             <span>
                                 {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
                             </span>
-                            <span class="flex justify-end">
+                            <span class="flex justify-end gap-2" x-on:keydown.enter.stop>
                                 <x-forms.button type="button" canGate="update" :canResource="$service"
                                     wire:click.stop="backupNow('storage', '{{ $backup->uuid }}')"
                                     wire:target="backupNow('storage', '{{ $backup->uuid }}')">Back up now</x-forms.button>
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="openSchedule('{{ $backup->uuid }}')">Settings</x-forms.button>
                             </span>
                         </div>
                     @endforeach
diff --git a/resources/views/livewire/project/shared/storages/all.blade.php b/resources/views/livewire/project/shared/storages/all.blade.php
index cfbc58972b..a6d207d60c 100644
--- a/resources/views/livewire/project/shared/storages/all.blade.php
+++ b/resources/views/livewire/project/shared/storages/all.blade.php
@@ -21,10 +21,10 @@
                 <span class="volumes-col-source">Source Path</span>
                 <span>Destination Path</span>
                 @if ($supportsPreviewSuffix)
-                    <span class="volumes-col-pr"
-                        title="Whether preview deployments receive an isolated -pr-N volume suffix.">
-                        PR suffix
-                    </span>
+                    <div class="volumes-col-pr flex items-center gap-1.5">
+                        <span>PR suffix</span>
+                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                    </div>
                 @endif
                 <span class="volumes-col-backup text-center">Backup</span>
                 @if ($showActionsColumn)
@@ -74,7 +74,10 @@
 
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
-                                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
+                                    <div class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">
+                                        <span>PR suffix</span>
+                                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                                    </div>
                                     <span>{{ $form['isPreviewSuffixEnabled'] ? 'Add suffix' : 'Share volume' }}</span>
                                 </div>
                             @endif
@@ -82,16 +85,22 @@
                             <div class="volumes-col-backup flex items-center justify-center gap-1.5">
                                 <span class="volumes-mobile-label volumes-field-label">Backup</span>
                                 @if ($hasEnabledBackup)
-                                    <a @if ($backupUrl) href="{{ $backupUrl }}" @endif title="Volume backup is enabled">
-                                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                            stroke-width="2" stroke="currentColor" class="size-4">
-                                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                                        </svg>
-                                    </a>
-                                    <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
-                                        title="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
-                                        {{ $hasS3Backup ? 'S3' : 'Local' }}
-                                    </span>
+                                    @if ($backupUrl)
+                                        <a href="{{ $backupUrl }}" @class([
+                                            'table-badge underline-offset-2 hover:underline',
+                                            'table-badge-success' => $hasS3Backup,
+                                        ])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </a>
+                                    @else
+                                        <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </span>
+                                    @endif
                                 @else
                                     <span class="data-table-cell-dash">-</span>
                                 @endif
@@ -103,10 +112,10 @@
                                     @if ($canUpdate)
                                         <x-modal-input title="Configure Volume Backup" :wireIgnore="false">
                                             <x-slot:content>
-                                                <button type="button" class="icon-button" title="Configure backup"
-                                                    aria-label="Configure backup">
-                                                    <x-reicon name="database" class="size-4" />
-                                                </button>
+                                                <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                    :canResource="$resource">
+                                                    Backup
+                                                </x-forms.button>
                                             </x-slot:content>
                                             @if ($resource instanceof \App\Models\Application)
                                                 <livewire:project.application.backup.create :application="$resource"
@@ -182,27 +191,36 @@
 
                             @if ($supportsPreviewSuffix)
                                 <div class="volumes-col-pr min-w-0">
-                                    <span class="volumes-mobile-label volumes-field-label">PR suffix</span>
+                                    <div class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">
+                                        <span>PR suffix</span>
+                                        <x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />
+                                    </div>
                                     <x-forms.listbox id="forms.{{ $id }}.isPreviewSuffixEnabled" portal :options="[
                                         ['value' => true, 'label' => 'Add suffix'],
                                         ['value' => false, 'label' => 'Share volume'],
-                                    ]" />
+                                    ]" canGate="update" :canResource="$resource" />
                                 </div>
                             @endif
 
                             <div class="volumes-col-backup flex items-center justify-center gap-1.5">
                                 <span class="volumes-mobile-label volumes-field-label">Backup</span>
                                 @if ($hasEnabledBackup)
-                                    <a @if ($backupUrl) href="{{ $backupUrl }}" @endif title="Volume backup is enabled">
-                                        <svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                            stroke-width="2" stroke="currentColor" class="size-4">
-                                            <path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />
-                                        </svg>
-                                    </a>
-                                    <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
-                                        title="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
-                                        {{ $hasS3Backup ? 'S3' : 'Local' }}
-                                    </span>
+                                    @if ($backupUrl)
+                                        <a href="{{ $backupUrl }}" @class([
+                                            'table-badge underline-offset-2 hover:underline',
+                                            'table-badge-success' => $hasS3Backup,
+                                        ])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </a>
+                                    @else
+                                        <span @class(['table-badge', 'table-badge-success' => $hasS3Backup])
+                                            title="Volume backup is enabled"
+                                            aria-label="{{ $hasS3Backup ? 'Backups are saved to S3' : 'Backups are stored locally only' }}">
+                                            {{ $hasS3Backup ? 'S3' : 'Local' }}
+                                        </span>
+                                    @endif
                                 @else
                                     <span class="data-table-cell-dash">-</span>
                                 @endif
@@ -217,10 +235,10 @@
                                 @if ($showBackupAction)
                                     <x-modal-input title="Configure Volume Backup" :wireIgnore="false">
                                         <x-slot:content>
-                                            <button type="button" class="icon-button" title="Configure backup"
-                                                aria-label="Configure backup">
-                                                <x-reicon name="database" class="size-4" />
-                                            </button>
+                                            <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                :canResource="$resource">
+                                                Backup
+                                            </x-forms.button>
                                         </x-slot:content>
                                         @if ($resource instanceof \App\Models\Application)
                                             <livewire:project.application.backup.create :application="$resource"
@@ -235,10 +253,10 @@
                                 @elseif (method_exists($resource, 'isBackupSolutionAvailable') && $resource->isBackupSolutionAvailable())
                                     <x-modal-input title="New Scheduled Backup" :wireIgnore="false">
                                         <x-slot:content>
-                                            <button type="button" class="icon-button" title="Configure backup"
-                                                aria-label="Configure backup">
-                                                <x-reicon name="database" class="size-4" />
-                                            </button>
+                                            <x-forms.button type="button" class="!px-2.5 !text-xs" canGate="update"
+                                                :canResource="$resource">
+                                                Backup
+                                            </x-forms.button>
                                         </x-slot:content>
                                         <livewire:project.database.create-scheduled-backup :database="$resource"
                                             wire:key="configure-database-backup-{{ $id }}" />
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 9fb2ca2fcc..78ed0eb01a 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -30,9 +30,27 @@
                 </x-forms.button>
             </x-slot:actions>
 
+            <div class="border-b border-neutral-200 p-3 dark:border-white/[0.08]">
+                <div class="relative w-full max-w-sm">
+                    <x-reicon name="search"
+                        class="pointer-events-none absolute top-1/2 left-2.5 z-10 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                    <input wire:model.live.debounce.300ms="search" type="search" placeholder="Search resources by name"
+                        aria-label="Search resources by name"
+                        class="h-8! w-full rounded-lg! border-neutral-200! bg-white! py-0! pr-8! pl-8! text-[12px]! shadow-none! placeholder:text-neutral-400 focus:border-accent! focus:ring-0! dark:border-white/[0.08]! dark:bg-white/[0.035]! dark:text-fg! dark:placeholder:text-fg-faint">
+                    <button type="button" wire:click="$set('search', '')" @class([
+                        'absolute top-1/2 right-2 flex size-5 -translate-y-1/2 items-center justify-center rounded text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg',
+                        'hidden' => blank($search),
+                    ]) aria-label="Clear search">
+                        <x-reicon name="x" class="size-3" />
+                    </button>
+                </div>
+            </div>
+
+            <div class="relative">
+            <div class="transition-all" wire:loading.class="pointer-events-none opacity-40 blur-[2px]"
+                wire:loading.attr="inert" wire:target="search">
             @if ($activeTab === 'managed')
-                @php($managedResources = $server->definedResources()->sortBy('name', SORT_NATURAL))
-                @if ($managedResources->count() > 0)
+                @if ($resources->total() > 0)
                     <div class="data-table">
                         <div class="data-table-header server-resources-managed-table-grid">
                             <span>Name</span>
@@ -41,9 +59,9 @@
                             <span>Type</span>
                             <span>Status</span>
                         </div>
-                        @foreach ($managedResources as $resource)
+                        @foreach ($resources as $resource)
                             @php($resourceStatus = (string) data_get($resource, 'status', 'unknown'))
-                            <div
+                            <div wire:key="managed-{{ $resource->type() }}-{{ $resource->uuid }}"
                                 class="data-table-row server-resources-managed-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
                                 <div class="min-w-0">
                                     <a class="block max-w-full truncate text-[12px] font-medium text-neutral-950 hover:underline dark:text-fg"
@@ -72,22 +90,16 @@
                                 </div>
                             </div>
                         @endforeach
-                        <div
-                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                            {{ $managedResources->count() }}
-                            {{ Str::plural('managed resource', $managedResources->count()) }}
-                        </div>
                     </div>
                 @else
                     <div class="p-6">
-                        <x-empty size="sm" title="No managed resources"
-                            description="Resources assigned to this server will appear here."
+                        <x-empty size="sm" :title="trim($search) !== '' ? 'No matching resources' : 'No managed resources'"
+                            :description="trim($search) !== '' ? 'Try another name or clear the search.' : 'Resources assigned to this server will appear here.'"
                             icon-name="projects" />
                     </div>
                 @endif
             @else
-                @if (count($unmanagedContainers) > 0)
-                    @php($sortedUnmanagedContainers = collect($unmanagedContainers)->sortBy('name', SORT_NATURAL))
+                @if ($resources->total() > 0)
                     <div class="data-table">
                         <div class="data-table-header server-resources-unmanaged-table-grid">
                             <span>Name</span>
@@ -95,9 +107,9 @@
                             <span>Status</span>
                             <span>Actions</span>
                         </div>
-                        @foreach ($sortedUnmanagedContainers as $resource)
+                        @foreach ($resources as $resource)
                             @php($containerState = (string) data_get($resource, 'State', 'unknown'))
-                            <div
+                            <div wire:key="unmanaged-{{ data_get($resource, 'ID') }}"
                                 class="data-table-row server-resources-unmanaged-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.08]">
                                 <div class="min-w-0 truncate text-[12px] font-medium text-neutral-950 dark:text-fg">
                                     {{ data_get($resource, 'Names') }}
@@ -139,20 +151,28 @@
                                 </div>
                             </div>
                         @endforeach
-                        <div
-                            class="flex min-h-11 items-center border-t border-neutral-200 px-4 text-[11px] text-neutral-500 dark:border-white/[0.08] dark:text-fg-faint">
-                            {{ $sortedUnmanagedContainers->count() }}
-                            {{ Str::plural('unmanaged container', $sortedUnmanagedContainers->count()) }}
-                        </div>
                     </div>
                 @else
                     <div class="p-6">
-                        <x-empty size="sm" title="No unmanaged containers"
-                            description="All detected Docker containers are managed by Coolify."
+                        <x-empty size="sm" :title="trim($search) !== '' ? 'No matching containers' : 'No unmanaged containers'"
+                            :description="trim($search) !== '' ? 'Try another name or clear the search.' : 'All detected Docker containers are managed by Coolify.'"
                             icon-name="servers" />
                     </div>
                 @endif
             @endif
+            @if ($resources->total() > 0)
+                <x-table-pagination :from="$resources->firstItem()" :to="$resources->lastItem()"
+                    :total="$resources->total()" :current-page="$resources->currentPage()"
+                    :last-page="$resources->lastPage()" wire-target="previousPage,nextPage,perPage"
+                    previous-action="previousPage" next-action="nextPage">
+                    <x-slot:pageSize>
+                        <x-page-size-select model="perPage" livewire storage-key="coolify.page-size.server-resources" />
+                    </x-slot:pageSize>
+                </x-table-pagination>
+            @endif
+            </div>
+                <x-table.loading target="search" text="Searching resources..." />
+            </div>
         </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/server/sentinel/logs.blade.php b/resources/views/livewire/server/sentinel/logs.blade.php
index 455bb55bb2..37f8367fd1 100644
--- a/resources/views/livewire/server/sentinel/logs.blade.php
+++ b/resources/views/livewire/server/sentinel/logs.blade.php
@@ -10,15 +10,27 @@
             <x-application.settings-section title="Sentinel logs"
                 helper="Search, filter, follow, copy, or download recent output from the Sentinel container."
                 flush class="logs-settings-section">
-                <x-slot:actions>
-                    <x-status-badge :status="$server->isSentinelLive() ? 'In sync' : 'Out of sync'"
-                        :type="$server->isSentinelLive() ? 'success' : 'warning'"
-                        class="logs-section-status-badge" />
-                </x-slot:actions>
-                <div class="settings-log-panel">
-                    <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel"
-                        displayName="Sentinel" :collapsible="false" />
-                </div>
+                @if ($server->isSentinelEnabled())
+                    <x-slot:actions>
+                        <x-status-badge :status="$server->isSentinelLive() ? 'In sync' : 'Out of sync'"
+                            :type="$server->isSentinelLive() ? 'success' : 'warning'"
+                            class="logs-section-status-badge" />
+                    </x-slot:actions>
+                    <div class="settings-log-panel">
+                        <livewire:project.shared.get-logs :server="$server" container="coolify-sentinel"
+                            displayName="Sentinel" :collapsible="false" />
+                    </div>
+                @else
+                    <x-slot:actions>
+                        <x-forms.button canGate="manageSentinel" :canResource="$server" isHighlighted
+                            wire:click="enableSentinel">
+                            Enable Sentinel
+                        </x-forms.button>
+                    </x-slot:actions>
+                    <x-empty size="sm" title="Sentinel is disabled"
+                        description="Enable Sentinel to view its logs."
+                        icon-name="dashboard" />
+                @endif
             </x-application.settings-section>
         </div>
     </div>
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index 6840529dc8..0e6242d572 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -9,7 +9,7 @@
                  listboxes (API, MCP, telemetry, …) update the snapshot on the server
                  immediately; without wire:target they briefly flash this bar. --}}
             <x-unsaved-bar action="submit"
-                targets="custom_dns_servers,allowed_ips,webhook_allowed_internal_hosts,webhook_allow_localhost,domain_connect_private_key" />
+                targets="custom_dns_servers,allowed_ips,webhook_allowed_internal_hosts,webhook_allow_localhost,domain_connect_private_key,image_cdn_url" />
 
             <x-application.settings-section id="access-section" title="Access">
                 <div class="grid gap-4 lg:grid-cols-2">
@@ -151,9 +151,11 @@
 
             <x-application.settings-section id="avatar-storage-section" title="Image storage"
                 helper="Choose where compressed profile pictures and project icons are stored. Use S3 for multi-instance or cloud deployments so every application replica can access the same files.">
-                <div class="max-w-md">
+                <div class="flex max-w-md flex-col gap-4">
                     <x-forms.listbox id="avatar_storage" label="Storage destination" onChange="instantSave"
                         :options="$avatar_storage_options" />
+                    <x-forms.input id="image_cdn_url" label="Image CDN URL"
+                        helper="Optional public CDN URL for profile pictures and project icons stored on S3. Leave empty to use the S3 endpoint." placeholder="https://images.example.com" />
                 </div>
                 @if (count($avatar_storage_options) === 1)
                     <x-callout type="info" title="No usable S3 storage configured" class="mt-4">
diff --git a/resources/views/livewire/shared-variables/server/show.blade.php b/resources/views/livewire/shared-variables/server/show.blade.php
index 4bba5eb064..445b6899e9 100644
--- a/resources/views/livewire/shared-variables/server/show.blade.php
+++ b/resources/views/livewire/shared-variables/server/show.blade.php
@@ -4,7 +4,8 @@
     </x-slot>
 
     <x-shared-variables.editor :resource="$server"
-        :variables="$server->environment_variables->whereNotIn('key', ['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME'])"
+        :variables="$server->environment_variables"
+        :readOnlyKeys="['COOLIFY_SERVER_UUID', 'COOLIFY_SERVER_NAME']"
         type="server" title="{{ $server->name }}"
         :view="$view" variablesLabel="Server shared variables" />
 </div>
diff --git a/tests/Feature/AllResourceRestartLimitsTest.php b/tests/Feature/AllResourceRestartLimitsTest.php
index 8418b552cd..7da82f7d65 100644
--- a/tests/Feature/AllResourceRestartLimitsTest.php
+++ b/tests/Feature/AllResourceRestartLimitsTest.php
@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Docker\GetContainersStatus;
+use App\Actions\Service\StopServiceApplication;
+use App\Jobs\PushServerUpdateJob;
 use App\Models\ApplicationPreview;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
@@ -14,9 +17,10 @@ use App\Models\StandaloneRedis;
 use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\Schema;
 
-it('gives every independently runnable non-application resource restart limit state', function (string $modelClass) {
+it('gives independently runnable application resources restart limit state', function (string $modelClass) {
     expect(class_uses_recursive($modelClass))->toContain(HasRestartLimit::class);
 
     $resource = new $modelClass;
@@ -34,17 +38,8 @@ it('gives every independently runnable non-application resource restart limit st
         'last_restart_at' => 'datetime',
     ]);
 })->with([
-    ApplicationPreview::class,
-    ServiceApplication::class,
-    ServiceDatabase::class,
-    StandaloneClickhouse::class,
-    StandaloneDragonfly::class,
-    StandaloneKeydb::class,
-    StandaloneMariadb::class,
-    StandaloneMongodb::class,
-    StandaloneMysql::class,
-    StandalonePostgresql::class,
-    StandaloneRedis::class,
+    [ApplicationPreview::class],
+    [ServiceApplication::class],
 ]);
 
 it('collects restart counts for preview and service containers from both status sources', function () {
@@ -157,7 +152,7 @@ it('imports the application model used when claiming a restart limit', function
         ->toContain('Application::query()');
 });
 
-it('adds restart limit columns to previews services and standalone databases', function () {
+it('limits restarts only for applications', function () {
     $migrations = collect(glob(database_path('migrations/*.php')))
         ->map(fn (string $path): string => file_get_contents($path))
         ->implode("\n");
@@ -165,19 +160,62 @@ it('adds restart limit columns to previews services and standalone databases', f
     expect($migrations)
         ->toContain("'application_previews'")
         ->toContain("'service_applications'")
-        ->toContain("'service_databases'")
         ->toContain("'max_restart_count'")
-        ->toContain("'restart_limit_reached'");
+        ->toContain("'restart_limit_reached'")
+        ->toContain("dropColumn(['max_restart_count', 'restart_limit_reached'])");
 
-    $restartLimitMigrations = collect(glob(database_path('migrations/*_add_restart_limit_to_*.php')));
+    $databaseModels = [
+        ServiceDatabase::class,
+        StandalonePostgresql::class,
+        StandaloneRedis::class,
+        StandaloneMongodb::class,
+        StandaloneMysql::class,
+        StandaloneMariadb::class,
+        StandaloneKeydb::class,
+        StandaloneDragonfly::class,
+        StandaloneClickhouse::class,
+    ];
 
-    expect($restartLimitMigrations)->toHaveCount(11);
-    expect($restartLimitMigrations->map(
-        fn (string $path): string => substr(basename($path), 0, 17)
-    )->unique())->toHaveCount(11);
-    $restartLimitMigrations->each(function (string $path): void {
-        expect(file_get_contents($path))->not->toContain('foreach (');
-    });
+    foreach ($databaseModels as $databaseModel) {
+        expect(class_uses_recursive($databaseModel))->not->toContain(HasRestartLimit::class);
+    }
+
+    foreach ([
+        'service_databases',
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+    ] as $databaseTable) {
+        expect(Schema::hasColumn($databaseTable, 'max_restart_count'))->toBeFalse()
+            ->and(Schema::hasColumn($databaseTable, 'restart_limit_reached'))->toBeFalse();
+    }
+
+    foreach ([GetContainersStatus::class, PushServerUpdateJob::class] as $statusUpdater) {
+        $source = file_get_contents((new ReflectionClass($statusUpdater))->getFileName());
+
+        expect($source)
+            ->not->toContain('$database->trackRestartCount')
+            ->not->toContain('$database->stoppedAfterRestartLimit()');
+    }
+
+    $stopServiceResource = file_get_contents((new ReflectionClass(StopServiceApplication::class))->getFileName());
+
+    expect($stopServiceResource)
+        ->toContain('$resetRestartCount && $serviceApplication instanceof ServiceApplication');
+});
+
+it('does not render restart limit warnings for service databases', function () {
+    $html = Blade::render(
+        '<x-application.restart-limit-warning :application="$database" />',
+        ['database' => new ServiceDatabase],
+    );
+
+    expect(trim($html))->toBeEmpty();
 });
 
 it('atomically claims a resource restart limit once and can reset it', function () {
diff --git a/tests/Feature/Api/ApplicationDomainValidationApiTest.php b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
new file mode 100644
index 0000000000..88533ce760
--- /dev/null
+++ b/tests/Feature/Api/ApplicationDomainValidationApiTest.php
@@ -0,0 +1,86 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.store' => 'array']);
+    InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
+    $this->bearerToken = $this->token->plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = $this->server->standaloneDockers()->firstOrCreate(
+            ['network' => 'coolify'],
+            ['uuid' => (string) new Cuid2, 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+
+    // Project boot event auto-creates a 'production' environment
+    $this->environment = $this->project->environments()->first();
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+});
+
+it('rejects wildcard domains on application updates regardless of proxy configuration', function (string $proxyType) {
+    $this->server->proxy = ['type' => $proxyType];
+    $this->server->save();
+    $originalDomain = $this->application->fqdn;
+
+    $this->withToken($this->bearerToken)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://*.example.com',
+            'force_domain_override' => true,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonPath('message', 'Validation failed.')
+        ->assertJsonPath('errors', fn (array $errors): bool => collect($errors)->flatten()->contains('Invalid URL: https://*.example.com'));
+
+    expect($this->application->fresh()->fqdn)->toBe($originalDomain);
+})->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
+
+it('rejects wildcard domains on application creation', function (string $proxyType) {
+    $this->server->proxy = ['type' => $proxyType];
+    $this->server->save();
+    $this->server->settings()->update(['is_reachable' => true, 'is_usable' => true]);
+    $count = Application::count();
+
+    $this->withToken($this->bearerToken)
+        ->postJson('/api/v1/applications/dockerimage', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'docker_registry_image_name' => 'nginx',
+            'ports_exposes' => '80',
+            'domains' => 'https://*.example.com',
+        ])
+        ->assertUnprocessable()
+        ->assertJsonPath('message', 'Validation failed.')
+        ->assertJsonPath('errors', fn (array $errors): bool => collect($errors)->flatten()->contains('Invalid URL: https://*.example.com'));
+
+    expect(Application::count())->toBe($count);
+})->with([ProxyTypes::NONE->value, ProxyTypes::TRAEFIK->value]);
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index 55d25927a3..a4c22a2b7c 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -165,6 +165,61 @@ test('changing a domain port regenerates managed labels with the requested port'
         ->and($labels)->not->toContain('loadbalancer.server.port=3000');
 });
 
+test('compose domain ports are stored as overrides when updating through the API', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  api:\n    image: nginx\n  frontend:\n    image: nginx\n",
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'docker_compose_domains' => [
+                ['name' => 'api', 'domain' => 'https://api.example.com'],
+                ['name' => 'frontend', 'domain' => 'https://app.example.com:80'],
+            ],
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+    $domains = json_decode($application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'frontend.domain'))->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 80,
+        ]);
+});
+
+test('compose domain ports are stored as overrides when creating through the API', function () {
+    Queue::fake();
+
+    $response = $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->postJson('/api/v1/applications/public', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'server_uuid' => $this->server->uuid,
+            'git_repository' => 'https://gitlab.com/coolify/compose-domain-port-test',
+            'git_branch' => 'main',
+            'build_pack' => 'dockercompose',
+            'autogenerate_domain' => false,
+            'docker_compose_domains' => [
+                ['name' => 'frontend', 'domain' => 'https://app.example.com:80'],
+            ],
+        ])
+        ->assertCreated();
+
+    $application = Application::where('uuid', $response->json('uuid'))->firstOrFail();
+    $domains = json_decode($application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'frontend.domain'))->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 80,
+        ]);
+});
+
 test('http basic auth updates regenerate managed labels', function () {
     $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
     $this->application->update([
diff --git a/tests/Feature/Api/LifecycleApisTest.php b/tests/Feature/Api/LifecycleApisTest.php
index 4973453e93..49d6f66359 100644
--- a/tests/Feature/Api/LifecycleApisTest.php
+++ b/tests/Feature/Api/LifecycleApisTest.php
@@ -138,6 +138,16 @@ describe('POST /api/v1/databases/{uuid}/clone', function () {
             'destination_id' => $this->destination->id,
             'destination_type' => $this->destination->getMorphClass(),
         ]);
+        $backup = $database->scheduledBackups()->create([
+            'team_id' => $this->team->id,
+            'enabled' => true,
+            'frequency' => '0 0 * * *',
+            'save_s3' => false,
+        ]);
+        $backup->forceFill([
+            'last_execution_at' => now()->subDay(),
+            'missing_backup_notification_sent_at' => now(),
+        ])->save();
 
         $response = $this->withHeaders($this->headers)
             ->postJson("/api/v1/databases/{$database->uuid}/clone", [
@@ -149,11 +159,14 @@ describe('POST /api/v1/databases/{uuid}/clone', function () {
             ->assertJsonPath('message', 'Database cloned.');
 
         $cloned = StandalonePostgresql::where('uuid', $response->json('uuid'))->first();
+        $clonedBackup = $cloned->scheduledBackups()->sole();
         expect($cloned)->not->toBeNull()
             ->and($cloned->name)->toBe('cloned-db')
             ->and($cloned->environment_id)->toBe($database->environment_id)
             ->and($cloned->destination_id)->toBe($this->destination->id)
-            ->and(str($cloned->status)->startsWith('exited'))->toBeTrue();
+            ->and(str($cloned->status)->startsWith('exited'))->toBeTrue()
+            ->and($clonedBackup->last_execution_at)->toBeNull()
+            ->and($clonedBackup->missing_backup_notification_sent_at)->toBeNull();
     });
 
     test('creates renamed volumes when cloning a database with clone_volumes', function () {
diff --git a/tests/Feature/ApiTokenExpirationWarningTest.php b/tests/Feature/ApiTokenExpirationWarningTest.php
index 92c2076077..a6bbffbbc3 100644
--- a/tests/Feature/ApiTokenExpirationWarningTest.php
+++ b/tests/Feature/ApiTokenExpirationWarningTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Jobs\ApiTokenExpirationWarningJob;
+use App\Models\InstanceSettings;
 use App\Models\PersonalAccessToken;
 use App\Models\Team;
 use App\Models\User;
@@ -14,6 +15,7 @@ use Illuminate\Support\Facades\Notification;
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
@@ -137,4 +139,15 @@ describe('ApiTokenExpirationWarningJob', function () {
         Notification::assertNothingSent();
         expect($token->fresh()->api_token_expiration_warning_sent_at)->toBeNull();
     });
+
+    test('manage url uses the instance fqdn when configured', function () {
+        InstanceSettings::query()->update(['fqdn' => 'https://coolify.example.com']);
+        $token = createTokenExpiring($this->user, $this->team, Carbon::now()->addHours(12));
+
+        $notification = new ApiTokenExpiringNotification($token);
+
+        expect($notification->toSlack()->description)
+            ->toContain('https://coolify.example.com/security/api-tokens')
+            ->not->toContain('localhost');
+    });
 });
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 9d0739d1ce..2c8ea4fe51 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -111,6 +111,33 @@ it('does not add a single-label hostname as an application domain', function ()
     expect($this->application->fresh()->fqdn)->toBeNull();
 });
 
+it('keeps a compose domain removed when the service declares a magic URL variable', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      SERVICE_URL_WEB: /api
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com/api'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $domainKey = hash('sha256', 'https://web.example.com/api|web');
+
+    $component
+        ->call('removeDomainByKey', $domainKey)
+        ->assertDispatched('success')
+        ->assertSet('domainRows', []);
+
+    expect(json_decode($this->application->fresh()->docker_compose_domains, true))
+        ->toMatchArray(['web' => ['domain' => null]]);
+});
+
 it('generates a preview domain when the application has no domain', function () {
     $preview = ApplicationPreview::create([
         'application_id' => $this->application->id,
@@ -591,10 +618,10 @@ it('lists existing domains as individual rows', function () {
         ->assertSee('class="invisible absolute inset-0 size-4 rounded-sm"', false)
         ->assertSee('$el.previousElementSibling.classList.add(\'hidden\')', false)
         ->assertSee('x-on:error="$el.remove()"', false)
-        ->assertSee('class="min-w-0 flex-1 text-[13px]', false)
+        ->assertSee('class="min-w-0 flex-1 truncate text-[13px]', false)
         ->html();
 
-    expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(2);
+    expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(0);
 });
 
 it('shows the HTTP redirect control for HTTPS domains and persists changes', function () {
@@ -618,7 +645,7 @@ it('hides the HTTP redirect control for HTTP-only domains', function () {
         ->assertDontSee('Redirect HTTP to HTTPS');
 });
 
-it('shows one redirect direction control in each compose service header', function () {
+it('shows the compose service redirect control in domain settings', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
         'docker_compose_raw' => "services:\n  api:\n    image: nginx:alpine\n",
@@ -633,11 +660,13 @@ it('shows one redirect direction control in each compose service header', functi
     $html = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSuccessful()
         ->assertSee('api')
+        ->call('startEdit', 0)
+        ->assertSee('www redirect')
         ->html();
 
     expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(1)
         ->and(substr_count($html, 'this.$wire.updateRedirect('))->toBe(0)
-        ->and(substr_count($html, 'domain-direction-service-api'))->toBeGreaterThan(0);
+        ->and(substr_count($html, 'application-domain-direction-'))->toBeGreaterThan(0);
 });
 
 it('shows dns entries control next to Add', function () {
@@ -689,6 +718,63 @@ it('lists dns entries for domains that still need dns and omits working configur
         ->not->toContain('app.example.com');
 });
 
+it('does not use instance network addresses for dns entries on a remote server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $this->application->update(['fqdn' => 'https://app.example.com']);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $records = $component->instance()->dnsRecordHints();
+
+    expect($records)->toBe([
+        [
+            'type' => 'A',
+            'name' => 'app.example.com',
+            'value' => '203.0.113.10',
+        ],
+    ]);
+});
+
+it('uses instance network addresses for dns entries on the localhost server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $localhost = Server::factory()->create([
+        'id' => 0,
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->server->private_key_id,
+        'ip' => 'localhost',
+    ]);
+    $destination = StandaloneDocker::withoutEvents(fn () => StandaloneDocker::forceCreate([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'localhost-docker',
+        'network' => 'coolify-localhost',
+        'server_id' => $localhost->id,
+    ]));
+    $this->application->update([
+        'destination_id' => $destination->id,
+        'fqdn' => 'https://app.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    expect($component->instance()->dnsRecordHints())->toBe([
+        [
+            'type' => 'A',
+            'name' => 'app.example.com',
+            'value' => '198.51.100.20',
+        ],
+        [
+            'type' => 'AAAA',
+            'name' => 'app.example.com',
+            'value' => '2001:db8::20',
+        ],
+    ]);
+});
+
 it('shows cloudflare domain connect only on cloud with a key', function () {
     config([
         'constants.coolify.self_hosted' => false,
@@ -721,7 +807,7 @@ it('shows cloudflare domain connect only on cloud with a key', function () {
 
 it('adds a domain to the application', function () {
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
-        ->assertSee('+ Add')
+        ->assertSee('Add domain')
         ->set('newDomain', 'https://app.example.com')
         ->call('addDomain')
         ->assertHasNoErrors()
@@ -825,7 +911,7 @@ it('updates a domain in place via modal', function () {
         ->call('startEdit', 0)
         ->assertSet('showEditDomainModal', true)
         ->assertSet('editingDomain', 'https://old.example.com')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('Search engine indexing')
         ->set('editingDomainParts.scheme', 'https')
         ->set('editingDomainParts.host', 'new.example.com')
@@ -1203,7 +1289,7 @@ it('hides dns message text when dns status is ok', function () {
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSet('domainRows.0.dns_status', 'ok')
-        ->assertSee('DNS OK')
+        ->assertSee('DNS matches')
         ->assertDontSee('DNS points to 203.0.113.10')
         ->assertDontSee('Last checked');
 });
@@ -1802,33 +1888,33 @@ it('uses the compact service domains layout for compose applications', function
         ->toContain('application-compose-domain-group-{{ $redirectWireKey }}')
         ->toContain('class="application-settings-section-body mt-1 scroll-mt-28')
         ->toContain('bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]')
-        ->toContain('class="data-table-header domains-table-grid-service"')
-        ->toContain('<span>Direction</span>')
-        ->toContain('<span class="whitespace-nowrap">Search engine indexing</span>')
+        ->toContain('class="data-table-header service-domains-overview-grid"')
+        ->toContain('<span>Domain redirect</span>')
+        ->toContain('<span>Search indexing</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain('id="edit-domain-direction"')
-        ->toContain('id="domain-direction-service-{{ $redirectWireKey }}"')
-        ->toContain('onChange="updateServiceRedirect"')
-        ->toContain("'showDirectionControl' => false")
+        ->toContain('wire:key="application-compose-domain-rows-{{ $redirectWireKey }}"')
+        ->toContain('id="application-domain-direction-{{ $editingKey }}"')
+        ->toContain("\$isCompose ? 'updateServiceRedirect' : 'updateRedirect'")
         ->not->toContain('title="No domains for this service"');
 });
 
-it('keeps search engine indexing table headers on one line', function () {
+it('uses concise search indexing headers in application and service domain tables', function () {
     $applicationView = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
     $serviceView = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
 
-    expect(substr_count($applicationView, '<span class="whitespace-nowrap">Search engine indexing</span>'))
-        ->toBe(2)
+    expect(substr_count($applicationView, '<span>Search indexing</span>'))
+        ->toBe(1)
         ->and($serviceView)
-        ->toContain('<span class="whitespace-nowrap">Search engine indexing</span>');
+        ->toContain('<span>Search indexing</span>');
 });
 
-it('shows domain guidance in the application domains section', function () {
+it('shows save guidance in the application domain settings', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
 
     expect($view)
-        ->toContain('<p class="text-sm text-neutral-500 dark:text-fg-dim">')
-        ->toContain('{{ $helperText }}');
+        ->toContain('Indexing and redirect changes save automatically.')
+        ->toContain('<x-unsaved-bar action="updateDomain"');
 });
 
 it('does not render a last checked column in the domains table', function () {
@@ -1844,13 +1930,15 @@ it('uses compact labeled domain cards on mobile', function () {
     $row = file_get_contents(resource_path('views/livewire/project/application/partials/domain-row.blade.php'));
 
     expect($styles)
-        ->toContain('@media (max-width: 768px)')
-        ->toContain('.domains-mobile-label')
-        ->toContain('.domains-table-grid .listbox-trigger')
+        ->toContain('@container service-domains (max-width: 980px)')
+        ->toContain('.service-domain-detail-label')
+        ->toContain('.service-domains-overview-grid')
+        ->toContain('@container service-domains (max-width: 600px)')
+        ->toContain('.service-domain-mobile-summary')
         ->and($row)
-        ->toContain('domains-mobile-label')
-        ->toContain('Search engine indexing')
-        ->toContain('Direction');
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('No redirects')
+        ->toContain('Noindex');
 });
 
 it('uses segmented fields when adding and editing application domains', function () {
@@ -2048,10 +2136,11 @@ it('updates search engine indexing from the domains view', function () {
     $this->application->update(['fqdn' => 'https://app.example.com,https://staging.example.com']);
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
         ->assertSee('Noindex')
         ->assertSee('Indexable')
         ->assertSee('Search engine indexing')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('toggleNoindexDomain', false)
         ->assertSee('updateRedirect', false)
         ->assertSee('wire:ignore', false)
@@ -2066,6 +2155,28 @@ it('updates search engine indexing from the domains view', function () {
         ->toBe(['https://staging.example.com']);
 });
 
+it('updates search engine indexing for a git docker compose domain', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://compose.example.com'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('toggleNoindexDomain', 'https://compose.example.com', 'noindex')
+        ->assertDispatched('configurationChanged')
+        ->assertDispatched('success');
+
+    expect($this->application->refresh()->noindexDomains()->all())
+        ->toBe(['https://compose.example.com']);
+
+    $component->call('toggleNoindexDomain', 'https://compose.example.com', 'index');
+
+    expect($this->application->refresh()->noindexDomains()->all())->toBe([]);
+});
+
 it('keeps noindex domains when normalizing a custom domain port', function () {
     $this->application->update([
         'fqdn' => 'https://staging.example.com:8080',
@@ -2270,7 +2381,7 @@ it('renders a portless domain link with an internal port badge for overrides', f
         ->not->toContain('Inherited from Ports Exposes');
 });
 
-it('shows an error badge when a domain has no internal port and ports exposes is empty', function () {
+it('shows a warning when a domain has no internal port and ports exposes is empty', function () {
     $this->application->update([
         'ports_exposes' => null,
         'fqdn' => 'https://example.com',
@@ -2281,7 +2392,8 @@ it('shows an error badge when a domain has no internal port and ports exposes is
         ->assertSet('domainRows.0.internal_port', null)
         ->assertSee('No internal port')
         ->assertDontSee('Internal port ')
-        ->assertSee('table-badge-danger', false);
+        ->assertSee('aria-label="No internal port"', false)
+        ->assertSee('Set Ports Exposes or a per-domain internal port', false);
 });
 
 it('keeps the internal port badge when a domain override exists without ports exposes', function () {
@@ -2307,10 +2419,92 @@ it('distinguishes an inherited internal port from a domain port override', funct
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->assertSee('Internal port 3000')
-        ->assertSee('Inherited from Ports Exposes', false)
+        ->assertSee('Inherited from the application or Compose service port', false)
         ->assertDontSee('Custom internal port for this domain', false);
 });
 
+it('shows the detected compose service port as the inherited internal port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose:\n      - '8069'\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', 8069)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 8069')
+        ->assertDontSee('Internal port 3000');
+});
+
+it('does not show an application port as the inherited port for a compose service without a declared port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  backend:\n    build: ./backend\n  frontend:\n    build: ./frontend\n",
+        'docker_compose_domains' => json_encode([
+            'backend' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertSet('domainRows.1.internal_port', null)
+        ->assertDontSee('Internal port 3000');
+});
+
+it('shows the detected compose service port for preview domains', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    ports:\n      - '18069:8069'\n",
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 8069,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/8069',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://preview.example.com'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', 8069)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 8069')
+        ->assertDontSee('Internal port 3000');
+});
+
+it('does not show an application port for a preview compose service without a declared port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  backend:\n    build: ./backend\n  frontend:\n    build: ./frontend\n",
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 8070,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/8070',
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://preview.example.com'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertDontSee('Internal port 3000');
+});
+
 it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
     $this->application->update([
         'ports_exposes' => '3000,8080',
@@ -2336,7 +2530,7 @@ it('stores compose domain port overrides without wiping other services', functio
         'build_pack' => 'dockercompose',
         'fqdn' => null,
         'ports_exposes' => '3000,8080',
-        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n  api:\n    image: node:alpine\n",
         'docker_compose_domains' => json_encode([
             'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
         ]),
@@ -2366,6 +2560,31 @@ it('stores compose domain port overrides without wiping other services', functio
         ->toHaveKey('https://api.example.com', 4000);
 });
 
+it('saves an unrecognized compose domain port after confirming the warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  frontend:\n    build: ./frontend\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '80')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://app.example.com' => 80]);
+});
+
 it('prunes a compose domain port override when that domain is removed', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
@@ -2560,3 +2779,255 @@ it('does not warn when editing an application domain to a port already used by a
         ->assertSet('showPortWarningModal', false)
         ->assertDispatched('success');
 });
+
+it('does not inherit the application port for single-service compose domains', function (string $extraService, bool $isPreview, bool $isStatic) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: httpd:2.4-alpine\n".$extraService,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://apache.example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    $this->application->settings()->update(['is_static' => $isStatic]);
+
+    if ($isPreview) {
+        $preview = ApplicationPreview::create([
+            'application_id' => $this->application->id,
+            'pull_request_id' => 1,
+            'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/1',
+            'docker_compose_domains' => $this->application->docker_compose_domains,
+        ]);
+        $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    } else {
+        $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    }
+
+    $component->assertSet('domainRows.0.internal_port', null)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertDontSee('Internal port 3000');
+})->with([
+    'web only' => '',
+    'web and database' => "  database:\n    image: postgres:16-alpine\n",
+])->with([false, true])->with([false, true]);
+
+it('checks compose ports against the selected service when saving domains', function (string $action, int $port, bool $warn) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    expose:
+      - 8080
+      - 8081
+    ports:
+      - target: 8082
+        published: 18082
+      - "18083:8083"
+  api:
+    image: nginx:alpine
+    expose:
+      - 9090
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://existing.example.com'],
+            'api' => ['domain' => 'https://api.example.com:9090'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    if ($action === 'add') {
+        $component->set('newDomainService', 'web')
+            ->set('newDomainParts.host', 'new.example.com')
+            ->set('newDomainParts.port', (string) $port)
+            ->call('addDomain');
+        $domain = 'https://new.example.com';
+    } else {
+        $component->call('startEdit', 0)
+            ->set('editingDomainParts.port', (string) $port)
+            ->call('updateDomain');
+        $domain = 'https://existing.example.com';
+    }
+
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', $warn);
+
+    if ($warn) {
+        expect($this->application->fresh()->domain_port_overrides ?? [])->not->toHaveKey($domain);
+        $component->assertSet('unrecognizedPort', $port)
+            ->call('confirmUseUnknownPort')
+            ->assertSet('showPortWarningModal', false);
+    }
+
+    $component->assertDispatched('success');
+    expect($this->application->fresh()->domain_port_overrides[$domain] ?? null)->toBe($port);
+})->with(['add', 'edit'])->with([
+    'first exposed port' => [8080, false],
+    'second exposed port' => [8081, false],
+    'long syntax target' => [8082, false],
+    'short syntax target' => [8083, false],
+    'global port' => [3000, true],
+    'another service port' => [9090, true],
+    'published host port' => [18082, true],
+]);
+
+it('keeps an existing custom compose port without another warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '7070')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
+});
+
+it('keeps the selected application domain when a refresh reorders dns rows', function (bool $compose) {
+    $first = 'https://first.example.com';
+    $second = 'https://second.example.com';
+    $this->application->update($compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => "$first,$second"]]),
+    ] : ['fqdn' => "$first,$second"]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'renamed.example.com');
+    $this->application->update(['domain_dns_statuses' => [
+        ($compose ? 'web|' : '').$second => ['status' => 'failed', 'message' => 'Mismatch'],
+    ]]);
+
+    $component->call('refreshDomains')
+        ->assertSet('editingIndex', 1)
+        ->assertSet('editingDomainParts.host', 'renamed.example.com')
+        ->call('toggleNoindexDomain', $first, 'noindex')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    $this->application->refresh();
+    $domains = $compose ? json_decode($this->application->docker_compose_domains, true)['web']['domain'] : $this->application->fqdn;
+    expect(explode(',', $domains))->toBe(['https://renamed.example.com', $second]);
+})->with([false, true]);
+
+it('inherits application counterpart ports without changing configured counterparts', function (bool $compose, ?int $override, string $redirect) {
+    $host = $redirect === 'www' ? 'app.example.com' : 'www.app.example.com';
+    $counterpart = $redirect === 'www' ? 'www.app.example.com' : 'app.example.com';
+    $url = "https://$host/blog";
+    $pairedUrl = "https://$counterpart/blog";
+    $existing = 'http://existing.example.com,https://www.existing.example.com';
+    $this->application->update(array_merge([
+        'ports_exposes' => '80',
+        'domain_port_overrides' => array_filter([
+            $url => $override,
+            'https://www.existing.example.com' => 9090,
+        ], fn ($port) => $port !== null),
+    ], $compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => "$url,$existing"]]),
+    ] : ['fqdn' => "$url,$existing"]));
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    if ($compose) {
+        $component->call('updateServiceRedirect', 'web', $redirect);
+    } else {
+        $component->call('updateRedirect', $redirect);
+    }
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', false);
+
+    $this->application->refresh();
+    $domains = $compose ? json_decode($this->application->docker_compose_domains, true)['web']['domain'] : $this->application->fqdn;
+    expect($domains)->toContain($pairedUrl)->toContain($existing)
+        ->and($this->application->domain_port_overrides[$pairedUrl] ?? 80)->toBe($override ?? 80)
+        ->and($this->application->domain_port_overrides[$url] ?? null)->toBe($override)
+        ->and($this->application->domain_port_overrides['https://www.existing.example.com'])->toBe(9090);
+})->with([false, true])->with([null, 8080])->with(['www', 'non-www']);
+
+it('preserves pending application redirect through refresh and resolves its domain conflict', function (bool $compose, bool $cancel) {
+    Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => 'https://www.pending.example.com',
+        'build_pack' => 'nixpacks',
+    ]);
+    $url = 'https://pending.example.com';
+    $this->application->update(array_merge([
+        'domain_port_overrides' => [$url => 8080],
+    ], $compose ? [
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.app:\n    image: nginx:alpine\n    expose: [80]\n",
+        'docker_compose_domains' => json_encode([
+            'web.app' => ['domain' => $url, 'redirect' => 'both'],
+            'occupied' => ['domain' => 'https://www.pending.example.com'],
+        ]),
+    ] : ['fqdn' => $url]));
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $property = $compose ? 'serviceRedirects.'.str_replace('.', '__dot__', 'web.app') : 'redirect';
+    if ($compose) {
+        $component->call('updateServiceRedirect', 'web.app', 'www');
+    } else {
+        $component->call('updateRedirect', 'www');
+    }
+    $component->assertSet('showDomainConflictModal', true)
+        ->call('refreshDomains')
+        ->assertSet($property, 'www');
+
+    if ($cancel) {
+        $component->set('showDomainConflictModal', false)
+            ->assertSet($property, 'both')
+            ->assertSet('pendingAction', null)
+            ->assertSet('pendingRedirectService', null);
+    } else {
+        $component->call('confirmDomainUsage')
+            ->assertHasNoErrors()
+            ->assertSet('pendingAction', null)
+            ->assertSet('pendingRedirectService', null)
+            ->assertSet($property, 'www');
+    }
+
+    $this->application->refresh();
+    $storedRedirect = $compose ? json_decode($this->application->docker_compose_domains, true)['web.app']['redirect'] : $this->application->redirect;
+    expect($storedRedirect)->toBe($cancel ? 'both' : 'www');
+    if (! $cancel) {
+        expect($this->application->domain_port_overrides['https://www.pending.example.com'] ?? null)->toBe(8080);
+    }
+})->with([false, true])->with([false, true]);
+
+it('keeps the selected application domain when removing an earlier row', function () {
+    $this->application->update(['fqdn' => 'https://first.example.com,https://second.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->call('removeDomain', 0)
+        ->assertSet('editingIndex', 0)
+        ->set('editingDomainParts.host', 'renamed.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($this->application->fresh()->fqdn)->toBe('https://renamed.example.com');
+});
+
+it('prevents members from cancelling protected application redirect conflict state', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('showDomainConflictModal', true)
+        ->set('showDomainConflictModal', false)
+        ->assertForbidden();
+});
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 0c40d4a86c..10e312b545 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\PrivateKey;
 use App\Models\Project;
@@ -570,17 +571,19 @@ YAML,
         ->toBeTrue();
 });
 
-test('applicationParser compose labels use the first ports_exposes value when a portless domain has no override', function () {
+test('single-service compose leaves undeclared ports to proxy discovery', function (int $parserVersion, string $extraService, bool $isPreview) {
     $application = disableExactProxyLabels(Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
         'destination_type' => StandaloneDocker::class,
         'build_pack' => 'dockercompose',
+        'compose_parsing_version' => $parserVersion,
         'ports_exposes' => '3000,8080',
-        'docker_compose_raw' => <<<'YAML'
+        'docker_compose_raw' => <<<YAML
 services:
   frontend:
-    image: myapp/frontend:latest
+    image: httpd:2.4-alpine
+{$extraService}
 YAML,
         'fqdn' => null,
         'domain_port_overrides' => null,
@@ -589,13 +592,92 @@ YAML,
         ]),
     ]));
 
-    $parsedCompose = applicationParser($application->fresh());
-    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+    $preview = $isPreview ? ApplicationPreview::create([
+        'application_id' => $application->id,
+        'pull_request_id' => 1,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/1',
+        'docker_compose_domains' => $application->docker_compose_domains,
+    ]) : null;
 
-    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=3000')))
-        ->toBeTrue()
-        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 3000}}')))
+    $parsedCompose = $application->fresh()->parse(
+        pull_request_id: $preview?->pull_request_id ?? 0,
+        preview_id: $preview?->id,
+    );
+    $labels = collect(data_get($parsedCompose, 'services'))->flatMap(fn ($service) => data_get($service, 'labels', []));
+
+    expect($labels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams}}')))
         ->toBeTrue()
         ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
         ->toBeTrue();
+})->with([2, 3])->with([
+    'web only' => '',
+    'web and database' => "  database:\n    image: postgres:16-alpine",
+])->with([false, true]);
+
+test('applicationParser compose labels prefer the service exposed port over application ports_exposes', function (string $portConfiguration) {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<YAML
+services:
+  frontend:
+    image: myapp/frontend:latest
+{$portConfiguration}
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $labels = collect(data_get(applicationParser($application->fresh()), 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8069')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8069}}')))
+        ->toBeTrue();
+})->with([
+    'expose' => "    expose:\n      - '8069'",
+    'short port syntax' => "    ports:\n      - '18069:8069'",
+    'long port syntax' => "    ports:\n      - target: 8069\n        published: 18069",
+]);
+
+test('applicationParser does not apply an application port to compose services without a declared port', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  postgres:
+    image: postgres:16-alpine
+  backend:
+    build: ./backend
+  frontend:
+    build: ./frontend
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'backend' => ['domain' => 'https://api.example.com'],
+            'frontend' => ['domain' => 'https://app.example.com'],
+        ]),
+    ]));
+
+    $services = data_get(applicationParser($application->fresh()), 'services');
+    $backendLabels = collect(data_get($services, 'backend.labels'));
+    $frontendLabels = collect(data_get($services, 'frontend.labels'));
+
+    expect($backendLabels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($frontendLabels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse();
 });
diff --git a/tests/Feature/ApplicationPreviewSettingsTest.php b/tests/Feature/ApplicationPreviewSettingsTest.php
new file mode 100644
index 0000000000..5a938e0d01
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewSettingsTest.php
@@ -0,0 +1,139 @@
+<?php
+
+use App\Livewire\Project\Application\Previews;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        [
+            'id' => 0,
+            'is_dns_validation_enabled' => false,
+        ]
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $key = PrivateKey::withoutEvents(fn () => PrivateKey::forceCreate([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]));
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $key->id,
+        'ip' => '203.0.113.10',
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Preview App',
+        'preview_url_template' => '{{pr_id}}.{{domain}}',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => null,
+        'redirect' => 'both',
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $this->application->settings()->update([
+        'is_container_label_readonly_enabled' => true,
+    ]);
+});
+
+it('shows preview settings and persists changes independently of preview inputs', function () {
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->assertSee('PR deployment access')
+        ->assertSet('isPreviewDeploymentsEnabled', false)
+        ->set('manualPullRequestId', -1)
+        ->set('isPreviewDeploymentsEnabled', true)
+        ->set('isPrDeploymentsPublicEnabled', true)
+        ->call('savePreviewSettings')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->settings)
+        ->is_preview_deployments_enabled->toBeTrue()
+        ->is_pr_deployments_public_enabled->toBeTrue();
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->assertSet('isPreviewDeploymentsEnabled', true)
+        ->assertSet('isPrDeploymentsPublicEnabled', true)
+        ->set('isPreviewDeploymentsEnabled', false)
+        ->call('savePreviewSettings');
+
+    expect($this->application->fresh()->settings->is_preview_deployments_enabled)->toBeFalse();
+});
+
+it('does not show git preview settings for non-git applications', function (string $buildPack, ?string $dockerfile) {
+    $this->application->update(['build_pack' => $buildPack, 'dockerfile' => $dockerfile]);
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->assertDontSee('PR deployment access');
+})->with([['dockerimage', null], ['dockerfile', 'FROM nginx']]);
+
+it('denies preview setting changes without application update permission', function (string $role, bool $otherTeam) {
+    $user = User::factory()->create();
+    $team = $otherTeam ? Team::factory()->create() : $this->team;
+    $team->members()->attach($user->id, ['role' => $role]);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    Livewire::test(Previews::class, ['application' => $this->application])
+        ->set('isPreviewDeploymentsEnabled', true)
+        ->set('isPrDeploymentsPublicEnabled', true)
+        ->call('savePreviewSettings')
+        ->assertForbidden();
+
+    expect($this->application->fresh()->settings)
+        ->is_preview_deployments_enabled->toBeFalse()
+        ->is_pr_deployments_public_enabled->toBeFalse();
+})->with([['member', false], ['owner', true]]);
+
+it('removes preview settings from Advanced including its persistence path', function () {
+    expect(file_get_contents(resource_path('views/livewire/project/application/advanced.blade.php')))
+        ->not->toContain('isPreviewDeploymentsEnabled', 'isPrDeploymentsPublicEnabled');
+    expect(file_get_contents(app_path('Livewire/Project/Application/Advanced.php')))
+        ->not->toContain('is_preview_deployments_enabled', 'is_pr_deployments_public_enabled');
+});
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 3e6e04629d..f5875adb2c 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -6,10 +6,21 @@ use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\BaseModel;
+use App\Models\InstanceSettings;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandalonePostgresql;
 use App\Notifications\Application\RestartLimitReached;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Mockery\MockInterface;
 
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0, 'fqdn' => 'https://coolify.test']);
+});
+
 function applicationWithRestartState(array $attributes = []): Application
 {
     $application = new Application;
@@ -115,7 +126,7 @@ it('can stop an application without removing its containers', function () {
 
     expect($removeContainers)->not->toBeNull()
         ->and($removeContainers->getDefaultValue())->toBeTrue()
-        ->and($action)->toContain('docker update --restart=no')
+        ->and($action)->not->toContain('docker update --restart=no')
         ->and($action)->toContain('if ($removeContainers)');
 });
 
@@ -161,14 +172,8 @@ it('preserves restart-limit applications only while their exited container exist
         ->and($sentinelJob)->toContain('if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(');
 });
 
-it('uses the application link for restart limit notifications', function () {
-    $application = new class extends Application
-    {
-        public function link()
-        {
-            return 'https://coolify.test/project/link-from-model';
-        }
-    };
+it('builds restart limit notification urls from the instance base url', function () {
+    $application = new Application;
     $application->forceFill([
         'name' => 'crashy-app',
         'uuid' => 'application-uuid',
@@ -183,7 +188,33 @@ it('uses the application link for restart limit notifications', function () {
 
     $notification = new RestartLimitReached($application);
 
-    expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
+    expect($notification->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/application/application-uuid');
+});
+
+it('links preview, service resource and database restart limit notifications to their pages', function () {
+    $environment = (object) ['uuid' => 'environment-uuid', 'name' => 'production', 'project' => (object) ['uuid' => 'project-uuid']];
+
+    $application = new Application;
+    $application->forceFill(['name' => 'app', 'uuid' => 'application-uuid']);
+    $application->setRelation('environment', $environment);
+    $preview = new ApplicationPreview;
+    $preview->forceFill(['uuid' => 'preview-uuid', 'pull_request_id' => 42, 'restart_count' => 2, 'max_restart_count' => 2]);
+    $preview->setRelation('application', $application);
+
+    $service = new Service;
+    $service->forceFill(['uuid' => 'service-uuid']);
+    $service->setRelation('environment', $environment);
+    $serviceApplication = new ServiceApplication;
+    $serviceApplication->forceFill(['name' => 'database', 'uuid' => 'service-application-uuid', 'restart_count' => 2, 'max_restart_count' => 2]);
+    $serviceApplication->setRelation('service', $service);
+
+    $database = new StandalonePostgresql;
+    $database->forceFill(['name' => 'postgres', 'uuid' => 'database-uuid', 'restart_count' => 2, 'max_restart_count' => 2]);
+    $database->setRelation('environment', $environment);
+
+    expect((new RestartLimitReached($preview))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/application/application-uuid')
+        ->and((new RestartLimitReached($serviceApplication))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/service/service-uuid')
+        ->and((new RestartLimitReached($database))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/database/database-uuid');
 });
 
 it('uses the resolved environment project name in Slack restart limit notifications', function () {
diff --git a/tests/Feature/BackupEditValidationTest.php b/tests/Feature/BackupEditValidationTest.php
index 42a430a491..03af1bea4f 100644
--- a/tests/Feature/BackupEditValidationTest.php
+++ b/tests/Feature/BackupEditValidationTest.php
@@ -247,6 +247,7 @@ it('redirects to executions after queuing a database backup with unusable S3 sto
         'timeout' => 3600,
     ]);
     $database = $backup->database;
+    $database->update(['status' => 'running:healthy']);
     $parameters = [
         'project_uuid' => $database->project()->uuid,
         'environment_uuid' => $database->environment->uuid,
@@ -509,7 +510,7 @@ it('subscribes to database status broadcasts so Backup Now can refresh without a
         ->toHaveKey('databaseUpdated');
 });
 
-it('shows Backup Now after refresh when the database becomes running', function () {
+it('enables Back up now after refresh when the database becomes running', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'enabled' => true,
     ]);
@@ -521,17 +522,21 @@ it('shows Backup Now after refresh when the database becomes running', function
         'availableS3Storages' => $this->team->s3s,
         'status' => 'exited:unhealthy',
     ])
-        ->assertDontSee('Backup Now')
+        ->assertSee('Back up now')
         ->assertSet('status', 'exited:unhealthy');
 
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
+
     $database->update(['status' => 'running:healthy']);
 
     $component->call('refreshStatus')
         ->assertSet('status', 'running:healthy')
-        ->assertSee('Backup Now');
+        ->assertSee('Back up now');
+
+    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
 });
 
-it('hides Backup Now after refresh when the database stops', function () {
+it('disables Back up now after refresh when the database stops', function () {
     $backup = createBackupForEditValidationTest($this->team, [
         'enabled' => true,
     ]);
@@ -543,12 +548,33 @@ it('hides Backup Now after refresh when the database stops', function () {
         'availableS3Storages' => $this->team->s3s,
         'status' => 'running:healthy',
     ])
-        ->assertSee('Backup Now')
+        ->assertSee('Back up now')
         ->assertSet('status', 'running:healthy');
 
     $database->update(['status' => 'exited:unhealthy']);
 
     $component->call('refreshStatus')
         ->assertSet('status', 'exited:unhealthy')
-        ->assertDontSee('Backup Now');
+        ->assertSee('Back up now');
+
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click="backupNow"/s');
+});
+
+it('renders S3 backup selectors outside the scrollable modal', function () {
+    createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team);
+    $html = Livewire::test(BackupEdit::class, [
+        'backup' => $backup->fresh(),
+        'availableS3Storages' => $this->team->s3s,
+        'section' => 's3',
+    ])->html();
+
+    $dom = new DOMDocument;
+    @$dom->loadHTML($html);
+    $xpath = new DOMXPath($dom);
+    foreach (['s3StorageId-panel', 'disableLocalBackup-panel'] as $panelId) {
+        $panels = $xpath->query('//template[@x-teleport="body"]/div[@id="'.$panelId.'"]');
+        expect($panels->length)->toBe(1);
+        expect($panels->item(0)->getAttribute('style'))->toContain('position: fixed', 'z-index: 9999');
+    }
 });
diff --git a/tests/Feature/BackupNowAvailabilityTest.php b/tests/Feature/BackupNowAvailabilityTest.php
new file mode 100644
index 0000000000..7c103e001f
--- /dev/null
+++ b/tests/Feature/BackupNowAvailabilityTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Jobs\DatabaseBackupJob;
+use App\Livewire\Project\Database\BackupEdit;
+use App\Livewire\Project\Database\BackupNow;
+use App\Livewire\Project\Service\VolumeBackup\Index;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $user->teams()->attach($team, ['role' => 'owner']);
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $resourceAttributes = [
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ];
+    $this->service = Service::factory()->create(['server_id' => $server->id, ...$resourceAttributes]);
+    $this->databases = [
+        'standalone' => StandalonePostgresql::create([
+            ...$resourceAttributes,
+            'name' => 'postgres',
+            'postgres_password' => 'password',
+        ]),
+        'service' => ServiceDatabase::create([
+            'service_id' => $this->service->id,
+            'name' => 'postgres',
+            'image' => 'postgres:16-alpine',
+            'custom_type' => 'postgresql',
+        ]),
+    ];
+    $this->backups = collect($this->databases)->map(fn ($database) => ScheduledDatabaseBackup::create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'database_id' => $database->id,
+        'database_type' => $database->getMorphClass(),
+    ]));
+    Queue::fake();
+});
+
+dataset('database backup controls', [
+    'standalone settings' => [BackupEdit::class, 'standalone'],
+    'service settings' => [BackupEdit::class, 'service'],
+    'standalone button' => [BackupNow::class, 'standalone'],
+    'service button' => [BackupNow::class, 'service'],
+    'service list' => [Index::class, 'service'],
+]);
+
+it('only enables and queues database backups for running targets', function (string $componentClass, string $type, string $status, bool $running) {
+    $database = $this->databases[$type];
+    $database->update(['status' => $status]);
+    $backup = $this->backups[$type]->fresh();
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $backup, ...($componentClass === BackupEdit::class ? ['availableS3Storages' => collect()] : [])];
+    $component = Livewire::test($componentClass, $parameters);
+    $dom = new DOMDocument;
+    @$dom->loadHTML($component->html());
+    $buttons = (new DOMXPath($dom))->query('//button');
+    $backupButtons = [];
+    foreach ($buttons as $button) {
+        if (str_starts_with($button->getAttribute('wire:click'), 'backupNow') || str_starts_with($button->getAttribute('wire:click.stop'), 'backupNow')) {
+            $backupButtons[] = $button;
+        }
+    }
+    expect($backupButtons)->toHaveCount(1);
+    expect($backupButtons[0]->hasAttribute('disabled'))->toBe(! $running);
+
+    $component->call('backupNow', ...($componentClass === Index::class ? ['database', $backup->uuid] : []));
+    if ($running) {
+        Queue::assertPushed(DatabaseBackupJob::class);
+    } else {
+        $component->assertDispatched('error')->assertNotDispatched('success')->assertNoRedirect();
+        Queue::assertNotPushed(DatabaseBackupJob::class);
+    }
+})->with('database backup controls')->with([
+    ['running:healthy', true],
+    ['running:unhealthy', true],
+    ['exited:unhealthy', false],
+    ['restarting:unhealthy', false],
+]);
+
+it('checks current database status before queuing from a stale page', function (string $componentClass, string $type) {
+    $database = $this->databases[$type];
+    $database->update(['status' => 'running:healthy']);
+    $backup = $this->backups[$type]->fresh();
+    $parameters = $componentClass === Index::class
+        ? ['service' => $this->service]
+        : ['backup' => $backup, ...($componentClass === BackupEdit::class ? ['availableS3Storages' => collect()] : [])];
+    $component = Livewire::test($componentClass, $parameters);
+    $database->update(['status' => 'exited:unhealthy']);
+
+    $component->call('backupNow', ...($componentClass === Index::class ? ['database', $backup->uuid] : []))
+        ->assertDispatched('error')->assertNotDispatched('success')->assertNoRedirect();
+    Queue::assertNotPushed(DatabaseBackupJob::class);
+})->with('database backup controls');
+
+it('refreshes service backup buttons when the service status check completes', function () {
+    $database = $this->databases['service'];
+    $database->update(['status' => 'exited:unhealthy']);
+    $component = Livewire::test(Index::class, ['service' => $this->service]);
+    $database->update(['status' => 'running:healthy']);
+
+    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
+    expect($component->html())->not->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+
+    $database->update(['status' => 'exited:unhealthy']);
+    $component->dispatch('echo-private:team.'.currentTeam()->id.',ServiceChecked');
+    expect($component->html())->toMatch('/<button\s+disabled[^>]*wire:click.stop="backupNow/s');
+});
diff --git a/tests/Feature/CreateScheduledBackupValidationTest.php b/tests/Feature/CreateScheduledBackupValidationTest.php
index 1b18c31b41..a96e776a05 100644
--- a/tests/Feature/CreateScheduledBackupValidationTest.php
+++ b/tests/Feature/CreateScheduledBackupValidationTest.php
@@ -82,11 +82,10 @@ it('creates a service database backup without S3 and opens its configuration', f
 
     $backup = ScheduledDatabaseBackup::query()->sole();
 
-    $component->assertRedirectToRoute('project.service.database.backup.show', [
+    $component->assertRedirectToRoute('project.service.volume-backups.index', [
         'project_uuid' => $this->project->uuid,
         'environment_uuid' => $this->environment->uuid,
         'service_uuid' => $service->uuid,
-        'stack_service_uuid' => $database->uuid,
         'backup_uuid' => $backup->uuid,
     ]);
 
@@ -114,14 +113,22 @@ it('selects a service database when creating a backup from the unified backups p
         'custom_type' => 'postgresql',
     ]);
 
-    Livewire::test(CreateScheduledBackup::class, ['service' => $service])
+    $component = Livewire::test(CreateScheduledBackup::class, ['service' => $service])
         ->assertSee('Database')
         ->assertSee('analytics')
         ->set('selectedDatabaseUuid', $analytics->uuid)
         ->set('frequency', 'daily')
         ->call('submit');
 
-    expect(ScheduledDatabaseBackup::query()->sole()->database->is($analytics))->toBeTrue();
+    $backup = ScheduledDatabaseBackup::query()->sole();
+    expect($backup->database->is($analytics))->toBeTrue();
+
+    $component->assertRedirectToRoute('project.service.volume-backups.index', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'service_uuid' => $service->uuid,
+        'backup_uuid' => $backup->uuid,
+    ]);
 });
 
 it('creates a clickhouse backup for its configured database', function () {
diff --git a/tests/Feature/DatabaseBackupUploadValidationTest.php b/tests/Feature/DatabaseBackupUploadValidationTest.php
index 88978eeaba..f8416fe6c7 100644
--- a/tests/Feature/DatabaseBackupUploadValidationTest.php
+++ b/tests/Feature/DatabaseBackupUploadValidationTest.php
@@ -220,16 +220,16 @@ test('file scanner allows ordinary gzipped dumps', function () {
     expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzClean))->toBeFalse();
 });
 
-test('file scanner detects program execution payloads inside custom format archives', function () {
+test('file scanner defers custom format archives to pg_restore inspection', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload");
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
-test('file scanner detects program execution payloads inside gzipped custom format archives', function () {
+test('file scanner defers gzipped custom format archives to pg_restore inspection', function () {
     $archive = writeScanPayload("PGDMP\0binary COPY records FROM PROGRAM payload", gzip: true);
 
-    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeTrue();
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($archive))->toBeFalse();
 });
 
 test('file scanner allows custom format archives without program execution', function () {
diff --git a/tests/Feature/DockerComposeHttpPortsTest.php b/tests/Feature/DockerComposeHttpPortsTest.php
new file mode 100644
index 0000000000..6b3adaa935
--- /dev/null
+++ b/tests/Feature/DockerComposeHttpPortsTest.php
@@ -0,0 +1,19 @@
+<?php
+
+use Symfony\Component\Yaml\Yaml;
+
+it('selects only TCP container ports for HTTP routing and confirmation', function (array $service, array $expected) {
+    $compose = Yaml::dump(['services' => ['web' => $service]]);
+
+    expect(firstDockerComposeServicePort($service))->toBe($expected[0] ?? null)
+        ->and(dockerComposeServicePort($compose, 'web'))->toBe($expected[0] ?? null)
+        ->and(dockerComposeServicePorts($compose, 'web'))->toBe($expected);
+})->with([
+    'expose UDP first' => [['expose' => ['53/udp', '8080/tcp']], [8080]],
+    'published UDP first' => [['ports' => ['53:53/udp', '18080:8080/tcp']], [8080]],
+    'long syntax UDP first' => [['ports' => [['target' => 53, 'protocol' => 'udp'], ['target' => 8080, 'published' => 18080, 'protocol' => 'tcp']]], [8080]],
+    'implicit TCP' => [['expose' => [80], 'ports' => [['target' => 8080], '18081:8081']], [80, 8080, 8081]],
+    'UDP only' => [['expose' => ['53/udp'], 'ports' => [['target' => 67, 'protocol' => 'udp']]], []],
+    'other protocol' => [['ports' => ['9000:9000/sctp', '8080']], [8080]],
+    'duplicates' => [['expose' => ['8080/udp', '8080/tcp'], 'ports' => ['18080:8080']], [8080]],
+]);
diff --git a/tests/Feature/EnvironmentVariableAsyncLoadTest.php b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
index 56abc94f77..d98313a9f8 100644
--- a/tests/Feature/EnvironmentVariableAsyncLoadTest.php
+++ b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
@@ -121,3 +121,69 @@ it('is idempotent when loadEnvironmentVariables is called twice', function () {
     expect($component->instance()->environmentVariables->pluck('key')->all())
         ->toContain('API_KEY');
 });
+
+it('preserves generated compose variables during bulk replacement', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'build_pack' => 'dockercompose',
+        'docker_compose' => <<<'YAML'
+services:
+  api:
+    image: nginx:alpine
+    environment:
+      SERVICE_URL_API: /api
+YAML,
+    ]);
+
+    foreach ([
+        'SERVICE_URL_API' => 'https://api.example.com/api',
+        'SERVICE_FQDN_API' => 'api.example.com/api',
+        'OLD_VARIABLE' => 'remove-me',
+    ] as $key => $value) {
+        EnvironmentVariable::create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+        ]);
+    }
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->set('variables', 'NEW_VARIABLE=keep-me')
+        ->call('submit')
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
+
+    expect($application->environment_variables()->pluck('value', 'key')->all())
+        ->toBe([
+            'SERVICE_URL_API' => 'https://api.example.com/api',
+            'SERVICE_FQDN_API' => 'api.example.com/api',
+            'NEW_VARIABLE' => 'keep-me',
+        ]);
+});
+
+it('hides generated compose variables from developer view', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'build_pack' => 'dockercompose',
+    ]);
+
+    foreach ([
+        'SERVICE_URL_API' => 'https://api.example.com',
+        'SERVICE_FQDN_API' => 'api.example.com',
+        'API_URL' => '$SERVICE_URL_API',
+    ] as $key => $value) {
+        EnvironmentVariable::create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+        ]);
+    }
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->call('switch');
+
+    expect($component->get('variables'))
+        ->toBe('API_URL=$SERVICE_URL_API');
+});
diff --git a/tests/Feature/GithubPullRequestWebhookRoutingTest.php b/tests/Feature/GithubPullRequestWebhookRoutingTest.php
new file mode 100644
index 0000000000..7768dbd903
--- /dev/null
+++ b/tests/Feature/GithubPullRequestWebhookRoutingTest.php
@@ -0,0 +1,156 @@
+<?php
+
+use App\Jobs\ProcessGithubPullRequestWebhook;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+function createGithubPullRequestWebhookApplication(array $overrides = []): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create(array_merge([
+        'name' => 'github-pr-webhook-app',
+        'git_repository' => 'https://github.com/test-org/test-repo',
+        'git_branch' => 'main',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ], $overrides));
+}
+
+function githubPullRequestPayload(string $action, string $baseBranch): array
+{
+    return [
+        'action' => $action,
+        'number' => 42,
+        'repository' => [
+            'id' => 987654321,
+            'full_name' => 'test-org/test-repo',
+        ],
+        'pull_request' => [
+            'html_url' => 'https://github.com/test-org/test-repo/pull/42',
+            'title' => 'Stacked change',
+            'author_association' => 'OWNER',
+            'head' => [
+                'ref' => 'feature/child',
+                'sha' => 'head-sha',
+            ],
+            'base' => [
+                'ref' => $baseBranch,
+            ],
+        ],
+    ];
+}
+
+it('routes a closed GitHub App pull request to its application after the base branch changes', function () {
+    Queue::fake();
+
+    $team = Team::factory()->create();
+    $githubApp = GithubApp::create([
+        'name' => 'github-app-webhook-test',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'app_id' => 1234567890,
+        'webhook_secret' => 'test-secret',
+        'is_public' => false,
+        'team_id' => $team->id,
+    ]);
+    $application = createGithubPullRequestWebhookApplication([
+        'repository_project_id' => 987654321,
+        'source_id' => $githubApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    $body = json_encode(githubPullRequestPayload('closed', 'feature/parent'), JSON_THROW_ON_ERROR);
+    $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    expect($response->getContent())->toContain('PR webhook received');
+    Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->applicationId === $application->id
+        && $job->action === 'closed'
+        && $job->pullRequestId === 42);
+});
+
+it('routes a closed manual pull request to its application after the base branch changes', function () {
+    Queue::fake();
+
+    $application = createGithubPullRequestWebhookApplication();
+    $payload = githubPullRequestPayload('closed', 'feature/parent');
+    $body = json_encode($payload, JSON_THROW_ON_ERROR);
+
+    $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+        'HTTP_X-GitHub-Event' => 'pull_request',
+        'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_github),
+        'CONTENT_TYPE' => 'application/json',
+    ], $body);
+
+    $response->assertOk();
+    Queue::assertPushed(ProcessGithubPullRequestWebhook::class, fn (ProcessGithubPullRequestWebhook $job): bool => $job->applicationId === $application->id
+        && $job->action === 'closed'
+        && $job->pullRequestId === 42);
+});
+
+it('continues to filter non-closed pull requests by base branch', function (string $endpoint) {
+    Queue::fake();
+
+    if ($endpoint === 'app') {
+        $team = Team::factory()->create();
+        $githubApp = GithubApp::create([
+            'name' => 'github-app-webhook-test',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'app_id' => 1234567890,
+            'webhook_secret' => 'test-secret',
+            'is_public' => false,
+            'team_id' => $team->id,
+        ]);
+        createGithubPullRequestWebhookApplication([
+            'repository_project_id' => 987654321,
+            'source_id' => $githubApp->id,
+            'source_type' => GithubApp::class,
+        ]);
+
+        $body = json_encode(githubPullRequestPayload('opened', 'feature/parent'), JSON_THROW_ON_ERROR);
+        $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'pull_request',
+            'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, 'test-secret'),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    } else {
+        $application = createGithubPullRequestWebhookApplication();
+        $body = json_encode(githubPullRequestPayload('opened', 'feature/parent'), JSON_THROW_ON_ERROR);
+        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'pull_request',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $body, $application->manual_webhook_secret_github),
+            'CONTENT_TYPE' => 'application/json',
+        ], $body);
+    }
+
+    $response->assertOk();
+    Queue::assertNotPushed(ProcessGithubPullRequestWebhook::class);
+})->with(['app', 'manual']);
diff --git a/tests/Feature/LegacyServiceRoutingPortTest.php b/tests/Feature/LegacyServiceRoutingPortTest.php
new file mode 100644
index 0000000000..41f0e17179
--- /dev/null
+++ b/tests/Feature/LegacyServiceRoutingPortTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Symfony\Component\Yaml\Yaml;
+
+uses(RefreshDatabase::class);
+
+it('only preserves an unambiguous saved upstream for the same legacy container', function (array $labels, ?int $expected, array $rawChanges = [], array $savedChanges = [], ?string $type = null) {
+    $raw = array_replace(['image' => 'httpd:2.4-alpine', 'environment' => ['SERVICE_URL_WEB']], $rawChanges);
+    $saved = array_replace(['image' => 'httpd:2.4-alpine', 'labels' => $labels], $savedChanges);
+    $service = new Service;
+    $service->forceFill([
+        'service_type' => $type,
+        'docker_compose_raw' => Yaml::dump(['services' => ['web' => $raw]]),
+        'docker_compose' => Yaml::dump(['services' => ['web' => $saved, 'other' => ['image' => 'httpd:2.4-alpine', 'labels' => ['traefik.http.services.other.loadbalancer.server.port=9000']]]]),
+    ]);
+    $application = new ServiceApplication(['name' => 'web']);
+    $application->setRelation('service', $service);
+
+    expect($application->getRequiredPort())->toBe($expected);
+})->with([
+    'Traefik list' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000],
+    'Traefik map' => [['traefik.http.services.web.loadbalancer.server.port' => '3000'], 3000],
+    'Caddy list' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'], 3000],
+    'Caddy map' => [['caddy_0.handle_path.0_reverse_proxy' => '{{upstreams 3000}}'], 3000],
+    'matching proxies' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}'], 3000],
+    'conflicting proxies' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}'], null],
+    'multiple Traefik ports' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'traefik.http.services.api.loadbalancer.server.port=4000'], null],
+    'malformed port' => [['traefik.http.services.web.loadbalancer.server.port=3000oops'], null],
+    'out of range' => [['traefik.http.services.web.loadbalancer.server.port=65536'], null],
+    'negative' => [['traefik.http.services.web.loadbalancer.server.port=-1'], null],
+    'mixed malformed' => [['traefik.http.services.web.loadbalancer.server.port=3000', 'caddy_0.handle_path.0_reverse_proxy=oops'], null],
+    'map bare FQDN' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000, ['environment' => ['SERVICE_FQDN_WEB' => null]]],
+    'UDP only preserves HTTP upstream' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 3000, ['expose' => ['53/udp']]],
+    'zero' => [['traefik.http.services.web.loadbalancer.server.port=0'], null],
+    'malformed Caddy' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams 3000oops}}'], null],
+    'discovery Caddy' => [['caddy_0.handle_path.0_reverse_proxy={{upstreams}}'], null],
+    'no cross container' => [[], null],
+    'changed image' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, [], ['image' => 'httpd:latest']],
+    'missing saved image' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, [], ['image' => null]],
+    'no direct declaration' => [['traefik.http.services.web.loadbalancer.server.port=3000'], null, ['environment' => ['URL=${SERVICE_URL_WEB}']]],
+    'explicit magic wins' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 8080, ['environment' => ['SERVICE_URL_WEB_8080']]],
+    'Compose port wins' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 8080, ['expose' => [8080]]],
+    'known template excluded' => [['traefik.http.services.web.loadbalancer.server.port=3000'], 80, [], [], 'wordpress-without-database'],
+]);
+
+it('preserves legacy upstreams across repeated parsing without adding public ports', function (int $version, ?int $override) {
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['generate_exact_labels' => false]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => 'legacy-stack',
+        'service_type' => null,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  web:\n    image: httpd:2.4-alpine\n    environment:\n      - SERVICE_URL_WEB\n",
+        'docker_compose' => Yaml::dump(['services' => ['web' => ['image' => 'httpd:2.4-alpine', 'labels' => ['traefik.http.services.web.loadbalancer.server.port=3000']]]]),
+        'compose_parsing_version' => (string) $version,
+    ]);
+    ServiceApplication::create([
+        'name' => 'web',
+        'service_id' => $service->id,
+        'image' => 'httpd:2.4-alpine',
+        'fqdn' => 'https://legacy.example.com',
+        'domain_port_overrides' => $override === null ? null : ['https://legacy.example.com' => $override],
+    ]);
+
+    for ($iteration = 0; $iteration < 2; $iteration++) {
+        $parsed = $service->fresh()->parse();
+        $labels = collect($parsed['services']['web']['labels']);
+        $ports = $labels->filter(fn ($label) => str_contains($label, '.loadbalancer.server.port='));
+        expect($ports)->not->toBeEmpty();
+        foreach ($ports as $port) {
+            expect($port)->toEndWith('='.($override ?? 3000));
+        }
+        expect($labels->filter(fn ($label) => str_contains($label, 'reverse_proxy'))->implode(' '))->toContain('{{upstreams '.($override ?? 3000).'}}');
+        expect($service->fresh()->applications()->first()->fqdn)->toBe('https://legacy.example.com');
+    }
+})->with([4, 5])->with([null, 8080]);
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index 82e526bb3b..a7cd462954 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -78,6 +78,13 @@ test('portaled listboxes measure content without inheriting the viewport width',
         ->toContain('Math.max(triggerRect.width, panel.offsetWidth)');
 });
 
+test('portaled listboxes stay anchored when a scroll container moves', function () {
+    $listbox = file_get_contents(resource_path('views/components/forms/listbox.blade.php'));
+
+    expect($listbox)
+        ->toContain('@scroll.window.capture="open && positionPanel()"');
+});
+
 test('searchable listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.searchable-listbox id="tz" label="Timezone"
diff --git a/tests/Feature/Livewire/SentinelLogsTest.php b/tests/Feature/Livewire/SentinelLogsTest.php
new file mode 100644
index 0000000000..99d2fa1051
--- /dev/null
+++ b/tests/Feature/Livewire/SentinelLogsTest.php
@@ -0,0 +1,127 @@
+<?php
+
+use App\Actions\Server\StartSentinel;
+use App\Livewire\Project\Shared\GetLogs;
+use App\Livewire\Server\Sentinel\Logs;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::create(['id' => 0]);
+    $team = Team::factory()->create();
+    $user = User::factory()->create();
+    $team->members()->attach($user->id, ['role' => 'owner']);
+    session(['currentTeam' => $team]);
+    $this->actingAs($user);
+    $this->server = Server::factory()->create(['team_id' => $team->id]);
+});
+
+it('does not show sync status or fetch logs when sentinel is disabled', function (bool $recentHeartbeat) {
+    $this->server->sentinelHeartbeat(isReset: ! $recentHeartbeat);
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertSee('Sentinel is disabled')
+        ->assertSeeHtml('wire:click="enableSentinel"')
+        ->assertDontSee('Out of sync')
+        ->assertDontSee('In sync')
+        ->assertDontSeeLivewire(GetLogs::class);
+})->with([false, true]);
+
+it('shows sync status and logs when sentinel is enabled', function (bool $metricsOnly, bool $recentHeartbeat) {
+    $this->server->sentinelHeartbeat(isReset: ! $recentHeartbeat);
+    $this->server->settings()->update([
+        'is_sentinel_enabled' => ! $metricsOnly,
+        'is_metrics_enabled' => $metricsOnly,
+        'is_build_server' => false,
+    ]);
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertDontSee('Sentinel is disabled')
+        ->assertSee($recentHeartbeat ? 'In sync' : 'Out of sync')
+        ->assertSeeLivewire(GetLogs::class);
+})->with([false, true])->with([false, true]);
+
+it('enables sentinel from the logs page', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    StartSentinel::shouldRun()->once()->withArgs(function (Server $server, bool $restart): bool {
+        expect($server->id)->toBe($this->server->id);
+        expect($restart)->toBeTrue();
+        $server->settings->update(['is_sentinel_enabled' => true]);
+
+        return true;
+    });
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertDontSee('Sentinel is disabled')
+        ->assertDontSee('Enable Sentinel')
+        ->assertSeeLivewire(GetLogs::class)
+        ->assertDispatched('refreshServerShow')
+        ->assertDispatched('success');
+
+    expect($this->server->fresh()->isSentinelEnabled())->toBeTrue();
+});
+
+it('keeps sentinel disabled when startup fails', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    StartSentinel::shouldRun()->once()->andThrow(new RuntimeException('Startup failed'));
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertSee('Sentinel is disabled')
+        ->assertDontSeeLivewire(GetLogs::class)
+        ->assertDispatched('error')
+        ->assertNotDispatched('success');
+
+    expect($this->server->fresh()->isSentinelEnabled())->toBeFalse();
+});
+
+it('does not enable sentinel on unsupported servers', function (string $setting) {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false, $setting => true]);
+    StartSentinel::shouldRun()->never();
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->call('enableSentinel')
+        ->assertSee('Sentinel is disabled')
+        ->assertDispatched('error');
+})->with(['is_build_server', 'is_swarm_manager', 'is_swarm_worker']);
+
+it('denies enabling sentinel to members and users outside the server team', function (bool $crossTeam) {
+    $this->server->settings()->update(['is_sentinel_enabled' => false, 'is_metrics_enabled' => false]);
+    $user = User::factory()->create();
+    if (! $crossTeam) {
+        $this->server->team->members()->attach($user->id, ['role' => 'member']);
+    }
+    $this->actingAs($user);
+    StartSentinel::shouldRun()->never();
+    $component = new Logs;
+    $component->server = $this->server->fresh();
+
+    expect(fn () => $component->enableSentinel())
+        ->toThrow(AuthorizationException::class);
+    expect($this->server->fresh()->isSentinelEnabled())->toBeFalse();
+})->with([false, true]);
+
+it('does not restart sentinel when it is already enabled', function () {
+    $this->server->settings()->update(['is_sentinel_enabled' => true, 'is_build_server' => false]);
+    StartSentinel::shouldRun()->never();
+
+    Livewire::withQueryParams(['server_uuid' => $this->server->uuid])
+        ->test(Logs::class)
+        ->assertSeeLivewire(GetLogs::class)
+        ->call('enableSentinel')
+        ->assertNotDispatched('success');
+});
diff --git a/tests/Feature/MissingDatabaseBackupNotificationTest.php b/tests/Feature/MissingDatabaseBackupNotificationTest.php
new file mode 100644
index 0000000000..f4f2efd191
--- /dev/null
+++ b/tests/Feature/MissingDatabaseBackupNotificationTest.php
@@ -0,0 +1,126 @@
+<?php
+
+use App\Jobs\CheckMissingDatabaseBackupsJob;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\Team;
+use App\Notifications\Database\BackupMissing;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Notification;
+
+uses(RefreshDatabase::class);
+
+afterEach(fn () => Carbon::setTestNow());
+
+function missingBackupSchedule(Team $team, array $attributes = []): ScheduledDatabaseBackup
+{
+    $backup = ScheduledDatabaseBackup::create(array_merge([
+        'enabled' => true,
+        'frequency' => '0 0 * * *',
+        'save_s3' => false,
+        'database_type' => 'App\\Models\\StandalonePostgresql',
+        'database_id' => 999,
+        'team_id' => $team->id,
+        'missing_backup_notification_days' => 2,
+    ], $attributes));
+
+    ScheduledDatabaseBackup::whereKey($backup->id)->update(['created_at' => now()->subDays(3)]);
+
+    return $backup->refresh();
+}
+
+function teamWithBackupFailureNotifications(): Team
+{
+    $team = Team::create(['name' => 'Test team']);
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'backup_failure_email_notifications' => true,
+    ]);
+
+    return $team;
+}
+
+it('notifies the team when an enabled backup has no executions for the configured days', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentTo($team, BackupMissing::class, fn (BackupMissing $notification) => $notification->backup->is($backup));
+    expect($backup->fresh()->missing_backup_notification_sent_at)->not->toBeNull();
+});
+
+it('does not notify for recent disabled or unconfigured backup schedules', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    missingBackupSchedule($team, ['enabled' => false]);
+    missingBackupSchedule($team, ['missing_backup_notification_days' => 0]);
+    $recent = missingBackupSchedule($team);
+    ScheduledDatabaseBackup::whereKey($recent->id)->update(['created_at' => now()->subDay()]);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertNothingSent();
+});
+
+it('notifies once per period without executions and rearms after another execution', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 1);
+
+    Carbon::setTestNow(now()->addMinute());
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'app',
+    ]);
+    Carbon::setTestNow(now()->addDays(3));
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 2);
+});
+
+it('preserves the last execution checkpoint when execution history is deleted', function () {
+    Notification::fake();
+    $team = teamWithBackupFailureNotifications();
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    Carbon::setTestNow(now()->addMinute());
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'app',
+    ]);
+    $execution->delete();
+    Carbon::setTestNow(now()->addDays(3));
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentToTimes($team, BackupMissing::class, 2);
+});
+
+it('waits to mark an incident sent until a notification channel is enabled', function () {
+    Notification::fake();
+    $team = Team::create(['name' => 'Test team']);
+    $backup = missingBackupSchedule($team);
+
+    (new CheckMissingDatabaseBackupsJob)->handle();
+    expect($backup->fresh()->missing_backup_notification_sent_at)->toBeNull();
+
+    $team->emailNotificationSettings->update([
+        'smtp_enabled' => true,
+        'backup_failure_email_notifications' => true,
+    ]);
+    (new CheckMissingDatabaseBackupsJob)->handle();
+
+    Notification::assertSentTo($team, BackupMissing::class);
+});
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index 46d9c36daa..1e06ea22d3 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -1047,14 +1047,15 @@ it('creates ScheduledTaskExecution with all fillable attributes', function () {
         'finished_at' => now()->toISOString(),
         'started_at' => now()->subMinute()->toISOString(),
         'retry_count' => 0,
-        'duration' => 60,
+        'duration' => '60.25',
         'error_details' => null,
     ]);
 
     expect($execution->exists)->toBeTrue();
     expect($execution->scheduled_task_id)->toBe($task->id);
     expect($execution->status)->toBe('success');
-    expect((float) $execution->duration)->toBe(60.0);
+    expect($execution->duration)->toBe(60.25);
+    expect($execution->toArray()['duration'])->toBe(60.25);
     expect($execution->retry_count)->toBe(0);
 });
 
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index 6546a00e31..a567a6e5c8 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -33,7 +33,6 @@ it('keeps storage backup schedule tables horizontally scrollable on mobile', fun
         ->and($css)->toMatch('/\.backup-table-grid\s*\{[^}]*min-width:\s*50rem;/');
 });
 
-
 it('keeps nested storage component keys stable when mounts are added or deleted', function () {
     $view = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
 
@@ -44,7 +43,6 @@ it('keeps nested storage component keys stable when mounts are added or deleted'
         ->not->toContain('wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"');
 });
 
-
 use App\Livewire\Project\Service\Storage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
 use App\Livewire\Project\Shared\Storages\All;
@@ -206,11 +204,79 @@ it('renders volumes as a data table with shared column headers', function () {
         ->toContain('12rem')
         ->not->toContain('17.5rem');
 
+    expect($allView)
+        ->toContain("'table-badge', 'table-badge-success' => \$hasS3Backup")
+        ->not->toContain('<path stroke-linecap="round" stroke-linejoin="round" d="m4.5 12.75 6 6 9-13.5" />');
+
+    expect($css)->toMatch('/@media \(max-width: 768px\)[\s\S]*?\.volumes-col-backup\s*\{[^}]*flex-direction:\s*row;[^}]*align-items:\s*center;/');
+
     // Settings form labels are 13px (not Tailwind text-sm 14px).
     expect($css)
         ->toMatch('/\.application-settings-form label\s*\{[^}]*font-size:\s*13px/s');
 });
 
+it('renders volume actions and PR suffix controls as valid markup', function () {
+    [$application] = createApplicationWithVolume();
+    LocalPersistentVolume::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => $application->uuid.'-cache',
+        'mount_path' => '/cache',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+        'is_preview_suffix_enabled' => true,
+    ]);
+
+    $html = Livewire::test(All::class, ['resource' => $application])->html();
+    $document = new DOMDocument;
+    $previousState = libxml_use_internal_errors(true);
+    $loaded = $document->loadHTML($html);
+    libxml_clear_errors();
+    libxml_use_internal_errors($previousState);
+    $xpath = new DOMXPath($document);
+    $helperText = 'Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews.';
+
+    expect($loaded)->toBeTrue()
+        ->and($xpath->query("//*[contains(concat(' ', normalize-space(@class), ' '), ' volumes-col-actions ')]//button[normalize-space(.)='Backup']"))->toHaveCount(2)
+        ->and($xpath->query("//*[contains(concat(' ', normalize-space(@class), ' '), ' volumes-col-actions ')]//button[normalize-space(.)='Backup']//svg"))->toHaveCount(0)
+        ->and($xpath->query("//button[@aria-label='More information']/following-sibling::*[@role='tooltip'][contains(normalize-space(.), '{$helperText}')]"))->toHaveCount(3)
+        ->and($xpath->query("//template[@x-teleport='body']/*[@role='listbox']"))->toHaveCount(2);
+});
+
+it('declares explicit authorization on the changed storage controls', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    preg_match(
+        '/<x-forms\.listbox\s+id="forms\.\{\{ \$id \}\}\.isPreviewSuffixEnabled"[\s\S]*?\/>/',
+        $view,
+        $previewSuffixListbox
+    );
+
+    expect($previewSuffixListbox[0] ?? '')
+        ->toContain('canGate="update"')
+        ->toContain(':canResource="$resource"');
+
+    preg_match_all('/<x-forms\.button\b[^>]*>\s*Backup\s*<\/x-forms\.button>/s', $view, $backupButtons);
+
+    expect($backupButtons[0])->toHaveCount(3);
+
+    foreach ($backupButtons[0] as $backupButton) {
+        expect($backupButton)
+            ->toContain('canGate="update"')
+            ->toContain(':canResource="$resource"');
+    }
+});
+
+it('uses valid block wrappers around PR suffix helpers', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
+
+    expect($view)
+        ->not->toContain('<span class="volumes-col-pr flex items-center gap-1.5">')
+        ->not->toContain('<span class="volumes-mobile-label volumes-field-label flex items-center gap-1.5">');
+
+    expect(substr_count($view, '<x-helper helper="Adds -pr-N to the storage name or path so each preview uses isolated data. Disabling it shares production data with previews." />'))
+        ->toBe(3);
+});
+
 it('keeps bind mount source paths out of the add volume form', function () {
     $storageView = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
     $volumesView = file_get_contents(resource_path('views/livewire/project/shared/storages/all.blade.php'));
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
index b40193cb29..b8825353b0 100644
--- a/tests/Feature/PreviewDomainPortOverridesTest.php
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -235,7 +235,7 @@ it('prunes a preview domain port override when removing the domain', function ()
         ->toBe(['https://two-preview.example.com' => 3000]);
 });
 
-it('shows an error badge when a preview domain has no internal port and ports exposes is empty', function () {
+it('shows a warning when a preview domain has no internal port and ports exposes is empty', function () {
     $this->application->update([
         'ports_exposes' => null,
     ]);
@@ -246,8 +246,9 @@ it('shows an error badge when a preview domain has no internal port and ports ex
     ]);
 
     Livewire::test(PreviewDomains::class, ['preview' => $preview])
-        ->assertSee('No internal port')
-        ->assertDontSee('Internal port');
+        ->assertSee('aria-label="No internal port"', false)
+        ->assertSee('Set Ports Exposes or a per-domain internal port')
+        ->assertDontSee('aria-label="Internal port ', false);
 });
 
 it('rejects adding a preview domain whose portless URL is already configured', function () {
@@ -269,7 +270,7 @@ it('rejects adding a preview domain whose portless URL is already configured', f
 it('saves compose preview domain port overrides per service without putting the port in the public URL', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
-        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n  api:\n    image: nginx:alpine\n    expose: [3000]\n",
         'docker_compose_domains' => null,
     ]);
 
@@ -537,7 +538,7 @@ YAML,
         ->toBeFalse();
 });
 
-it('uses ports_exposes as the compose preview fallback when a domain has no override', function () {
+it('leaves single-service compose preview ports to proxy discovery when a domain has no override', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
         'compose_parsing_version' => '3',
@@ -565,9 +566,9 @@ YAML,
     $parsedCompose = applicationParser($this->application->fresh(), 118, $preview->id);
     $labels = collect(data_get($parsedCompose, 'services.frontend-pr-118.labels'));
 
-    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=4000')))
-        ->toBeTrue()
-        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 4000}}')))
+    expect($labels->contains(fn (string $label): bool => str_contains($label, '.loadbalancer.server.port=')))
+        ->toBeFalse()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams}}')))
         ->toBeTrue();
 });
 
@@ -672,3 +673,305 @@ it('does not warn when re-saving a preview domain with the same custom port', fu
         ->assertSet('showPortWarningModal', false)
         ->assertDispatched('success');
 });
+
+it('checks compose preview ports against the selected service when saving domains', function (string $action, int $port, bool $warn) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    expose:
+      - 8080
+      - 8081
+    ports:
+      - target: 8082
+        published: 18082
+      - "18083:8083"
+  api:
+    image: nginx:alpine
+    expose:
+      - 9090
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://existing.example.com'],
+            'api' => ['domain' => 'https://api.example.com:9090'],
+        ]),
+    ]);
+    $preview = createPreviewForPortTests($this->application, 130, [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com']]),
+        'fqdn' => 'https://existing.example.com',
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    if ($action === 'add') {
+        $component->set('newDomainService', 'web')
+            ->set('newDomainParts.host', 'new.example.com')
+            ->set('newDomainParts.port', (string) $port)
+            ->call('addDomain');
+        $domain = 'https://new.example.com';
+    } else {
+        $component->call('startEdit', 0)
+            ->set('editingDomainParts.port', (string) $port)
+            ->call('updateDomain');
+        $domain = 'https://existing.example.com';
+    }
+
+    $component->assertHasNoErrors()->assertSet('showPortWarningModal', $warn);
+
+    if ($warn) {
+        expect($preview->fresh()->domain_port_overrides ?? [])->not->toHaveKey($domain);
+        $component->assertSet('unrecognizedPort', $port)
+            ->call('confirmUseUnknownPort')
+            ->assertSet('showPortWarningModal', false);
+    }
+
+    $component->assertDispatched('success');
+    expect($preview->fresh()->domain_port_overrides[$domain] ?? null)->toBe($port);
+})->with(['add', 'edit'])->with([
+    'first exposed port' => [8080, false],
+    'second exposed port' => [8081, false],
+    'long syntax target' => [8082, false],
+    'short syntax target' => [8083, false],
+    'global port' => [3000, true],
+    'another service port' => [9090, true],
+    'published host port' => [18082, true],
+]);
+
+it('keeps an existing custom compose preview port without another warning', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [8080]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+    ]);
+    $preview = createPreviewForPortTests($this->application, 131, [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://existing.example.com:7070']]),
+        'fqdn' => 'https://existing.example.com:7070',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '7070')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->domain_port_overrides['https://existing.example.com'] ?? null)->toBe(7070);
+});
+
+it('keeps the selected preview domain identity across polling refreshes', function (bool $compose) {
+    $first = 'https://first-preview.example.com';
+    $second = 'https://second-preview.example.com';
+    if ($compose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+    }
+    $preview = createPreviewForPortTests($this->application, 140, $compose ? [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => $first], 'api' => ['domain' => $first]]),
+    ] : ['fqdn' => "$first,$second"]);
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com');
+
+    $preview->update($compose ? [
+        'docker_compose_domains' => json_encode(['api' => ['domain' => $first], 'web' => ['domain' => $first]]),
+    ] : ['fqdn' => "$second,$first"]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('editingIndex', 1)
+        ->assertSet('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+    if ($compose) {
+        expect(json_decode($preview->docker_compose_domains, true))
+            ->toMatchArray(['web' => ['domain' => 'https://renamed-preview.example.com'], 'api' => ['domain' => $first]]);
+    } else {
+        expect($preview->fqdn)->toBe("$second,https://renamed-preview.example.com");
+    }
+})->with([false, true]);
+
+it('keeps the selected preview domain when deleting an earlier row', function () {
+    $preview = createPreviewForPortTests($this->application, 141, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 1)
+        ->call('removeDomainByKey', hash('sha256', 'https://first-preview.example.com|'))
+        ->assertSet('editingIndex', 0)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($preview->fresh()->fqdn)->toBe('https://renamed-preview.example.com');
+});
+
+it('clears the selected preview domain when it is deleted', function () {
+    $preview = createPreviewForPortTests($this->application, 142, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->call('removeDomain', 0)
+        ->assertSet('editingIndex', null)
+        ->assertDispatched('close-preview-domain-edit', previewId: $preview->id)
+        ->set('editingDomainParts.host', 'wrong-preview.example.com')
+        ->call('updateDomain');
+
+    expect($preview->fresh()->fqdn)->toBe('https://second-preview.example.com');
+});
+
+it('scopes preview domain modal events to their preview', function () {
+    $preview = createPreviewForPortTests($this->application, 143, ['fqdn' => 'https://preview.example.com']);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->assertDispatched('open-preview-domain-edit', previewId: $preview->id)
+        ->set('editingDomainParts.host', 'renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertDispatched('close-preview-domain-edit', previewId: $preview->id)
+        ->set('newDomainParts.host', 'another-preview.example.com')
+        ->call('addDomain')
+        ->assertDispatched('close-preview-domain-add', previewId: $preview->id)
+        ->assertNotDispatched('close-modal');
+});
+
+it('prevents members from opening editable preview domain settings', function () {
+    $preview = createPreviewForPortTests($this->application, 144, ['fqdn' => 'https://preview.example.com']);
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->actingAs($this->user->fresh());
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSuccessful()
+        ->call('startEdit', 0)
+        ->assertForbidden();
+});
+
+it('prevents reading preview domains from another team', function () {
+    $preview = createPreviewForPortTests($this->application, 145, ['fqdn' => 'https://private-preview.example.com']);
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherTeam->members()->attach($otherUser->id, ['role' => 'owner']);
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])->assertForbidden();
+});
+
+it('rechecks preview view permission before polling domains', function () {
+    $preview = createPreviewForPortTests($this->application, 146, ['fqdn' => 'https://private-preview.example.com']);
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+    $this->team->members()->detach($this->user->id);
+    $this->actingAs($this->user->fresh());
+
+    $component->call('pollDnsChecks')->assertForbidden();
+});
+
+it('reports the readonly preview redirect policy used by proxy labels', function (int $parserVersion, string $expectedRedirect) {
+    $compose = $parserVersion > 0;
+    $this->application->update(array_merge(['redirect' => 'www'], $compose ? [
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => (string) $parserVersion,
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [3000]\n",
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://production.example.com', 'redirect' => 'www']]),
+    ] : []));
+    $previewDomain = $expectedRedirect === 'non-www' ? 'https://www.preview.example.com' : 'https://preview.example.com';
+    $preview = createPreviewForPortTests($this->application, 147, array_merge([
+        'fqdn' => $previewDomain,
+    ], $compose ? [
+        'docker_compose_domains' => json_encode(['web' => [
+            'domain' => $previewDomain,
+            'redirect' => 'non-www',
+        ]]),
+    ] : []));
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.redirect', $expectedRedirect);
+
+    $labels = $compose
+        ? collect(data_get($this->application->fresh()->parse(147, $preview->id), 'services.web-pr-147.labels'))->implode("\n")
+        : implode("\n", generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+    expect($labels)->toContain('X-Robots-Tag=noindex, nofollow');
+    if ($expectedRedirect === 'both') {
+        expect($labels)->not->toContain('.redirectregex.');
+    } else {
+        expect($labels)->toContain('.redirectregex.');
+    }
+})->with([
+    'normal previews ignore the production redirect' => [0, 'both'],
+    'legacy compose previews use the production redirect' => [2, 'www'],
+    'current compose previews use their own stored redirect' => [3, 'non-www'],
+]);
+
+it('clears the previous preview address validation error when opening another domain', function () {
+    $preview = createPreviewForPortTests($this->application, 148, [
+        'fqdn' => 'https://first-preview.example.com,https://second-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'not a hostname')
+        ->call('updateDomain')
+        ->assertHasErrors('editingDomainParts.host')
+        ->call('startEdit', 1)
+        ->assertHasNoErrors('editingDomainParts.host');
+});
+
+it('inherits preview HTTPS redirect policy while always preventing indexing', function (bool $compose, bool $forceHttps) {
+    if ($compose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'compose_parsing_version' => '3',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose: [3000]\n",
+            'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://production.example.com']]),
+        ]);
+    }
+    $this->application->settings()->update(['is_force_https_enabled' => $forceHttps]);
+    $preview = createPreviewForPortTests($this->application, 149, array_merge([
+        'fqdn' => 'https://preview.example.com',
+    ], $compose ? [
+        'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://preview.example.com']]),
+    ] : []));
+
+    $labels = $compose
+        ? collect(data_get($this->application->fresh()->parse(149, $preview->id), 'services.web-pr-149.labels'))->implode("\n")
+        : implode("\n", generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)->toContain('X-Robots-Tag=noindex, nofollow');
+    expect((bool) preg_match('/\.middlewares=[^\n]*redirect-to-https/', $labels))->toBe($forceHttps);
+})->with([false, true])->with([false, true]);
+
+it('preserves readonly compose preview redirects when saving an address', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+    ]);
+    $preview = createPreviewForPortTests($this->application, 150, [
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://www.preview.example.com', 'redirect' => 'non-www'],
+            'api' => ['domain' => '', 'redirect' => 'www'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.redirect', 'non-www')
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.host', 'www.renamed-preview.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSet('domainRows.0.redirect', 'non-www');
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => 'https://www.renamed-preview.example.com', 'redirect' => 'non-www'],
+        'api' => ['domain' => '', 'redirect' => 'www'],
+    ]);
+});
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index 68ced553d5..3512fccea3 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -72,11 +72,14 @@ it('serves the authenticated users profile picture', function () {
     $this->withoutMiddleware()->actingAs($user)
         ->get(route('profile.avatar'))
         ->assertSuccessful()
-        ->assertHeader('content-type', 'image/jpeg');
+        ->assertHeader('content-type', 'image/jpeg')
+        ->assertHeader('cache-control', 'immutable, max-age=31536000, private');
 });
 
 it('loads an S3 profile picture from the configured CDN', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    InstanceSettings::findOrFail(0)->update([
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -98,7 +101,6 @@ it('loads an S3 profile picture from the configured CDN', function () {
 });
 
 it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
-    config()->set('constants.coolify.avatar_cdn_url');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -120,7 +122,6 @@ it('loads an S3 profile picture directly from S3 when the CDN is not configured'
 });
 
 it('does not use an unrelated S3 storage URL for a profile picture', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
     $storage = S3Storage::query()->create([
         'team_id' => Team::factory()->create()->id,
         'name' => 'Unrelated storage',
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index fc03c9f30e..99a6c0ac5b 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -61,7 +61,8 @@ it('serves a project icon only to a member of its team', function () {
 
     $this->withoutMiddleware()->get(route('project.icon', ['project_uuid' => $this->project->uuid]))
         ->assertSuccessful()
-        ->assertHeader('content-type', 'image/jpeg');
+        ->assertHeader('content-type', 'image/jpeg')
+        ->assertHeader('cache-control', 'immutable, max-age=31536000, private');
 
     $otherUser = User::factory()->create();
     $otherTeam = Team::factory()->create();
@@ -104,7 +105,9 @@ it('exposes the icon URL on the projects index', function () {
 });
 
 it('loads an S3 project icon from the configured CDN', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    InstanceSettings::findOrFail(0)->update([
+        'image_cdn_url' => 'https://avatars.example.com/media',
+    ]);
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -127,7 +130,6 @@ it('loads an S3 project icon from the configured CDN', function () {
 });
 
 it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
-    config()->set('constants.coolify.avatar_cdn_url');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
@@ -149,7 +151,6 @@ it('loads an S3 project icon directly from S3 when the CDN is not configured', f
 });
 
 it('does not use an unusable S3 storage URL for a project icon', function () {
-    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
     Team::factory()->create(['id' => 0]);
     $storage = S3Storage::query()->create([
         'team_id' => 0,
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 278f50f2ee..c04a21fccf 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -82,13 +82,31 @@ it('docks desktop resource actions in the top bar instead of floating over conte
     }
 });
 
-it('links the service header missing variables warning to environment variables', function () {
+it('shows disabled deploy actions when service variables are missing', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    $mobileActions = str($heading)
+        ->after('<div class="w-full xl:hidden">')
+        ->before("@teleport('#resource-action-hud-slot')")
+        ->toString();
+    $desktopActions = str($heading)
+        ->after("@teleport('#resource-action-hud-slot')")
+        ->before('@endteleport')
+        ->toString();
 
-    expect($heading)
-        ->toContain("route('project.service.environment-variables'")
-        ->toContain('Required variables missing')
-        ->toContain('href="{{ $environmentVariablesUrl }}"');
+    expect($mobileActions)
+        ->toContain('id="service-mobile-actions"')
+        ->toContain('aria-disabled="true"')
+        ->toContain('Deploy')
+        ->toContain('missing required env vars')
+        ->toContain('href="{{ $environmentVariablesUrl }}"')
+        ->toContain('underline')
+        ->and($desktopActions)
+        ->toContain('id="service-desktop-actions"')
+        ->toContain('aria-disabled="true"')
+        ->toContain('Deploy')
+        ->toContain('missing required env vars')
+        ->toContain('href="{{ $environmentVariablesUrl }}"')
+        ->toContain('underline');
 });
 
 it('places the account menu beside the desktop sidebar toggle while retaining it on mobile', function () {
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index ef2d80e648..3ad3808631 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -59,7 +59,7 @@ it('does not schedule Stripe subscription reconciliation automatically', functio
     expect($event)->toBeNull();
 });
 
-it('schedules stuck resource cleanup once per day on one server', function () {
+it('schedules stuck resource cleanup in the background once per day', function () {
     $schedule = app(Schedule::class);
 
     $event = collect($schedule->events())->first(
@@ -67,6 +67,8 @@ it('schedules stuck resource cleanup once per day on one server', function () {
     );
 
     expect($event)->not->toBeNull()
-        ->and($event->expression)->toBe('0 0 * * *')
-        ->and($event->onOneServer)->toBeTrue();
+        ->and($event->expression)->toBe('17 3 * * *')
+        ->and($event->onOneServer)->toBeTrue()
+        ->and($event->withoutOverlapping)->toBeTrue()
+        ->and($event->runInBackground)->toBeTrue();
 });
diff --git a/tests/Feature/ServerResourcesPaginationTest.php b/tests/Feature/ServerResourcesPaginationTest.php
new file mode 100644
index 0000000000..0f9efaae40
--- /dev/null
+++ b/tests/Feature/ServerResourcesPaginationTest.php
@@ -0,0 +1,141 @@
+<?php
+
+use App\Livewire\Server\Resources;
+use App\Models\Server;
+
+beforeEach(function () {
+    $this->component = new Resources;
+    $this->component->server = Mockery::mock(Server::class)->makePartial();
+});
+
+it('paginates sorted resources on both tabs', function (string $tab, string $nameKey) {
+    $rows = collect(range(23, 1))->map(fn (int $id) => [$nameKey => "Resource $id"]);
+    $this->component->activeTab = $tab;
+    if ($tab === 'managed') {
+        $this->component->server->shouldReceive('definedResources')->andReturn($rows);
+    } else {
+        $this->component->unmanagedContainers = $rows->all();
+    }
+
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->total())->toBe(23)
+        ->and($page->count())->toBe(10)
+        ->and($page->pluck($nameKey)->all())->toBe(array_map(fn ($id) => "Resource $id", range(1, 10)));
+
+    $this->component->nextPage();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe(2)->and($page->count())->toBe(10)
+        ->and($page->first()[$nameKey])->toBe('Resource 11');
+
+    $this->component->nextPage();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->count())->toBe(3)->and($page->first()[$nameKey])->toBe('Resource 21');
+
+    $this->component->previousPage();
+    expect($this->component->render()->getData()['resources']->currentPage())->toBe(2);
+})->with([['managed', 'name'], ['unmanaged', 'Names']]);
+
+it('resets pagination and search when switching tabs but preserves them on refresh', function () {
+    $this->component->server->shouldReceive('refresh')->andReturnSelf();
+    $this->component->server->shouldReceive('loadUnmanagedContainers')->andReturn(collect());
+    $this->component->setPage(3);
+    $this->component->search = 'managed resource';
+    $this->component->loadUnmanagedContainers();
+    expect($this->component->getPage())->toBe(1)
+        ->and($this->component->search)->toBe('');
+    $this->component->setPage(2);
+    $this->component->search = 'container';
+    $this->component->loadUnmanagedContainers();
+    expect($this->component->getPage())->toBe(2)
+        ->and($this->component->search)->toBe('container');
+    $this->component->loadManagedContainers();
+    expect($this->component->getPage())->toBe(1)
+        ->and($this->component->search)->toBe('');
+    $this->component->setPage(2);
+    $this->component->search = 'application';
+    $this->component->loadManagedContainers();
+    expect($this->component->getPage())->toBe(2)
+        ->and($this->component->search)->toBe('application');
+});
+
+it('clamps page size and resets the page', function (int $size, int $expected) {
+    $this->component->setPage(3);
+    $this->component->perPage = $size;
+    $this->component->updatedPerPage();
+    expect($this->component->perPage)->toBe($expected)
+        ->and($this->component->getPage())->toBe(1);
+})->with([[25, 25], [0, 1], [200, 100]]);
+
+it('clamps stale pages after resources disappear including an empty list', function (int $count, int $expectedPage) {
+    $this->component->activeTab = 'unmanaged';
+    $this->component->unmanagedContainers = array_fill(0, $count, ['Names' => 'Container']);
+    $this->component->setPage(9);
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe($expectedPage)
+        ->and($this->component->getPage())->toBe($expectedPage)
+        ->and($page->total())->toBe($count);
+})->with([[12, 2], [0, 1]]);
+
+it('renders shared pagination for both resource tabs with stable row identities', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+    expect($view)->toContain('<x-table-pagination')
+        ->toContain('<x-page-size-select')
+        ->toContain('previous-action="previousPage"')
+        ->toContain('next-action="nextPage"')
+        ->toContain('wire:key="managed-')
+        ->toContain('wire:key="unmanaged-')
+        ->not->toContain('$server->definedResources()');
+});
+
+it('searches names across all pages before pagination on both tabs', function (string $tab, string $nameKey) {
+    $rows = collect(range(1, 25))->map(fn (int $id) => [$nameKey => "Resource $id"]);
+    $this->component->activeTab = $tab;
+    if ($tab === 'managed') {
+        $this->component->server->shouldReceive('definedResources')->andReturn($rows);
+    } else {
+        $this->component->unmanagedContainers = $rows->all();
+    }
+
+    $this->component->setPage(3);
+    $this->component->search = '  RESOURCE 2  ';
+    $this->component->updatedSearch();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->currentPage())->toBe(1)
+        ->and($page->total())->toBe(7)
+        ->and($page->pluck($nameKey)->all())->toBe([
+            'Resource 2', 'Resource 20', 'Resource 21', 'Resource 22',
+            'Resource 23', 'Resource 24', 'Resource 25',
+        ]);
+
+    $this->component->search = 'missing';
+    $this->component->updatedSearch();
+    expect($this->component->render()->getData()['resources']->total())->toBe(0);
+
+    $this->component->search = '';
+    $this->component->updatedSearch();
+    $page = $this->component->render()->getData()['resources'];
+    expect($page->total())->toBe(25)->and($page->currentPage())->toBe(1);
+
+    $this->component->search = '   ';
+    expect($this->component->render()->getData()['resources']->total())->toBe(25);
+})->with([['managed', 'name'], ['unmanaged', 'Names']]);
+
+it('provides accessible live search and a distinct no-results message', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+
+    expect($view)->toContain('wire:model.live.debounce.300ms="search"')
+        ->toContain('aria-label="Search resources by name"')
+        ->toContain('aria-label="Clear search"')
+        ->toContain('No matching resources')
+        ->toContain('No matching containers');
+});
+
+it('shows search feedback and prevents interaction with stale results while searching', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+
+    expect($view)
+        ->toContain('<x-table.loading target="search" text="Searching resources..." />')
+        ->not->toContain('wire:loading.inline-flex wire:target="search"')
+        ->toContain('wire:loading.class="pointer-events-none opacity-40 blur-[2px]"')
+        ->toContain('wire:loading.attr="inert" wire:target="search"');
+});
diff --git a/tests/Feature/Service/EditDomainPortValidationTest.php b/tests/Feature/Service/EditDomainPortValidationTest.php
index 0d569574ff..29e1f0b339 100644
--- a/tests/Feature/Service/EditDomainPortValidationTest.php
+++ b/tests/Feature/Service/EditDomainPortValidationTest.php
@@ -48,6 +48,7 @@ beforeEach(function () {
     // Create service with a name that maps to a template with required port
     $this->service = Service::factory()->create([
         'name' => 'supabase-test123',
+        'service_type' => 'supabase',
         'server_id' => $this->server->id,
         'destination_id' => $this->destination->id,
         'destination_type' => $this->destination->getMorphClass(),
@@ -99,6 +100,67 @@ it('loads a persisted port override in the service application editor', function
         ->assertOk();
 });
 
+it('preserves a legacy embedded port when only the description changes', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication->fresh(),
+    ])
+        ->set('description', 'Updated description')
+        ->call('submitApplication')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('fqdn', 'http://example.com:8080');
+
+    expect($this->serviceApplication->fresh())
+        ->description->toBe('Updated description')
+        ->fqdn->toBe('http://example.com')
+        ->domain_port_overrides->toBe(['http://example.com' => 8080]);
+});
+
+it('loads a legacy embedded port in the domain editor', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->assertSet('fqdn', 'http://example.com:8080')
+        ->assertOk();
+});
+
+it('prefers a persisted override over a legacy embedded port', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => json_encode(['http://example.com' => 3000]),
+    ]);
+
+    expect($this->serviceApplication->fresh()->url)->toBe('http://example.com:3000');
+});
+
+it('allows explicit removal of a legacy embedded port', function () {
+    ServiceApplication::query()->whereKey($this->serviceApplication->id)->update([
+        'fqdn' => 'http://example.com:8080',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->set('fqdn', 'http://example.com')
+        ->call('submit')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmRemovePort')
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false);
+
+    expect($this->serviceApplication->fresh())
+        ->fqdn->toBe('http://example.com')
+        ->url->toBe('http://example.com')
+        ->domain_port_overrides->toBeNull();
+});
+
 it('initializes route state when mounting a service application directly', function () {
     Livewire::test(Index::class, [
         'serviceApplication' => $this->serviceApplication,
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index d6c687fbc5..3d7309ee32 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -410,3 +410,36 @@ describe('GET /api/v1/services/{uuid}/applications/{app_uuid}/logs', function ()
         $response->assertJsonFragment(['message' => 'Server is not functional.']);
     });
 });
+
+it('applies UI domain validation to service API updates', function (string $target, string $url) {
+    $ctx = createServiceWithApplicationForApiTest($this);
+    $ctx->serviceApplication->update(['fqdn' => 'https://original.example.com']);
+    $isApplication = $target === 'application';
+    $path = $isApplication
+        ? "/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}"
+        : "/api/v1/services/{$ctx->service->uuid}";
+    $payload = $isApplication ? ['url' => $url] : ['urls' => [['name' => 'web', 'url' => $url]]];
+
+    $this->withToken($this->bearerToken)->patchJson($path, $payload)
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors($isApplication ? 'url' : 'urls.0.url');
+
+    expect($ctx->serviceApplication->fresh()->fqdn)->toBe('https://original.example.com');
+})->with(['application', 'service'])->with([
+    'wildcard' => 'https://*.example.com',
+    'too long' => 'https://example.com/'.str_repeat('a', 2048),
+]);
+
+it('rejects oversized service domains before creating a service', function () {
+    $count = Service::count();
+
+    $this->withToken($this->bearerToken)->postJson('/api/v1/services', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'server_uuid' => $this->server->uuid,
+        'docker_compose_raw' => base64_encode("services:\n  web:\n    image: nginx:alpine\n"),
+        'urls' => [['name' => 'web', 'url' => 'https://example.com/'.str_repeat('a', 2048)]],
+    ])->assertUnprocessable()->assertJsonValidationErrors('urls.0.url');
+
+    expect(Service::count())->toBe($count);
+});
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 4f825f8e24..e5f2768cd8 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -12,6 +12,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 use Livewire\Livewire;
@@ -20,6 +21,7 @@ uses(RefreshDatabase::class);
 
 beforeEach(function () {
     $this->withoutVite();
+    config()->set('app.maintenance.store', 'array');
 
     InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
         ['id' => 0],
@@ -140,24 +142,22 @@ it('groups configured domains and shows redirect settings in the table', functio
 
     expect($html)
         ->toContain("service-domain-group-{$this->apiApp->id}")
-        ->toContain("id=\"service-domain-direction-{$this->apiApp->id}-0-trigger\"")
-        ->toContain("id=\"service-domain-indexing-{$this->apiApp->id}-0-trigger\"")
         ->toContain('src="https://api.example.com/favicon.ico"')
         ->toContain('class="relative size-4 shrink-0"')
         ->toContain('domain-favicon-fallback')
         ->toContain('class="invisible absolute inset-0 size-4 rounded-sm"')
         ->toContain('$el.previousElementSibling.classList.add(\'hidden\')')
         ->toContain('x-on:error="$el.remove()"')
-        ->toContain('class="min-w-0 flex-1 text-[13px]')
+        ->toContain('class="min-w-0 flex-1 truncate text-[13px]')
         ->toContain('class="listbox-trigger"')
         ->toContain('application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overflow-visible')
         ->toContain('dark:bg-white/[0.04]')
         ->toContain('<span>Domain</span>')
-        ->toContain('<span>DNS Check</span>')
+        ->toContain('<span>DNS status</span>')
         ->not->toContain('<span>Last checked</span>')
         ->not->toContain("service-domain-group-{$this->webApp->id}")
         ->and(substr_count($html, '2 domains'))->toBe(1)
-        ->and(strpos($html, '>API</span>'))->toBeLessThan(strpos($html, '<span>Domain</span>'))
+        ->and(substr_count($html, '<span>Domain</span>'))->toBe(1)
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
@@ -194,16 +194,25 @@ it('hides the HTTP redirect control for HTTP-only service applications', functio
         ->assertDontSee('Redirect HTTP to HTTPS');
 });
 
-it('shows one redirect control for each www and non-www pair', function () {
-    $this->apiApp->update([
-        'fqdn' => 'https://api.example.com,https://www.api.example.com,https://admin.example.com,https://www.admin.example.com',
-    ]);
+it('opens address fields and service-wide redirects in the same settings dialog for every domain', function () {
+    $domains = ['https://api.example.com', 'https://www.api.example.com', 'https://admin.example.com', 'https://www.admin.example.com'];
+    $this->apiApp->update(['fqdn' => implode(',', $domains)]);
 
-    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertSuccessful()
-        ->html();
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
 
-    expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(2);
+    foreach ($domains as $index => $domain) {
+        $html = $component->call('startEdit', $index)
+            ->assertSet('editingDomain', $domain)
+            ->assertSee('Domain settings')
+            ->assertSee('Save changes')
+            ->assertDontSee('Save address')
+            ->assertSee('Search engine indexing')
+            ->assertSee('www redirect')
+            ->assertDontSee('Edit address and port')
+            ->html();
+
+        expect(substr_count($html, 'this.$wire.updateServiceRedirect('))->toBe(1);
+    }
 });
 
 it('uses segmented fields when adding and editing service domains', function () {
@@ -246,12 +255,12 @@ it('shows dns entries control next to Add', function () {
         ->assertSee('Manual records');
 });
 
-it('rotates the dns entries chevron while its dropdown is open', function () {
+it('exposes the dns entries dropdown expanded state', function () {
     $view = file_get_contents(resource_path('views/livewire/project/shared/cloudflare-autoconfigure.blade.php'));
 
     expect($view)
-        ->toContain('class="inline-flex transition-transform"')
-        ->toContain(':class="dnsEntriesOpen && \'rotate-180\'"');
+        ->toContain('x-bind:aria-expanded="dnsEntriesOpen"')
+        ->toContain('x-show="dnsEntriesOpen"');
 });
 
 it('lists dns entries for service hosts that still need dns', function () {
@@ -280,6 +289,24 @@ it('lists dns entries for service hosts that still need dns', function () {
         ->not->toContain('web.example.com');
 });
 
+it('does not use instance network addresses for service dns entries on a remote server', function () {
+    InstanceSettings::get()->update([
+        'public_ipv4' => '198.51.100.20',
+        'public_ipv6' => '2001:db8::20',
+    ]);
+    $this->apiApp->update(['fqdn' => 'https://api.example.com']);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
+
+    expect($component->instance()->dnsRecordHints())->toBe([
+        [
+            'type' => 'A',
+            'name' => 'api.example.com',
+            'value' => '203.0.113.10',
+        ],
+    ]);
+});
+
 it('persists a service redirect when its dropdown changes', function () {
     $this->webApp->update(['fqdn' => 'https://web.example.com', 'redirect' => 'both']);
 
@@ -400,7 +427,7 @@ it('keeps a stable key for the rendered domain list', function () {
 
     expect($view)
         ->toContain('wire:key="service-domains-list"')
-        ->toContain('wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}"')
+        ->toContain('wire:key="service-domain-rows-{{ $appId }}"')
         ->not->toContain('md5(serialize($domainRows))');
 });
 
@@ -484,9 +511,9 @@ it('prunes the previous dns status when a service domain is renamed', function (
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->call('startEdit', 0)
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('Search engine indexing')
-        ->set('editingDomain', 'https://renamed.example.com')
+        ->set('editingDomainParts.host', 'renamed.example.com')
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertDispatched('edit-domain-saved')
@@ -739,7 +766,8 @@ it('shows service dns mismatches before other domain entries', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSet('domainRows.0.url', 'https://broken.example.com')
         ->assertSet('domainRows.0.dns_status', 'failed')
-        ->assertSet('domainRows.2.url', 'https://healthy.example.com');
+        ->assertCount('domainRows', 2)
+        ->assertSet('domainRows.1.url', 'https://healthy.example.com');
 });
 
 it('hides dns message text when service domain dns status is ok', function () {
@@ -755,7 +783,7 @@ it('hides dns message text when service domain dns status is ok', function () {
     ]);
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertSee('DNS OK')
+        ->assertSee('DNS matches')
         ->assertDontSee('DNS points to 203.0.113.10');
 });
 
@@ -809,7 +837,8 @@ it('hides dns check controls from read-only users', function () {
     $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
 
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
-        ->assertDontSee('Recheck DNS')
+        ->assertDontSee('Check all DNS')
+        ->assertDontSee('aria-label="Settings for', false)
         ->assertDontSee('Check DNS');
 });
 
@@ -828,10 +857,11 @@ it('exposes the stack domains route', function () {
 
 it('updates search engine indexing from the service domains view', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0)
         ->assertSee('Noindex')
         ->assertSee('Indexable')
         ->assertSee('Search engine indexing')
-        ->assertSee('Direction')
+        ->assertSee('www redirect')
         ->assertSee('toggleNoindexDomain', false)
         ->assertSee('updateServiceRedirect', false)
         ->assertSee('wire:ignore', false)
@@ -913,3 +943,179 @@ it('does not show an internal port badge when the service has no env port', func
         ->assertDontSee('Internal port ')
         ->assertDontSee('table-badge-danger', false);
 });
+
+it('prioritizes public addresses and moves domain configuration behind settings', function () {
+    $this->apiApp->update(['fqdn' => 'https://api.example.com:8080']);
+
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Check all DNS')
+        ->assertSee('Add domain')
+        ->assertSee('Domain settings')
+        ->call('startEdit', 0)
+        ->assertSee('Indexing and redirect changes save automatically.')
+        ->assertSee('Internal port 8080')
+        ->assertSee('Both www and non-www')
+        ->assertSee('Search indexing allowed')
+        ->assertDontSee('Manage domains and www/non-www redirects')
+        ->html();
+
+    expect($html)->toContain('title="https://api.example.com"')
+        ->not->toContain('title="https://api.example.com:8080"');
+});
+
+it('distinguishes unchecked domains from dns checks in progress', function () {
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => true]);
+    Cache::forget('instance_settings');
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Not checked')
+        ->assertDontSee('DNS pending');
+});
+
+it('keeps the edited domain selected when settings refresh and reorder rows', function () {
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0);
+
+    $this->webApp->update([
+        'fqdn' => 'https://broken.example.com',
+        'domain_dns_statuses' => [
+            'https://broken.example.com' => ['status' => 'failed', 'message' => 'Mismatch'],
+        ],
+    ]);
+
+    $component->call('refreshDomains')
+        ->assertSet('editingIndex', 1)
+        ->set('editingDomainParts.host', 'renamed.example.com')
+        ->call('updateDomain')
+        ->assertHasNoErrors();
+
+    expect($this->apiApp->fresh()->fqdn)->toBe('https://renamed.example.com')
+        ->and($this->webApp->fresh()->fqdn)->toBe('https://broken.example.com');
+});
+
+it('renders compact icon-only domain actions with accessible labels', function () {
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])->html();
+    $document = new DOMDocument;
+    @$document->loadHTML($html);
+    $xpath = new DOMXPath($document);
+
+    foreach (['Check DNS', 'Settings for https://api.example.com', 'Remove domain'] as $label) {
+        $buttons = $xpath->query('//button[@aria-label="'.$label.'"]');
+        expect($buttons->length)->toBe(1);
+        $button = $buttons->item(0);
+        expect(trim($button->textContent))->toBe('')
+            ->and($button->getAttribute('class'))->toContain('icon-button')
+            ->and($button->getAttribute('title'))->not->toBe('');
+    }
+
+    expect($html)->not->toContain('aria-label="More actions for');
+});
+
+it('uses the shared mobile domain summary layout', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+
+    expect($view)
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('Domain routing summary')
+        ->toContain('No redirects')
+        ->toContain('Noindex');
+});
+
+it('reuses the floating save bar for pending domain address edits', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+
+    expect($view)->toContain('<x-unsaved-bar action="updateDomain"')
+        ->toContain('dirty="hasAddressChanges"')
+        ->toContain('<template x-if="modalOpen">')
+        ->not->toContain('Save address');
+});
+
+it('inherits the counterpart internal port when enabling redirects without a port warning', function (?int $override, string $redirect) {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_URL_WEB_80\n  api:\n    image: node:alpine\n",
+    ]);
+    $host = $redirect === 'www' ? 'web.example.com' : 'www.web.example.com';
+    $counterpart = $redirect === 'www' ? 'www.web.example.com' : 'web.example.com';
+    $url = "https://{$host}/blog";
+    $pairedUrl = "https://{$counterpart}/blog";
+    $this->webApp->update([
+        'fqdn' => $url,
+        'redirect' => 'both',
+        'domain_port_overrides' => $override === null ? null : [$url => $override],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('updateServiceRedirect', $this->webApp->id, $redirect)
+        ->assertHasNoErrors()
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('pendingAction', null)
+        ->assertDispatched('success', 'Redirect updated.')
+        ->call('refreshDomains')
+        ->assertSet("serviceRedirects.{$this->webApp->id}", $redirect);
+
+    $this->webApp->refresh();
+    expect($this->webApp->redirect)->toBe($redirect)
+        ->and($this->webApp->fqdn)->toContain($pairedUrl)
+        ->and($this->webApp->domain_port_overrides[$pairedUrl] ?? $this->webApp->getRequiredPort())->toBe($override ?? 80)
+        ->and($this->webApp->domain_port_overrides[$url] ?? null)->toBe($override);
+})->with([null, 80, 8080])->with(['www', 'non-www']);
+
+it('still warns and allows cancellation when manually adding a different port', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_WEB_8000\n  api:\n    image: node:alpine\n",
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomain', 'https://web.example.com:3000')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('cancelRemovePort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('pendingAction', null)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true);
+
+    expect($this->webApp->fresh()->fqdn)->toBeNull();
+});
+
+it('still checks domain conflicts when inheriting a redirect counterpart port', function () {
+    $this->webApp->update([
+        'fqdn' => 'https://example.com',
+        'redirect' => 'both',
+        'domain_port_overrides' => ['https://example.com' => 8080],
+    ]);
+    $this->apiApp->update(['fqdn' => 'https://www.example.com']);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('updateServiceRedirect', $this->webApp->id, 'www')
+        ->assertSet('showDomainConflictModal', true)
+        ->assertSet('showPortWarningModal', false);
+
+    expect($this->webApp->fresh()->redirect)->toBe('both');
+
+    $component->call('refreshDomains')
+        ->call('confirmDomainUsage')
+        ->assertSet('showDomainConflictModal', false)
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success', 'Redirect updated.');
+
+    expect($this->webApp->fresh()->redirect)->toBe('www')
+        ->and($this->webApp->fresh()->domain_port_overrides['https://www.example.com'])->toBe(8080);
+});
+
+it('renders domain settings in compact columns instead of a second summary line', function () {
+    $html = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])->html();
+    foreach (['Protocol redirect', 'Domain redirect', 'Internal port', 'Search indexing'] as $heading) {
+        expect($html)->toContain('<span>'.$heading.'</span>');
+    }
+    $view = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+    expect($view)->toContain('service-domain-detail')
+        ->not->toContain('gap-x-3 gap-y-1');
+});
+
+it('lays out the domain settings dropdowns in responsive columns', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
+    expect($view)->toContain('mt-4 grid grid-cols-1 gap-4 border-t border-neutral-200 pt-4 sm:grid-cols-2')
+        ->toContain('class="sm:col-span-2 text-[12px]');
+});
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index 9d5ac5a8a8..ede6fb6fc0 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -3,14 +3,17 @@
 use App\Jobs\DatabaseBackupJob;
 use App\Jobs\VolumeBackupJob;
 use App\Livewire\Project\Database\Import as DatabaseImport;
+use App\Livewire\Project\Service\BackupExecutions;
 use App\Livewire\Project\Service\Heading;
 use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\LocalPersistentVolume;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -20,6 +23,7 @@ use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
@@ -234,6 +238,7 @@ test('service database backup schedules open in the Livewire component', functio
 
 test('service database backups can be queued from the Livewire component', function () {
     Queue::fake();
+    $this->ownServiceDatabase->update(['status' => 'running:healthy']);
     $backup = ScheduledDatabaseBackup::create([
         'team_id' => $this->teamA->id,
         'frequency' => 'daily',
@@ -448,5 +453,294 @@ test('service storage backups page includes schedules from all compose databases
         ->assertSee('own-db')
         ->assertSee('analytics-db')
         ->assertSee("wire:click=\"openSchedule('{$backups->first()->uuid}')\"", false)
-        ->assertSee("wire:click=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
+        ->assertSee("wire:click.stop=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
+});
+
+test('service backup settings open automatically from the creation redirect', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('selectedDatabaseBackup.uuid', $backup->uuid)
+        ->assertSee('S3');
+});
+
+test('service backup settings reject a backup belonging to another team', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamB->id,
+        'frequency' => 'daily',
+        'database_id' => $this->otherServiceDatabase->id,
+        'database_type' => $this->otherServiceDatabase->getMorphClass(),
+    ]);
+
+    $this->expectException(ModelNotFoundException::class);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService]);
+});
+
+test('service backups have explicit settings actions for database and storage schedules', function () {
+    $databaseBackup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeBackup = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+    ]);
+
+    $html = Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])->html();
+    $dom = new DOMDocument;
+    @$dom->loadHTML($html);
+    $xpath = new DOMXPath($dom);
+    $buttons = $xpath->query('//button[contains(., "Settings")]');
+    $actions = [];
+    foreach ($buttons as $button) {
+        $actions[] = $button->getAttribute('wire:click.stop');
+    }
+
+    expect($actions)->toContain("openSchedule('{$databaseBackup->uuid}')", "openSchedule('{$volumeBackup->uuid}')");
+
+    foreach (['database' => $databaseBackup, 'storage' => $volumeBackup] as $type => $backup) {
+        $backupAction = "wire:click.stop=\"backupNow('{$type}', '{$backup->uuid}')\"";
+        $settingsAction = "wire:click.stop=\"openSchedule('{$backup->uuid}')\"";
+        expect(strpos($html, $backupAction))->toBeLessThan(strpos($html, $settingsAction));
+    }
+
+});
+
+test('members cannot open service backup settings', function () {
+    $this->userA->teams()->updateExistingPivot($this->teamA->id, ['role' => 'member']);
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::withQueryParams(['backup_uuid' => $backup->uuid])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertForbidden();
+});
+
+test('closing service backup settings clears the backup query parameter', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    $component = Livewire::withQueryParams(['backup_uuid' => $backup->uuid, 'search' => 'own-db'])
+        ->test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('backupUuid', $backup->uuid);
+
+    expect($component->effects['url']['backupUuid'])
+        ->toMatchArray(['as' => 'backup_uuid', 'use' => 'replace', 'except' => '']);
+
+    $component->dispatch('modalClosed')
+        ->assertSet('scheduleModalOpen', false)
+        ->assertSet('selectedDatabaseBackup', null)
+        ->assertSet('selectedVolumeBackup', null)
+        ->assertSet('backupUuid', '')
+        ->assertSet('search', 'own-db')
+        ->assertNoRedirect();
+});
+
+test('service execution history paginates both backup types without truncating older runs', function () {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $databaseExecutions = collect(range(1, 105))->map(fn ($index) => ScheduledDatabaseBackupExecution::forceCreate([
+        'scheduled_database_backup_id' => $schedule->id,
+        'status' => 'success',
+        'created_at' => now()->subMinutes($index),
+    ]));
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeSchedule = $volume->scheduledBackups()->create(['team_id' => $this->teamA->id, 'frequency' => 'daily']);
+    $volumeExecution = ScheduledVolumeBackupExecution::create([
+        'scheduled_volume_backup_id' => $volumeSchedule->id,
+        'status' => 'success',
+    ]);
+
+    $component = Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertViewHas('executions', function ($executions) use ($volumeExecution, $databaseExecutions) {
+            expect($executions)->toBeInstanceOf(LengthAwarePaginator::class)
+                ->and($executions->total())->toBe(106)
+                ->and($executions->count())->toBe(10)
+                ->and($executions->first()['uuid'])->toBe($volumeExecution->uuid)
+                ->and($executions->last()['uuid'])->toBe($databaseExecutions[8]->uuid);
+
+            return true;
+        })
+        ->assertSeeHtml('aria-label="Next page"');
+
+    $component->call('openExecution', $volumeExecution->uuid)
+        ->assertSet('selectedExecution.uuid', $volumeExecution->uuid)
+        ->call('closeExecutionModal');
+    $component->call('nextPage', 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 2 && $executions->first()['uuid'] === $databaseExecutions[9]->uuid);
+    $component->call('setPage', 11, 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->count() === 6 && $executions->last()['uuid'] === $databaseExecutions->last()->uuid)
+        ->call('openExecution', $databaseExecutions->last()->uuid)
+        ->assertSet('executionModalOpen', true)
+        ->assertSet('selectedExecution.uuid', $databaseExecutions->last()->uuid);
+    $component->set('perPage', 25)
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 1 && $executions->count() === 25);
+    $component->call('setPage', 999, 'executionsPage')
+        ->assertViewHas('executions', fn ($executions) => $executions->currentPage() === 5 && $executions->count() === 6);
+    $component->set('perPage', 1000)->assertSet('perPage', 100);
+    $component->set('perPage', 0)->assertSet('perPage', 1);
+});
+
+test('service execution pagination excludes other teams and denies opening their runs', function (string $type) {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamB->id,
+        'frequency' => 'daily',
+        'database_id' => $this->otherServiceDatabase->id,
+        'database_type' => $this->otherServiceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $schedule->id,
+        'status' => 'success',
+    ]);
+
+    if ($type === 'storage') {
+        $volume = LocalPersistentVolume::create([
+            'name' => 'other-service-data',
+            'mount_path' => '/data',
+            'resource_id' => $this->otherServiceDatabase->id,
+            'resource_type' => $this->otherServiceDatabase->getMorphClass(),
+        ]);
+        $volumeSchedule = $volume->scheduledBackups()->create(['team_id' => $this->teamB->id, 'frequency' => 'daily']);
+        $execution = ScheduledVolumeBackupExecution::create([
+            'scheduled_volume_backup_id' => $volumeSchedule->id,
+            'status' => 'success',
+        ]);
+    }
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertViewHas('executions', fn ($executions) => $executions->isEmpty())
+        ->assertDontSeeHtml('aria-label="Next page"')
+        ->call('openExecution', $execution->uuid)
+        ->assertNotFound();
+})->with(['database', 'storage']);
+
+test('execution page size remains adjustable when all runs fit on one page', function () {
+    $schedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    foreach (range(1, 11) as $index) {
+        $schedule->executions()->create(['status' => 'success']);
+    }
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->set('perPage', 25)
+        ->assertSeeHtml('aria-label="Items per page"')
+        ->assertDontSeeHtml('aria-label="Next page"')
+        ->set('perPage', 10)
+        ->assertSeeHtml('aria-label="Next page"');
+});
+
+test('service backup lists identify the configured S3 storage without extra columns', function () {
+    foreach (['Cloudflare R2', 'Railway S3', 'Maxio S3'] as $name) {
+        $volume = LocalPersistentVolume::create([
+            'name' => 'service-data-'.str($name)->slug(),
+            'mount_path' => '/data',
+            'resource_id' => $this->ownServiceDatabase->id,
+            'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+        ]);
+        $storage = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => $name, 'bucket' => 'backups']);
+        ScheduledDatabaseBackup::create([
+            'team_id' => $this->teamA->id,
+            'frequency' => 'daily',
+            'database_id' => $this->ownServiceDatabase->id,
+            'database_type' => $this->ownServiceDatabase->getMorphClass(),
+            'save_s3' => true,
+            's3_storage_id' => $storage->id,
+        ]);
+        $volume->scheduledBackups()->create([
+            'team_id' => $this->teamA->id,
+            'frequency' => 'daily',
+            'save_s3' => true,
+            's3_storage_id' => $storage->id,
+        ]);
+    }
+
+    $html = Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])->html();
+    foreach (['Cloudflare R2', 'Railway S3', 'Maxio S3'] as $name) {
+        expect(substr_count($html, 'data-tooltip="S3 storage: '.$name.' (bucket: backups)"'))->toBe(2);
+    }
+});
+
+test('execution tooltips distinguish current database storage from the recorded storage destination', function () {
+    $original = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => 'Cloudflare R2', 'bucket' => 'original']);
+    $current = S3Storage::create(['key' => 'key', 'secret' => 'secret', 'region' => 'auto', 'endpoint' => 'https://s3.example.com', 'team_id' => $this->teamA->id, 'name' => 'Railway S3', 'bucket' => 'current']);
+    $databaseSchedule = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+        'save_s3' => true,
+        's3_storage_id' => $current->id,
+    ]);
+    $databaseSchedule->executions()->create(['status' => 'success', 's3_uploaded' => true]);
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $volumeSchedule = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        's3_storage_id' => $current->id,
+    ]);
+    $volumeSchedule->executions()->create(['status' => 'success', 's3_uploaded' => true, 's3_storage_id' => $original->id]);
+
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Railway S3 (bucket: current)"')
+        ->assertSeeHtml('data-tooltip="S3 storage: Cloudflare R2 (bucket: original)"');
+
+    $current->update(['team_id' => $this->teamB->id]);
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->assertDontSee('Railway S3')
+        ->assertSeeHtml('data-tooltip="S3 storage: Unavailable"');
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertDontSee('Railway S3')
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Unavailable"');
+
+    $databaseSchedule->update(['save_s3' => false]);
+    $original->delete();
+    Livewire::test(BackupExecutions::class, ['service' => $this->ownService])
+        ->assertSeeHtml('data-tooltip="Current schedule S3 storage: Not configured"')
+        ->assertDontSeeHtml('data-tooltip="S3 storage: Cloudflare R2 (bucket: original)"')
+        ->assertSeeHtml('data-tooltip="S3 storage: Unavailable"');
 });
diff --git a/tests/Feature/ServiceRoutingPortTest.php b/tests/Feature/ServiceRoutingPortTest.php
new file mode 100644
index 0000000000..dc4b489290
--- /dev/null
+++ b/tests/Feature/ServiceRoutingPortTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('does not infer a custom service port from a coincidental template name', function (int $version, string $name, ?string $type, string $declarations, ?int $expected) {
+    expect(config('database.connections.'.config('database.default').'.driver'))->toBe('sqlite');
+    expect(config('database.connections.'.config('database.default').'.database'))->toBe(':memory:');
+    InstanceSettings::forceCreate(['id' => 0]);
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $server->settings->update(['generate_exact_labels' => false]);
+    $destination = StandaloneDocker::where('server_id', $server->id)->first()
+        ?? StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $service = Service::factory()->create([
+        'name' => 'custom-stack',
+        'service_type' => $type,
+        'environment_id' => $environment->id,
+        'server_id' => $server->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'docker_compose_raw' => "services:\n  {$name}:\n    image: httpd:2.4-alpine\n{$declarations}",
+        'compose_parsing_version' => (string) $version,
+    ]);
+    ServiceApplication::create([
+        'name' => $name,
+        'service_id' => $service->id,
+        'image' => 'httpd:2.4-alpine',
+        'fqdn' => 'https://apache.example.com',
+    ]);
+    $parsed = $service->fresh()->parse();
+    $labels = collect(data_get($parsed, 'services'))->flatMap(fn ($entry) => data_get($entry, 'labels', []));
+    $ports = $labels->filter(fn ($label) => str_contains($label, '.loadbalancer.server.port='))->values()->all();
+    if ($expected === null) {
+        expect($ports)->toBeEmpty();
+        expect($labels->filter(fn ($label) => str_contains($label, 'reverse_proxy'))->implode(' '))->not->toContain('upstreams 3000');
+    } else {
+        expect($ports)->not->toBeEmpty();
+        foreach ($ports as $port) {
+            expect($port)->toEndWith('.loadbalancer.server.port='.$expected);
+        }
+    }
+})->with([4, 5])->with([
+    'UDP before HTTP' => ['web', null, "    expose: ['53/udp', '8080/tcp']\n", 8080],
+    'UDP only discovery' => ['web', null, "    expose: ['53/udp']\n", null],
+    'custom collision' => ['grafana', null, "    expose: [80]\n", 80],
+    'custom discovery' => ['grafana', null, '', null],
+    'unrelated template child' => ['web', 'grafana', '', null],
+    'real template' => ['wordpress', 'wordpress-without-database', "    environment:\n      - SERVICE_URL_WORDPRESS\n", 80],
+    'explicit magic port' => ['web', null, "    expose: [80]\n    environment:\n      - SERVICE_URL_WEB_8080\n", 8080],
+]);
diff --git a/tests/Feature/ServiceTemplatePortLookupTest.php b/tests/Feature/ServiceTemplatePortLookupTest.php
index 1e228811dd..28f8cee3c4 100644
--- a/tests/Feature/ServiceTemplatePortLookupTest.php
+++ b/tests/Feature/ServiceTemplatePortLookupTest.php
@@ -25,3 +25,9 @@ YAML,
 
     expect($app->getRequiredPort())->toBe(80);
 });
+
+it('does not infer a template port from a custom display name', function () {
+    $service = new Service(['name' => 'grafana-custom', 'service_type' => null]);
+
+    expect($service->getRequiredPort())->toBeNull();
+});
diff --git a/tests/Feature/SettingsAccessListboxTest.php b/tests/Feature/SettingsAccessListboxTest.php
index 4ec9dceb9e..c1508bf73b 100644
--- a/tests/Feature/SettingsAccessListboxTest.php
+++ b/tests/Feature/SettingsAccessListboxTest.php
@@ -29,6 +29,12 @@ test('settings advanced access section always uses listboxes', function () {
         ->not->toContain('Two-step confirmations enabled');
 });
 
+test('image storage fields use the standard settings field gap', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/advanced.blade.php'));
+
+    expect($contents)->toContain('<div class="flex max-w-md flex-col gap-4">');
+});
+
 test('instance admin can toggle registration via listbox instantSave', function () {
     $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
     Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
@@ -82,6 +88,28 @@ test('instance admin can toggle two-step confirmation via listbox instantSave',
     expect((bool) $settings->fresh()->disable_two_step_confirmation)->toBeTrue();
 });
 
+test('instance admin can configure the image CDN URL at runtime', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    $settings = InstanceSettings::forceCreate(['id' => 0]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Advanced::class)
+        ->assertSee('Image CDN URL')
+        ->set('image_cdn_url', 'https://images.example.com/media/')
+        ->call('submit')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($settings->fresh()->image_cdn_url)->toBe('https://images.example.com/media');
+});
+
 test('open API allowlist warning is hidden when API access is disabled', function () {
     $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
     Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
diff --git a/tests/Feature/SharedVariableDevViewTest.php b/tests/Feature/SharedVariableDevViewTest.php
index 34767cf06d..9b434ef994 100644
--- a/tests/Feature/SharedVariableDevViewTest.php
+++ b/tests/Feature/SharedVariableDevViewTest.php
@@ -168,3 +168,38 @@ test('server shared variable dev view updates existing variable', function () {
     expect($var->value)->toBe('new_value')
         ->and($var->comment)->toBe('updated comment');
 });
+
+test('server shared variables display built-ins as read-only rows', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertSee('COOLIFY_SERVER_NAME')
+        ->assertSee('Built-in · Read-only')
+        ->assertDontSee('Add a variable to make it available to resources in this scope.')
+        ->assertDontSee('data-env-settings-trigger', false)
+        ->assertSet('variables', '')
+        ->call('switch')
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertSee('COOLIFY_SERVER_NAME')
+        ->assertSet('variables', '')
+        ->set('variables', "COOLIFY_SERVER_UUID=changed\nCOOLIFY_SERVER_NAME=changed\nCUSTOM=value")
+        ->call('submit');
+
+    expect($server->environment_variables()->pluck('value', 'key')->all())
+        ->toMatchArray(['COOLIFY_SERVER_UUID' => $server->uuid, 'COOLIFY_SERVER_NAME' => $server->name, 'CUSTOM' => 'value']);
+});
+
+test('server built-ins are visible to team members but not other teams', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->user->teams()->updateExistingPivot($this->team->id, ['role' => 'member']);
+
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $server->uuid])
+        ->assertSee('COOLIFY_SERVER_UUID')
+        ->assertDontSee('Add variable');
+
+    $otherServer = Server::factory()->create(['team_id' => Team::factory()->create()->id]);
+    Livewire::test(App\Livewire\SharedVariables\Server\Show::class, ['server_uuid' => $otherServer->uuid])
+        ->assertRedirect(route('dashboard'))
+        ->assertDontSee($otherServer->uuid);
+});
diff --git a/tests/Feature/Subscription/CreateCheckoutSessionTest.php b/tests/Feature/Subscription/CreateCheckoutSessionTest.php
new file mode 100644
index 0000000000..6cb4e712b4
--- /dev/null
+++ b/tests/Feature/Subscription/CreateCheckoutSessionTest.php
@@ -0,0 +1,338 @@
+<?php
+
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
+use App\Models\Subscription;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Stripe\Exception\ApiConnectionException;
+use Stripe\Service\BillingPortal\SessionService as BillingPortalSessionService;
+use Stripe\Service\Checkout\SessionService;
+use Stripe\Service\CustomerService;
+use Stripe\Service\SubscriptionService;
+use Stripe\Stripe;
+use Stripe\StripeClient;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('cache.default', 'array');
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->stripe = Mockery::mock(StripeClient::class);
+    $this->checkoutSessions = Mockery::mock(SessionService::class);
+    $this->customers = Mockery::mock(CustomerService::class);
+    $this->stripeSubscriptions = Mockery::mock(SubscriptionService::class);
+    $this->stripe->checkout = (object) ['sessions' => $this->checkoutSessions];
+    $this->stripe->customers = $this->customers;
+    $this->stripe->subscriptions = $this->stripeSubscriptions;
+});
+
+function stripeCheckoutCollection(array $data, ?array $allPages = null): object
+{
+    $pages = $allPages ?? $data;
+
+    return new class($data, $pages)
+    {
+        public function __construct(
+            public array $data,
+            private array $allPages,
+        ) {}
+
+        public function autoPagingIterator(): iterable
+        {
+            yield from $this->allPages;
+        }
+    };
+}
+
+test('two near-simultaneous checkout requests reuse one open session', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $openSession = (object) ['id' => 'cs_open', 'url' => 'https://checkout.stripe.test/cs_open', 'status' => 'open', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]), stripeCheckoutCollection([$openSession]));
+    $this->checkoutSessions->shouldReceive('create')->once()->andReturn($openSession);
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_open')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+
+    $action = new CreateCheckoutSession($this->stripe);
+    $first = $action->execute($this->team, $this->user, 'price_monthly');
+    $second = $action->execute($this->team, $this->user, 'price_monthly');
+
+    expect($first->id)->toBe('cs_open')->and($second->id)->toBe('cs_open');
+});
+
+test('checkout session expiration includes a buffer above Stripe\'s 30-minute minimum', function () {
+    $this->freezeTime();
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(function (array $payload): bool {
+            expect($payload['expires_at'])->toBeGreaterThanOrEqual(now()->addMinutes(35)->timestamp)
+                ->and($payload['expires_at'])->toBeLessThanOrEqual(now()->addHours(24)->timestamp);
+
+            return $payload['customer'] === 'cus_existing';
+        })
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+});
+
+test('separate checkout attempts let the SDK manage idempotency', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $session = (object) ['id' => 'cs_retry', 'url' => 'https://checkout.stripe.test/cs_retry'];
+    $payloads = [];
+    $originalRetries = Stripe::getMaxNetworkRetries();
+
+    $this->stripeSubscriptions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->twice()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->twice()
+        ->withArgs(function (array $payload, array $options = []) use (&$payloads): bool {
+            expect($options)->not->toHaveKey('idempotency_key');
+            expect(Stripe::getMaxNetworkRetries())->toBe(2);
+            $payloads[] = $payload;
+
+            return $payload['customer'] === 'cus_existing';
+        })->andReturn($session);
+
+    $action = new CreateCheckoutSession($this->stripe);
+    $action->execute($this->team, $this->user, 'price_monthly');
+    $this->travel(5)->seconds();
+    $action->execute($this->team, $this->user, 'price_monthly');
+
+    expect($payloads)->toHaveCount(2)
+        ->and($payloads[1]['expires_at'])->toBeGreaterThan($payloads[0]['expires_at'])
+        ->and(Stripe::getMaxNetworkRetries())->toBe($originalRetries);
+});
+
+test('an existing active Stripe subscription blocks checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing', 'stripe_subscription_id' => 'sub_active']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_active', 'status' => 'active']]));
+    $billingPortalSessions->shouldNotReceive('create');
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(CheckoutUnavailableException::class, 'active subscription');
+});
+
+test('blocking Stripe subscriptions explain the payment state instead of calling every status active', function (string $status, string $expected) {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_blocked', 'status' => $status]]));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->getMessage())
+            ->toBe($expected)
+            ->not->toContain('active subscription');
+    }
+})->with([
+    'incomplete' => ['incomplete', "This team's subscription payment is incomplete. Complete the payment in the billing portal."],
+    'past_due' => ['past_due', "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal."],
+    'unpaid' => ['unpaid', "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal."],
+    'paused' => ['paused', "This team's subscription is paused. Resume it in the billing portal."],
+]);
+
+test('recoverable blocked subscriptions include a billing portal link', function (string $status) {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_blocked', 'status' => $status]]));
+    $billingPortalSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload): bool => $payload['customer'] === 'cus_existing' && $payload['return_url'] === route('subscription.show'))
+        ->andReturn((object) ['url' => 'https://billing.stripe.test/session']);
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->billingPortalUrl)
+            ->toBe('https://billing.stripe.test/session')
+            ->and($exception->getMessage())->not->toContain('active subscription');
+    }
+})->with(['incomplete', 'past_due', 'unpaid', 'paused']);
+
+test('a past due subscription still blocks checkout when the billing portal cannot be opened', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $billingPortalSessions = Mockery::mock(BillingPortalSessionService::class);
+    $this->stripe->billingPortal = (object) ['sessions' => $billingPortalSessions];
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'sub_past_due', 'status' => 'past_due']]));
+    $billingPortalSessions->shouldReceive('create')->once()->andThrow(new ApiConnectionException('Connection failed'));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+        $this->fail('Expected checkout to be blocked.');
+    } catch (CheckoutUnavailableException $exception) {
+        expect($exception->getMessage())->toContain('past due')
+            ->and($exception->billingPortalUrl)->toBeNull();
+    }
+});
+
+test('a blocking Stripe subscription beyond the first page still blocks checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+
+    $firstPage = collect(range(1, 10))
+        ->map(fn (int $i): object => (object) ['id' => "sub_canceled_{$i}", 'status' => 'canceled'])
+        ->all();
+    $laterPageActive = (object) ['id' => 'sub_active_later', 'status' => 'active'];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(
+        stripeCheckoutCollection($firstPage, [...$firstPage, $laterPageActive])
+    );
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(CheckoutUnavailableException::class, 'active subscription');
+});
+
+test('checkout session lookup asks Stripe for open sessions only', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $openSession = (object) ['id' => 'cs_open', 'url' => 'https://checkout.stripe.test/cs_open', 'status' => 'open', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()
+        ->with(['customer' => 'cus_existing', 'limit' => 10, 'status' => 'open'])
+        ->andReturn(stripeCheckoutCollection([$openSession]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_open')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+
+    expect($session->id)->toBe('cs_open');
+});
+
+test('an expired checkout session permits a new checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $expired = (object) ['id' => 'cs_expired', 'status' => 'expired', 'mode' => 'subscription', 'subscription' => null];
+
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([$expired]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload, array $options = []): bool => $payload['customer'] === 'cus_existing' && ! isset($options['idempotency_key']))
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+    expect($session->id)->toBe('cs_new');
+});
+
+test('checkout creates and persists one Stripe customer for later attempts', function () {
+    $this->customers->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload, array $options): bool => $payload['metadata']['team_id'] === $this->team->id && $options['idempotency_key'] === 'coolify-team-'.$this->team->id.'-customer')
+        ->andReturn((object) ['id' => 'cus_new']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(function (array $payload): bool {
+            expect($payload['automatic_tax']['enabled'])->toBeTrue()
+                ->and($payload['billing_address_collection'])->toBe('required')
+                ->and($payload['customer_update'])->toMatchArray([
+                    'name' => 'auto',
+                    'address' => 'auto',
+                ]);
+
+            return $payload['customer'] === 'cus_new';
+        })
+        ->andReturn((object) ['id' => 'cs_new', 'url' => 'https://checkout.stripe.test/cs_new']);
+
+    (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly');
+    expect($this->team->fresh()->subscription->stripe_customer_id)->toBe('cus_new');
+});
+
+test('a monthly subscription can move to yearly after Stripe confirms the old subscription ended', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    config()->set('subscription.stripe_price_id_dynamic_yearly', 'price_yearly');
+
+    Subscription::create([
+        'team_id' => $this->team->id,
+        'stripe_customer_id' => 'cus_existing',
+        'stripe_subscription_id' => 'sub_monthly_ended',
+        'stripe_plan_id' => 'price_monthly',
+        'stripe_invoice_paid' => false,
+    ]);
+
+    $this->customers->shouldNotReceive('create');
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([
+        (object) ['id' => 'sub_monthly_ended', 'status' => 'canceled'],
+    ]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()
+        ->withArgs(fn (array $payload): bool => $payload['customer'] === 'cus_existing' && $payload['line_items'][0]['price'] === 'price_yearly')
+        ->andReturn((object) ['id' => 'cs_yearly', 'url' => 'https://checkout.stripe.test/cs_yearly']);
+
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly');
+
+    expect($session->id)->toBe('cs_yearly')
+        ->and($this->team->fresh()->subscription->stripe_customer_id)->toBe('cus_existing');
+});
+
+test('the checkout lock blocks a concurrent request before it calls Stripe', function () {
+    $lock = Cache::lock(CreateCheckoutSession::lockKey($this->team->id), 30);
+    expect($lock->get())->toBeTrue();
+
+    $this->customers->shouldNotReceive('create');
+    $this->stripeSubscriptions->shouldNotReceive('all');
+    $this->checkoutSessions->shouldNotReceive('create');
+
+    try {
+        expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+            ->toThrow(CheckoutUnavailableException::class, 'already being created');
+    } finally {
+        $lock->release();
+    }
+});
+
+test('a Stripe connection failure releases the lock without creating another session', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $originalRetries = Stripe::getMaxNetworkRetries();
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('create')->once()->andThrow(new ApiConnectionException('Connection failed'));
+
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_monthly'))
+        ->toThrow(ApiConnectionException::class);
+    expect(Stripe::getMaxNetworkRetries())->toBe($originalRetries);
+    $lock = Cache::lock(CreateCheckoutSession::lockKey($this->team->id), 30);
+    try {
+        expect($lock->get())->toBeTrue();
+    } finally {
+        $lock->release();
+    }
+});
+
+test('changing checkout price expires the old session before creating the selected plan', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'cs_monthly', 'mode' => 'subscription', 'status' => 'open']]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->with('cs_monthly')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldReceive('expire')->with('cs_monthly')->once()->globally()->ordered()->andReturn((object) ['status' => 'expired']);
+    $this->checkoutSessions->shouldReceive('create')->once()->globally()->ordered()
+        ->withArgs(fn (array $payload): bool => $payload['line_items'][0]['price'] === 'price_yearly')
+        ->andReturn((object) ['id' => 'cs_yearly']);
+    $session = (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly');
+    expect($session->id)->toBe('cs_yearly');
+});
+
+test('failed session expiration never creates a second checkout', function () {
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_existing']);
+    $this->stripeSubscriptions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([]));
+    $this->checkoutSessions->shouldReceive('all')->once()->andReturn(stripeCheckoutCollection([(object) ['id' => 'cs_monthly', 'mode' => 'subscription', 'status' => 'open']]));
+    $this->checkoutSessions->shouldReceive('allLineItems')->once()->andReturn(stripeCheckoutCollection([(object) ['price' => (object) ['id' => 'price_monthly']]]));
+    $this->checkoutSessions->shouldReceive('expire')->once()->andThrow(new ApiConnectionException('Cannot confirm expiration'));
+    $this->checkoutSessions->shouldNotReceive('create');
+    expect(fn () => (new CreateCheckoutSession($this->stripe))->execute($this->team, $this->user, 'price_yearly'))
+        ->toThrow(ApiConnectionException::class);
+});
diff --git a/tests/Feature/Subscription/StripeProcessJobTest.php b/tests/Feature/Subscription/StripeProcessJobTest.php
index 302edf9e2e..f681ca4a5f 100644
--- a/tests/Feature/Subscription/StripeProcessJobTest.php
+++ b/tests/Feature/Subscription/StripeProcessJobTest.php
@@ -55,9 +55,13 @@ describe('customer.subscription.created does not fall through to updated', funct
         expect($subscription->stripe_invoice_paid)->toBeFalsy();
     });
 
-    test('created event updates existing subscription instead of duplicating', function () {
+    test('created event cannot overwrite a different recorded subscription', function () {
         Queue::fake();
 
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+        Notification::fake();
+
         Subscription::create([
             'team_id' => $this->team->id,
             'stripe_subscription_id' => 'sub_old',
@@ -84,8 +88,46 @@ describe('customer.subscription.created does not fall through to updated', funct
 
         expect(Subscription::where('team_id', $this->team->id)->count())->toBe(1);
         $subscription = Subscription::where('team_id', $this->team->id)->first();
-        expect($subscription->stripe_subscription_id)->toBe('sub_new_123');
-        expect($subscription->stripe_customer_id)->toBe('cus_new_123');
+        expect($subscription->stripe_subscription_id)->toBe('sub_old');
+        expect($subscription->stripe_customer_id)->toBe('cus_old');
+        expect($subscription->stripe_invoice_paid)->toBeTruthy();
+
+        Notification::assertSentTo($rootTeam, GeneralNotification::class, function (GeneralNotification $notification) {
+            return str_contains($notification->message, 'StripeProcessJob error:')
+                && str_contains($notification->message, 'cus_old')
+                && str_contains($notification->message, 'cus_new_123');
+        });
+    });
+
+    test('created event rejects a pending record with a different stripe customer id', function () {
+        Queue::fake();
+
+        $rootTeam = Team::factory()->create(['id' => 0]);
+        $rootTeam->discordNotificationSettings()->update(['discord_enabled' => true]);
+        Notification::fake();
+
+        Subscription::create([
+            'team_id' => $this->team->id,
+            'stripe_customer_id' => 'cus_pending',
+            'stripe_invoice_paid' => false,
+        ]);
+
+        (new StripeProcessJob(['type' => 'customer.subscription.created', 'data' => ['object' => [
+            'id' => 'sub_other',
+            'customer' => 'cus_other',
+            'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+        ]]]))->handle();
+
+        $subscription = $this->team->subscription()->first();
+        expect($subscription->stripe_subscription_id)->toBeNull()
+            ->and($subscription->stripe_customer_id)->toBe('cus_pending')
+            ->and($subscription->stripe_invoice_paid)->toBeFalsy();
+
+        Notification::assertSentTo($rootTeam, GeneralNotification::class, function (GeneralNotification $notification) {
+            return str_contains($notification->message, 'StripeProcessJob error:')
+                && str_contains($notification->message, 'cus_pending')
+                && str_contains($notification->message, 'cus_other');
+        });
     });
 });
 
@@ -338,3 +380,32 @@ describe('missing subscription Stripe webhooks are ignored', function () {
         ]],
     ]);
 });
+
+test('late repeated subscription created events preserve confirmed payment', function () {
+    Queue::fake();
+    $completed = ['type' => 'checkout.session.completed', 'data' => ['object' => [
+        'client_reference_id' => $this->user->id.':'.$this->team->id,
+        'subscription' => 'sub_paid', 'customer' => 'cus_paid',
+    ]]];
+    (new StripeProcessJob($completed))->handle();
+    $created = ['type' => 'customer.subscription.created', 'data' => ['object' => [
+        'id' => 'sub_paid', 'customer' => 'cus_paid',
+        'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+    ]]];
+    foreach (range(1, 2) as $attempt) {
+        (new StripeProcessJob($created))->handle();
+        expect($this->team->subscription()->first()->stripe_invoice_paid)->toBeTruthy();
+    }
+    expect($this->team->subscription()->count())->toBe(1);
+});
+
+test('created event fills a pending customer record without granting access', function () {
+    Queue::fake();
+    Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_pending', 'stripe_invoice_paid' => false]);
+    (new StripeProcessJob(['type' => 'customer.subscription.created', 'data' => ['object' => [
+        'id' => 'sub_pending', 'customer' => 'cus_pending',
+        'metadata' => ['team_id' => $this->team->id, 'user_id' => $this->user->id],
+    ]]]))->handle();
+    expect($this->team->subscription()->first()->stripe_subscription_id)->toBe('sub_pending')
+        ->and($this->team->subscription()->first()->stripe_invoice_paid)->toBeFalsy();
+});
diff --git a/tests/Feature/Subscription/SubscriptionPricingPageTest.php b/tests/Feature/Subscription/SubscriptionPricingPageTest.php
index 98e0c9ad4b..f411d6425e 100644
--- a/tests/Feature/Subscription/SubscriptionPricingPageTest.php
+++ b/tests/Feature/Subscription/SubscriptionPricingPageTest.php
@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Stripe\CreateCheckoutSession;
+use App\Exceptions\CheckoutUnavailableException;
+use App\Jobs\ServerLimitCheckJob;
 use App\Livewire\Subscription\Index;
 use App\Livewire\Subscription\PricingPlans;
 use App\Models\InstanceSettings;
@@ -7,12 +10,19 @@ use App\Models\Subscription;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Exceptions;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
+use Stripe\Exception\ApiConnectionException;
+use Stripe\Service\CustomerService;
+use Stripe\Service\SubscriptionService;
+use Stripe\StripeClient;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config()->set('app.maintenance.store', 'array');
     config()->set('constants.coolify.self_hosted', false);
     config()->set('subscription.provider', 'stripe');
     config()->set('subscription.stripe_api_key', 'sk_test_fake');
@@ -133,3 +143,120 @@ test('subscription plan page does not render a single-item plan tab strip', func
         ->and($html)->not->toContain(route('subscription.show'))
         ->and($html)->not->toContain(route('subscription.index'));
 });
+
+test('Stripe API failures show an error without redirecting or retrying checkout', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new ApiConnectionException('Connection failed'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', 'Unable to confirm checkout with Stripe. Please try again shortly.')
+        ->assertNoRedirect();
+});
+
+test('expected checkout unavailable errors keep their user-facing messages', function (string $message) {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    Exceptions::fake();
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new CheckoutUnavailableException($message));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', $message)
+        ->assertNoRedirect();
+
+    Exceptions::assertNothingReported();
+})->with([
+    'lock' => 'A subscription checkout is already being created for this team.',
+    'active' => 'Team already has an active subscription.',
+    'past_due' => "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.",
+    'incomplete' => "This team's subscription payment is incomplete. Complete the payment in the billing portal.",
+    'unpaid' => "This team's subscription is unpaid. Settle the outstanding invoice in the billing portal.",
+]);
+
+test('pricing plans links recoverable checkout blocks to the billing portal', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    $message = "This team's subscription payment is past due. Update the payment method or settle the outstanding invoice in the billing portal.";
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new CheckoutUnavailableException($message, 'https://billing.stripe.test/session'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched(
+            'error',
+            $message.' <a href="https://billing.stripe.test/session" target="_blank" rel="noopener noreferrer" class="underline">Open billing portal</a>'
+        )
+        ->assertNoRedirect();
+});
+
+test('unexpected checkout RuntimeExceptions are reported without exposing internal messages', function () {
+    config()->set('subscription.stripe_price_id_dynamic_monthly', 'price_monthly');
+    Exceptions::fake();
+    $this->mock(CreateCheckoutSession::class)
+        ->shouldReceive('execute')->once()
+        ->andThrow(new RuntimeException('SQLSTATE[HY000]: General error: 1 table subscriptions has no column named foo'));
+
+    Livewire::test(PricingPlans::class)
+        ->call('subscribeStripe', 'dynamic-monthly')
+        ->assertDispatched('error', 'Unable to start checkout. Please try again shortly.')
+        ->assertNoRedirect();
+
+    Exceptions::assertReported(RuntimeException::class);
+});
+
+test('subscription status check restores an active subscription after a missed webhook', function (int $quantity, int $expectedLimit, string $lookupKey) {
+    Queue::fake();
+    $this->team->update(['custom_server_limit' => 7]);
+    $subscription = Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_recover', 'stripe_invoice_paid' => false]);
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->customers = Mockery::mock(CustomerService::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->customers->shouldReceive('retrieve')->with('cus_recover')->once()->andReturn((object) ['id' => 'cus_recover']);
+    $stripe->subscriptions->shouldReceive('all')->with(['customer' => 'cus_recover'])->once()->andReturn((object) ['data' => [(object) [
+        'id' => 'sub_recovered', 'status' => 'active', 'metadata' => (object) ['team_id' => (string) $this->team->id],
+        'cancel_at_period_end' => true, 'items' => (object) ['data' => [(object) ['quantity' => $quantity, 'price' => (object) ['id' => 'price_yearly', 'lookup_key' => $lookupKey]]]],
+    ]]]);
+    app()->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Index::class)->call('getStripeStatus')->assertRedirect(route('subscription.show'));
+
+    expect((bool) $subscription->fresh()->stripe_invoice_paid)->toBeTrue()
+        ->and($subscription->fresh()->stripe_subscription_id)->toBe('sub_recovered')
+        ->and($subscription->fresh()->stripe_plan_id)->toBe('price_yearly')
+        ->and((bool) $subscription->fresh()->stripe_cancel_at_period_end)->toBeTrue()
+        ->and((bool) $subscription->fresh()->stripe_past_due)->toBeFalse()
+        ->and($this->team->fresh()->custom_server_limit)->toBe($expectedLimit);
+    if (str_contains($lookupKey, 'dynamic')) {
+        Queue::assertPushed(ServerLimitCheckJob::class);
+    } else {
+        Queue::assertNotPushed(ServerLimitCheckJob::class);
+    }
+})->with([[5, 5, 'dynamic_yearly'], [1, 2, 'dynamic_yearly'], [101, 100, 'dynamic_yearly'], [5, 7, 'legacy']]);
+
+test('subscription status check does not activate non-active or other-team subscriptions', function (string $status, bool $otherTeam) {
+    $subscription = Subscription::create(['team_id' => $this->team->id, 'stripe_customer_id' => 'cus_recover', 'stripe_invoice_paid' => false]);
+    $stripe = Mockery::mock(StripeClient::class);
+    $stripe->customers = Mockery::mock(CustomerService::class);
+    $stripe->subscriptions = Mockery::mock(SubscriptionService::class);
+    $stripe->customers->shouldReceive('retrieve')->once()->andReturn((object) ['id' => 'cus_recover']);
+    $stripe->subscriptions->shouldReceive('all')->once()->andReturn((object) ['data' => [(object) [
+        'id' => 'sub_other', 'status' => $status, 'metadata' => (object) ['team_id' => (string) ($otherTeam ? $this->team->id + 100 : $this->team->id)],
+    ]]]);
+    app()->instance(StripeClient::class, $stripe);
+
+    Livewire::test(Index::class)->call('getStripeStatus')->assertNoRedirect();
+    expect((bool) $subscription->fresh()->stripe_invoice_paid)->toBeFalse();
+    if ($otherTeam) {
+        expect($subscription->fresh()->stripe_subscription_id)->toBeNull();
+    }
+})->with([['incomplete', false], ['unpaid', false], ['canceled', false], ['active', true]]);
+
+test('team members cannot synchronize billing status', function () {
+    $this->team->members()->updateExistingPivot($this->user->id, ['role' => 'member']);
+    $this->user->unsetRelation('teams');
+    Livewire::test(Index::class)->call('getStripeStatus')->assertForbidden();
+});
diff --git a/tests/Feature/TeamSeederTest.php b/tests/Feature/TeamSeederTest.php
new file mode 100644
index 0000000000..96cf3a19e3
--- /dev/null
+++ b/tests/Feature/TeamSeederTest.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Database\Seeders\TeamSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('assigns seeded memberships without assuming normal user or personal team IDs', function () {
+    InstanceSettings::create(['id' => 0]);
+    $unrelatedUser = User::factory()->create();
+    User::factory()->create(['id' => 0, 'email' => 'test@example.com']);
+    $rootTeamMember = User::factory()->create(['id' => 10, 'email' => 'test2@example.com']);
+    $otherUser = User::factory()->create(['id' => 11, 'email' => 'test3@example.com']);
+    $personalTeam = $rootTeamMember->teams()->firstOrFail();
+
+    $this->seed(TeamSeeder::class);
+
+    expect(Team::findOrFail(0)->description)->toBe('The root team')
+        ->and($rootTeamMember->teams()->whereKey(0)->exists())->toBeTrue()
+        ->and($otherUser->teams()->whereKey($personalTeam->id)->firstOrFail()->pivot->role)->toBe('admin')
+        ->and($otherUser->teams()->whereKey(0)->exists())->toBeFalse()
+        ->and($unrelatedUser->teams()->count())->toBe(1)
+        ->and($otherUser->teams()->whereKey($unrelatedUser->teams()->firstOrFail()->id)->exists())->toBeFalse();
+});
diff --git a/tests/Feature/TelegramNotificationThreadRoutingTest.php b/tests/Feature/TelegramNotificationThreadRoutingTest.php
new file mode 100644
index 0000000000..474d2b157d
--- /dev/null
+++ b/tests/Feature/TelegramNotificationThreadRoutingTest.php
@@ -0,0 +1,89 @@
+<?php
+
+use App\Jobs\SendMessageToTelegramJob;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\Channels\TelegramChannel;
+use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\TraefikVersionOutdated;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->team->telegramNotificationSettings->update([
+        'telegram_enabled' => true,
+        'telegram_token' => 'test-token',
+        'telegram_chat_id' => '-1001234567890',
+    ]);
+
+    Queue::fake();
+});
+
+function telegramTestServer(Team $team): Server
+{
+    return Server::factory()->make([
+        'name' => 'Test Server',
+        'uuid' => 'test-uuid',
+        'team_id' => $team->id,
+    ]);
+}
+
+function outdatedTraefikServer(Team $team): Server
+{
+    $server = telegramTestServer($team);
+
+    $server->outdatedInfo = [
+        'current' => '3.5.0',
+        'latest' => '3.5.6',
+        'type' => 'patch_update',
+    ];
+
+    return $server;
+}
+
+it('sends the traefik outdated notification to its configured topic', function () {
+    $this->team->telegramNotificationSettings->update([
+        'telegram_notifications_traefik_outdated_thread_id' => '42',
+    ]);
+
+    $notification = new TraefikVersionOutdated(collect([outdatedTraefikServer($this->team)]));
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === '42'
+    );
+});
+
+it('sends the server patch notification to its configured topic', function () {
+    $this->team->telegramNotificationSettings->update([
+        'telegram_notifications_server_patch_thread_id' => '7',
+    ]);
+
+    $notification = new ServerPatchCheck(telegramTestServer($this->team), ['total_updates' => 3]);
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === '7'
+    );
+});
+
+it('falls back to the main chat when no topic is configured', function () {
+    $notification = new TraefikVersionOutdated(collect([outdatedTraefikServer($this->team)]));
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === null
+    );
+});
diff --git a/tests/Feature/ToastPositionTest.php b/tests/Feature/ToastPositionTest.php
index 6bcfc898ea..d8b7e58790 100644
--- a/tests/Feature/ToastPositionTest.php
+++ b/tests/Feature/ToastPositionTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use Symfony\Component\Process\Process;
+
 test('toast messages default to the bottom right while supporting position overrides', function () {
     $toast = file_get_contents(resource_path('views/components/toast.blade.php'));
 
@@ -24,3 +26,50 @@ test('toast copy button shows temporary success feedback', function () {
         ->toContain('x-show="toast.copied"')
         ->toContain("'bg-emerald-100 text-emerald-700 dark:bg-emerald-500/10 dark:text-emerald-400': toast.copied");
 });
+
+test('subscription success uses a persistent standard toast instead of a banner', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+    if ($view === false) {
+        throw new RuntimeException('Could not read layout popups view.');
+    }
+
+    if (preg_match("/@if \\(request\\(\\)->query->get\\('success'\\)\\)(.*?)@endif/s", $view, $match) !== 1 || ! isset($match[1])) {
+        throw new RuntimeException('Could not locate the subscription success block.');
+    }
+
+    expect($match[1])->toContain("window.toast('Welcome onboard!'")
+        ->toContain('persistent: true')
+        ->not->toContain('<x-banner>');
+});
+
+test('persistent toasts survive timers hover and new notifications until dismissed', function () {
+    $process = new Process(['node', '-e', <<<'JS'
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const source = fs.readFileSync(process.argv[1], 'utf8');
+const data = source.match(/<ul x-data="([\s\S]*?)" @toast-show/)[1];
+const timers = new Map();
+let timerId = 0;
+global.setTimeout = callback => { timers.set(++timerId, callback); return timerId; };
+global.clearTimeout = id => timers.delete(id);
+const state = new Function(`return (${data})`)();
+state.$nextTick = callback => callback();
+state.addToast({ detail: { message: 'Persistent', persistent: true } });
+const persistent = state.toasts[0];
+assert.equal(timers.size, 0, 'persistent toast must not schedule dismissal');
+state.pauseToast(persistent);
+state.resumeToast(persistent);
+assert.equal(timers.size, 0, 'hover must not start a persistent toast timer');
+for (let i = 0; i < 5; i++) state.addToast({ detail: { message: 'Normal' } });
+assert(state.toasts.includes(persistent), 'new notifications must not evict persistent toast');
+assert(timers.size > 0, 'normal notifications still have timers');
+for (const callback of [...timers.values()]) callback();
+for (const callback of [...timers.values()]) callback();
+assert(state.toasts.includes(persistent), 'persistent toast survives elapsed timers');
+state.removeToast(persistent.id);
+for (const callback of [...timers.values()]) callback();
+assert(!state.toasts.includes(persistent), 'manual dismissal removes persistent toast');
+JS, resource_path('views/components/toast.blade.php')]);
+    $process->run();
+    expect($process->isSuccessful())->toBeTrue($process->getErrorOutput());
+});
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
index 3dad5423e5..de3cf8e17c 100644
--- a/tests/Feature/TraefikVersionStateTest.php
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -1,12 +1,16 @@
 <?php
 
 use App\Enums\ProxyTypes;
+use App\Events\ProxyStatusChangedUI;
 use App\Jobs\CheckTraefikVersionForServerJob;
+use App\Jobs\CheckTraefikVersionJob;
 use App\Livewire\Server\Proxy;
 use App\Models\Server;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
 
 uses(RefreshDatabase::class);
 
@@ -185,7 +189,7 @@ it('marks matching Traefik outdated information as a current warning', function
     expect($server->hasCurrentTraefikOutdatedInfo())->toBeTrue();
 });
 
-it('clears stale outdated information before detecting the current version', function () {
+it('clears stale Traefik version state before detecting the current version', function () {
     $team = Team::factory()->create();
     $server = Server::factory()->create([
         'team_id' => $team->id,
@@ -204,6 +208,80 @@ it('clears stale outdated information before detecting the current version', fun
 
     $server->refresh();
 
-    expect($server->detected_traefik_version)->toBe('3.6.23')
+    expect($server->detected_traefik_version)->toBeNull()
         ->and($server->traefik_outdated_info)->toBeNull();
 });
+
+it('clears Traefik version state when the proxy changes', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+
+    $server->changeProxy(ProxyTypes::NONE->value);
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+});
+
+it('cleans stale Traefik version state while selecting servers to check', function () {
+    Bus::fake();
+    Cache::put('coolify:versions:all', [
+        'traefik' => ['v3.7' => '3.7.8'],
+    ]);
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::NONE->value,
+            'status' => 'exited',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+
+    (new CheckTraefikVersionJob)->handle();
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+});
+
+it('does not inspect a server after its Traefik proxy has been disabled', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::NONE->value,
+            'status' => 'exited',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+    Event::fake();
+
+    (new CheckTraefikVersionForServerJob($server, ['v3.7' => '3.7.8']))->handle();
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+
+    Event::assertNotDispatched(ProxyStatusChangedUI::class);
+});
diff --git a/tests/Feature/UserSeederTest.php b/tests/Feature/UserSeederTest.php
index d8ccf86510..ce7705453b 100644
--- a/tests/Feature/UserSeederTest.php
+++ b/tests/Feature/UserSeederTest.php
@@ -2,15 +2,47 @@
 
 use App\Models\User;
 use Database\Seeders\UserSeeder;
-use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Database\Schema\Blueprint;
 
-uses(RefreshDatabase::class);
+it('preserves the root ID and lets the database generate normal user IDs', function (string $connectionName, int $existingUsers) {
+    if ($connectionName === 'pgsql' && ! getenv('TEST_POSTGRES_SEEDER')) {
+        $this->markTestSkipped('Set TEST_POSTGRES_SEEDER=1 to test PostgreSQL using the configured pgsql connection.');
+    }
 
-it('leaves the user id sequence ready for new development users', function () {
-    $this->seed(UserSeeder::class);
+    $originalConnectionName = config('database.default');
+    config()->set('database.default', $connectionName);
+    $connection = (new User)->getConnection();
+    $connection->beginTransaction();
 
-    $user = User::factory()->create();
+    try {
+        // A temporary table isolates this test from existing development users and their sequence.
+        $connection->getSchemaBuilder()->create('users', function (Blueprint $table) {
+            $table->temporary();
+            $table->id();
+            $table->string('name')->nullable();
+            $table->string('email')->unique();
+            $table->string('password');
+            $table->timestamp('email_verified_at')->nullable();
+            $table->rememberToken();
+            $table->timestamps();
+        });
 
-    expect(User::query()->orderBy('id')->pluck('id')->all())->toBe([0, 1, 2, 3])
-        ->and($user->id)->toBe(3);
-});
+        User::withoutEvents(function () use ($existingUsers) {
+            User::factory()->count($existingUsers)->create();
+
+            $this->seed(UserSeeder::class);
+
+            expect(User::query()->whereIn('email', ['test@example.com', 'test2@example.com', 'test3@example.com'])->orderBy('id')->pluck('email', 'id')->all())->toBe([
+                0 => 'test@example.com',
+                $existingUsers + 1 => 'test2@example.com',
+                $existingUsers + 2 => 'test3@example.com',
+            ]);
+
+            expect(User::factory()->create()->id)->toBe($existingUsers + 3)
+                ->and(User::factory()->create()->id)->toBe($existingUsers + 4);
+        });
+    } finally {
+        $connection->rollBack();
+        config()->set('database.default', $originalConnectionName);
+    }
+})->with(['testing', 'pgsql'])->with([0, 5]);
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 519b323f6b..c1312552a6 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -28,6 +28,7 @@ use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Filesystem\FilesystemAdapter;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
@@ -947,6 +948,67 @@ it('enables and disables volume S3 backups from the S3 title action', function (
     expect($backup->refresh()->save_s3)->toBeFalse();
 });
 
+it('persists S3 settings the first time when a volume backup schedule does not exist yet', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Volume backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->assertSet('s3StorageId', $s3Storage->id)
+        ->call('toggleS3')
+        ->assertSet('saveToS3', true)
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+
+    expect($backup->enabled)->toBeFalse()
+        ->and($backup->save_s3)->toBeTrue()
+        ->and($backup->s3_storage_id)->toBe($s3Storage->id);
+});
+
+it('persists the selected S3 storage when a volume backup schedule does not exist yet', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Volume backups',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->set('s3StorageId', $s3Storage->id)
+        ->assertDispatched('success');
+
+    $backup = ScheduledVolumeBackup::query()->sole();
+
+    expect($backup->enabled)->toBeFalse()
+        ->and($backup->s3_storage_id)->toBe($s3Storage->id);
+});
+
 it('shows and saves volume S3 retention while S3 backups are disabled', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
@@ -991,7 +1053,7 @@ it('allows team owners to edit volume backup retention settings', function () {
     ])->assertDontSee('You do not have permission to perform this action.');
 });
 
-it('only updates S3 fields when toggling volume S3 backups', function () {
+it('does not enable S3 backups when another volume backup setting is invalid', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);
     [$application, $volume] = createVolumeBackupApplication($team);
@@ -1018,9 +1080,54 @@ it('only updates S3 fields when toggling volume S3 backups', function () {
     ])
         ->set('frequency', 'not a valid schedule')
         ->call('toggleS3')
-        ->assertDispatched('success');
+        ->assertHasErrors('frequency')
+        ->assertNotDispatched('success');
 
-    expect($backup->refresh()->save_s3)->toBeTrue()
+    expect($backup->refresh()->save_s3)->toBeFalse()
+        ->and($backup->frequency)->toBe('daily');
+});
+
+it('does not change S3 storage when another volume backup setting is invalid', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $firstS3Storage = S3Storage::create([
+        'name' => 'First storage',
+        'region' => 'us-east-1',
+        'key' => 'first-key',
+        'secret' => 'secret',
+        'bucket' => 'first-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $secondS3Storage = S3Storage::create([
+        'name' => 'Second storage',
+        'region' => 'us-east-1',
+        'key' => 'second-key',
+        'secret' => 'secret',
+        'bucket' => 'second-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        's3_storage_id' => $firstS3Storage->id,
+    ]);
+
+    Livewire::test(VolumeBackups::class, [
+        'storage' => $volume,
+        'resource' => $application,
+        'section' => 's3',
+    ])
+        ->set('frequency', 'not a valid schedule')
+        ->set('s3StorageId', $secondS3Storage->id)
+        ->assertHasErrors('frequency')
+        ->assertNotDispatched('success');
+
+    expect($backup->refresh()->s3_storage_id)->toBe($firstS3Storage->id)
         ->and($backup->frequency)->toBe('daily');
 });
 
@@ -1783,6 +1890,152 @@ it('keeps the upload destination on the volume backup execution', function () {
         ->and($execution->s3->is($s3Storage))->toBeTrue();
 });
 
+it('streams S3-only volume backups without creating or copying a local archive', function () {
+    config(['broadcasting.default' => 'null']);
+    defined('CURLOPT_RESOLVE') || define('CURLOPT_RESOLVE', 10203);
+    Carbon::setTestNow('2026-08-15 12:00:00');
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Streaming destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->once()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->once()->andReturn($disk);
+    Process::fake([
+        '*mc pipe*' => "Added `temporary` successfully.\n128 bytes -> `temporary/bucket/archive.tar.gz`\n128",
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    $expectedFilename = 'volume-app-data-1786795200.tar.gz';
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
+        && str_contains($process->command, 'mc pipe')
+        && str_contains($process->command, '>/dev/null && (compressor=')
+        && str_contains($process->command, '>/dev/null) && mc stat')
+        && str_contains($process->command, 'temporary/bucket/')
+        && str_contains($process->command, $expectedFilename)
+        && substr_count($process->command, '--resolve') === 3
+        && substr_count($process->command, '>/dev/null') >= 2
+        && ! str_contains($process->command, ' > ')
+        && ! str_contains($process->command, 'mc cp'));
+    expect($execution->status)->toBe('success')
+        ->and($execution->size)->toBe(128)
+        ->and($execution->s3_uploaded)->toBeTrue()
+        ->and($execution->local_storage_deleted)->toBeTrue();
+});
+
+it('fails an unsupported S3 stream without falling back to a local archive', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Unsupported streaming destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => true,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->zeroOrMoreTimes()->andReturn([]);
+    $disk->shouldReceive('delete')->once()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->zeroOrMoreTimes()->andReturn($disk);
+    Process::fake([
+        '*mc pipe*' => Process::result(errorOutput: 'streaming upload is unsupported', exitCode: 1),
+        '*' => '',
+    ]);
+
+    expect(fn () => (new VolumeBackupJob($backup))->handle())
+        ->toThrow(RuntimeException::class, 'Enable local backups to use the local archive upload method.');
+
+    $execution = ScheduledVolumeBackupExecution::query()->sole();
+    expect($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('The S3 destination may not support streaming uploads.')
+        ->and($execution->message)->toContain('Enable local backups to use the local archive upload method.')
+        ->and($execution->filename)->toBeNull()
+        ->and($execution->local_storage_deleted)->toBeTrue();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc pipe')
+        && ! str_contains($process->command, 'mc cp')
+        && ! str_contains($process->command, ' > '));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'mkdir -p')
+        || (str_contains($process->command, 'rm -f') && str_contains($process->command, '.tar.gz')));
+});
+
+it('keeps local-first archive creation and mc copy when retaining a local volume backup', function () {
+    config(['broadcasting.default' => 'null']);
+    InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
+    $team = Team::factory()->create();
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $s3Storage = S3Storage::create([
+        'name' => 'Copied destination',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => 'https://s3.amazonaws.com',
+        'team_id' => $team->id,
+        'is_usable' => true,
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'save_s3' => true,
+        'disable_local_backup' => false,
+        's3_storage_id' => $s3Storage->id,
+    ]);
+    $sshDisk = Storage::fake('ssh-keys');
+    $disk = Mockery::mock(FilesystemAdapter::class);
+    $disk->shouldReceive('files')->once()->andReturn([]);
+    $disk->shouldReceive('delete')->zeroOrMoreTimes()->andReturnTrue();
+    Storage::shouldReceive('disk')->with('ssh-keys')->andReturn($sshDisk);
+    Storage::shouldReceive('build')->once()->andReturn($disk);
+    Process::fake([
+        '*du -b*' => '128',
+        '*' => '',
+    ]);
+
+    (new VolumeBackupJob($backup))->handle();
+
+    Process::assertRan(fn ($process) => str_contains($process->command, 'tar -I')
+        && str_contains($process->command, '>')
+        && ! str_contains($process->command, 'mc pipe'));
+    Process::assertRan(fn ($process) => str_contains($process->command, 'mc cp')
+        && ! str_contains($process->command, 'mc pipe'));
+});
+
 it('removes local volume backups older than the configured retention days', function () {
     config(['broadcasting.default' => 'null']);
     InstanceSettings::unguarded(fn () => InstanceSettings::create(['id' => 0]));
diff --git a/tests/Unit/ApplicationGitCommitLinkTest.php b/tests/Unit/ApplicationGitCommitLinkTest.php
index e1a15e7149..378384fe8f 100644
--- a/tests/Unit/ApplicationGitCommitLinkTest.php
+++ b/tests/Unit/ApplicationGitCommitLinkTest.php
@@ -26,3 +26,14 @@ it('generates commit links for direct repository remotes', function (string $rep
         'https://bitbucket.org/coollabsio/coolify/commits/1234567890abcdef',
     ],
 ]);
+
+it('does not generate commit links from incomplete repository URLs', function (string $repository) {
+    $application = new Application;
+    $application->setRelation('source', null);
+    $application->git_repository = $repository;
+
+    expect($application->gitCommitLink('1234567890abcdef'))->toBeNull();
+})->with([
+    'missing host' => 'https://',
+    'missing scheme' => 'github.com/coollabsio/coolify',
+]);
diff --git a/tests/Unit/CleanupHelperContainersJobTest.php b/tests/Unit/CleanupHelperContainersJobTest.php
new file mode 100644
index 0000000000..bd3e2e175d
--- /dev/null
+++ b/tests/Unit/CleanupHelperContainersJobTest.php
@@ -0,0 +1,74 @@
+<?php
+
+use App\Jobs\CleanupHelperContainersJob;
+use App\Models\Server;
+use Symfony\Component\Process\Process;
+
+it('matches helper image references without matching similarly named images', function () {
+    $command = (new ReflectionMethod(CleanupHelperContainersJob::class, 'helperContainersCommand'))->invoke(null);
+    $directory = sys_get_temp_dir().'/coolify-helper-filter-'.bin2hex(random_bytes(4));
+    $docker = $directory.'/docker';
+    $images = [
+        'coollabsio/coolify-helper:1.0.15',
+        'docker.io/coollabsio/coolify-helper:1.0.16',
+        'ghcr.io/coollabsio/coolify-helper@sha256:abc',
+        'registry.example/team/coollabsio/coolify-helper:latest',
+        'coollabsio/coolify:latest',
+        'coollabsio/coolify:4.3.12',
+        'coollabsio/coolify-realtime:1.0.10',
+        'coolify-helper:latest',
+        'someone/coolify-helper:1.0.16',
+        'evil/coollabsio/coolify-helper-copy:latest',
+        'coollabsio/not-coolify-helper:latest',
+    ];
+
+    mkdir($directory);
+    file_put_contents($docker, "#!/bin/sh\n".implode("\n", array_map(
+        fn (string $image): string => 'echo '.escapeshellarg(json_encode(['Image' => $image], JSON_THROW_ON_ERROR)),
+        $images
+    ))."\n");
+    chmod($docker, 0755);
+
+    try {
+        $process = new Process(['/bin/sh', '-c', $command], env: [
+            'PATH' => $directory.':'.getenv('PATH'),
+        ]);
+        $process->mustRun();
+
+        expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
+            ->toBe(array_slice($images, 0, 4));
+    } finally {
+        unlink($docker);
+        rmdir($directory);
+    }
+});
+
+it('preserves the helper image filter for non-root servers', function () {
+    $command = (new ReflectionMethod(CleanupHelperContainersJob::class, 'helperContainersCommand'))->invoke(null);
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->user = 'ubuntu';
+    $command = parseCommandsByLineForSudo(collect([$command]), $server)[0];
+    $directory = sys_get_temp_dir().'/coolify-helper-sudo-filter-'.bin2hex(random_bytes(4));
+    $docker = $directory.'/docker';
+    $sudo = $directory.'/sudo';
+
+    mkdir($directory);
+    file_put_contents($docker, "#!/bin/sh\necho '{\"Image\":\"coollabsio/coolify-helper:1.0.15\"}'\n");
+    file_put_contents($sudo, "#!/bin/sh\nexec \"\$@\"\n");
+    chmod($docker, 0755);
+    chmod($sudo, 0755);
+
+    try {
+        $process = new Process(['/bin/sh', '-c', $command], env: [
+            'PATH' => $directory.':'.getenv('PATH'),
+        ]);
+        $process->mustRun();
+
+        expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
+            ->toBe(['coollabsio/coolify-helper:1.0.15']);
+    } finally {
+        unlink($docker);
+        unlink($sudo);
+        rmdir($directory);
+    }
+});
diff --git a/tests/Unit/HetznerDeletionFailedNotificationTest.php b/tests/Unit/HetznerDeletionFailedNotificationTest.php
index 22d5e80db3..bcd3f294ee 100644
--- a/tests/Unit/HetznerDeletionFailedNotificationTest.php
+++ b/tests/Unit/HetznerDeletionFailedNotificationTest.php
@@ -19,7 +19,7 @@ it('can be instantiated with correct properties', function () {
         ->and($notification->errorMessage)->toBe('Hetzner API error: Server not found');
 });
 
-it('uses hetzner_deletion_failed event for channels', function () {
+it('uses the always-send hetzner_deletion_failure event for channels', function () {
     $notification = new HetznerDeletionFailed(
         hetznerServerId: 12345,
         teamId: 1,
@@ -28,7 +28,7 @@ it('uses hetzner_deletion_failed event for channels', function () {
 
     $mockNotifiable = Mockery::mock();
     $mockNotifiable->shouldReceive('getEnabledChannels')
-        ->with('hetzner_deletion_failed')
+        ->with('hetzner_deletion_failure')
         ->once()
         ->andReturn([]);
 
diff --git a/tests/Unit/Notifications/Channels/WebhookChannelTest.php b/tests/Unit/Notifications/Channels/WebhookChannelTest.php
new file mode 100644
index 0000000000..783159e69e
--- /dev/null
+++ b/tests/Unit/Notifications/Channels/WebhookChannelTest.php
@@ -0,0 +1,113 @@
+<?php
+
+use App\Jobs\SendWebhookJob;
+use App\Models\InstanceSettings;
+use App\Models\PersonalAccessToken;
+use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\ApiTokenExpiringNotification;
+use App\Notifications\Channels\WebhookChannel;
+use App\Notifications\Internal\GeneralNotification;
+use App\Notifications\Server\ForceDisabled;
+use App\Notifications\Server\ForceEnabled;
+use App\Notifications\SslExpirationNotification;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Notifications\Notification;
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+beforeEach(function () {
+    // base_url() resolves the instance settings singleton, which lives at the id = 0 sentinel.
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->updateOrCreate(['id' => 0], [
+        'fqdn' => 'https://coolify.example.com',
+    ]));
+    Queue::fake();
+
+    $this->team = Team::create([
+        'name' => 'Webhook Channel Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    // Assign through the model so the `encrypted` cast on webhook_url is applied.
+    $settings = $this->team->webhookNotificationSettings;
+    $settings->webhook_enabled = true;
+    $settings->webhook_url = 'https://webhook.example.com/coolify';
+    $settings->save();
+    $this->team->refresh();
+});
+
+/**
+ * Send a notification through the webhook channel and return the dispatched payload.
+ *
+ * @return array<string, mixed>
+ */
+function deliverOverWebhook(Team $team, Notification $notification): array
+{
+    expect($notification->via($team))->toContain(WebhookChannel::class);
+
+    (new WebhookChannel)->send($team, $notification);
+
+    $payload = null;
+    Queue::assertPushed(SendWebhookJob::class, function (SendWebhookJob $job) use (&$payload) {
+        $payload = $job->payload;
+
+        return true;
+    });
+
+    expect($payload)->toBeArray()
+        ->and($payload['success'])->toBeBool()
+        ->and($payload['message'])->toBeString()->not->toBeEmpty();
+
+    return $payload;
+}
+
+it('delivers ssl certificate renewal notifications over the webhook channel', function () {
+    $payload = deliverOverWebhook(
+        $this->team,
+        new SslExpirationNotification([(object) ['name' => 'my-application']])
+    );
+
+    expect($payload['event'])->toBe('ssl_certificate_renewal')
+        ->and($payload['resources'])->toBe(['my-application']);
+});
+
+it('delivers api token expiring notifications over the webhook channel', function () {
+    $token = new PersonalAccessToken([
+        'name' => 'ci-token',
+        'expires_at' => now()->addDay(),
+    ]);
+
+    $payload = deliverOverWebhook($this->team, new ApiTokenExpiringNotification($token));
+
+    expect($payload['event'])->toBe('api_token_expiring')
+        ->and($payload['token_name'])->toBe('ci-token');
+});
+
+it('delivers server force enabled notifications over the webhook channel', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $payload = deliverOverWebhook($this->team, new ForceEnabled($server));
+
+    expect($payload['event'])->toBe('server_force_enabled')
+        ->and($payload['success'])->toBeTrue()
+        ->and($payload['server_uuid'])->toBe($server->uuid);
+});
+
+it('delivers server force disabled notifications over the webhook channel', function () {
+    $server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $payload = deliverOverWebhook($this->team, new ForceDisabled($server));
+
+    expect($payload['event'])->toBe('server_force_disabled')
+        ->and($payload['success'])->toBeFalse()
+        ->and($payload['server_uuid'])->toBe($server->uuid);
+});
+
+it('delivers general notifications over the webhook channel', function () {
+    $payload = deliverOverWebhook($this->team, new GeneralNotification('Something happened'));
+
+    expect($payload['event'])->toBe('general')
+        ->and($payload['message'])->toBe('Something happened');
+});
diff --git a/tests/Unit/ParseCommandsByLineForSudoTest.php b/tests/Unit/ParseCommandsByLineForSudoTest.php
index b741b875f2..93c9f8b643 100644
--- a/tests/Unit/ParseCommandsByLineForSudoTest.php
+++ b/tests/Unit/ParseCommandsByLineForSudoTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Models\Server;
+use Symfony\Component\Process\Process;
 
 beforeEach(function () {
     // Create a mock server with non-root user
@@ -184,6 +185,50 @@ test('handles if statements by adding sudo to condition', function () {
     expect($result[0])->toBe('if sudo command -v docker');
 });
 
+test('preserves shell negation before sudo', function (string $command, string $expected) {
+    expect(parseCommandsByLineForSudo(collect([$command]), $this->server))->toBe([$expected]);
+})->with([
+    'negated condition' => ['if ! docker inspect coolify-proxy; then', 'if ! sudo docker inspect coolify-proxy; then'],
+    'indented condition' => ["\tif  !  docker inspect coolify-proxy; then", "\tif  !  sudo docker inspect coolify-proxy; then"],
+    'negated pipeline' => [
+        '    if ! docker ps -a --format "{{.Names}}" | grep -q "^coolify-proxy$"; then',
+        '    if ! sudo docker ps -a --format "{{.Names}}" | sudo grep -q "^coolify-proxy$"; then',
+    ],
+    'standalone negation' => ['! docker inspect coolify-proxy', '! sudo docker inspect coolify-proxy'],
+    'repeated negation' => ['if ! ! docker inspect coolify-proxy; then', 'if ! ! sudo docker inspect coolify-proxy; then'],
+    'literal exclamation argument' => ['echo "! docker"', 'echo "! docker"'],
+]);
+
+test('proxy removal loop exits only once the container is absent', function (string $containers, string $expected) {
+    $commands = collect([
+        'for i in {1..15}; do',
+        '    if ! docker ps -a --format "{{.Names}}" | grep -q "^coolify-proxy$"; then',
+        '        echo "Container removed successfully."',
+        '        break',
+        '    fi',
+        '    echo "Waiting for container to be removed... ($i/15)"',
+        'done',
+    ]);
+    $script = <<<'BASH'
+sudo() { "$@"; }
+docker() { printf '%s\n' "$CONTAINERS"; }
+BASH;
+    $script .= "\n".implode("\n", parseCommandsByLineForSudo($commands, $this->server));
+    $process = new Process(['bash', '-c', $script], env: ['CONTAINERS' => $containers]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeTrue()
+        ->and($process->getErrorOutput())->toBe('')
+        ->and($process->getOutput())->toBe($expected);
+})->with([
+    'removed' => ['', "Container removed successfully.\n"],
+    'other containers remain' => ['another-container', "Container removed successfully.\n"],
+    'still present' => ['coolify-proxy', implode('', array_map(
+        fn (int $attempt): string => "Waiting for container to be removed... ($attempt/15)\n",
+        range(1, 15),
+    ))],
+]);
+
 test('skips sudo for fi statements', function () {
     $commands = collect([
         'fi',
@@ -457,6 +502,7 @@ test('handles real-world proxy startup with for loop from StartProxy action', fu
 
     // Verify other control structures remain correct
     expect($result[0])->toStartWith('if sudo docker ps');
+    expect($result[6])->toBe('        if ! sudo docker ps -a --format "{{.Names}}" | sudo grep -q "^coolify-proxy$"; then');
     expect($result[8])->toBe('        fi');
     expect($result[13])->toBe('fi');
 });
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 293c9422e9..206cf5f34e 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@ it('publishes v4 branch builds under the commit sha with a traceable internal ve
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.15'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.15')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.18'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.18')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index 35b6052dd3..a6d8d2fc1e 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -6,6 +6,17 @@ it('persists exited status when stopping standalone databases', function () {
     expect($action)->toContain("'status' => 'exited'");
 });
 
+it('does not change Docker restart policies when retaining stopped containers', function (string $actionPath) {
+    $action = file_get_contents(__DIR__.'/../../'.$actionPath);
+
+    expect($action)->not->toContain('docker update --restart=no');
+})->with([
+    'applications' => 'app/Actions/Application/StopApplication.php',
+    'application previews' => 'app/Actions/Application/StopApplicationPreview.php',
+    'service applications' => 'app/Actions/Service/StopServiceApplication.php',
+    'standalone databases' => 'app/Actions/Database/StopDatabase.php',
+]);
+
 it('persists exited status for every full application stop path', function () {
     $action = file_get_contents(__DIR__.'/../../app/Actions/Application/StopApplication.php');
 
@@ -21,7 +32,7 @@ it('persists exited status for all children when stopping a service', function (
         ->toContain("\$application->update(['status' => 'exited']);")
         ->toContain('$application->resetRestartLimit();')
         ->toContain("\$database->update(['status' => 'exited']);")
-        ->toContain('$database->resetRestartLimit();');
+        ->not->toContain('$database->resetRestartLimit();');
 });
 
 it('persists exited status when stopping an individual service resource', function () {
diff --git a/tests/v4/Browser/ApplicationConfigurationTest.php b/tests/v4/Browser/ApplicationConfigurationTest.php
index fa7fb4ffa3..f3e5b6cc8c 100644
--- a/tests/v4/Browser/ApplicationConfigurationTest.php
+++ b/tests/v4/Browser/ApplicationConfigurationTest.php
@@ -1,6 +1,10 @@
 <?php
 
+use App\Models\ApplicationPreview;
+use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -37,6 +41,61 @@ it('shows application configuration sections and navigation', function () {
         ->screenshot(filename: 'application-configuration-overview');
 });
 
+it('keeps the PR suffix listbox visible outside the volumes table while scrolling', function () {
+    foreach (range(1, 8) as $index) {
+        LocalPersistentVolume::create([
+            'uuid' => (string) new Cuid2,
+            'name' => $this->application->uuid.'-data-'.$index,
+            'mount_path' => '/data/'.$index,
+            'resource_id' => $this->application->id,
+            'resource_type' => $this->application->getMorphClass(),
+            'is_preview_suffix_enabled' => true,
+        ]);
+    }
+
+    loginAndSkipBoarding();
+
+    $url = applicationConfigurationUrl(
+        $this->stack['project'],
+        $this->stack['environment'],
+        $this->application
+    ).'/persistent-storage';
+
+    $page = visit($url);
+    $page->assertSee('PR suffix')
+        ->assertSee('Add suffix')
+        ->assertScript(<<<'JS'
+            () => {
+                const table = document.querySelector('.data-table');
+                const trigger = document.querySelector('[id$="isPreviewSuffixEnabled-trigger"]');
+                window.__volumeTableScrollHeight = table.scrollHeight;
+                trigger.click();
+
+                return true;
+            }
+            JS)
+        ->wait(0.2)
+        ->assertScript(<<<'JS'
+            () => {
+                const table = document.querySelector('.data-table');
+                const panel = document.querySelector('[id$="isPreviewSuffixEnabled-panel"]');
+                const beforeScroll = panel.getBoundingClientRect();
+                window.scrollBy(0, 100);
+                const afterScroll = panel.getBoundingClientRect();
+
+                return panel.parentElement === document.body
+                    && table.scrollHeight === window.__volumeTableScrollHeight
+                    && window.scrollY > 0
+                    && beforeScroll.top >= 0
+                    && beforeScroll.bottom <= window.innerHeight
+                    && afterScroll.top >= 0
+                    && afterScroll.bottom <= window.innerHeight;
+            }
+            JS)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-persistent-storage-pr-suffix-listbox');
+});
+
 it('saves application name description and ports from the general form', function () {
     loginAndSkipBoarding();
 
@@ -153,3 +212,149 @@ it('shows danger zone for application deletion', function () {
         ->assertSee('Config App')
         ->screenshot(filename: 'application-danger-zone');
 });
+
+it('uses compact application domains with unified settings and a floating save bar', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->application->update(['fqdn' => 'https://first.example.com,https://second.example.com', 'redirect' => 'both']);
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('Check all DNS')
+        ->assertSee('Protocol redirect')
+        ->assertSee('Search indexing')
+        ->assertDontSee('Search engine indexing')
+        ->fill('[aria-label="Search services or domains"]', 'missing.example.com')
+        ->assertSee('No domains found')
+        ->fill('[aria-label="Search services or domains"]', '')
+        ->click('[aria-label="Settings for https://first.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertValue('#editingDomainParts-host', 'first.example.com')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->fill('#editingDomainParts-path', '/blog')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->click('[id^="application-domain-indexing-"][id$="-trigger"]')
+        ->click('Noindex')
+        ->assertSee('Search engine indexing updated.')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'application-domain-unified-settings')
+        ->click('[wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertSee('https://first.example.com/blog')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-domains-compact');
+
+    $page->click('[aria-label="Settings for https://second.example.com"]')
+        ->fill('#editingDomainParts-path', '/discard')
+        ->click('Reset')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-path', '')
+        ->click('[aria-label="Close"]:visible')
+        ->click('[wire\\:key="domain-row-'.md5('https://first.example.com/blog|').'"] [aria-label="Remove domain"]')
+        ->assertSee('Remove domain?')
+        ->click('button:has([x-text="step2ButtonText"]):visible')
+        ->assertDontSee('https://first.example.com/blog')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-host', 'second.example.com')
+        ->click('[aria-label="Close"]:visible')
+        ->resize(390, 844)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-domains-mobile');
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+});
+
+it('edits Compose application domain redirects in the unified settings dialog', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web.api:\n    image: nginx:alpine\n    expose:\n      - '8080'\n",
+        'docker_compose_domains' => json_encode(['web.api' => ['domain' => 'https://web.example.com', 'redirect' => 'both']]),
+    ]);
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('web.api')
+        ->assertSee('Domain redirect')
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->assertSee('Domain settings')
+        ->click('[id^="application-domain-direction-"][id$="-trigger"]')
+        ->click('Redirect to www')
+        ->assertDontSee('Use a different port?')
+        ->assertSee('Redirect updated for web.api.')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'application-compose-domain-settings');
+
+    expect(json_decode($this->application->fresh()->docker_compose_domains, true)['web.api']['redirect'])->toBe('www');
+    $page->click('[aria-label="Close"]:visible')
+        ->assertSee('https://www.web.example.com')
+        ->screenshot(filename: 'application-compose-domain-overview');
+});
+
+it('uses compact preview domains and opens only the selected preview settings', function (bool $isCompose) {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    if ($isCompose) {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'compose_parsing_version' => '3',
+            'docker_compose_raw' => "services:\n  web.api:\n    image: nginx:alpine\n    expose:\n      - '8080'\n",
+            'docker_compose_domains' => json_encode(['web.api' => ['domain' => 'https://production.example.com']]),
+        ]);
+    }
+    foreach ([101, 102] as $number) {
+        ApplicationPreview::create([
+            'application_id' => $this->application->id,
+            'pull_request_id' => $number,
+            'pull_request_html_url' => "https://example.com/pull/{$number}",
+            'fqdn' => $isCompose ? null : "https://preview-{$number}.example.com",
+            'docker_compose_domains' => $isCompose ? json_encode(['web.api' => ['domain' => "https://preview-{$number}.example.com"]]) : null,
+        ]);
+    }
+    loginAndSkipBoarding();
+    $url = applicationConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->application).'/preview-deployments';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->click('[aria-label="Settings for https://preview-101.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertVisible('[aria-label="Search indexing blocked"] >> nth=0');
+    expect($page->script("[...document.querySelectorAll('[data-preview-domain-dialog]')].filter(el => el.getClientRects().length > 0).length"))->toBe(1);
+    $page->fill('#editingDomainParts-host:visible', 'renamed-preview.example.com')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'preview-domain-unified-settings')
+        ->click('.is-dirty [wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertSee('https://renamed-preview.example.com')
+        ->assertSee('https://preview-102.example.com')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'preview-domains-compact');
+    $page->click('[aria-label="Settings for https://preview-102.example.com"]')
+        ->assertSee('Domain settings')
+        ->fill('#editingDomainParts-path:visible', '/discard')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'preview-domain-before-reset')
+        ->click('.is-dirty button:has-text("Reset")')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://preview-102.example.com"]')
+        ->assertValue('#editingDomainParts-path:visible', '')
+        ->click('[data-preview-domain-dialog]:visible [aria-label="Close"]')
+        ->resize(390, 844)
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'preview-domains-mobile');
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+})->with(['regular application' => false, 'Compose application' => true]);
+
+it('declares the compact preview domain layout and shared save bar', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+    expect($view)->toContain('service-domains-overview-grid')
+        ->toContain('service-domain-mobile-summary')
+        ->toContain('Domain routing summary')
+        ->toContain('<x-unsaved-bar action="updateDomain"')
+        ->toContain('$event.detail.previewId');
+});
diff --git a/tests/v4/Browser/ServiceConfigurationTest.php b/tests/v4/Browser/ServiceConfigurationTest.php
index d5c840ae60..6f7919664a 100644
--- a/tests/v4/Browser/ServiceConfigurationTest.php
+++ b/tests/v4/Browser/ServiceConfigurationTest.php
@@ -1,6 +1,8 @@
 <?php
 
+use App\Models\InstanceSettings;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
 use Visus\Cuid2\Cuid2;
 
 uses(RefreshDatabase::class);
@@ -189,3 +191,130 @@ it('shows service danger zone', function () {
         ->assertSee('Config Service')
         ->screenshot(filename: 'service-danger-zone');
 });
+
+it('keeps domain settings out of the overview and supports editing and removal', function () {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->serviceApplication->update([
+        'fqdn' => 'https://long-public-domain-for-the-service.example.com,https://second.example.com',
+        'domain_port_overrides' => ['https://long-public-domain-for-the-service.example.com' => 8080],
+    ]);
+    loginAndSkipBoarding();
+
+    $url = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->service).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->assertSee('Check all DNS')
+        ->assertVisible('[aria-label="Internal port 8080"]')
+        ->assertDontSee('Search engine indexing')
+        ->assertDontSee('Remove domain')
+        ->screenshot(filename: 'service-domains-overview');
+
+    expect($page->script("document.querySelector('.data-table-row.service-domains-overview-grid').getBoundingClientRect().height"))->toBeLessThanOrEqual(48);
+    expect($page->script("getComputedStyle(document.querySelector('.data-table-row.service-domains-overview-grid')).gridTemplateColumns.split(' ').length"))->toBe(7);
+
+    $page->click('[aria-label="Settings for https://long-public-domain-for-the-service.example.com"]')
+        ->assertSee('Domain settings')
+        ->assertValue('#editingDomainParts-host', 'long-public-domain-for-the-service.example.com')
+        ->assertValue('#editingDomainParts-port', '8080')
+        ->assertDontSee('Edit address and port')
+        ->assertDontSee('Save address')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->assertSee('Search engine indexing')
+        ->screenshot(filename: 'service-domain-settings');
+
+    expect($page->script(<<<'JS'
+        (() => {
+            const indexing = document.querySelector('[id^="service-domain-indexing-"][id$="-trigger"]').getBoundingClientRect();
+            const redirect = document.querySelector('[id^="service-domain-direction-"][id$="-trigger"]').getBoundingClientRect();
+            return Math.abs(indexing.top - redirect.top) < 2 && redirect.left > indexing.right;
+        })()
+    JS))->toBeTrue();
+
+    $page->fill('#editingDomainParts-port', '80')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->screenshot(filename: 'service-domain-unsaved-changes');
+
+    $domainKey = hash('sha256', 'https://long-public-domain-for-the-service.example.com|'.$this->serviceApplication->id);
+    $page->click('#service-domain-indexing-'.$this->serviceApplication->id.'-'.$domainKey.'-trigger')
+        ->click('Noindex')
+        ->screenshot(filename: 'service-domain-indexing-saved')
+        ->assertSee('Domain settings')
+        ->assertVisible('[aria-label="Search indexing blocked"]')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->assertNoJavaScriptErrors();
+
+    expect($this->serviceApplication->fresh()->isDomainNoindexed('https://long-public-domain-for-the-service.example.com'))->toBeTrue();
+
+    $page->click('[wire\\:click="updateDomain"]')
+        ->assertDontSee('Domain settings')
+        ->assertVisible('[aria-label="Internal port 80"] >> nth=0');
+
+    $page->click('[wire\\:key="svc-domain-'.$this->serviceApplication->id.'-'.md5('https://long-public-domain-for-the-service.example.com').'"] [aria-label="Remove domain"]')
+        ->assertSee('Remove domain?')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-domain-removal-confirmation')
+        ->click('button:has([x-text="step2ButtonText"]):visible')
+        ->assertDontSee('https://long-public-domain-for-the-service.example.com')
+        ->assertSee('1 domain across 1 service')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertSee('www redirect')
+        ->assertValue('#editingDomainParts-host', 'second.example.com')
+        ->click('[aria-label="Close"]:visible')
+        ->assertDontSee('Domain settings')
+        ->assertNoJavaScriptErrors();
+
+    $page->click('[aria-label="Settings for https://second.example.com"]')
+        ->fill('#editingDomainParts-path', '/discard-this')
+        ->assertVisible('.is-dirty:not(.is-saving) [wire\\:click="updateDomain"]')
+        ->click('Reset')
+        ->assertDontSee('Domain settings')
+        ->click('[aria-label="Settings for https://second.example.com"]')
+        ->assertValue('#editingDomainParts-path', '')
+        ->assertMissing('.is-dirty [wire\\:click="updateDomain"]')
+        ->click('[aria-label="Close"]:visible')
+        ->assertDontSee('Domain settings')
+        ->assertNoJavaScriptErrors();
+
+    $page->script("document.querySelectorAll('[aria-label=\"Dismiss\"]').forEach(button => button.click()); document.documentElement.classList.remove('dark');");
+    $page->screenshot(filename: 'service-domains-light');
+    $page->resize(390, 844)
+        ->assertSee('https://second.example.com')
+        ->assertVisible('[aria-label="Settings for https://second.example.com"]');
+    $page->script("document.getElementById('service-domains-section').scrollIntoView(); window.scrollBy(0, -80);");
+    $page->screenshot(filename: 'service-domains-mobile');
+
+    expect($page->script('document.documentElement.scrollWidth <= window.innerWidth'))->toBeTrue();
+});
+
+it('inherits the internal port when enabling the www redirect without a warning', function (?int $override) {
+    config()->set('app.maintenance.store', 'array');
+    InstanceSettings::find(0)->update(['is_dns_validation_enabled' => false]);
+    Cache::forget('instance_settings');
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    environment:\n      - SERVICE_FQDN_WEB_80\n  api:\n    image: httpd:alpine\n",
+    ]);
+    $this->serviceApplication->update(['fqdn' => 'https://web.example.com', 'redirect' => 'both', 'domain_port_overrides' => $override === null ? null : ['https://web.example.com' => $override]]);
+    loginAndSkipBoarding();
+
+    $url = serviceConfigurationUrl($this->stack['project'], $this->stack['environment'], $this->service).'/domains';
+    $page = visit($url);
+    $page->click('Accept and close')
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->click('[id^="service-domain-direction-"][id$="-trigger"]')
+        ->click('Redirect to www')
+        ->assertDontSee('Use a different port?')
+        ->assertSee('Redirect updated.')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-redirect-port-'.($override ?? 80));
+
+    expect($this->serviceApplication->fresh()->redirect)->toBe('www')
+        ->and($this->serviceApplication->fresh()->domain_port_overrides['https://www.web.example.com'] ?? null)->toBe($override);
+
+    $page->navigate($url)
+        ->click('[aria-label="Settings for https://web.example.com"]')
+        ->assertSee('Redirect to www')
+        ->assertNoJavaScriptErrors()
+        ->screenshot(filename: 'service-redirect-persisted-'.($override ?? 80));
+})->with([null, 8080]);
diff --git a/versions.json b/versions.json
index 455918fdc0..97ab3b3a6a 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.15"
+            "version": "4.3.18"
         },
         "nightly": {
             "version": "4.4-rc.1"